Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Windows Hello for Business generates an asymmetric key pair during enrollment; the private key is secured by the device's Trusted Platform Module and can be accessed only after the user completes a local gesture such as face recognition or entering a PIN. This provides a passwordless experience that is bound to the specific Windows device.

• FIDO2 security keys also enable passwordless sign-in but keep the private key on an external hardware token rather than the device's TPM.
• SMS one-time passcode is indeed a passwordless method, yet it delivers a numeric code by text message and does not depend on a TPM-protected key or a biometric/PIN gesture on the Windows device.
• Certificate-based authentication relies on X.509 certificates and is commonly used for specialized scenarios; it is not the TPM-based, gesture-unlocked approach described here.