Azure MFA for Credential Encryption During Deployment

Describe Azure identity, access, and security
Answer Correct answer: B — Azure MFA does not encrypt credentials; Azure Key Vault is required for secure storage and encryption of secrets.

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. You have been informed by your superiors of the company's intentions to automate server deployment to Azure. There is, however, some concern that administrative credentials could be uncovered during this process. You are required to make sure that during the deployment, the administrative credentials are encrypted using a suitable Azure solution. Solution: You recommend the use of Azure Multi-Factor Authentication (MFA). Does the solution meet the goal?

  1. Yes
  2. No Correct Answer

Community Insight

The question tests the distinction between identity governance and data security; the trap is assuming any 'security' feature like MFA protects stored secrets, whereas Key Vault is required for encryption.

This question evaluates whether Azure Multi-Factor Authentication (MFA) can encrypt administrative credentials during automated server deployment. The correct answer is B, as MFA is an authentication control, not a data protection service.

Many learners choose A because they associate 'security' with MFA without reading the specific requirement for 'encryption' of credentials. They confuse access control with data confidentiality.

Community Discussion (34 comments)

Said Ismail 👍 2 Selected: B
. The solution is to use Azure Key Vault. MFA is a security policy implemented for user login.
eduardok95 👍 1 Selected: B
No. Azure key vault.
AlekksMaciel 👍 1 Selected: B
O MFA adiciona uma camada adicional ao processo de autenticação, mas não mantém sua credencial segura.
LePastore 👍 2 Selected: B
No. The solution is to use Azure Key Vault. MFA is a security policy implemented for user login.
islacks 👍 1 Selected: B
should be azure key-vault
kahla 👍 2 Selected: B
Azure MFA enhances login security by requiring multiple verification steps but does not encrypt or securely store administrative credentials during automated deployments. To protect credentials during deployment, Azure Key Vault should be used.
tojatin 👍 1 Selected: B
Use azure Key Vault https://docs.microsoft.com/en-us/azure/vpn-gateway/design
xxx_111_yyy_222 👍 1 Selected: A
key vault to encrypt credentials
deyson 👍 1 Selected: B
No, completly unrelated. This is a great example to use Azure Key-Vaults
arjunyv2022 👍 1 Selected: B
Azure Multi-Factor Authentication (MFA) is for user authentication and not for encrypting administrative credentials, the solution does not meet the goal. Instead, Azure Key Vault should be used for secure credential management
ElPitu97 👍 2 Selected: B
no key vault correct answer
supreddy 👍 1 Selected: B
It is not MFA.
Jas001 👍 1 Selected: B
Key Vault.
intentando 👍 2 Selected: B
https://learn.microsoft.com/es-es/entra/identity/authentication/concept-mfa-howitworks
azzaa 👍 7
MFA is authenticating a login. Key Vault will protect credentials
GeeKaizer1 👍 2
Answer is No, it should be Key Vault
MissLuka 👍 5
I just passed, a variation of MFA question was there so I recommend you guys to review it as I had 5 questions concerning MFA, SSO and autorization
BeauChateau 👍 14 Selected: B
No, the recommended solution of Azure Multi-Factor Authentication (MFA) does not encrypt administrative credentials during server deployment to Azure. MFA is a solution that adds an additional layer of authentication to the login process, and it can help prevent unauthorized access to resources. To encrypt administrative credentials during server deployment to Azure, a better solution would be to use Azure Key Vault. Azure Key Vault is a cloud-based service that provides secure storage of keys, secrets, and certificates. By storing the administrative credentials in Azure Key Vault, they can be encrypted and protected from unauthorized access.
Zaidsdb 👍 1 Selected: B
only the azure key vault
Kanders 👍 1
B. No - does not meet goal due to MFA is used to add authentication layer for user access, not to encrypt credentials. Correct solution is Azure Key Vault.
dt_go 👍 2 Selected: B
key vault to encrypt credentials
cnuila 👍 1 Selected: B
Correct Answer is key Vault
rameshsee 👍 2
Selected Answer: B
JG990 👍 3 Selected: B
MFA is used to authenticate the user not to secure your credentials.
himanshu_90677 👍 3
Azure key vault
glhs 👍 5
B is correct. A vault solution is needed
maysonazure 👍 1
MFA does not encrypt passwords.
chartanalyst 👍 1
https://docs.microsoft.com/en-us/azure/virtual-machines/infrastructure-automation
jgalanj 👍 62
key word = concern that administrative CREDENTIALS could be uncovered during this process = Key Vault
shadeey 👍 4
Correct!
Dennx 👍 38
MFA adds an aditional layer to the authentication process, but it doesn't keep your credential safe.
nikee000 👍 5
Answer is Correct. It should be Azure Key Vault. Azure Key Vault is a secure secrets store, providing management for secrets, keys, and certificates, all backed by Hardware Security Modules Source: https://docs.microsoft.com/en-us/azure/key-vault/general/overview
Insanewhip 👍 2
B is the correct answer. The solution should be Azure Key Vault.
Atquil 👍 1
No: Use Key-Valut

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The solution does not meet the goal because Azure Multi-Factor Authentication (MFA) is designed to verify user identity during login, not to store or encrypt secrets. MFA adds a second factor to authentication but provides no mechanism for protecting the confidentiality of administrative credentials themselves during deployment. To encrypt and securely store these credentials, you must use a dedicated secrets management service like Azure Key Vault.

Why the Other Options Are Wrong

Option A is incorrect because it validates a flawed technical premise. MFA cannot encrypt data; it only challenges the user for additional proof of identity. Using MFA would leave the plaintext credentials exposed in scripts or configuration files, defeating the purpose of encryption.

Community Comment Notes

Community consensus strongly supports Option B. Users like jgalanj noted that the keyword 'credentials' points directly to Key Vault. Dennx clarified that "MFA adds an aditional layer to the authentication process, but it doesn't keep your credential safe." Another commenter emphasized that "Key Vault will protect credentials," highlighting the correct architectural component for this scenario.

Official Reference

https://docs.microsoft.com/en-us/azure/key-vault/general/overview

Exam Strategy

When a question asks about securing passwords, keys, or certificates, immediately think of Azure Key Vault. Do not confuse it with Azure Active Directory features like MFA or Conditional Access, which handle who gets in, not what data is protected.

Frequently Asked Questions

Why isn't MFA enough to secure credentials?

MFA verifies identity at login but does not store or encrypt the actual password or key. It prevents unauthorized access but leaves the secret itself unprotected if compromised elsewhere.

What Azure service should I use instead of MFA for secrets?

Use Azure Key Vault. It is a centralized service for managing secrets, keys, and certificates, providing encryption and strict access controls.

More AZ-900 FAQ →

Related Analysis

Note: The question is included in a number of questions that

S-Grade

Note: The question is included in a number of questions that

A-Grade

Note: The question is included in a number of questions that

S-Grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide