A single compromised login can grant entry to all linked services is correct.

Centralized authentication creates a single point of authentication that many services trust. If an attacker obtains those credentials they can access every linked application and resource without needing separate usernames and passwords. This is the classic account takeover risk that follows from centralizing logins.

Because of that risk defenders focus on multi factor authentication strong monitoring and least privilege for accounts that have broad access. They also apply anomaly detection and rapid revocation to limit the blast radius if credentials are stolen.

Older on premises applications may not integrate with centralized authentication is incorrect because it describes an integration challenge rather than the direct security consequence of exposed centralized credentials. Integration limitations do not make credential exposure itself less dangerous.

SSO forces users to maintain more complex passwords for each service is incorrect because single sign on actually reduces the number of passwords a user must manage. It does not require separate complex passwords for each service and the security concern is that one password can unlock many services.

Recovery operations can increase help desk workload is incorrect as a primary security consequence. Recovery work may change with centralized authentication but the immediate security impact of exposed credentials is unauthorized access across linked services rather than administrative burden.

Full AWS Practitioner Certification Question