Practice Test GeeksSC-300 - Microsoft Identity and Access Administrator Practice Test
← All SC-300 Flashcard Decks

Azure AD Authentication Methods Flashcards

7 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Azure AD Authentication Methods flashcards as text

  1. What is the key difference between per-user MFA and Conditional Access-based MFA in Azure AD?

    Answer: Conditional Access MFA can be scoped to specific apps, locations, or risk levels; per-user MFA applies globally

    Conditional Access MFA is flexible and can be scoped to specific cloud apps, locations, device states, or risk levels, while per-user MFA enforces MFA for every sign-in regardless of context.

  2. An administrator enables Azure AD Security Defaults. Which statement about Security Defaults and MFA is correct?

    Answer: Security Defaults enforce MFA for all users and block legacy authentication protocols

    Security Defaults enforce MFA for all users (with a 14-day registration period), require MFA for privileged roles at every sign-in, and block legacy authentication protocols that cannot perform MFA.

  3. A user cannot sign in because they lost their phone used for MFA and have no backup methods registered. What is the recommended way for an administrator to temporarily help the user sign in?

    Answer: Issue a Temporary Access Pass (TAP) scoped to allow re-registration

    Issuing a Temporary Access Pass (TAP) is the recommended approach, as it gives the user a secure, time-limited credential to sign in and register new authentication methods without disabling their MFA.

  4. Which setting in the Azure AD Authentication Methods policy determines whether end users can self-manage a specific authentication method?

    Answer: User controls (allow/disallow users to manage the method)

    The 'User controls' (also called 'Allow users to manage') setting in the Authentication Methods policy determines whether users can register and self-manage a given authentication method or if only admins can assign it.

  5. An administrator wants to ensure that only phishing-resistant authentication methods are required for access to a critical application. Which Conditional Access control should they apply?

    Answer: Authentication strength requiring phishing-resistant MFA

    Authentication Strengths allow administrators to specify that only phishing-resistant MFA methods (e.g., FIDO2 keys, Windows Hello for Business) are accepted, rather than any MFA method.

  6. Which Azure AD feature provides additional context in push notifications, such as the application name and geographic location, to help users make informed MFA approval decisions?

    Answer: Additional context in Microsoft Authenticator notifications

    Additional context in Microsoft Authenticator notifications shows users the application requesting access and the approximate location of the sign-in attempt, helping them detect suspicious MFA requests.

  7. An organization wants to enable SMS sign-in for frontline workers who share workstations and do not have personal email addresses configured in Azure AD. What is a prerequisite for enabling SMS sign-in for a user?

    Answer: The user must have a mobile phone number configured in their Azure AD profile

    SMS sign-in requires that a mobile phone number be set on the user's Azure AD profile, as this number is used to send the one-time passcode for authentication.