MS-900 Microsoft 365 Fundamentals Identity and Access Management 4 — Questions and Answers
Question 1: Which of the following is an example of 'something you have' as a multi-factor authentication factor?
- A password
- A fingerprint scan
- An authenticator app on your phone (Correct answer)
- Your username
Correct answer: An authenticator app on your phone
An authenticator app on your phone represents 'something you have,' one of the three MFA factor categories.
Question 2: What does 'Seamless Single Sign-On' (Seamless SSO) in Azure AD enable?
- Users to reset passwords without IT help
- Users on domain-joined devices to sign in to cloud apps without entering credentials (Correct answer)
- Admins to approve or deny sign-ins in real time
- External users to access internal SharePoint sites
Correct answer: Users on domain-joined devices to sign in to cloud apps without entering credentials
Seamless SSO automatically signs in users on corporate domain-joined devices to Azure AD-connected apps without requiring them to type passwords.
Question 3: An organization wants to allow users to sign in to Microsoft 365 using their existing on-premises Active Directory credentials. Which technology enables this?
- Azure AD B2C
- Azure AD Connect with password hash synchronization (Correct answer)
- Azure AD Privileged Identity Management
- Microsoft Defender for Identity
Correct answer: Azure AD Connect with password hash synchronization
Azure AD Connect with password hash synchronization replicates on-premises AD credentials to Azure AD, enabling consistent sign-in.
Question 4: Which of the following best describes 'pass-through authentication' in Azure AD?
- Passwords are hashed and stored in Azure AD
- Authentication requests are validated directly against on-premises Active Directory in real time (Correct answer)
- Users receive a one-time passcode for each login
- Federated authentication using a third-party identity provider
Correct answer: Authentication requests are validated directly against on-premises Active Directory in real time
Pass-through authentication validates user passwords directly against on-premises Active Directory without storing them in the cloud.
Question 5: What is the primary security benefit of using passwordless authentication methods like Windows Hello for Business?
- It eliminates the need for MFA entirely
- It removes the password as an attack vector, reducing phishing and credential theft risks (Correct answer)
- It allows users to sign in without any verification
- It stores passwords in a more secure encrypted vault
Correct answer: It removes the password as an attack vector, reducing phishing and credential theft risks
Passwordless authentication eliminates passwords entirely, removing the primary target for phishing, credential stuffing, and brute-force attacks.
Question 6: In Azure AD, what is a 'tenant'?
- A subscription billing unit for Microsoft 365 licenses
- A dedicated instance of Azure AD representing an organization (Correct answer)
- A group of users with the same role assignments
- A virtual machine used to host identity services
Correct answer: A dedicated instance of Azure AD representing an organization
An Azure AD tenant is a dedicated, isolated instance of the Azure AD service that an organization receives when it signs up for Microsoft cloud services.
Question 7: Which report in Azure AD helps an administrator identify sign-ins that were blocked by Conditional Access policies?
- Audit logs
- Sign-in logs with Conditional Access filter (Correct answer)
- Risky users report
- Usage and insights report
Correct answer: Sign-in logs with Conditional Access filter
The Azure AD sign-in logs include Conditional Access details showing which policies were applied and whether they resulted in a block or grant.
MS-900 Microsoft 365 Fundamentals Identity and Access Management 4
Which of the following is an example of 'something you have' as a multi-factor authentication factor?