SC-300 Azure AD Authentication Methods 1 — Questions and Answers
Question 1: An administrator wants to enable passwordless authentication for users who use Windows 10 domain-joined devices. Which authentication method should they configure?
- FIDO2 security keys
- Windows Hello for Business (Correct answer)
- Microsoft Authenticator phone sign-in
- SMS-based authentication
Correct answer: Windows Hello for Business
Windows Hello for Business is the passwordless solution designed specifically for Windows 10/11 domain-joined and Azure AD-joined devices, replacing passwords with biometric or PIN-based authentication tied to the device.
Question 2: Which Azure AD feature allows users to reset their own passwords without contacting the helpdesk?
- Azure AD Identity Protection
- Privileged Identity Management
- Self-Service Password Reset (SSPR) (Correct answer)
- Azure AD Access Reviews
Correct answer: Self-Service Password Reset (SSPR)
Self-Service Password Reset (SSPR) enables users to reset or unlock their accounts without administrator intervention, reducing helpdesk load.
Question 3: What is the minimum number of authentication methods a user must register when SSPR is configured to require 2 methods?
- 1
- 2 (Correct answer)
- 3
- 4
Correct answer: 2
When SSPR is configured to require 2 methods, users must register at least 2 authentication methods so they can use two different methods to verify their identity during reset.
Question 4: An organization wants to allow users to register both MFA and SSPR information in a single registration experience. Which Azure AD feature enables this?
- Authentication Methods policy
- Combined security information registration (Correct answer)
- Per-user MFA portal
- Identity Protection registration policy
Correct answer: Combined security information registration
Combined security information registration provides a unified registration experience where users can register their MFA and SSPR authentication methods in a single workflow at aka.ms/mysecurityinfo.
Question 5: Which authentication method in Azure AD uses a physical device compliant with the FIDO Alliance standards for passwordless sign-in?
- Software OATH tokens
- FIDO2 security keys (Correct answer)
- Microsoft Authenticator push notifications
- Hardware OATH tokens
Correct answer: FIDO2 security keys
FIDO2 security keys are physical hardware devices (like YubiKey) that comply with FIDO2/WebAuthn standards, enabling passwordless authentication without any shared secrets.
Question 6: A user reports they are no longer receiving MFA push notifications from the Microsoft Authenticator app. Which Azure AD portal should an administrator visit to re-register the user's authentication methods?
- Azure AD > Users > Authentication methods (Correct answer)
- Azure AD > Security > MFA > User settings
- Azure AD > Identity Protection > User risk
- Azure AD > Conditional Access > Named locations
Correct answer: Azure AD > Users > Authentication methods
In Azure AD, administrators can view and manage a specific user's registered authentication methods by navigating to Azure AD > Users > selecting the user > Authentication methods.
Question 7: Which report in Azure AD helps administrators identify users who have NOT registered for MFA?
- Sign-in logs filtered by MFA result
- Authentication methods activity report (Correct answer)
- Conditional Access policy report
- Azure AD audit logs
Correct answer: Authentication methods activity report
The Authentication methods activity report provides registration details including which users have or have not registered specific authentication methods, making it easy to identify gaps in MFA adoption.
SC-300 Azure AD Authentication Methods 1
An administrator wants to enable passwordless authentication for users who use Windows 10 domain-joined devices.
Which authentication method should they configure?