SC-300 Azure AD Authentication Methods 2 — Questions and Answers
Question 1: What is a Temporary Access Pass (TAP) in Azure AD?
- A one-time SMS code valid for 30 days
- A time-limited passcode that allows users to onboard or recover passwordless credentials (Correct answer)
- A guest access token for B2B collaboration
- A Conditional Access bypass for privileged accounts
Correct answer: A time-limited passcode that allows users to onboard or recover passwordless credentials
Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator that lets users onboard passwordless authentication methods or regain access when they lose their primary credential.
Question 2: An administrator configures Authentication Strengths in Azure AD Conditional Access. What do Authentication Strengths define?
- The complexity requirements for password policies
- A combination of authentication methods that must be satisfied to access a resource (Correct answer)
- The encryption algorithm used for token signing
- The session lifetime for authenticated users
Correct answer: A combination of authentication methods that must be satisfied to access a resource
Authentication Strengths are a Conditional Access control that defines an allowable set of authentication method combinations (e.g., phishing-resistant MFA) that users must satisfy to gain access.
Question 3: Which Azure AD feature helps prevent MFA fatigue attacks by requiring users to enter a number displayed on the sign-in screen into the Authenticator app?
- Authenticator Lite
- Number matching (Correct answer)
- Passwordless phone sign-in
- Identity Protection risk-based MFA
Correct answer: Number matching
Number matching requires the user to enter a two-digit number shown on the sign-in screen into their Microsoft Authenticator app, preventing accidental or malicious approval of MFA push requests.
Question 4: A company needs hardware-based OATH TOTP tokens for their security-sensitive accounts. Where in Azure AD are hardware OATH tokens managed?
- Azure AD > Security > Authentication methods > OATH tokens (Correct answer)
- Azure AD > Users > Per-user MFA
- Azure AD > Conditional Access > Authentication strengths
- Azure AD > Identity Protection > Risk policies
Correct answer: Azure AD > Security > Authentication methods > OATH tokens
Hardware OATH tokens are managed in Azure AD > Security > Authentication methods > OATH tokens, where administrators can upload a CSV of token serial numbers and secret keys to assign to users.
Question 5: Which Azure AD authentication method allows users to sign in to Azure AD using a Microsoft Authenticator notification WITHOUT entering a password?
- Software OATH token
- SMS sign-in
- Passwordless phone sign-in (Microsoft Authenticator) (Correct answer)
- Windows Hello for Business
Correct answer: Passwordless phone sign-in (Microsoft Authenticator)
Passwordless phone sign-in through Microsoft Authenticator allows users to sign in by approving a notification on their phone, completely replacing the password with the device-bound credential.
Question 6: An organization is deploying Azure AD and wants to enforce MFA registration for all new users within 14 days of their first sign-in. Which feature should the administrator configure?
- Conditional Access policy with MFA grant
- Identity Protection MFA registration policy (Correct answer)
- Azure AD Security Defaults
- Per-user MFA enforcement
Correct answer: Identity Protection MFA registration policy
The Identity Protection MFA registration policy can target all users and requires them to register for Azure AD MFA within a grace period, prompting registration upon sign-in.
Question 7: Which of the following authentication methods supports SMS as a verification option in Azure AD?
- Windows Hello for Business
- FIDO2 security keys
- OATH hardware tokens
- Self-Service Password Reset (SSPR) (Correct answer)
Correct answer: Self-Service Password Reset (SSPR)
SSPR supports SMS as one of its authentication methods for identity verification during the password reset process, along with other methods like email, authenticator app, and security questions.
SC-300 Azure AD Authentication Methods 2
What is a Temporary Access Pass (TAP) in Azure AD?