SC-300 Azure AD Authentication Methods 3

Question 1

What is the key difference between per-user MFA and Conditional Access-based MFA in Azure AD?

Accepted Answer

Conditional Access MFA can be scoped to specific apps, locations, or risk levels; per-user MFA applies globally

Answer

Per-user MFA supports more authentication methods than Conditional Access MFA

Answer

Per-user MFA integrates with Identity Protection; Conditional Access MFA does not

Answer

Conditional Access MFA only works with FIDO2 keys; per-user MFA works with all methods

Question 2

An administrator enables Azure AD Security Defaults. Which statement about Security Defaults and MFA is correct?

Accepted Answer

Security Defaults enforce MFA for all users and block legacy authentication protocols

Answer

Security Defaults allow administrators to exempt specific users from MFA

Answer

Security Defaults only apply to Global Administrators, not regular users

Answer

Security Defaults can be combined with Conditional Access policies

Question 3

A user cannot sign in because they lost their phone used for MFA and have no backup methods registered. What is the recommended way for an administrator to temporarily help the user sign in?

Accepted Answer

Issue a Temporary Access Pass (TAP) scoped to allow re-registration

Answer

Disable MFA for the user account permanently

Answer

Add the user's IP to a Conditional Access named location exclusion

Answer

Reset the user's password and disable legacy authentication

Question 4

Which setting in the Azure AD Authentication Methods policy determines whether end users can self-manage a specific authentication method?

Accepted Answer

User controls (allow/disallow users to manage the method)

Answer

Target (who can use the method)

Answer

The method's enabled/disabled toggle

Answer

Authentication strength requirement

Question 5

An administrator wants to ensure that only phishing-resistant authentication methods are required for access to a critical application. Which Conditional Access control should they apply?

Accepted Answer

Authentication strength requiring phishing-resistant MFA

Answer

Require MFA grant control

Answer

Require compliant device grant control

Answer

Session control with sign-in frequency of 0

Question 6

Which Azure AD feature provides additional context in push notifications, such as the application name and geographic location, to help users make informed MFA approval decisions?

Accepted Answer

Additional context in Microsoft Authenticator notifications

Answer

Number matching

Answer

Authenticator Lite

Answer

Identity Protection risk-based prompts

Question 7

An organization wants to enable SMS sign-in for frontline workers who share workstations and do not have personal email addresses configured in Azure AD. What is a prerequisite for enabling SMS sign-in for a user?

Accepted Answer

The user must have a mobile phone number configured in their Azure AD profile

Answer

The user must have a Microsoft Authenticator app installed

Answer

The user must be assigned an Azure AD Premium P2 license

Answer

The user must have previously completed MFA registration