SC-300 Azure AD Authentication Methods 3

Question 1

What is the key difference between per-user MFA and Conditional Access-based MFA in Azure AD?

Accepted Answer

Conditional Access MFA can be scoped to specific apps, locations, or risk levels; per-user MFA applies globally

Answer

Conditional Access MFA is flexible and can be scoped to specific cloud apps, locations, device states, or risk levels, while per-user MFA enforces MFA for every sign-in regardless of context.

Question 2

An administrator enables Azure AD Security Defaults. Which statement about Security Defaults and MFA is correct?

Accepted Answer

Security Defaults enforce MFA for all users and block legacy authentication protocols

Answer

Security Defaults enforce MFA for all users (with a 14-day registration period), require MFA for privileged roles at every sign-in, and block legacy authentication protocols that cannot perform MFA.

Question 3

A user cannot sign in because they lost their phone used for MFA and have no backup methods registered. What is the recommended way for an administrator to temporarily help the user sign in?

Accepted Answer

Issue a Temporary Access Pass (TAP) scoped to allow re-registration

Answer

Issuing a Temporary Access Pass (TAP) is the recommended approach, as it gives the user a secure, time-limited credential to sign in and register new authentication methods without disabling their MFA.

Question 4

Which setting in the Azure AD Authentication Methods policy determines whether end users can self-manage a specific authentication method?

Accepted Answer

User controls (allow/disallow users to manage the method)

Answer

The 'User controls' (also called 'Allow users to manage') setting in the Authentication Methods policy determines whether users can register and self-manage a given authentication method or if only admins can assign it.

Question 5

An administrator wants to ensure that only phishing-resistant authentication methods are required for access to a critical application. Which Conditional Access control should they apply?

Accepted Answer

Authentication strength requiring phishing-resistant MFA

Answer

Authentication Strengths allow administrators to specify that only phishing-resistant MFA methods (e.g., FIDO2 keys, Windows Hello for Business) are accepted, rather than any MFA method.

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 Azure AD Authentication Methods 3