SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods Questions and Answers

Question 1

A new employee is starting, and an administrator needs to provide them with a method to sign in and register for passwordless authentication for the first time. The employee does not yet have a corporate device or any registered authentication methods. Which Microsoft Entra authentication method is specifically designed for this onboarding scenario?

Accepted Answer

Temporary Access Pass (TAP)

Answer

A Temporary Access Pass (TAP) is a time-limited passcode that can be used to onboard other authentication methods, including passwordless ones like the Microsoft Authenticator app or a FIDO2 key. It is ideal for new users who need to register their permanent authentication methods without first needing a password.

Question 2

Which of the following authentication methods is considered the most resistant to phishing attacks?

Accepted Answer

FIDO2 Security Key

Answer

FIDO2 security keys are a form of passwordless authentication that is highly resistant to phishing. They use public-key cryptography and require the physical presence of the key, making it extremely difficult for an attacker to steal credentials through a fake website or social engineering.

Question 3

A company wants to enable passwordless sign-in for its users. They want to provide an option that uses the employee's company-issued smartphone. Which feature of the Microsoft Authenticator app should be configured?

Accepted Answer

Passwordless sign-in (phone sign-in)

Answer

The Microsoft Authenticator app supports passwordless sign-in, also known as phone sign-in. With this method, the user enters their username, and then receives a notification on their registered device. They can approve the sign-in directly from the app using a biometric gesture (like a fingerprint) or a PIN, eliminating the need for a password.

Question 4

An organization is configuring its Self-Service Password Reset (SSPR) policy. They want to ensure users have multiple ways to prove their identity before being allowed to reset their password. Which of the following is NOT a valid authentication method that can be used for SSPR in Microsoft Entra ID?

Accepted Answer

Windows Hello for Business

Answer

While Windows Hello for Business is a strong, passwordless authentication method for signing into a device, it is used for primary authentication, not as a method for account recovery during a Self-Service Password Reset (SSPR) flow. SSPR relies on methods like email, phone calls, SMS, security questions, or the Authenticator app to verify the user's identity when they have forgotten their password.

Question 5

When configuring the FIDO2 security key authentication method policy in the Microsoft Entra admin center, an administrator chooses to set "Enforce attestation" to "Yes". What is the primary purpose of this setting?

Accepted Answer

To ensure that the security key model is genuine and from a legitimate vendor.

Answer

The "Enforce attestation" setting for FIDO2 security keys verifies the Authenticator Attestation GUID (AAGUID) of the key during registration. This process ensures that the key is from a specific, trusted manufacturer and model, preventing the use of unapproved or potentially compromised hardware.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods Questions and Answers