SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 3 — Questions and Answers
Question 1: Which Microsoft Entra authentication method is considered most resistant to phishing attacks?
- SMS one-time passcode
- Email OTP
- FIDO2 security keys (Correct answer)
- Voice call verification
Correct answer: FIDO2 security keys
FIDO2 security keys are phishing-resistant because they use public key cryptography bound to the specific site's origin, so credentials cannot be intercepted and replayed on fake sites.
Question 2: A company wants to allow employees to sign in to Microsoft Entra ID using their fingerprint on a corporate laptop. Which technology enables this?
- Smart card authentication
- Windows Hello for Business (Correct answer)
- FIDO2 USB security key
- Certificate-based authentication
Correct answer: Windows Hello for Business
Windows Hello for Business uses biometrics (fingerprint, face) or PIN stored locally on the device to authenticate users to Microsoft Entra ID.
Question 3: What type of cryptography underpins FIDO2 and Windows Hello for Business?
- Symmetric key encryption
- Public key (asymmetric) cryptography (Correct answer)
- MD5 hashing
- Kerberos ticket granting
Correct answer: Public key (asymmetric) cryptography
Both FIDO2 and Windows Hello for Business use asymmetric cryptography, where a private key stays on the device and the public key is registered with the identity provider.
Question 4: Which statement about SMS as an authentication method is accurate in the context of Microsoft Entra security guidance?
- SMS is the most secure MFA method available
- SMS is recommended for all admin accounts
- SMS is less secure than app-based methods due to SIM-swapping risks (Correct answer)
- SMS cannot be used with Microsoft Entra ID
Correct answer: SMS is less secure than app-based methods due to SIM-swapping risks
SMS is vulnerable to SIM-swapping attacks where an attacker takes over a phone number, making it less secure than authenticator apps or FIDO2 keys.
Question 5: In Microsoft Entra ID, what is the purpose of the 'Temporary Access Pass' (TAP)?
- A permanent alternative to passwords
- A time-limited passcode to bootstrap passwordless credential registration (Correct answer)
- An emergency admin password
- A guest user invitation link
Correct answer: A time-limited passcode to bootstrap passwordless credential registration
A Temporary Access Pass is a time-limited, admin-issued passcode that lets users sign in once to register passwordless methods like FIDO2 keys or Microsoft Authenticator.
Question 6: Which Microsoft Entra feature uses risk signals to require step-up authentication when a user's sign-in appears risky?
- Self-Service Password Reset
- Authentication Methods Policy
- Identity Protection with risk-based Conditional Access (Correct answer)
- Microsoft Entra Permissions Management
Correct answer: Identity Protection with risk-based Conditional Access
Microsoft Entra Identity Protection detects risk signals and integrates with Conditional Access to enforce MFA or block sign-ins when risk is elevated.
Question 7: What is the minimum number of authentication methods an organization should require users to register for SSPR to ensure resilience?
- 1
- 2 (Correct answer)
- 3
- 4
Correct answer: 2
Microsoft recommends requiring users to register at least 2 authentication methods so they have a backup if one method is unavailable during password reset.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 3
Which Microsoft Entra authentication method is considered most resistant to phishing attacks?