SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 4 — Questions and Answers
Question 1: Which Microsoft Entra authentication method sends a push notification to a smartphone requiring user approval?
- TOTP code from authenticator app
- Microsoft Authenticator push notification (Correct answer)
- FIDO2 security key tap
- Windows Hello PIN
Correct answer: Microsoft Authenticator push notification
Microsoft Authenticator push notifications send an approval request to the user's registered phone, which they must accept to complete authentication.
Question 2: A user's phone is lost. Which action should an admin perform in Microsoft Entra ID to prevent unauthorized access via the lost phone's authenticator app?
- Delete the user account
- Revoke all refresh tokens and remove the registered MFA device (Correct answer)
- Reset only the user's password
- Enable legacy authentication protocols
Correct answer: Revoke all refresh tokens and remove the registered MFA device
The admin should revoke the user's refresh tokens (to invalidate active sessions) and remove the lost phone as a registered MFA device from the user's authentication methods.
Question 3: Which of the following best describes Certificate-Based Authentication (CBA) in Microsoft Entra ID?
- Using a digital certificate on a smart card or device to authenticate without a password (Correct answer)
- Sending a certificate via email as a one-time code
- A certificate proving the domain is registered
- Encrypting the login page with SSL
Correct answer: Using a digital certificate on a smart card or device to authenticate without a password
CBA in Microsoft Entra ID allows users to authenticate using X.509 digital certificates stored on smart cards or devices, replacing passwords entirely.
Question 4: What does the Microsoft Entra ID Authentication Methods policy control?
- Which users can create new Microsoft Entra tenants
- Which authentication methods are enabled and for which users or groups (Correct answer)
- The expiration time of all user passwords
- Network locations allowed for sign-in
Correct answer: Which authentication methods are enabled and for which users or groups
The Authentication Methods policy lets admins configure which methods (e.g., FIDO2, Microsoft Authenticator, SMS) are enabled and which users or groups can use them.
Question 5: Which scenario correctly describes where Windows Hello for Business stores its private key?
- In Microsoft Entra ID cloud storage
- In the user's Active Directory account
- In a Trusted Platform Module (TPM) on the user's device (Correct answer)
- In a shared key vault accessible by IT
Correct answer: In a Trusted Platform Module (TPM) on the user's device
Windows Hello for Business stores the private key in the device's TPM chip, ensuring it never leaves the hardware and cannot be extracted remotely.
Question 6: In Microsoft Entra ID, what is 'MFA fatigue' and how does number matching address it?
- Users forgetting their MFA method; number matching replaces it with email
- Attackers spamming push notifications hoping users accidentally approve; number matching requires entering a specific number shown at sign-in (Correct answer)
- Too many methods registered causing confusion; number matching limits to one
- MFA expiring too quickly; number matching extends token lifetime
Correct answer: Attackers spamming push notifications hoping users accidentally approve; number matching requires entering a specific number shown at sign-in
MFA fatigue involves attackers sending repeated push notifications until a tired user approves one; number matching defeats this by requiring the user to enter a code visible only during the legitimate sign-in.
Question 7: Which Microsoft Entra authentication method is best suited for frontline workers who share devices and do not have personal smartphones?
- Microsoft Authenticator app push notifications
- SMS to personal mobile number
- FIDO2 security keys (Correct answer)
- Windows Hello face recognition
Correct answer: FIDO2 security keys
FIDO2 security keys are portable hardware tokens that workers can carry personally and use on any shared device without requiring a personal smartphone.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 4
Which Microsoft Entra authentication method sends a push notification to a smartphone requiring user approval?