SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 5 — Questions and Answers
Question 1: What is the role of a 'passkey' in Microsoft Entra ID authentication?
- A recovery code stored in the cloud
- A FIDO2-based passwordless credential tied to biometrics or device PIN (Correct answer)
- An admin-generated temporary password
- A Kerberos service ticket
Correct answer: A FIDO2-based passwordless credential tied to biometrics or device PIN
Passkeys are FIDO2-based credentials that replace passwords, using device biometrics or PIN combined with public key cryptography for phishing-resistant sign-in.
Question 2: An administrator wants to enforce that all users in a high-security group use only phishing-resistant authentication methods. What is the correct approach in Microsoft Entra ID?
- Require SSPR registration for the group
- Create a Conditional Access policy requiring phishing-resistant MFA strength for the group (Correct answer)
- Enable legacy authentication for the group
- Set the group's password to never expire
Correct answer: Create a Conditional Access policy requiring phishing-resistant MFA strength for the group
Conditional Access Authentication Strength policies allow admins to require specific method tiers (like phishing-resistant MFA) for particular users, groups, or scenarios.
Question 3: Which protocol do FIDO2 security keys use when communicating with a browser or platform during authentication?
- SAML 2.0
- OAuth 2.0
- WebAuthn/CTAP2 (Correct answer)
- WS-Federation
Correct answer: WebAuthn/CTAP2
FIDO2 keys use the WebAuthn API (browser side) and CTAP2 protocol (between authenticator and device) to perform cryptographic authentication.
Question 4: How does Microsoft Entra ID handle authentication for users in regions where SMS delivery is unreliable?
- It automatically switches to email OTP without any configuration
- Admins can enable alternative methods such as Microsoft Authenticator or FIDO2 keys in the Authentication Methods policy (Correct answer)
- SMS is mandatory and cannot be replaced
- Users must use password-only authentication in those regions
Correct answer: Admins can enable alternative methods such as Microsoft Authenticator or FIDO2 keys in the Authentication Methods policy
Admins configure the Authentication Methods policy to enable alternative methods like Microsoft Authenticator or FIDO2, giving users options that don't rely on SMS infrastructure.
Question 5: What is the difference between MFA and passwordless authentication in Microsoft Entra ID?
- MFA always requires a password plus a second factor; passwordless replaces the password entirely with strong factors (Correct answer)
- MFA and passwordless are the same thing
- Passwordless requires more factors than MFA
- MFA is only for cloud apps; passwordless is only for on-premises apps
Correct answer: MFA always requires a password plus a second factor; passwordless replaces the password entirely with strong factors
MFA combines a password with additional factors, while passwordless authentication eliminates the password and uses strong factors like biometrics or security keys alone.
Question 6: Which Microsoft Entra ID report helps administrators identify users who have not yet registered for MFA?
- Sign-in logs
- Audit logs
- Authentication Methods Registration Report (Correct answer)
- Risky sign-ins report
Correct answer: Authentication Methods Registration Report
The Authentication Methods Registration Report in Microsoft Entra ID shows which users have registered specific authentication methods and identifies those who haven't completed registration.
Question 7: A company is migrating from per-user MFA settings to Conditional Access-based MFA. What should admins do to avoid conflicts?
- Enable both per-user MFA and Conditional Access MFA simultaneously
- Disable per-user MFA for users covered by Conditional Access policies to prevent double prompts (Correct answer)
- Delete all Conditional Access policies before migrating
- Require all users to re-register their authentication methods
Correct answer: Disable per-user MFA for users covered by Conditional Access policies to prevent double prompts
Running per-user MFA alongside Conditional Access MFA can cause redundant authentication prompts, so admins should turn off per-user MFA for users governed by CA policies.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 5
What is the role of a 'passkey' in Microsoft Entra ID authentication?