SC-300 · Domain 2: Implement authentication and access management · 29% of the exam
Task 2.1: Plan, implement, and manage Microsoft Entra user authentication
Authentication methods policy, certificate-based authentication, Temporary Access Pass, Authenticator and passkeys, tenant-wide MFA settings, SSPR, Windows Hello for Business, session revocation, password protection and Microsoft Entra Kerberos.
Study it
The authentication methods policy: passkeys, Authenticator, certificates and Temporary Access Pass
Lesson coming
Tenant-wide MFA settings, SSPR and password protection
Lesson coming
Windows Hello for Business, Microsoft Entra Kerberos and session revocation
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Help desk agents hold Authentication Administrator and issue each new hire a Temporary Access Pass so that the hire can register a passkey on day one. For one new hire who was pre-assigned the Security Administrator role, the agents can't create the pass. You must fix this with the least privilege. Which role should the person issuing that pass hold?
APrivileged Authentication Administrator
BUser Administrator
CAuthentication Policy Administrator
DHelpdesk Administrator
Show the answer and why
APrivileged Authentication Administrator
Correct
It can create, view and delete a Temporary Access Pass for admins as well as for members.
BUser Administrator
Incorrect
User Administrator manages user properties and passwords but doesn't create a Temporary Access Pass.
CAuthentication Policy Administrator
Incorrect
This role configures the authentication methods policy; it doesn't manage a user's methods or create passes.
DHelpdesk Administrator
Incorrect
Helpdesk Administrator resets passwords for non-admins and some admin roles; it doesn't create a Temporary Access Pass.
Authentication Administrators can create, delete and view a Temporary Access Pass for members only (not themselves). Privileged Authentication Administrators can do it for admins and members, so it's the least-privileged role for a hire who already holds an administrator role.
Contoso wants staff to be able to register synced passkeys, while members of the Admins group may register only attested, device-bound passkeys from two approved security key models. The rules must apply when passkeys are registered, not only when they're used. What should you configure in the passkey (FIDO2) method of the authentication methods policy?
AOne tenant-wide passkey configuration with attestation enforced, synced passkeys off and the two AAGUIDs allowed
BTwo passkey profiles: synced allowed for staff; attestation, device-bound only and the two AAGUIDs for Admins
CA custom authentication strength that allows the two AAGUIDs, required by a Conditional Access policy for Admins
DA registration campaign targeting Admins with the passkey (FIDO2) method
Show the answer and why
AOne tenant-wide passkey configuration with attestation enforced, synced passkeys off and the two AAGUIDs allowed
Incorrect
A single configuration applies the same rules to everyone, so staff would lose synced passkeys.
BTwo passkey profiles: synced allowed for staff; attestation, device-bound only and the two AAGUIDs for Admins
Correct
Passkey profiles set attestation, passkey type and key restrictions per targeted group.
CA custom authentication strength that allows the two AAGUIDs, required by a Conditional Access policy for Admins
Incorrect
An authentication strength controls which keys satisfy sign-in to resources; it doesn't stop admins registering other passkeys.
DA registration campaign targeting Admins with the passkey (FIDO2) method
Incorrect
It doesn't restrict attestation, passkey type or key models when passkeys are registered.
Passkey profiles are named sets of passkey (FIDO2) rules, such as enforced attestation, device-bound or synced passkey types and AAGUID allow or block lists, each targeted at groups. One profile can allow synced passkeys for staff while another limits Admins to attested device-bound keys from approved models.
Contoso set self-service password reset to None for all users while it tests a rollout. A user who holds the Exchange Administrator role is still able to reset her own password, and she was asked for two methods. Why?
ACombined security info registration turned on SSPR for her when she registered methods
BAdministrator accounts get a fixed two-gate SSPR policy that the user SSPR setting doesn't change
CPassword writeback in Microsoft Entra Connect Sync enables SSPR for synced accounts
DThe Authentication methods policy overrides the SSPR setting once its migration is complete
Show the answer and why
ACombined security info registration turned on SSPR for her when she registered methods
Incorrect
Combined registration collects methods; whether SSPR is enabled is still set by policy.
BAdministrator accounts get a fixed two-gate SSPR policy that the user SSPR setting doesn't change
Correct
Admins are enabled for SSPR by default with a strong two-gate policy, which can't be changed.
CPassword writeback in Microsoft Entra Connect Sync enables SSPR for synced accounts
Incorrect
Writeback sends cloud resets to Active Directory; it doesn't enable SSPR for anyone.
DThe Authentication methods policy overrides the SSPR setting once its migration is complete
Incorrect
Migrating methods doesn't decide who is enabled for SSPR.
By default, administrator accounts are enabled for self-service password reset with a strong two-gate policy that requires two pieces of authentication data and prohibits security questions. That admin policy can't be changed and differs from the user policy, so SSPR should be tested with an account that holds no admin role.
Contoso wants passwords set in Active Directory to be checked against the global banned password list and its custom list containing Contoso2026 and its variants. Its domain controllers have no internet access, and the rollout must start in audit mode. Which two components should you deploy? (Choose TWO.)
AThe DC agent on the read-only domain controllers only
BThe Microsoft Entra Password Protection proxy service on two member servers with internet access
CThe Microsoft Entra Password Protection DC agent on every writable domain controller
DThe proxy service on each domain controller, so that no member server is needed
EA fine-grained password policy with a higher minimum length
Show the answer and why
AThe DC agent on the read-only domain controllers only
Incorrect
RODCs forward password changes to writable DCs and don't need the agent.
BThe Microsoft Entra Password Protection proxy service on two member servers with internet access
Correct
The proxy relays policy from Microsoft Entra ID, so domain controllers never need internet access.
CThe Microsoft Entra Password Protection DC agent on every writable domain controller
Correct
DC agents check password changes against the downloaded policy, in audit mode first.
DThe proxy service on each domain controller, so that no member server is needed
Incorrect
The domain controllers have no internet access, and the proxy must reach Microsoft Entra ID.
EA fine-grained password policy with a higher minimum length
Incorrect
Fine-grained policies set length and complexity; they can't ban words or their variants.
On-premises Microsoft Entra Password Protection uses a proxy service on servers that can reach Microsoft Entra ID and a DC agent on every writable domain controller. DC agents reach the proxy over RPC and never talk to the internet, and RODCs don't need the agent. Audit mode is the default, logging passwords that would be rejected before you switch to Enforce.
Contoso finished migrating its methods to the authentication methods policy and set the migration to Complete. Some users still reset their passwords with security questions, and Contoso wants to keep that option for now. Where are security questions managed?
AIn a Security questions method in the authentication methods policy
BIn a custom authentication strength assigned to the SSPR registration flow
CIn the per-user MFA settings for the users who answer them
DIn the legacy SSPR policy, which still manages security questions
Show the answer and why
AIn a Security questions method in the authentication methods policy
Incorrect
The authentication methods policy has no security questions method today.
BIn a custom authentication strength assigned to the SSPR registration flow
Incorrect
Authentication strengths are Conditional Access grant controls and don't include security questions.
CIn the per-user MFA settings for the users who answer them
Incorrect
Per-user MFA settings set a user's MFA state; they don't manage SSPR methods.
DIn the legacy SSPR policy, which still manages security questions
Correct
Security questions can only be enabled in the legacy SSPR policy until a migration control exists.
Since September 30, 2025, authentication methods can't be managed in the legacy MFA and SSPR policies; the authentication methods policy is the place for them. Security questions are the exception: they can be enabled only in the legacy SSPR policy, which stays active for them after the other methods are migrated.
Within what range can the lifetime of a Temporary Access Pass be configured?
AFrom 1 minute to 24 hours
BFrom 10 minutes to 30 days (43,200 minutes)
CFrom 1 hour to 90 days
DExactly 8 hours, which can't be changed
Show the answer and why
AFrom 1 minute to 24 hours
Incorrect
The minimum is 10 minutes and the maximum is longer than a day.
BFrom 10 minutes to 30 days (43,200 minutes)
Correct
Minimum, maximum and default lifetimes are set in that range.
CFrom 1 hour to 90 days
Incorrect
The maximum is 30 days.
DExactly 8 hours, which can't be changed
Incorrect
Lifetimes are configurable in the policy and per pass.
The Temporary Access Pass policy sets minimum, maximum and default lifetimes between 10 and 43,200 minutes (30 days), and an individual pass can override the default within that range. One-time use can also be enforced.
By default, after how many failed sign-in attempts does Microsoft Entra smart lockout lock an account in an Azure Public tenant?
A3
B5
C10
D50
Show the answer and why
A3
Incorrect
The default threshold is higher.
B5
Incorrect
The default threshold is higher.
C10
Correct
The default lockout threshold is 10 failed attempts in Azure Public and 21Vianet tenants.
D50
Incorrect
The default threshold is lower.
Smart lockout locks an account after 10 failed attempts by default in Azure Public and 21Vianet tenants, for one minute at first and longer after further failures. With hybrid identity, the Microsoft Entra threshold should be lower than the AD DS lockout threshold.
A user has registered SMS, Microsoft Authenticator and a passkey. With system-preferred authentication in its Microsoft managed state, which method is the user asked for?
AThe most secure registered method the user can use on that device
BSMS, because it works on every phone
CA choice of all three methods on every sign-in
DThe method the user picked as default sign-in method in My Security Info
Show the answer and why
AThe most secure registered method the user can use on that device
Correct
It selects the highest-ranked registered method, preferring a passkey usable locally.
BSMS, because it works on every phone
Incorrect
SMS is among the least secure methods, which system-preferred authentication avoids.
CA choice of all three methods on every sign-in
Incorrect
The system picks one method instead of asking the user to choose.
DThe method the user picked as default sign-in method in My Security Info
Incorrect
System-preferred authentication overrides the user's default with the most secure method.
System-preferred authentication prompts users for their most secure registered method, and for passkeys it considers whether one can be used on the current device and browser. It's a Microsoft managed setting with enabled, disabled and Microsoft managed states.
Microsoft enforces mandatory multifactor authentication for some admin sign-ins. Which sign-ins does phase 1 of the enforcement cover?
AThe Azure portal, Microsoft Entra admin center and Intune admin center
BOnly Azure CLI and Azure PowerShell
CEvery sign-in to Microsoft 365 apps such as Outlook, Teams and SharePoint
DOnly accounts that hold the Global Administrator role
Show the answer and why
AThe Azure portal, Microsoft Entra admin center and Intune admin center
Correct
Phase 1 started in October 2024 for these portals, and the Microsoft 365 admin center followed from February 2025.
BOnly Azure CLI and Azure PowerShell
Incorrect
Command-line tools belong to phase 2, from October 1, 2025.
CEvery sign-in to Microsoft 365 apps such as Outlook, Teams and SharePoint
Incorrect
Enforcement covers admin portals and Azure management tools, not every app.
DOnly accounts that hold the Global Administrator role
Incorrect
Enforcement applies to accounts that sign in to these portals, not to one role.
Phase 1 of mandatory MFA requires MFA for accounts signing in to the Azure portal, Microsoft Entra admin center and Intune admin center (from October 2024) and the Microsoft 365 admin center (from February 2025). Phase 2, from October 1, 2025, covers Azure CLI, Azure PowerShell, the Azure mobile app, IaC tools and REST API endpoints for write operations.