SC-900 · Domain 2: Describe the capabilities of Microsoft Entra · 28% of the exam
Task 2.2: Describe authentication capabilities of Microsoft Entra ID
Authentication methods and passwordless options, multifactor authentication and security defaults, self-service password reset and password protection.
Study it
Authentication methods, passwordless and phishing-resistant sign-in
Lesson coming
Multifactor authentication and security defaults
Lesson coming
Self-service password reset and password protection
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 2
A company wants sign-in methods whose credential is bound to the site where it was registered, so that a look-alike phishing page can't use it. Which two methods meet that goal? (Choose TWO.)
ASMS verification codes
BFIDO2 security keys
CMicrosoft Authenticator push notifications with number matching
DEmail one-time passcodes
EWindows Hello for Business
Show the answer and why
ASMS verification codes
Incorrect
Text message codes can be phished; Microsoft recommends moving away from them for MFA.
BFIDO2 security keys
Correct
FIDO2 security keys are listed among Microsoft's phishing-resistant methods.
CMicrosoft Authenticator push notifications with number matching
Incorrect
Number matching helps against MFA fatigue, but push notifications aren't in the phishing-resistant list; passkeys in Authenticator are.
DEmail one-time passcodes
Incorrect
Email one-time passwords are increasingly vulnerable to remote phishing.
EWindows Hello for Business
Correct
Windows Hello for Business is listed among Microsoft's phishing-resistant methods.
Phishing-resistant methods use public key cryptography with the credential bound to the origin (domain) where it was registered, so it can't be used on a fraudulent site, replayed or shared. In Microsoft Entra ID they include Windows Hello for Business, Platform Credential for macOS, synced passkeys, FIDO2 security keys, passkeys in Microsoft Authenticator and certificate-based authentication.
A new hire starts remotely next week on her own company laptop. She has no password and no registered authentication methods yet, and IT wants her first sign-in to let her register a passkey in Microsoft Authenticator without a password ever being set. What should the help desk issue her?
AA Temporary Access Pass
BA temporary password that she must change at first sign-in
CAn email one-time passcode
DA QR code with a PIN
Show the answer and why
AA Temporary Access Pass
Correct
A Temporary Access Pass is a time-limited passcode for signing in and registering other methods, including passwordless ones, which suits onboarding.
BA temporary password that she must change at first sign-in
Incorrect
This sets a password on the account, which IT wants to avoid.
CAn email one-time passcode
Incorrect
An email one-time passcode isn't a primary sign-in method, so it can't carry her first sign-in.
DA QR code with a PIN
Incorrect
QR code sign-in is designed for frontline workers on shared devices, not for registering methods on a laptop of her own.
A Temporary Access Pass is a time-limited passcode that an administrator issues. Users can sign in with it and register other authentication methods, including passwordless methods such as passkeys, which makes it useful for onboarding new users and for recovering access after lost credentials.
A 40-person nonprofit uses the free tier of Microsoft Entra ID. It wants every user registered for multifactor authentication, administrators always prompted for it, and legacy authentication protocols blocked, without buying any licenses. What should it rely on?
AConditional Access policies that require MFA
BMFA prompts built into each application
CMicrosoft Entra Password Protection for every user
DSecurity defaults, turned on for the tenant
Show the answer and why
AConditional Access policies that require MFA
Incorrect
Conditional Access gives more granular control, but it requires Microsoft Entra ID P1 or P2 licenses.
BMFA prompts built into each application
Incorrect
Microsoft Entra ID requests and processes MFA as part of sign-in, without changes to the applications.
CMicrosoft Entra Password Protection for every user
Incorrect
Password Protection blocks weak passwords; it doesn't require MFA registration or block legacy protocols.
DSecurity defaults, turned on for the tenant
Correct
Security defaults require MFA registration for all users, MFA for administrators and block legacy authentication at no extra cost.
Security defaults are a set of basic identity security mechanisms that Microsoft enforces when they're enabled: MFA registration for all users, MFA for administrators and when needed for users, blocking legacy authentication and protecting privileged activities. They suit organizations on the free tier; Conditional Access offers finer control with P1 or P2 licenses.
Users keep choosing passwords such as Contoso2026! that are built on the company's name and its product names. The tenant already applies Microsoft's global banned password list. What should the administrator add?
AEvery full password variant built on the product names, added to the global banned list
BThe global banned password list, switched on for these users
CA custom banned password list with the organization's brand names and other terms of its own
DSelf-service password reset that requires two methods
Show the answer and why
AEvery full password variant built on the product names, added to the global banned list
Incorrect
The global list can't be edited, and the custom list holds key base terms because variants are blocked automatically.
BThe global banned password list, switched on for these users
Incorrect
The global list is applied to all users automatically; there's nothing to enable.
CA custom banned password list with the organization's brand names and other terms of its own
Correct
Custom terms are combined with the global list, and fuzzy matching also blocks their variants.
DSelf-service password reset that requires two methods
Incorrect
Requiring two methods for password resets doesn't add organization-specific terms to block.
Microsoft Entra Password Protection applies a global banned password list to every user, with nothing to enable or configure. Organizations add their own terms, such as brand names, product names and locations, in a custom banned password list of up to 1,000 terms; password changes and resets are checked against both lists with fuzzy matching.
Which passwordless method replaces passwords on company PCs with a key or certificate tied to the device, unlocked with a PIN or a biometric gesture?
ASMS sign-in
BTemporary Access Pass
CWindows Hello for Business
DHardware OATH token
Show the answer and why
ASMS sign-in
Incorrect
SMS sign-in sends a code to a registered phone number.
BTemporary Access Pass
Incorrect
A Temporary Access Pass isn't tied to the device with a PIN or biometric.
CWindows Hello for Business
Correct
It combines a key or certificate tied to the device with something the person knows (PIN) or is (biometrics).
DHardware OATH token
Incorrect
Hardware OATH tokens don't replace passwords with a device key.
Windows Hello for Business replaces passwords with strong two-factor authentication on devices, combining a key or certificate tied to a device with a PIN or biometrics. The gesture triggers the private key to sign data sent to the identity provider, so an attacker would need both the device and the PIN or biometric.
Where can a Microsoft Entra user's email one-time passcode serve as an authentication method?
AAs the primary sign-in method instead of a password
BAs the second factor for multifactor authentication at every sign-in
CAs a phishing-resistant method for administrators
DAs a secondary method during self-service password reset
Show the answer and why
AAs the primary sign-in method instead of a password
Incorrect
Email OTP isn't supported as a primary form of authentication.
BAs the second factor for multifactor authentication at every sign-in
Incorrect
Email OTP isn't listed among the methods for Microsoft Entra MFA.
CAs a phishing-resistant method for administrators
Incorrect
Email one-time passwords are increasingly vulnerable to phishing and aren't phishing resistant.
DAs a secondary method during self-service password reset
Correct
Email OTP is a verification code sent to the user's email address, used during SSPR; it can also be set up for guest sign-in.
An email one-time passcode is a verification code sent to a user's email address. In Microsoft Entra ID it's a secondary form of authentication during self-service password reset and can also be configured for guest sign-in. It isn't a primary method or an MFA method, and it isn't phishing resistant.
Help desk staff spend hours every week on forgotten passwords and locked accounts. Which Microsoft Entra feature lets users get back in on their own, without calling them?
AMicrosoft Entra Password Protection
BSecurity defaults
CPrivileged Identity Management
DSelf-service password reset
Show the answer and why
AMicrosoft Entra Password Protection
Incorrect
Password Protection blocks weak passwords; it doesn't let users reset theirs.
BSecurity defaults
Incorrect
Security defaults don't provide password reset.
CPrivileged Identity Management
Incorrect
PIM governs privileged role activation, not users' passwords.
DSelf-service password reset
Correct
SSPR lets users change or reset their password without administrator or help desk involvement.
Self-service password reset (SSPR) lets users change or reset their password, or unlock their account, without administrator or help desk involvement, which reduces help desk calls and lost productivity.