SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 2 — Questions and Answers
Question 1: Which Microsoft Entra authentication method uses a time-based one-time passcode generated by an authenticator app?
- Hardware FIDO2 key
- TOTP via Microsoft Authenticator (Correct answer)
- SMS one-time passcode
- Windows Hello for Business
Correct answer: TOTP via Microsoft Authenticator
Microsoft Authenticator can generate TOTP (Time-based One-Time Passcode) codes that refresh every 30 seconds as a second authentication factor.
Question 2: A user forgets their password and needs to reset it without contacting IT. Which Microsoft Entra feature enables this?
- Conditional Access
- Self-Service Password Reset (SSPR) (Correct answer)
- Privileged Identity Management
- Identity Protection
Correct answer: Self-Service Password Reset (SSPR)
Self-Service Password Reset (SSPR) allows users to reset their own passwords after verifying their identity through registered authentication methods.
Question 3: Which of the following is NOT a supported SSPR verification method in Microsoft Entra ID?
- Mobile app notification
- Security questions
- Email to primary work address (Correct answer)
- Mobile phone SMS
Correct answer: Email to primary work address
SSPR cannot send verification to the user's primary work email because that account may be locked; it uses alternate email, mobile, or app methods instead.
Question 4: What is the primary security benefit of passwordless authentication over traditional password-based methods?
- It is faster to type
- It eliminates credentials that can be phished or stolen (Correct answer)
- It requires less storage space
- It works without internet connectivity
Correct answer: It eliminates credentials that can be phished or stolen
Passwordless authentication removes the shared secret (password) that attackers can steal through phishing, breaches, or credential stuffing attacks.
Question 5: When a user sets up Microsoft Authenticator for push notifications, what information does the app display to prevent MFA fatigue attacks?
- The user's IP address
- Number matching and geographic context (Correct answer)
- The exact time of the request
- The user's department
Correct answer: Number matching and geographic context
Number matching requires users to enter a number shown on the sign-in screen into the app, while geographic context shows the location — both combat MFA fatigue attacks.
Question 6: Which license is required to use Microsoft Entra ID SSPR in an organization?
- Microsoft Entra ID Free
- Microsoft Entra ID P1 or P2 (Correct answer)
- Microsoft Entra ID P2 only
- No license required for any tenant
Correct answer: Microsoft Entra ID P1 or P2
SSPR requires Microsoft Entra ID P1 or P2 (or Microsoft 365 Business Premium), as it is not available in the Free tier.
Question 7: What does 'combined registration' mean in Microsoft Entra ID?
- Registering both a work and personal account simultaneously
- A single experience to register methods for both MFA and SSPR (Correct answer)
- Combining hardware and software tokens
- Registering devices and users together
Correct answer: A single experience to register methods for both MFA and SSPR
Combined registration provides a unified portal where users register authentication methods that work for both MFA and SSPR in one workflow.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Entra Authentication Methods 2
Which Microsoft Entra authentication method uses a time-based one-time passcode generated by an authenticator app?