You are deploying Microsoft Authenticator to a group of users who are geographically distributed. Some users have older phones that do not support push notifications. You want to ensure that all users can still use Authenticator for MFA. What should you configure?

Disable MFA for users with older phones.

Enable 'One-time passcode (OTP)' in the Authenticator method policy so users can use time-based codes.

Require all users to upgrade to newer phones that support push notifications.

Issue Temporary Access Passes to all users for every MFA prompt.

An employee is leaving the company. The security team wants to ensure that the user cannot access any resources immediately, but they also want to preserve the user's mailbox for legal hold. What should you do?

Disable the user account in Microsoft Entra and revoke all sessions using the 'Revoke sessions' action.

Revoke all sessions but leave the account enabled.

Delete the user account and remove all licenses.

Reset the user's password and require MFA on next sign-in.

You are planning an authentication strategy for a new subsidiary that will have 500 users. The subsidiary has no on-premises infrastructure and all users will be cloud-only. The security team requires MFA for all users and self-service password reset. You also want to minimize the number of authentication methods users must register. What is the most efficient approach?

Enable all available authentication methods and let users choose which to register.

Deploy FIDO2 security keys to all users and disable MFA because the keys are strong enough.

Enable Microsoft Authenticator as the only authentication method, require MFA via conditional access, and configure SSPR to use the same methods.

Require SSPR registration separately from MFA registration to ensure users have multiple methods.

Your organization uses smartcard-based certificates for all employees. You want to enable certificate-based authentication (CBA) for Microsoft Entra ID so that users can sign in without passwords. The tenant currently has MFA policies that require MFA for all cloud apps. What must you configure to ensure CBA works as a primary authentication method?

Enable 'Require MFA' for the CBA authentication method in the tenant-wide MFA settings.

Upload the trusted root CA certificates and configure the certificate authentication binding to map the certificate to the user account.

Configure a custom password protection policy that allows certificate-based sign-in.

Assign the user a Temporary Access Pass to use as a fallback when the certificate is not recognized.

In Microsoft Entra certificate-based authentication, which component is required to validate the certificate presented by a user?

A registered device in Microsoft Entra

A trusted certificate authority (CA)

Microsoft Certified:Identity and Access Administrator Associate

Domain 2Objective 1

Plan, Implement, and Manage Microsoft Entra User Authentication SC-300 Practice Questions (Page 4)

Part of the Implement authentication and access management domain, which accounts for 25–30% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~10–20 in this domain), expect 3–5 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

25–30%of the exam

Questions 16–20

16expert · hard
You are deploying Microsoft Authenticator to a group of users who are geographically distributed. Some users have older phones that do not support push notifications. You want to ensure that all users can still use Authenticator for MFA. What should you configure?
Select an answer first
17application · medium
An employee is leaving the company. The security team wants to ensure that the user cannot access any resources immediately, but they also want to preserve the user's mailbox for legal hold. What should you do?
Select an answer first
18expert · hard
You are planning an authentication strategy for a new subsidiary that will have 500 users. The subsidiary has no on-premises infrastructure and all users will be cloud-only. The security team requires MFA for all users and self-service password reset. You also want to minimize the number of authentication methods users must register. What is the most efficient approach?
Select an answer first
19application · medium
Your organization uses smartcard-based certificates for all employees. You want to enable certificate-based authentication (CBA) for Microsoft Entra ID so that users can sign in without passwords. The tenant currently has MFA policies that require MFA for all cloud apps. What must you configure to ensure CBA works as a primary authentication method?
Select an answer first
20foundation · easy
In Microsoft Entra certificate-based authentication, which component is required to validate the certificate presented by a user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.

Plan, Implement, and Manage Microsoft Entra User Authentication SC-300 Practice Questions (Page 4)

Questions 16–20

You are deploying Microsoft Authenticator to a group of users who are geographically distributed. Some users have older phones that do not support push notifications. You want to ensure that all users can still use Authenticator for MFA. What should you configure?

An employee is leaving the company. The security team wants to ensure that the user cannot access any resources immediately, but they also want to preserve the user's mailbox for legal hold. What should you do?

In Microsoft Entra certificate-based authentication, which component is required to validate the certificate presented by a user?

Keep studying — Implement authentication and access management