Plan, Implement, and Manage Microsoft Entra User Authentication SC-300 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are configuring self-service password reset (SSPR) for your tenant. You want to ensure that users who are already registered for MFA can use that registration to satisfy the SSPR authentication requirement. What should you do?

   • ADisable MFA for SSPR users so they can reset their password with just a security question.
   • BEnable SSPR and select 'Number of methods required to reset' as 1, and allow users to use their existing MFA methods.
   • CConfigure a custom password protection policy to allow SSPR resets.
   • DRequire users to re-register for SSPR separately, even if they have MFA methods.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   Your organization wants to deploy passwordless authentication. You have a mix of Windows 10 devices and mobile devices. You want to allow users to use Windows Hello for Business on their Windows devices and FIDO2 security keys on mobile devices. You also want to enforce MFA for all users. What is the best way to configure this?

   • AEnable only Windows Hello for Business and require users to use it on mobile devices.
   • BEnable both Windows Hello for Business and FIDO2 as authentication methods, and require MFA via conditional access.
   • CDisable MFA because passwordless methods are strong enough.
   • DEnable only FIDO2 and require users to use security keys on all devices.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are building a custom application that uses OAuth 2.0 to access Microsoft Graph. You want to ensure that the application can access resources on behalf of the signed-in user only when the user has granted consent. What type of OAuth 2.0 grant should you implement?

   • AAuthorization code flow with PKCE
   • BClient credentials flow
   • CDevice code flow
   • DImplicit flow
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You are configuring SSPR for your tenant. You want to ensure that users can reset their password using only their mobile phone number, but you also want to prevent users from using a phone number that is already used by another user. What should you configure?

   • AEnable SSPR and require two methods, including phone number and email, to prevent reuse.
   • BUse Microsoft Entra Password Protection to block duplicate phone numbers.
   • CDisable SSPR and use a manual password reset process to ensure uniqueness.
   • DEnable SSPR and set the number of methods required to 1, then configure the phone number as an allowed method. Use a custom script or policy to enforce uniqueness.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary function of the Microsoft Authenticator app in Microsoft Entra?

   • ATo provide a second factor for multifactor authentication and support passwordless sign-in
   • BTo manage user passwords and reset them when forgotten
   • CTo act as a VPN client for secure remote access
   • DTo store and manage certificate-based authentication credentials
   Reveal Solution Discussion Select an answer first