Plan, Implement, and Manage Microsoft Entra User Authentication SC-300 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of certificate-based authentication (CBA) in Microsoft Entra?

   • ATo encrypt all network traffic between the user and Microsoft Entra
   • BTo manage the lifecycle of certificates issued by external CAs
   • CTo allow users to sign in using a smart card or a certificate on a device
   • DTo replace the need for conditional access policies
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   Your company wants to enforce a custom banned password list to prevent users from using common company-specific terms like the company name and product names. You also want to ensure that password changes are checked against this list. What should you configure?

   • AUse a conditional access policy to block password changes from non-compliant devices.
   • BConfigure SSPR to require a custom security question instead of a password.
   • CCreate a custom banned password list in Microsoft Entra Password Protection and enable enforcement for the tenant.
   • DSet the tenant-wide MFA policy to require MFA for all password changes.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of Windows Hello for Business?

   • ATo manage device compliance policies
   • BTo synchronize user passwords between on-premises and cloud
   • CTo provide a passwordless sign-in experience using biometrics or PIN on Windows devices
   • DTo provide a VPN connection for remote users
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is rolling out Microsoft Entra multifactor authentication (MFA) to all users. The security team wants to enforce MFA for all users but allow a grace period for users who have not yet registered their authentication methods. The help desk needs a way to provide temporary access to users who lose their phone while traveling. What should you configure?

   • AConfigure a conditional access policy requiring MFA for all users and set the grace period to 7 days. Use a temporary password for phone loss.
   • BEnable MFA registration campaign and set the grace period to 14 days. Issue Temporary Access Passes for users who lose their phone.
   • CSet MFA to 'Enabled' and require users to register via the Authenticator app. Use a second phone number for backup.
   • DEnable MFA with 'Remember MFA on trusted devices' and set the grace period to 30 days. Use a one-time bypass for phone loss.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are planning to deploy passkeys (FIDO2) for a group of users who use Windows 10 devices. The tenant currently requires MFA for all users. What is the minimum configuration needed to allow these users to sign in with a FIDO2 security key?

   • ACreate a Temporary Access Pass for each user to use during the FIDO2 registration process.
   • BDisable MFA for the FIDO2 users because the security key already provides strong authentication.
   • CInstall the Microsoft Authenticator app on each user's device and link it to the security key.
   • DEnable FIDO2 as an authentication method and configure the key restrictions policy to allow the specific security key models.
   Reveal Solution Discussion Select an answer first