You have a Microsoft 365 tenant.All users have mobile phones and laptops.The users frequently work from remote locations that do not have Wi-Fi access or mobile phone connectivity. While working from the remote locations, the users connect their laptop to a wired network that has internet access.You plan to implement multi-factor authentication (MFA).Which MFA authentication method can the users use from the remote location?
Answer(s): A
The Authenticator app can be used as a software token to generate an OATH verification code. After entering your username and password, you enter the code provided by the Authenticator app into the sign-in interface.Incorrect Answers:B: Security questions are not used as an authentication method but can be used during the self-service password reset (SSPR) process.C, D: An automated voice call and an SMS requires mobile connectivity.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods
HOTSPOT (Drag and Drop is not supported) You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.User2 reports that he can only configure multi-factor authentication (MFA) to use the Microsoft Authenticator app.You need to ensure that User2 can configure alternate MFA methods.Which configuration is required, and which user should perform the configuration? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Modify security defaults.Privileged Authentication AdministratorUsers with this role can set or reset any authentication method (including passwords) for any user, including Global Administrators. Privileged AuthenticationAdministrators can force users to re-register against existing non-password credential (such as MFA or FIDO) and revoke 'remember MFA on the device', prompting for MFA on the next sign-in of all users.The Authentication Administrator role has permission to force re-registration and multifactor authentication for standard users and users with some admin roles.Box 2: User1 only.Security Administrator.Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Azure Active Directory Identity Protection, AzureActive Directory Authentication, Azure Information Protection, and Office 365 Security & Compliance Center.Incorrect:Not User3. Service Support Administrator.Users with this role can create and manage support requests with Microsoft for Azure and Microsoft 365 services, and view the service dashboard and message center in the Azure portal and Microsoft 365 admin center.
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
You have an Azure Active Directory (Azure AD) tenant.You configure self-service password reset (SSPR) by using the following settings:-Require users to register when signing in: Yes-Number of methods required to reset: 1What is a valid authentication method available to users?
Answer(s): C
When administrators require one method be used to reset a password, verification code is the only option available.Note: When administrators require two methods be used to reset a password, users are able to use notification OR verification code in addition to any other enabled methods.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks
You have an Azure Active Directory (Azure AD) tenant that uses Azure AD Identity Protection and contains the resources shown in the following table.Azure Multi-factor Authentication (MFA) is enabled for all users.User1 triggers a medium severity alert that requires additional investigation.You need to force User1 to reset his password the next time he signs in. The solution must minimize administrative effort.What should you do?
Answer(s): B
Scenario: User compromised (True positive)'Risky users' report shows an at-risk user [Risk state = At risk] with low risk [Risk level = Low] and that user was indeed compromised.Feedback: Select the user and click on 'Confirm user compromised'.What happens under the hood? Azure AD will move the user risk to High [Risk state = Confirmed compromised; Risk level = High] and will add a new detection'Admin confirmed user compromised'.Notes: Currently, the 'Confirm user compromised' option is only available in 'Risky users' report.The detection 'Admin confirmed user compromised' is shown in the tab 'Risk detections not linked to a sign-in' in the 'Risky users' report.
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-risk-feedback
HOTSPOT (Drag and Drop is not supported) You have an Azure Active Directory (Azure AD) tenant: that contains the users shown in the following table.In Azure. AD Identity Protection, you configure a user risk policy that has the following settings:-Assignments:- Users: Group1- User risk: Low and above-Controls:- Access: Block access-Enforce policy: OnIn Azure AD Identify Protection, you configure a sign-in risk policy that has the following settings:-Assignments:- Users: Group2- Sign-in risk: Low and above-Controls:- Access: Require multi-factor authentication-Enforce policy: OnFor each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Yes Note: Azure AD Identity Protection can review user sign-in attempts and take additional action if there's suspicious behavior:Some of the following actions may trigger Azure AD Identity Protection risk detection:Users with leaked credentials.* -> Sign-ins from anonymous IP addresses.Impossible travel to atypical locations.Sign-ins from infected devices.Sign-ins from IP addresses with suspicious activity.Sign-ins from unfamiliar locations.Box 2: No Box 3: No
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa
Post your Comments and Discuss Microsoft SC-300 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-300 content, but please register or login to continue.