HOTSPOT (Drag and Drop is not supported)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: NoBox 2: YesIdentity Protection detects risks of many types, including:Anonymous IP address use Atypical travelMalware linked IP address Unfamiliar sign-in properties Leaked credentials Password sprayand more...Box 3:YesThe risk signals can trigger remediation efforts such as requiring: perform multifactor authentication, reset their password using self-service password reset, or block access until an administrator takes action.
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
What can you use to ensure that all the users in a specific group must use multi-factor authentication (MFA) to sign in to Microsoft Entra?
Answer(s): C
Conditional Access: Require MFA for all usersCreate a Conditional Access policyThe following steps will help create a Conditional Access policy to require all users do multifactor authentication.1. Sign in to the Azure portal as a Global Administrator, Security Administrator, or Conditional Access Administrator.2. Browse to Microsoft Entra > Security > Conditional Access.3. Select New policy.4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.Under Assignments, select Users or workload identities. Under Include, select All usersUnder Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.Under Cloud apps or actions > Include, select All cloud apps.Under Exclude, select any applications that don't require multifactor authentication.7. Under Access controls > Grant, select Grant access, Require multifactor authentication, and select Select.8. Confirm your settings and set Enable policy to Report-only.9. Select Create to create to enable your policy.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all- users-mfa
Which Microsoft Entra ID feature can you use to evaluate group membership and automatically remove users that no longer require membership in a group?
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview
Box 1: YesMicrosoft’s identity solutions span on-premises and cloud-based capabilities. These solutions create a common user identity for authentication and authorization to all resources, regardless of location. We call this hybrid identity.With hybrid identity to Microsoft Entra ID and hybrid identity management these scenarios become possible.To achieve hybrid identity with Microsoft Entra ID, one of three authentication methods can be used, depending on your scenarios. The three methods are:Password hash synchronization (PHS) Pass-through authentication (PTA) Federation (AD FS)Note: Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity.Microsoft Entra Connect synchronizes a hash of a user's password from an on-premises Active Directory instance to a cloud-based Microsoft Entra instance.Box 2: NoNeed to configure password synchronization.The user accounts created on-premises would then be synchronized to the cloud.Box 3: YesFederated authenticationFederated authentication is primarily for large enterprise organizations with more complex authentication requirements. AD DS identities are synchronized with Microsoft 365 and users accounts are managed on- premises. With federated authentication, users have the same password on-premises and in the cloud and they do not have to sign in again to use Microsoft 365.For third-party authentication and identity providers, on-premises directory objects may be synchronized to Microsoft 365 and cloud resource access that are primarily managed by a third-party identity provider (IdP). If your organization uses a third-party federation solution, you can configure sign-on with that solution for Microsoft 365 provided that the third-party federation solution is compatible with Microsoft Entra ID.
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs https://learn.microsoft.com/en-us/microsoft-365/enterprise/deploy-identity-solution-identity-model?
Which three authentication methods can Microsoft Entra users use to reset their password? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.
Answer(s): A,B,C
Microsoft Entra self-service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement. If a user's account is locked or they forget their password, they can follow prompts to unblock themselves and get back to work. This ability reduces help desk calls and loss of productivity when a user can't sign in to their device or an application.Authentication methodsWhen a user is enabled for SSPR, they must register at least one authentication method. We highly recommend that you choose two or more authentication methods so that your users have more flexibility in case they're unable to access one method when they need it. For more information, see What are authentication methods?.The following authentication methods are available for SSPR: Mobile app notificationMobile app code EmailMobile phoneOffice phone (available only for tenants with paid subscriptions) Security questionsUsers can only reset their password if they have registered an authentication method that the administrator has enabled.Note: Select authentication methods and registration optionsWhen users need to unlock their account or reset their password, they're prompted for another confirmation method. This extra authentication factor makes sure that Microsoft Entra ID finished only approved SSPR events. You can choose which authentication methods to allow, based on the registration information the user provides.From the menu on the left side of the Authentication methods page, set the Number of methods required to reset to 2.To improve security, you can increase the number of authentication methods required for SSPR.Choose the Methods available to users that your organization wants to allow. For this tutorial, check the boxes to enable the following methods:Mobile app notification Mobile app code EmailMobile phoneYou can enable other authentication methods, like Office phone or Security questions, as needed to fit your business requirements.3. To apply the authentication methods, select Save.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr
Post your Comments and Discuss Microsoft SC-900 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-900 content, but please register or login to continue.