HOTSPOT (Drag and Drop is not supported)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: YesAzure Active Directory B2C provides business-to-customer identity as a service. Your customers use their preferred social, enterprise, or local account identities to get single sign-on access to your applications and APIs.Box 2: NoAzure AD B2C is a separate service from Microsoft Entra ID. It is built on the same technology as Microsoft Entra ID but for a different purpose. It allows businesses to build customer facing applications, and then allow anyone to sign up into those applications with no restrictions on user account.Box 3: YesCustom-branded identity solutionAzure AD B2C is a white-label authentication solution. You can customize the entire user experience with your brand so that it blends seamlessly with your web and mobile applications.Customize every page displayed by Azure AD B2C when your users sign up, sign in, and modify their profile information. Customize the HTML, CSS, and JavaScript in your user journeys so that the Azure AD B2C experience looks and feels like it's a native part of your application.
https://learn.microsoft.com/en-us/azure/active-directory-b2c/overview
Box 1: NoSoftware tokens is a time-based one-time passcodes (TOTP) solution.Microsoft Authenticator, which is a passwordless solution, uses software tokens though. Note: Authentication methods in Microsoft Entra ID - OATH tokensOATH TOTP (Time-based One Time Password) is an open standard that specifies how one-time password (OTP) codes are generated. OATH TOTP can be implemented using either software or hardware to generate the codes. Microsoft Entra ID doesn't support OATH HOTP, a different code generation standard.OATH software tokensSoftware OATH tokens are typically applications such as the Microsoft Authenticator app and other authenticator apps. Microsoft Entra ID generates the secret key, or seed, that's input into the app and used to generate each OTP.Box 2: YesEach organization has different needs when it comes to authentication. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Microsoft Entra ID:Windows Hello for Business Microsoft AuthenticatorFIDO2 security keys Box 3: Yes
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens
Box 1: NoWho should use Conditional Access?If you're an organization currently using Conditional Access policies, security defaults are probably not right for you.If you're an organization with Microsoft Entra Premium licenses, security defaults are probably not right for you.Box 2: NoEnabling security defaultsIf your tenant was created on or after October 22, 2019, security defaults may be enabled in your tenant. To protect all of our users, security defaults are being rolled out to all new tenants at creation.To enable security defaults in your directory:1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.2. Browse to Microsoft Entra > Properties.3. Select Manage security defaults.4. Set Security defaults to **Enabled **.5. Select Save.Box 3: YesEnforced security policiesRequire all users to register for Microsoft Entra Multifactor AuthenticationAll users in your tenant must register for multifactor authentication (MFA) in the form of the A Microsoft Entra Multifactor Authentication. Users have 14 days to register for Microsoft Entra Multifactor Authentication by using the Microsoft Authenticator app or any app supporting OATH TOTP. After the 14 days have passed, the user can't sign in until registration is completed. A user's 14-day period begins after their first successful interactive sign-in after enabling security defaults.Require administrators to do multifactor authenticationAdministrators have increased access to your environment. Because of the power these highly privileged accounts have, you should treat them with special care. One common method to improve the protection of privileged accounts is to require a stronger form of account verification for sign-in. In Microsoft Entra ID, you can get a stronger account verification by requiring multifactor authentication.TipRecommendations for your admins:Ensure all your admins sign in after enabling security defaults so that they can register for authentication methods.Have separate accounts for administration and standard productivity tasks to significantly reduce the number of times your admins are prompted for MFA.
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults
Which three forms of verification can be used with Microsoft Entra Multi-Factor Authentication (MFA)? Each correct answer presents a complete solution.NOTE: Each correct answer is worth one point.
Answer(s): B,C,E
Available verification methodsWhen users sign in to an application or service and receive an MFA prompt, they can choose from one of their registered forms of additional verification. Users can access My Profile to edit or add verification methods.The following additional forms of verification can be used with Microsoft Entra Multi-Factor Authentication:* Microsoft Authenticator Authenticator Lite (in Outlook)Windows Hello for Business FIDO2 security keyOATH hardware token (preview) OATH software tokenSMSVoice call
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
Box 1: YesSelect authentication methods and registration optionsWhen users need to unlock their account or reset their password, they're prompted for another confirmation method. This extra authentication factor makes sure that Microsoft Entra ID finished only approved SSPR events. You can choose which authentication methods to allow, based on the registration information the user provides.The following authentication methods are available for SSPR: Mobile app notificationMobile app codeEmail Mobile phoneOffice phone (available only for tenants with paid subscriptions) Security questionsBox 2: YesThe following authentication methods are available for SSPR:Mobile app notification (Authenticator app) Mobile app codeEmailMobile phoneOffice phone (available only for tenants with paid subscriptions) Security questionsNote: The Authenticator app can't be selected as the only authentication method when only one method is required. Similarly, the Authenticator app and only one additional method cannot be selected when requiring two methods.When configuring SSPR policies that include the Authenticator app as a method, at least one additional method should be selected when one method is required, and at least two additional methods should be selected when configuring two methods are required.This requirement is because the current SSPR registration experience doesn't include the option to register the authenticator app. The option to register the authenticator app is included with the new combined registration experience.Allowing policies that only use the Authenticator app (when one method is required), or the Authenticator app and only one additional method (when two methods are required), could lead to users being blocked from registering for SSPR until they're configured to use the new combined registration experience.Box 3: NoHow does the password reset process work?A user can reset or change their password using the SSPR portal. They must first have registered their desired authentication methods. When a user accesses the SSPR portal, the Azure platform considers the following factors:How should the page be localized? Is the user account valid?What organization does the user belong to? Where is the user's password managed?After the SSPR portal is displayed in the required language, the user is prompted to enter a user ID and pass a captcha. Microsoft Entra ID now verifies that the user is able to use SSPR by doing the following checks:Checks that the user has SSPR enabledChecks that the user has the right authentication methods defined on their account in accordance with administrator policy.* Checks to see if the user's password is managed on-premises, such as if the Microsoft Entra tenant is using federated, pass-through authentication, or password hash synchronizationIf all of the previous checks are successfully completed, the user is guided through the process to reset or change their password.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks
Post your Comments and Discuss Microsoft SC-900 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-900 content, but please register or login to continue.