ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-300 All Questions

View all questions & answers for the SC-300 exam
Go to Exam

Exam SC-300 topic 2 question 55 discussion

Actual exam question from Microsoft's SC-300
Question #: 55
Topic #: 2
[All SC-300 Questions]

HOTSPOT -


Case Study -


Overview -

ADatum Corporation is a consulting company in Montreal.

ADatum recently acquired a Vancouver-based company named Litware, Inc.

Existing Environment. ADatum Environment

The on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.

ADatum has a Microsoft 365 E5 subscription. The subscription contains a verified domain that syncs with the adatum.com AD DS domain by using Azure AD Connect.

ADatum has an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant has Security defaults disabled.

The tenant contains the users shown in the following table.



The tenant contains the groups shown in the following table.



Existing Environment. Litware Environment

Litware has an AD DS forest named litware.com

Existing Environment. Problem Statements

ADatum identifies the following issues:

• Multiple users in the sales department have up to five devices. The sales department users report that sometimes they must contact the support department to join their devices to the Azure AD tenant because they have reached their device limit.
• A recent security incident reveals that several users leaked their credentials, a suspicious browser was used for a sign-in, and resources were accessed from an anonymous IP address.
• When you attempt to assign the Device Administrators role to IT_Group1, the group does NOT appear in the selection list.
• Anyone in the organization can invite guest users, including other guests and non-administrators.
• The helpdesk spends too much time resetting user passwords.
• Users currently use only passwords for authentication.


Requirements. Planned Changes -

ADatum plans to implement the following changes:

• Configure self-service password reset (SSPR).
• Configure multi-factor authentication (MFA) for all users.
• Configure an access review for an access package named Package1.
• Require admin approval for application access to organizational data.
• Sync the AD DS users and groups of litware.com with the Azure AD tenant.
• Ensure that only users that are assigned specific admin roles can invite guest users.
• Increase the maximum number of devices that can be joined or registered to Azure AD to 10.

Requirements. Technical Requirements

ADatum identifies the following technical requirements:

• Users assigned the User administrator role must be able to request permission to use the role when needed for up to one year.
• Users must be prompted to register for MFA and provided with an option to bypass the registration for a grace period.
• Users must provide one authentication method to reset their password by using SSPR. Available methods must include:
- Email
- Phone
- Security questions
- The Microsoft Authenticator app
• Trust relationships must NOT be established between the adatum.com and litware.com AD DS domains.
• The principle of least privilege must be used.


You implement the planned changes for SSPR.

What occurs when User3 attempts to use SSPR? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer:
by marsot at July 22, 2023, 7:28 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
marsot
Highly Voted 1 year, 9 months ago
User 3 is a User Admin. So, Box 1: 2 Why: By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. Box 2: Email, phone and Microsoft Authenticator only Why: The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number, and it prohibits security questions. A two-gate policy applies in the following circumstances: ..... Security administrator Service support administrator SharePoint administrator Skype for Business administrator User administrator Source:https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences
upvoted 30 times
Fijii
2 months ago
This is correct, under SSPR in Entra, it is said : These settings only apply to end users in your organization. Admins are always enabled for self-service password reset and are required to use two authentication methods to reset their password. Click here to learn more about administrator password policies.
upvoted 1 times
...
Shivz0903
9 months ago
It says security defaults are disabled, does this not make a difference?
upvoted 1 times
...
SFAY
1 year, 3 months ago
You have missed the sentence following what you quoted. The full text goes like this - By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. Therefore, the two gate policy applies to admin roles, is enforced, can't be changed and is independent of the actual policy defined for the users. Why would you need 2 auth methods when the requirement clearly asks for 1?
upvoted 2 times
armid
2 months, 2 weeks ago
because the requirements stated in the questions apply for "users" not administrators
upvoted 1 times
...
...
...
SFAY
Highly Voted 1 year, 3 months ago
I tested and set Auth method as '1' and checked email, phone, MS App Code & security questions as available options for users. However, SSPR presented only one option i.e MS Auth App code for pwd reset. I tested both with a normal user and with 'User Admin' role and the result was same i.e no two gate thing as mentioned in some of the comments. Therefore, based on my testing and the results I got the answers are '1' & MS App only'. Please test it out yourself before blindly following others. If you ask why 1 and not 2 auth methods, then please note that the requirement is that: Users must provide ONE authentication method to reset their password by using SSPR. If MS Auth is selected as one of the authentication options, then it appears that Azure prefers it over all other possible options.
upvoted 9 times
survivor
5 months ago
Exceptions A one-gate policy requires one piece of authentication data, such as an email address or phone number. A one-gate policy applies in the following circumstances: It's within the first 30 days of a trial subscription -Or- A custom domain isn't configured (the tenant is using the default *.onmicrosoft.com, which isn't recommended for production use) and Microsoft Entra Connect isn't synchronizing identities.
upvoted 1 times
...
ANiMOSiTYOP
1 year, 1 month ago
The word "and" in the phrase "Email, Phone, Microsoft Authenticator, and Security Questions" could be potentially misleading. The word "or" would be more appropriate because the users are supposed to choose only one method among these for authentication. So I'd agree with MS prefers "Microsoft Authenticator only" probably as the best answer.
upvoted 1 times
...
...
d1e85d9
Most Recent 1 month, 2 weeks ago
Correct Answer: Number of Auth Method: => 1 Auth Method CAN BE use: => Email, Phone, & The Microsoft Authenticator app Because Admin canot use security question as authenticaiton method for SSPR.
upvoted 1 times
...
Arash123
5 months, 1 week ago
It has to be 2 methods for admins. This is what I see on Authentication methods blade for SSPR: These settings only apply to end users in your organization. Admins are always enabled for self-service password reset and are required to use two authentication methods to reset their password. Click here to learn more about administrator password policies. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#administrator-password-policy-differences
upvoted 1 times
...
emartiy
1 year, 1 month ago
1 method since quetion asks for and Email,Phone,MFA selection can be chosen except Security Questions. Admins can't use it for SSPR. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-security-questions
upvoted 2 times
survivor
5 months ago
Exceptions A one-gate policy requires one piece of authentication data, such as an email address or phone number. A one-gate policy applies in the following circumstances: It's within the first 30 days of a trial subscription -Or- A custom domain isn't configured (the tenant is using the default *.onmicrosoft.com, which isn't recommended for production use) and Microsoft Entra Connect isn't synchronizing identities.
upvoted 1 times
...
...
hw121693
1 year, 9 months ago
I think authen methods should be 2, password + one of those MFA methods
upvoted 1 times
...
Peeeedor
1 year, 9 months ago
I would go for: Number of authentication methods required : 1 Authentication methods that can be used: Email, phone and MS authenticator I picked this option because admins are prohibited from using the "security questions option" Source: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences Read this part: Administrator reset policy differences By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number, and it prohibits security questions.
upvoted 3 times
JCkD4Ni3L
1 year, 6 months ago
You are contradicting yourself :)
upvoted 5 times
...
...
marsot
1 year, 9 months ago
Box 1: 2 Box 2: Email, phone and Microsoft Authenticator only By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences
upvoted 7 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago