exam questions

Exam AZ-104 All Questions

View all questions & answers for the AZ-104 exam

Exam AZ-104 topic 6 question 12 discussion

Actual exam question from Microsoft's AZ-104
Question #: 12
Topic #: 6
[All AZ-104 Questions]

HOTSPOT -
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant is synced to the on-premises Active
Directory domain. The domain contains the users shown in the following table.

You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:
✑ Number of methods required to reset: 2
✑ Methods available to users: Mobile phone, Security questions
✑ Number of questions required to register: 3
✑ Number of questions required to reset: 3
You select the following security questions:
✑ What is your favorite food?
✑ In what city was your first job?
✑ What was the name of your first pet?
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer Hide Answer
Suggested Answer:
Box 1: No -
Administrator accounts are special accounts with elevated permissions. To secure them, the following restrictions apply to changing passwords of administrators:
On-premises enterprise administrators or domain administrators cannot reset their password through Self-service password reset (SSPR). They can only change their password in their on-premises environment. Thus, we recommend not syncing on-prem AD admin accounts to Azure AD. An administrator cannot use secret
Questions & Answers as a method to reset password.

Box 2: Yes -
Self-service password reset (SSPR) is an Azure Active Directory feature that enables employees to reset their passwords without needing to contact IT staff.

Box 3: Yes -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Mozbius_
Highly Voted 2 years, 7 months ago
By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. With a two-gate policy, administrators don't have the ability to use security questions. The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-password-policy-differences Therefore I would say N N Y as SecAdmin1 and BillAdmin1 are both administrators. NOTE: I have tried to test in lab but was unsuccessful (somehow SSPR isn't even recognized as being enabled, hell one of the user is taking forever to show an updated assigned role).
upvoted 72 times
Mtijnz0r
2 years, 7 months ago
SSPR for Administrators isn't enabled on the tenant. SSPR for Administrators (SSPR-A) was the first implementation of SSPR. After SSPR for Users (SSPR-U) was introduced, users could have two separate configurations. The old SSPR-A implementation is used when an Azure AD account has an admin role, such as Global Administrator or Billing Administrator. However, the SSPR management on the Azure portal is for SSPR-U only. Therefore, SSPR-A might not be enabled on the tenant. https://docs.microsoft.com/en-us/troubleshoot/azure/active-directory/password-writeback-error-code-sspr-009
upvoted 4 times
...
Citmerian
2 years, 1 month ago
Answer: NO, NO, YES https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. With a two-gate policy, administrators don't have the ability to use security questions. The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number.
upvoted 17 times
AzureMasterChamp
1 year, 9 months ago
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy
upvoted 1 times
...
...
...
awssecuritynewbie
Highly Voted 2 years, 2 months ago
So after some research it does look like "Security questions aren't used as an authentication method during a sign-in event. Instead, security questions can be used during the self-service password reset (SSPR) process to confirm who you are. Administrator accounts can't use security questions as verification method with SSPR." so it means the administrator cannot use security questions as verification method for SSPR. so it would be N N Y . check the link the first line of the link. PLEASE LIKE THIS COMMENT Ref https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions
upvoted 50 times
DonVish
1 year, 11 months ago
So it SSPR is not used for any kind of administrator ? Global , Local ..etc. ?
upvoted 1 times
Lexxsuse
1 year, 11 months ago
Admins CAN use SSPR. But they can not use security questions to reset passwords.
upvoted 6 times
...
...
ki01
11 months, 3 weeks ago
LIKE SHARE AND SUBSCRIBE!
upvoted 3 times
...
...
SeMo0o0o0o
Most Recent 1 month, 1 week ago
WRONG No No Yes
upvoted 1 times
...
roses2021
4 months, 2 weeks ago
NNY Refer to Microsoft article: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#administrator-password-policy-differences
upvoted 2 times
...
Ottris
6 months, 2 weeks ago
Number of methods required to reset the password is 2. N N N
upvoted 1 times
Josh219
6 days, 19 hours ago
Correct is NO, NO, YES
upvoted 1 times
...
...
Amir1909
9 months, 3 weeks ago
No No Yes
upvoted 2 times
...
TripleFires
10 months ago
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#administrator-password-policy-differences >>> The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number, and it prohibits security questions. Office and mobile voice calls are also prohibited for trial or free versions of Microsoft Entra ID. A two-gate policy applies in the following circumstances: All the following Azure administrator roles are affected: Application administrator Application proxy service administrator Authentication administrator Billing administrator ...... Security administrator
upvoted 4 times
MatAlves
9 months, 4 weeks ago
So N-N-Y?
upvoted 1 times
bobothewiseman
8 months, 2 weeks ago
Yes. Its N N Y Administrators (includes Security and Billing) requires 2 gate policy, excluding Security questions .
upvoted 2 times
...
...
...
PhoenixAscending
10 months, 1 week ago
This was on my exam. I think the correct answer is provided by Mozbius.
upvoted 1 times
...
KM
1 year, 3 months ago
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment NYY
upvoted 1 times
...
oopspruu
1 year, 3 months ago
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences NNY
upvoted 3 times
...
Josete1106
1 year, 4 months ago
N N Y is correct!
upvoted 1 times
...
NurSalman
1 year, 5 months ago
How can you have this question wrong?
upvoted 2 times
...
kmsalman
1 year, 7 months ago
Number of security questions required to reset password is 3. My opinion is that user can also not self reset the password by answering just one question. So the Answer should be N, N, N
upvoted 2 times
Elecktrus
1 year, 3 months ago
Re-read the question. They are asking about if user1 will have to answer this question (but no ONLY this question). Of course user1 must answer the 2 qustions. They are not asking about reset password, but answer that question
upvoted 1 times
...
...
zellck
1 year, 9 months ago
NNY is the answer. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. With a two-gate policy, administrators don't have the ability to use security questions. All the following Azure administrator roles are affected: - Billing administrator - Security administrator
upvoted 8 times
...
RougePotatoe
1 year, 9 months ago
N N Y "Administrator accounts can't use security questions as verification method with SSPR." https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions
upvoted 3 times
...
LauLauLauw
1 year, 10 months ago
NNY https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences This link shows the list of administrators that arre not able to use security questions.
upvoted 3 times
...
azhunter
1 year, 11 months ago
Answer is NNY
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...