Microsoft SC-300 Bundle

When a manager confuses security defaults with granular per-application Conditional Access controls, Choose Conditional Access for tailored app, user, and condition-specific enforcement is justified because security defaults offer baseline protections but not the targeted policy design available through Conditional Access; here the issue is a compromised user's current sessions must be interrupted as part of containment, and Disable the account and revoke sign-in sessions with the incident workflow addresses that distinction.

The distinct mechanism for Review and remove obsolete authentication methods while registering the current method is that stale MFA methods expand the set of credentials that could accidentally satisfy challenges; this handles the user has multiple stale Authenticator device registrations after repeated phone replacements rather than a compromised user's current sessions must be interrupted as part of containment, so use Disable the account and revoke sign-in sessions with the incident workflow.

Although Issue a scoped recovery Temporary Access Pass under the approved enrollment process fits the user lost a FIDO2 key and needs to register a replacement without changing the entire tenant method policy (tAP can bootstrap a replacement authentication method when an allowed recovery path is needed), it is not the necessary control for a compromised user's current sessions must be interrupted as part of containment. Select Disable the account and revoke sign-in sessions with the incident workflow.

The distinct mechanism for Review SSPR number-of-methods and method eligibility settings is that recovery factors must match the approved security policy without imposing unsupported registration assumptions; this handles employees are prompted for too many recovery methods compared with the policy requirements rather than the user lost a FIDO2 key and needs to register a replacement without changing the entire tenant method policy, so use Issue a scoped recovery Temporary Access Pass under the approved enrollment process.

Although Require a FIDO2 or other supported phishing-resistant method for the targeted application fits a legacy sign-in insists that a phone number is a sufficient phishing-resistant factor (telecom-based factors are not equivalent to cryptographic origin-bound authentication), it is not the necessary control for the user lost a FIDO2 key and needs to register a replacement without changing the entire tenant method policy. Select Issue a scoped recovery Temporary Access Pass under the approved enrollment process.

Review and remove obsolete authentication methods while registering the current method would support the different situation where the user has multiple stale Authenticator device registrations after repeated phone replacements: stale MFA methods expand the set of credentials that could accidentally satisfy challenges; however it does not resolve the user lost a FIDO2 key and needs to register a replacement without changing the entire tenant method policy, which calls for Issue a scoped recovery Temporary Access Pass under the approved enrollment process.

The distinct mechanism for Disable the account and revoke sign-in sessions with the incident workflow is that revocation and account status together reduce further use of issued credentials after compromise; this handles a compromised user's current sessions must be interrupted as part of containment rather than the user has multiple stale Authenticator device registrations after repeated phone replacements, so use Review and remove obsolete authentication methods while registering the current method.

Although Investigate sign-in events and protect against MFA fatigue with approved prompt safeguards fits a fraud team detects repeated Authenticator push prompts for a targeted employee (repeated unrequested prompts are a potential attack pattern and require more than adding extra application roles), it is not the necessary control for the user has multiple stale Authenticator device registrations after repeated phone replacements. Select Review and remove obsolete authentication methods while registering the current method.

Telecom-based factors are not equivalent to cryptographic origin-bound authentication, which makes Require a FIDO2 or other supported phishing-resistant method for the targeted application appropriate when a legacy sign-in insists that a phone number is a sufficient phishing-resistant factor; here the task is the user has multiple stale Authenticator device registrations after repeated phone replacements, requiring Review and remove obsolete authentication methods while registering the current method.

Although Disable the account and revoke sign-in sessions with the incident workflow fits a compromised user's current sessions must be interrupted as part of containment (revocation and account status together reduce further use of issued credentials after compromise), it is not the necessary control for the incident team must determine if a recent sign-in actually satisfied the intended MFA method. Select Inspect the authentication details of the relevant Entra sign-in event.

Compare registration and sign-in method reports over time would support the different situation where the security team needs to monitor passwordless rollout adoption over several weeks: usage and registration metrics expose whether strong methods are actively replacing legacy options; however it does not resolve the incident team must determine if a recent sign-in actually satisfied the intended MFA method, which calls for Inspect the authentication details of the relevant Entra sign-in event.

When the user lost a FIDO2 key and needs to register a replacement without changing the entire tenant method policy, Issue a scoped recovery Temporary Access Pass under the approved enrollment process is justified because tAP can bootstrap a replacement authentication method when an allowed recovery path is needed; here the issue is the incident team must determine if a recent sign-in actually satisfied the intended MFA method, and Inspect the authentication details of the relevant Entra sign-in event addresses that distinction.

Security defaults offer baseline protections but not the targeted policy design available through Conditional Access, which makes Choose Conditional Access for tailored app, user, and condition-specific enforcement appropriate when a manager confuses security defaults with granular per-application Conditional Access controls; here the task is agents should be nudged to register Microsoft Authenticator where it is permitted, requiring Configure a scoped Microsoft Authenticator registration campaign.

When the user lost a FIDO2 key and needs to register a replacement without changing the entire tenant method policy, Issue a scoped recovery Temporary Access Pass under the approved enrollment process is justified because tAP can bootstrap a replacement authentication method when an allowed recovery path is needed; here the issue is agents should be nudged to register Microsoft Authenticator where it is permitted, and Configure a scoped Microsoft Authenticator registration campaign addresses that distinction.

Apply an authentication strength requirement scoped to the department's Conditional Access policy concerns one department must use stronger authentication methods than the general workforce, where authentication strengths express allowed methods for access to protected resources; the current scenario instead requires agents should be nudged to register Microsoft Authenticator where it is permitted, so Configure a scoped Microsoft Authenticator registration campaign is a closer fit.

Security defaults offer baseline protections but not the targeted policy design available through Conditional Access, which makes Choose Conditional Access for tailored app, user, and condition-specific enforcement appropriate when a manager confuses security defaults with granular per-application Conditional Access controls; here the task is agents using shared terminals must still meet the organization's approved authentication requirements, requiring Require the policy's accepted authentication methods rather than bypassing MFA for the device category.

Configure a scoped Microsoft Authenticator registration campaign concerns agents should be nudged to register Microsoft Authenticator where it is permitted, where registration campaigns encourage method enrollment separately from authentication-enforcement policies; the current scenario instead requires agents using shared terminals must still meet the organization's approved authentication requirements, so Require the policy's accepted authentication methods rather than bypassing MFA for the device category is a closer fit.

The distinct mechanism for Apply the approved sign-out and session termination process for the former worker is that residual device sessions can preserve access after the physical device passes to the next employee; this handles the shared device should not retain a departing operator's registered authentication session rather than agents using shared terminals must still meet the organization's approved authentication requirements, so use Require the policy's accepted authentication methods rather than bypassing MFA for the device category.

When the incident team must determine if a recent sign-in actually satisfied the intended MFA method, Inspect the authentication details of the relevant Entra sign-in event is justified because sign-in detail shows method outcomes and authentication requirements more accurately than an account's registered-method list; here the issue is one department must use stronger authentication methods than the general workforce, and Apply an authentication strength requirement scoped to the department's Conditional Access policy addresses that distinction.

Configure a scoped Microsoft Authenticator registration campaign concerns agents should be nudged to register Microsoft Authenticator where it is permitted, where registration campaigns encourage method enrollment separately from authentication-enforcement policies; the current scenario instead requires one department must use stronger authentication methods than the general workforce, so Apply an authentication strength requirement scoped to the department's Conditional Access policy is a closer fit.

The distinct mechanism for Require the policy's accepted authentication methods rather than bypassing MFA for the device category is that shared device context does not authenticate a unique human identity by itself; this handles agents using shared terminals must still meet the organization's approved authentication requirements rather than one department must use stronger authentication methods than the general workforce, so use Apply an authentication strength requirement scoped to the department's Conditional Access policy.

Enforce an appropriate phishing-resistant authentication strength for privileged access concerns a security architect wants to prevent ordinary SMS OTP from satisfying a high-risk administrative session, where a general second factor can be insufficient where token phishing resistance is explicitly required; the current scenario instead requires a manager confuses security defaults with granular per-application Conditional Access controls, so Choose Conditional Access for tailored app, user, and condition-specific enforcement is a closer fit.

Although Require the policy's accepted authentication methods rather than bypassing MFA for the device category fits agents using shared terminals must still meet the organization's approved authentication requirements (shared device context does not authenticate a unique human identity by itself), it is not the necessary control for a manager confuses security defaults with granular per-application Conditional Access controls. Select Choose Conditional Access for tailored app, user, and condition-specific enforcement.

Apply an authentication strength requirement scoped to the department's Conditional Access policy would support the different situation where one department must use stronger authentication methods than the general workforce: authentication strengths express allowed methods for access to protected resources; however it does not resolve a manager confuses security defaults with granular per-application Conditional Access controls, which calls for Choose Conditional Access for tailored app, user, and condition-specific enforcement.

The distinct mechanism for Troubleshoot password writeback status and the connector's authorization to update AD is that a cloud recovery action needs a configured writeback channel to update the on-premises authority; this handles the on-premises password remains unchanged after successful cloud reset rather than users should reset cloud-managed passwords without calling the administrator, so use Enable appropriately scoped SSPR and verify their registered recovery methods.

Although Review available SSPR reporting or audit records for failed reset operations fits the service desk needs evidence of how many resets ended unsuccessfully (recovery events are recorded separately from normal interactive application sign-in success), it is not the necessary control for users should reset cloud-managed passwords without calling the administrator. Select Enable appropriately scoped SSPR and verify their registered recovery methods.

Require proper passkey registration on a supported authenticator before enforcing that method would support the different situation where the security officer expects an unknown legacy device to satisfy a FIDO2-only login without enrollment: a strong method can only be used after the user has a working registered credential; however it does not resolve users should reset cloud-managed passwords without calling the administrator, which calls for Enable appropriately scoped SSPR and verify their registered recovery methods.

Although Review SSPR number-of-methods and method eligibility settings fits employees are prompted for too many recovery methods compared with the policy requirements (recovery factors must match the approved security policy without imposing unsupported registration assumptions), it is not the necessary control for the on-premises password remains unchanged after successful cloud reset. Select Troubleshoot password writeback status and the connector's authorization to update AD.

Enable appropriately scoped SSPR and verify their registered recovery methods would support the different situation where users should reset cloud-managed passwords without calling the administrator: sSPR requires both user policy eligibility and enough approved verification information; however it does not resolve the on-premises password remains unchanged after successful cloud reset, which calls for Troubleshoot password writeback status and the connector's authorization to update AD.

When faculty should reset a forgotten password after satisfying approved verification methods, Configure self-service password reset scope and accepted verification methods is justified because sSPR securely lets in-scope users complete password recovery with configured authentication proof; here the issue is the on-premises password remains unchanged after successful cloud reset, and Troubleshoot password writeback status and the connector's authorization to update AD addresses that distinction.

A cloud recovery action needs a configured writeback channel to update the on-premises authority, which makes Troubleshoot password writeback status and the connector's authorization to update AD appropriate when the on-premises password remains unchanged after successful cloud reset; here the task is employees are prompted for too many recovery methods compared with the policy requirements, requiring Review SSPR number-of-methods and method eligibility settings.

When agents using shared terminals must still meet the organization's approved authentication requirements, Require the policy's accepted authentication methods rather than bypassing MFA for the device category is justified because shared device context does not authenticate a unique human identity by itself; here the issue is employees are prompted for too many recovery methods compared with the policy requirements, and Review SSPR number-of-methods and method eligibility settings addresses that distinction.

Review available SSPR reporting or audit records for failed reset operations concerns the service desk needs evidence of how many resets ended unsuccessfully, where recovery events are recorded separately from normal interactive application sign-in success; the current scenario instead requires employees are prompted for too many recovery methods compared with the policy requirements, so Review SSPR number-of-methods and method eligibility settings is a closer fit.