SkillTestPro | SC-900 Practice Test 19 Hard Questions

SC-900 Exam Practice Test 19 (Hard) - Authentication Methods Deep-Dive

SC-900 Exam Practice Tests

1 / 15

Which authentication factor category does a password belong to?

Something you have

Something you are

Something you know

Somewhere you are

Something you do

Someone you know

2 / 15

Which authentication factor category does a physical FIDO2 security key or a smart card belong to?

Something you know

Something you are

Something you have

Somewhere you are

Something you do

Someone you know

3 / 15

Which authentication factor category does a fingerprint or facial recognition scan belong to?

Something you know

Something you have

Something you are

Somewhere you are

Something you do

Someone you know

4 / 15

Why does combining a password with a code from an authenticator app provide stronger security than a password alone?

It requires no additional factor beyond the password itself

It relies solely on a single factor category repeated twice

It requires the attacker to compromise two different factor categories (something you know and something you have), rather than just one

It eliminates the need for any password at all

It only strengthens security if the password is changed daily

It provides no meaningful security improvement over a password alone

5 / 15

Which Microsoft Authenticator app capability allows a user to approve or deny a sign-in attempt with a simple tap, rather than manually typing a numeric code?

SMS-based one-time codes alone

Voice call verification alone

Push notifications

FIDO2 security key tap alone

Windows Hello for Business alone

Certificate-based authentication alone

6 / 15

Which authentication method is generally considered LESS secure than app-based push notifications or FIDO2 keys, due to vulnerabilities like SIM-swapping attacks?

FIDO2 security keys

Windows Hello for Business

SMS-based one-time codes

Microsoft Authenticator app push notifications

Certificate-based authentication

Passkeys

7 / 15

Which modern authentication credential is a passwordless, phishing-resistant credential based on FIDO standards that can be synced across a user's devices via a platform provider?

An SMS-based one-time code, which relies on a shared secret sent over a potentially insecure channel

A traditional static password

A passkey

A security question, which relies on potentially guessable or researchable information

A PIN alone, without an underlying FIDO-based cryptographic credential

A CAPTCHA, which verifies a human user rather than serving as an authentication credential

8 / 15

Which term describes an authentication method considered resistant to phishing because it does not involve a shared secret, such as a password or one-time code, that could be intercepted or tricked out of a user?

An SMS-based one-time code, which relies on a value that can potentially be intercepted or socially engineered

A traditional static password, which can be phished directly

A phishing-resistant authentication method (such as FIDO2 keys, certificate-based authentication, or passkeys)

A security question, which can be researched or guessed

An email-based magic link alone, without additional phishing-resistant protections

A voice call verification code alone

9 / 15

Which term describes the requirement that a specific application or scenario mandates stronger authentication factors before granting access, such as requiring a FIDO2 key for accessing highly sensitive financial systems?

Authorization alone, which determines permitted actions rather than the strength of the authentication method used

Federation alone

Authentication strength

Single sign-on alone

Password hash synchronization alone

Self-service password reset alone

10 / 15

Which certificate-based authentication use case allows an organization to authenticate users based on a digital certificate installed on their device, without relying on a password at all?

SMS-based one-time codes, which rely on a shared secret sent via text rather than a certificate

Traditional password authentication, which relies on a shared secret rather than a certificate

Certificate-based authentication for passwordless sign-in

Security questions, which rely on knowledge-based answers rather than a certificate

Voice call verification, which relies on a phone call rather than a certificate

Federation with AD FS alone, which delegates authentication rather than directly relying on a locally installed certificate

11 / 15

Which recommended practice helps reduce the risk of MFA fatigue attacks, where an attacker repeatedly sends push notification prompts hoping a user will eventually approve one by mistake?

Disabling MFA entirely to eliminate all push notifications

Allowing an unlimited number of push notification attempts with no additional verification step

Enabling number matching within the Microsoft Authenticator app's push notification approval process

Reverting exclusively to SMS-based codes with no MFA fatigue mitigation whatsoever

Requiring no user interaction of any kind for any sign-in attempt

Assuming MFA fatigue attacks are not a realistic risk that needs mitigation

12 / 15

Which Conditional Access-related concept combines specific authentication methods together, such as requiring both a password and a compliant device, to satisfy a policy's grant requirements?

Session controls alone, which govern ongoing session behavior rather than initial authentication requirements

Named locations alone, which define location-based conditions rather than authentication method combinations

Grant controls (such as requiring multifactor authentication and/or a compliant device)

Assignments alone, which define who and what the policy applies to rather than the authentication requirement itself

Sign-in risk levels alone, which are a condition rather than a grant requirement combination

User risk levels alone, which are a condition rather than a grant requirement combination

13 / 15

Which term describes a scenario where a user is prompted for authentication less frequently on a trusted, previously registered device, improving user experience while maintaining reasonable security?

A requirement to re-authenticate with full MFA on every single sign-in with no exception, regardless of device trust

Disabling MFA entirely for that device permanently

Remembering multifactor authentication on trusted devices (or a similar reduced re-authentication frequency setting)

A one-time password that never expires and requires no periodic re-verification

A requirement to change the user's password daily instead of adjusting MFA frequency

A setting that has no relationship to device trust or authentication frequency

14 / 15

Which factor combination would be considered TRUE multifactor authentication, as opposed to simply using two credentials from the same factor category?

A password combined with a security question, both of which are 'something you know'

A password combined with a second, different password, both of which are 'something you know'

A password (something you know) combined with a fingerprint scan (something you are)

Two separate security questions, both of which are 'something you know'

A PIN combined with a second PIN, both of which are 'something you know'

Two different passwords used together, both of which are 'something you know'

15 / 15

Which term describes the process by which a user proves ownership of a new authentication method, such as a phone number, before it can be used for future sign-ins or password resets?

Federation, which delegates authentication to another identity provider rather than registering a new method for the current provider

Authorization, which determines access rights rather than proving ownership of a new credential

Registration (of an authentication method)

Auditing, which reviews past activity rather than establishing a new credential

Tokenization, which substitutes sensitive data with a placeholder rather than proving ownership of a credential

Hashing, which is a one-way data transformation rather than a credential registration process

Your score is

The average score is 0%