SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Implement Microsoft Entra ID passwordless authentication

  Why this is correct

  Implementing Microsoft Entra ID passwordless authentication replaces the password with a cryptographic key pair bound to the user's device or a FIDO2 security key. Methods such as Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app's passwordless mode allow authentication through a biometric gesture or PIN, with the private key never leaving the device. This directly eliminates the shared-secret model that attackers can phish or replay, and it aligns with Zero Trust by verifying possession and intent without ever transmitting a password over the network.

• ✗

  Configure conditional access policies to block legacy authentication

  Why it's wrong here

  Configuring Conditional Access policies to block legacy authentication denies requests from protocols like POP, IMAP, SMTP, and older Office clients that do not support modern authentication. While this significantly reduces risk by preventing those non-modern clients from bypassing policies, the underlying interactive sign-in for modern applications still validates a username and password. The policy simply blocks the client or demands a compliant device; it does not remove the password from the authentication flow itself, so passwords remain an exploitable factor.

• ✗

  Enable Microsoft Entra ID Privileged Identity Management (PIM)

  Why it's wrong here

  Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time role activation, time-bound access, and approval workflows for elevated Entra roles and Azure resources. PIM reduces standing privilege by ensuring users only gain admin rights for a limited window, but it operates on top of the existing authentication process. Users still authenticate initially with their normal credentials, and PIM's controls address authorization, not authentication; it never eliminates the password as the primary authentication factor.

• ✗

  Require multifactor authentication (MFA) for all users

  Why it's wrong here

  Requiring multifactor authentication (MFA) for all users adds a second verification layer, such as a one-time passcode or a push approval, but the first factor still typically remains the password. This means the password is still transmitted, still susceptible to phishing, and can be combined with an MFA approval during an MFA fatigue attack. MFA raises the bar for an attacker but does not remove the password-dependency from the authentication flow; it merely adds friction, so it falls short of the passwordless objective.

Go deeper

Related to this question