Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your company is migrating on-premises Active Directory to Microsoft Entra ID. The security team requires that users must use passwordless authentication methods for all sign-ins. Which Microsoft Entra ID feature should you enable to support passwordless authentication?
⚠ Common exam trap
Candidates often confuse 'passwordless authentication' with features that reduce password usage (like Seamless SSO or PHS) rather than understanding that only the dedicated passwordless methods in Entra ID actually remove the password requirement entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID passwordless authentication methods
Microsoft Entra ID passwordless authentication methods (such as Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator) are the native features designed to eliminate passwords entirely. These methods satisfy the security team's requirement by enabling users to sign in without a password, using biometrics or cryptographic keys instead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID passwordless authentication methods
Why this is correct
These methods replace the password with a device-bound cryptographic key (e.g., Windows Hello for Business, FIDO2 security keys) or a biometric gesture in the Microsoft Authenticator app. By requiring proof of possession and user presence, they eliminate the password secret entirely and are inherently phishing-resistant, which aligns with the passwordless goal of the migration.
- ✗
Password hash synchronization
Why it's wrong here
Password hash synchronization (PHS) copies the password hash from on-premises Active Directory to Microsoft Entra ID so users can sign in with the same username and password. It simply enables cloud authentication for a password-based credential; it does not remove or replace the password, so it cannot satisfy a passwordless authentication requirement.
- ✗
Seamless Single Sign-On (Seamless SSO)
Why it's wrong here
Seamless Single Sign-On (SSO) lets users on domain-joined devices authenticate to Entra ID without re-entering credentials by leveraging cached Kerberos tickets. However, the user still needs to prove their identity with a password (or another primary credential) at least once before the SSO session is established, so the system itself does not enable passwordless authentication.
- ✗
Pass-through authentication
Why it's wrong here
Pass-through authentication (PTA) delegates sign-in verification to the on-premises Active Directory, simply forwarding the password for validation. The password is still presented by the user and must remain present; PTA is about authentication location (cloud to on-prem) rather than credential type, so it is orthogonal to passwordless authentication.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.