Design security operations, identity, and compliance capabilities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?
⚠ Common exam trap
Many candidates confuse 'passwordless' with 'MFA' and select SMS-based authentication, not realizing that SMS still relies on a shared secret (the code) and is not truly passwordless or phishing-resistant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Authenticator app with passwordless sign-in
The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FIDO2 security keys
Why it's wrong here
FIDO2 security keys are a legitimate passwordless option, but they require deploying physical hardware tokens to every user. This is impractical for a workforce that relies on personal smartphones, especially in remote or bring-your-own-device (BYOD) scenarios. Additionally, FIDO2 keys require a USB, NFC, or BLE interface on the device, and not all mobile devices support these protocols consistently, making provisioning and support burdensome.
- ✓
Microsoft Authenticator app with passwordless sign-in
Why this is correct
Microsoft Authenticator app with passwordless sign-in is the correct choice because it leverages the user's smartphone as a possession factor, using a cryptographic challenge-response protocol. When the user enters their username, the Authenticator app displays a number or a number match prompt; the user's approval signs the request with a private key stored in the device's secure enclave, eliminating the password entirely. This method is phishing-resistant, supports conditional access policies, and works seamlessly on iOS and Android, making it ideal for smartphone-centric users.
- ✗
SMS-based authentication
Why it's wrong here
SMS-based authentication is not a passwordless method because it still requires the user to enter a password to initiate the sign-in; it only provides an additional one-time passcode as a second factor. More critically, SMS is vulnerable to SIM-swap attacks, SS7 protocol weaknesses, and phishing, which is why Microsoft and NIST discourage its use as a primary authentication factor. Since it depends on mobile carrier infrastructure and lacks hardware-bound key protection, it does not meet the security and user-experience requirements for a modern passwordless deployment.
- ✗
Windows Hello for Business
Why it's wrong here
Windows Hello for Business is a robust passwordless method that uses biometrics or a PIN, with private keys protected by a device's Trusted Platform Module (TPM). However, it is exclusively integrated with Windows 10/11 devices and Azure AD join, so it does not work on iOS or Android smartphones, which are the target device platform in this scenario. Additionally, it requires significant infrastructure setup, such as a Windows Hello for Business deployment policy and certificate or key trust models, making it unsuitable for a heterogeneous, smartphone-first organization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.