SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization wants to allow users to sign in using their mobile phone number and a verification code. Which Microsoft Entra ID feature enables this?
⚠ Common exam trap
Many candidates confuse SMS-based authentication with App passwords, mistakenly thinking App passwords are used for phone-based sign-in, when in fact App passwords are a legacy workaround for non-MFA-aware apps and have nothing to do with phone number verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SMS-based authentication
SMS-based authentication allows users to sign in to Microsoft Entra ID by entering their mobile phone number and receiving a verification code via text message. This is a form of passwordless authentication that leverages the user's phone number as the primary identifier and the SMS-delivered code as the second factor, meeting the organization's requirement for phone number and verification code sign-in.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FIDO2 security keys
Why it's wrong here
FIDO2 security keys represent a robust, phishing-resistant passwordless authentication method that relies on cryptographic keys stored on a physical device, such as a USB security key or a device's Trusted Platform Module (TPM). Users authenticate by proving possession of this key, often with a biometric or PIN. This method does not involve sending an SMS message to a phone number for sign-in, as its core design is to eliminate traditional passwords and often multi-factor authentication steps by leveraging hardware-bound credentials.
- ✗
App passwords
Why it's wrong here
App passwords are 16-character, system-generated passcodes specifically designed to allow non-browser-based applications, or older applications that do not support modern authentication protocols like OAuth 2.0, to access cloud services when multi-factor authentication (MFA) is enabled for a user. They serve as a workaround for legacy applications that cannot prompt for MFA or handle modern authentication flows. App passwords are not a primary sign-in method using a phone number and do not involve SMS for the authentication process itself.
- ✓
SMS-based authentication
Why this is correct
SMS-based authentication in Azure AD allows users to sign in to cloud applications by entering their registered phone number instead of a traditional username and password. Upon entering the phone number, a one-time passcode (OTP) is sent via SMS to that number, which the user then enters to complete authentication. This method provides a convenient, passwordless experience, directly leveraging the ubiquity of mobile phones and SMS for identity verification and fulfilling the requirement to sign in using a phone number.
- ✗
Password hash synchronization
Why it's wrong here
Password Hash Synchronization (PHS) is a fundamental identity synchronization method used by Azure AD Connect to copy a hash of a user's on-premises Active Directory password hash to Azure AD. This enables users to use the same password for both on-premises and cloud resources, providing a seamless single sign-on experience. PHS is an identity synchronization mechanism that ensures password consistency across directories, not an authentication method itself, nor does it facilitate signing in directly with a phone number via SMS.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.