SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID to manage user identities. A new employee named John joins the company and needs access to Microsoft 365 apps. You want to ensure John's identity is verified using a phone call. Which authentication method should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse 'phone call' with 'text message (SMS)' because both involve a phone, but the question explicitly specifies 'phone call (voice call)', not a text-based code delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phone call (voice call)
The question explicitly requires verification using a phone call. The Phone call (voice call) authentication method in Microsoft Entra ID delivers an automated voice call to the user's registered phone number, prompting them to press a key to confirm their identity. This directly matches the requirement, making D the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Time-based one-time password (TOTP)
Why it's wrong here
Time-based one-time password (TOTP) involves an authenticator application, such as Microsoft Authenticator, generating a unique, short-lived numerical code on a user's device. This code must be manually entered into the sign-in prompt to complete authentication. This method relies on a software token and user input of a code, not an interactive voice call to a phone number.
- ✗
Email one-time passcode
Why it's wrong here
Email one-time passcode authentication sends a temporary, single-use verification code directly to a user's pre-registered email address. This method is primarily utilized for external collaboration with guest users or as a fallback when other MFA methods are unavailable. It delivers a text-based code via email, which is distinct from receiving an audible phone call for verification.
- ✗
Text message (SMS)
Why it's wrong here
Text message (SMS) authentication delivers a six-digit verification code directly to a user's registered mobile phone number. The user then manually inputs this code into the sign-in interface to prove their identity. While it uses a mobile phone, this method relies on a text message containing a code, not an interactive voice call where the user answers and presses a key.
- ✓
Phone call (voice call)
Why this is correct
Phone call (voice call) is a supported multi-factor authentication method where Microsoft Entra ID initiates an automated voice call to a user's registered phone number. To complete authentication, the user must answer the incoming call and typically press a specific key, such as the # key, on their phone's keypad to confirm their identity. This directly fulfills the requirement of a phone call for user verification.
- ✗
FIDO2 security key
Why it's wrong here
FIDO2 security keys are physical hardware devices that provide strong, phishing-resistant authentication using public-key cryptography. Users authenticate by inserting the USB or NFC key into their device and then providing a PIN or biometric (like a fingerprint) directly to the key. This method involves a physical token and local interaction, fundamentally differing from a remote voice call for verification.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.