Correct Answer:

Explanation:
An external email address can be used to authenticate self-service password reset (SSPR). # Yes A notification to the Microsoft Authenticator app can be used to authenticate self-service password reset (SSPR). # Yes To perform self-service password reset (SSPR), a user must already be signed in and authenticated to Azure AD. # No For Microsoft Entra self-service password reset (SSPR), users must register one or more authentication methods that can later be used when they forget their password or are locked out. Microsoft's end-user guidance states that an email address option lets users configure "an alternate email address that can be used without requiring your forgotten or missing password," and that this method is available only for password reset. In practice, this alternate address is typically a personal or external email (for example, Gmail), so using an external email to authenticate SSPR is valid.
SSPR can also use the Microsoft Authenticator app as an authentication method. Microsoft documents that Authenticator push notifications, including number matching, are supported for several scenarios, explicitly listing self-service password reset (SSPR) among them. This means a push notification to the app on the user' s device can be used to verify identity during SSPR.
Finally, SSPR is designed for situations where the user cannot sign in. Official SSPR process descriptions explain that users start from the "Can't access your account?" or password-reset page, provide their username, and then use their registered methods to prove identity. They do not need to be already authenticated to Azure AD; SSPR exists precisely to recover access when sign-in fails.

Correct Answer:

Explanation:
authorization
In the context of Microsoft identity and access management, when users attempt to access an application or a service, authorization is what controls their level of access. This concept is clearly defined in Microsoft's Security, Compliance, and Identity (SCI) learning paths, particularly in SC-900 and SC-300 certifications.
From Microsoft SCI training materials:
"Authentication is the process of verifying the identity of a user, while authorization is the process of determining what resources a user can access and what actions they are permitted to perform." In more detail:
Authentication confirms who you are (e.g., verifying credentials through Azure AD, MFA).
Authorization decides what you can do (e.g., access to files, roles, permissions in an app or service).
SCI documentation explains:
"Once authentication is successful, authorization policies are applied to determine whether the authenticated user is allowed to access the requested resource and at what level." This principle is implemented using role-based access control (RBAC) in Microsoft Azure and Microsoft 365 environments. For example, even if a user successfully logs into the Microsoft 365 portal (authentication), their ability to manage Exchange Online settings or view compliance data depends on their assigned roles (authorization).

Correct Answer:

Explanation:

Microsoft's identity guidance for Azure resources states there are two kinds of managed identities: system- assigned and user-assigned. The documentation describes that a system-assigned identity is scoped to a single resource and follows its lifecycle: "A system-assigned managed identity is created in Microsoft Entra ID and is tied to the lifecycle of that Azure service instance. When the resource is deleted, Azure automatically deletes the identity." By contrast, a user-assigned identity is reusable across resources: "A user-assigned managed identity is a standalone Azure resource... It can be assigned to one or more Azure service instances and is managed independently of the resources that use it." Because the scenario requires multiple Azure web apps to use the same identity, the only managed identity type that supports this sharing model is the user-assigned managed identity. This allows you to grant RBAC permissions once to the identity and then attach that same identity to several App Service instances, simplifying secretless access to Azure resources (Key Vault, Storage, SQL, etc.) and providing centralized lifecycle and rotation management. Certificates or generic service principals would reintroduce credential management, while a system-assigned identity cannot be shared across multiple apps. Therefore, a user- assigned managed identity is the correct choice.

Correct Answer: C  🗳️

Explanation: Only visible for Prep4away members. You can sign-up / login (it's free).