AZ-104 Exam - Question 498

Question

HOTSPOT -You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso. com. The tenant is synced to the on-premises ActiveDirectory domain. The domain contains the users shown in the following table. You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:✑ Number of methods required to reset: 2✑ Methods available to users: Mobile phone, Security questions✑ Number of questions required to register: 3✑ Number of questions required to reset: 3You select the following security questions:✑ What is your favorite food?✑ In what city was your first job?✑ What was the name of your first pet?For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

Box 1: No -Administrator accounts are special accounts with elevated permissions. To secure them, the following restrictions apply to changing passwords of administrators:On-premises enterprise administrators or domain administrators cannot reset their password through Self-service password reset (SSPR). They can only change their password in their on-premises environment. Thus, we recommend not syncing on-prem AD admin accounts to Azure AD. An administrator cannot use secretQuestions & Answers as a method to reset password. Box 2: Yes -Self-service password reset (SSPR) is an Azure Active Directory feature that enables employees to reset their passwords without needing to contact IT staff. Box 3: Yes -Reference:https://docs. microsoft. com/en-us/azure/active-directory/authentication/howto-sspr-deployment.

Mozbius_ · Answer

By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned.

With a two-gate policy, administrators don't have the ability to use security questions.

The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number.

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-password-policy-differences

Therefore I would say N N Y as  SecAdmin1 and BillAdmin1 are both administrators.
NOTE: I have tried to test in lab but was unsuccessful (somehow SSPR isn't even recognized as being enabled, hell one of the user is taking forever to show an updated assigned role).

awssecuritynewbie · Answer

So after some research it does look like "Security questions aren't used as an authentication method during a sign-in event. Instead, security questions can be used during the self-service password reset (SSPR) process to confirm who you are. Administrator accounts can't use security questions as verification method with SSPR." 
so it means the administrator cannot use security questions as verification method for SSPR. so it would be N N Y . check the link the first line of the link. PLEASE LIKE THIS COMMENT

Ref https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions

zellck · Answer

NNY is the answer.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences
By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned.

With a two-gate policy, administrators don't have the ability to use security questions.

All the following Azure administrator roles are affected:
- Billing administrator
- Security administrator

TripleFires · Answer

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#administrator-password-policy-differences
>>>
The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number, and it prohibits security questions. Office and mobile voice calls are also prohibited for trial or free versions of Microsoft Entra ID.

A two-gate policy applies in the following circumstances:

All the following Azure administrator roles are affected:

Application administrator
Application proxy service administrator
Authentication administrator
Billing administrator
......
Security administrator

LauLauLauw · Answer

NNY

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences
This link shows the list of administrators that arre not able to use security questions.

RougePotatoe · Answer

N
N
Y

"Administrator accounts can't use security questions as verification method with SSPR."
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions

oopspruu · Answer

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences

NNY

kmsalman · Answer

Number of security questions required to reset password is 3. My opinion is that user can also not self reset the password by answering just one question. So the Answer should be N, N, N

NurSalman · Answer

How can you have this question wrong?

Amir1909 · Answer

No
No
Yes

omerco61 · Answer

NNY
"Administrator accounts can't use security questions as verification method with SSPR."
Quote from microsoft
Link:

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-security-questions

azhunter · Answer

Answer is NNY

Josete1106 · Answer

N N Y is correct!

KM · Answer

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment
NYY

PhoenixAscending · Answer

This was on my exam. I think the correct answer is provided by Mozbius.

Ottris · Answer

Number of methods required to reset the password is 2. 
N N N

roses2021 · Answer

NNY
Refer to Microsoft article: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#administrator-password-policy-differences

AZ-104 Exam - Question 498

Discussion