AZ-104 Exam - Question 532

Question

HOTSPOT -You have an Azure Active Directory (Azure AD) tenant named contoso. onmicrosoft. com that contains the users shown in the following table. You enable password reset for contoso. onmicrosoft. com as shown in the Password Reset exhibit. (Click the Password Reset tab. )You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods tab. )For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

.

fedztedz · Answer

Answer is not correct. It should be
- NO: User2 needs 2 authentication methods. Security questions are not enough to reset password
- NO: User1 is not part of the SSPR Group1
- NO: to be able to add security questions to the process. you need Global admin role
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#prerequisites
& https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator-permissions

mlantonis · Answer

C0rrect Answer:

Box 1: No
Two methods are required (Mobile phone and Security questions).

Box 2: No
Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.

Box 3: No
To be able to add Security questions to the process, you need to be a Global Administrator. User3 is User Administrator, so User3 cannot add security questions to the reset process. User Administrator doesn’t have MFA permissions.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr 
https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-passwords-faq
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#prerequisites
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

janshal · Answer

NO
NO
NO
Tested!

Sorrynotsorry · Answer

I think it is NO NO NO. the third one; user administrators can't use secret questions as a password reset method. this is an enforced Azure policy for administrators

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy

PBA1211 · Answer

it is No,No No
1st no, because 2 methods requierd
2nd no, because wrong groupmembership
3td no, User 3 is not "An account with Global Administrator privileges.'

JohnPC · Answer

First two are No, for obvious reasons.  Third is No, user administrator doesn't have the ability to access Password Reset in Azure AD, as the option is greyed out - tested and confirmed.  Only Global admins can add security questions from a predefined or custom created list of security questions.  Also, user admins have an admin role so their ability to change their own security questions are not available, as stated, "With two-gate policy, administrators don't have the ability to use security questions". 
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy
This was tested by setting up a new account with user admin role; security questions wasn't an option when setting up other authentication methods during first sign in.

david76x · Answer

No, No, No is the correct answer.  I'd like to know if the person who wrote these dumps actually passed their AZ-104!?

ZUMY · Answer

No-No-No

benvdw · Answer

on exam 13/3/2022

ra_aly · Answer

why azure exams are so confusing and there is a lack of knowledge, there are conflicting opinions and unclear direction.

typales2005 · Answer

Was on the 09/01/2023 exam.

mikl · Answer

1. No - requires 2 methods.
2. No - Group1 can't.
3. No - User Administrator doesnt have MFA permissions.

Source : https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator-permissions

toniiv · Answer

Last answer is NO also, User Administrator cannot modify this settings: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator-permissions

lucky_18 · Answer

came in exam on June 28 2021

klexams · Answer

N - need mobile phone too
N - user2 is not in the group1
N - apparently it needs GA

Aghora · Answer

tested user admin with P2 lice and got no access but the following link say I can ..go figure .
https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task

TiredofTesting · Answer

Answer is 
NO
NO
NO
3) User3 = user administrator
With a two-gate policy, administrators don't have the ability to use security questions.

The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number. A two-gate policy applies in the following circumstances:

All the following Azure administrator roles are affected:

Helpdesk administrator
Service support administrator
Billing administrator
Partner Tier1 Support
Partner Tier2 Support
Exchange administrator
Mailbox Administrator
Skype for Business administrator
User administrator

wsscool · Answer

in exam 7/3/2021, answered NNN

Lazylinux · Answer

For sure NO NO NO and as per others comments - read  mlantonis

EmnCours · Answer

Box 1: No
Two methods are required (Mobile phone and Security questions).

Box 2: No
Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.

Box 3: No
To be able to add Security questions to the process, you need to be a Global Administrator. User3 is User Administrator, so User3 cannot add security questions to the reset process. User Administrator doesn’t have MFA permissions.

morito · Answer

Took a bit of digging, but here are my answers:

- NO: User2 must provide two authentication methods before they can reset their password
- NO: User 1 is not enabled for SSPR
- NO: A User must have the role of global Administrator or Authentication Policy Administrator to change SSPR (https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr).

NickyDee · Answer

With a two-gate policy, administrators don't have the ability to use security questions.

carterbest · Answer

one thing is certain administrators of different kind use stronger kind password reset and its using multifactor authentication

Wucrib · Answer

Answer is correct. There are 2 self service password resets; one for end users and one for admins(always enabled). Clearly states Group 2 has pw reset enabled not end-users so 2nd question is right. Questions 1 and 2 are self explanatory I think.

ivantchev · Answer

N,N,N - we have a lot of wrong dump questions here as a whole. Just make sure to practice to test if in doubt

JayBee65 · Answer

To confirm 3 is No: https://docs.microsoft.com/en-us/answers/questions/356305/in-azure-could-the-user-administrator-have-permiss.html

korben_dallas · Answer

1. Y
Authentication methods
When a user is enabled for SSPR, they must register at least one authentication method. We highly recommend that you choose two or more authentication methods so that your users have more flexibility in case they're unable to access one method when they need it. For more information, see What are authentication methods?.
The following authentication methods are available for SSPR:
Mobile app notification
Mobile app code
Email
Mobile phone
Office phone (available only for tenants with paid subscriptions)
Security questions
2.NO
NO: User1 is not part of the SSPR Group1

3. NO - You need Global Admin role

Kpup · Answer

Still learning azure so excuse the lack of knowledge but the sspr is targetted at group 2, user 1 is not a member, so could they not reset using the mobile app?

ravi000001 · Answer

NO
NO
NO

Reference: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

dani12 · Answer

SSP stands for Self Service Password reset.

zellck · Answer

NNN is the answer.

https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

Josete1106 · Answer

N N N is correct!

PrepaCertif · Answer

Tested in LAB : No, No, No

Amir1909 · Answer

No
No
No

[Removed] · Answer

WRONG..

No
No
No

RNZLR · Answer

it says "number of questions required to reset = 3". why is everyone stuck on the two METHODS? you need to answer 3 questions. the security question option itself is ONE METHOD. i'd say yes,no,no

CloudyTech · Answer

NoNoNo , User admin cannot add

ZacAz104 · Answer

correct answer i think is Yes-No-No because user2 is only member of Group2

RKETBO · Answer

The Number of methods required to reset option determines the minimum number of available authentication methods or gates a user must go through to reset or unlock his password. It can be set to either 1 or 2. Since this option is set to 2, user2 will not be able to reset his password after only one method has been run.

User1 is a member of group1. Self-service password reset is enabled only for group2.

As a user administrator, user3 cannot add security questions to the reset process.

The following Technet articles contain more information about the topic

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

djgodzilla · Answer

Box 1: No
Two methods are required (Mobile / Security questions).

Box 2: No
Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.

Box 3: No
 User3 is User Administrator,  With a two-gate policy, administrators don't have the ability to use security questions.
Admin users cannot do the following:
- Cannot manage MFA.
- Cannot change the credentials or reset MFA for members and owners of a role-assignable group.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences
https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

Teroristo · Answer

NNN
https://learn.microsoft.com/en-us/answers/questions/356305/in-azure-could-the-user-administrator-have-permiss

8ac3742 · Answer

User Access Admin role cannot change the security questions of self service reset password: User Access Admin is one RBAC role, it can only grant RBAC role to the user to access the Azure resources.
Global Admin is Entra role, it can manage user, group and domain so it can change the security questions of self service password reset.

AZ-104 Exam - Question 532

Discussion