Exam MS-900 topic 1 question 390 discussion

Correct answer is ACD. The JIT and PAW are least-privileged access Reference: https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices

https://www.microsoft.com/insidetrack/blog/implementing-a-zero-trust-security-model-at-microsoft/ Verify identity: MFA Verify device: PAW Verify access: JIT

For explicit verification, the three best solutions to recommend are: - A. Multifactor Authentication (MFA) – Requires users to verify their identity using multiple factors, such as passwords, biometrics, or security keys, ensuring stronger authentication. - C. Passwordless Authentication – Eliminates passwords in favor of more secure methods like Windows Hello, FIDO2 security keys, and Microsoft Authenticator. - D. Block Legacy Authentication – Prevents outdated authentication protocols that lack modern security protections, reducing the risk of credential-based attacks. Options B and E focus more on access control and secure workstations rather than explicit verification

JIT and PAW are for Least Privileged Access not for explicit verification

Options B (Just-in-time access) and E (Privileged Access Workstations) are important solutions for access and security management, but they are not directly related to explicit verification in terms of authentication.

On Exam 21/08/2024

Given answer is correct

Simple reason: Options B, E are for access management - this is authorization concept not *authentication*. Also, Methods A, and B are very common, even to non admin users, if you have a business/enterprise subscription.

Policies for explicit verification

According to Chatgpt Multifactor authentication (MFA): This solution requires users to provide two or more forms of authentication before accessing a resource. This can include something the user knows (such as a password), something the user has (such as a smart card), or something the user is (such as a fingerprint). MFA provides an additional layer of security to protect against unauthorized access. Just-in-time (JIT) access: This solution provides temporary access to resources only when needed. JIT access can be used to grant access to users who require it for a specific task or time period. This helps to reduce the risk of unauthorized access and limit the exposure of sensitive data. Block legacy authentication: This solution blocks authentication requests that use legacy protocols such as POP, IMAP, and SMTP. Legacy authentication protocols are less secure than modern authentication protocols and can be exploited by attackers to gain unauthorized access to resources.

A and D Definitely - https://learn.microsoft.com/en-us/security/zero-trust/deploy/identity

Correct ACE Above PAW on Microsoft ZERO TRUST documentation. https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-virtual-machines

I think answer ACD are all correct.

Multifactor authentication (MFA) Just-in-time (IT) access Privileged Access Workstations (PAW) devices These ( 3 ) follows zero trust model for explicit verification