Exam SC-300 topic 2 question 117 discussion

I am going with C. I researched this quite a bit online using different articles and ran a lot thru copilot. The Email option for Self-Service Password Reset (SSPR) can be configured for either internal or external email addresses. However, using an internal email address is generally more secure and recommended. Comparison: Email vs. Mobile App Notification Email: Pros: Easy to set up and use; familiar to most users. Cons: Can be less secure due to potential phishing attacks; relies on users having access to their email. Mobile App Notification: Pros: More secure; uses push notifications through apps like Microsoft Authenticator; less susceptible to phishing. Cons: Requires users to have the app installed and configured. Recommendation: Mobile App Notification is generally better for security and reliability. It provides a stronger defense against phishing and ensures users can securely reset their passwords using a trusted app.

Answer C) a mobile app notification You guys are reading this question all wrong. This is asking about SSPR "authentication" and although it is stating that you must register at least 1 method, it does not mean that it is the only method that is enabled. The following authentication methods are available for SSPR: - Mobile app notification (***this is valid if they setup more than one method to authenticate) - Mobile app code (***valid for one method registration only scenario) - Email (***Has to be to their company email address and not external) - Mobile phone - Office phone (available only for tenants with paid subscriptions) - Security questions https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#authentication-methods

Again the same question in the 1 last questions 3 questions are same with the same context completely different answers

The catch in this question is the number of methods required: Check https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks. "Mobile app and SSPR When using a mobile app as a method for password reset, like Microsoft Authenticator, the following considerations apply if an organization hasn't migrated to the centralized Authentication methods policy: When administrators require one method be used to reset a password, verification code is the only option available. When administrators require two methods be used to reset a password, users are able to use notification OR verification code in addition to any other enabled methods." My choice will be D

First priority is mobile app code, second priority is an email to an address outside your organization

d is correct