AZ-104 Certification Practice Question #273

Question

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant is synced to the on-premises Active
Directory domain. The domain contains the users shown in the following table.

You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:
✑ Number of methods required to reset: 2
✑ Methods available to users: Mobile phone, Security questions
✑ Number of questions required to register: 3
✑ Number of questions required to reset: 3
You select the following security questions:
✑ What is your favorite food?
✑ In what city was your first job?
✑ What was the name of your first pet?
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

Microsoft Entra ID (formerly Azure AD) enforces a strict, unchangeable **two-gate password reset policy** for administrative accounts. This policy applies to roles like Security Administrator (SecAdmin1) and Billing Administrator (BillAdmin1). Under this policy, administrators must use two specific authentication methods (such as email, mobile phone SMS/voice, or authenticator app) and are strictly prohibited from using security questions for password resets. In contrast, standard user accounts—like User1 (Reports Reader)—are governed by the custom SSPR policy configured by the directory administrators. Since the custom SSPR policy requires two methods for reset and lists "Security questions" as one of the available methods, User1 will need to answer the security questions during a password reset.

More AZ-104 practice questions