Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Azure Security Engineer Associate > Manage authentication by using Microsoft Entra ID > Flashcards

Manage authentication by using Microsoft Entra ID Flashcards

1
Q

Microsoft Entra authentication includes the following components

A

Self service password reset
Microsoft Entra multifactor authentication
Hybrid integration to write password changed back to on premises environment
Hybrid integration to enforce password protection policies for an on premises environment
Passwordless authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

T or F

Microsoft Entra ID helps to protect a users identity and simplify their sign in experience

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Self - service

A

Allows password reset through a web browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Microsoft Entra multifactor authentication

A

additional form of authentication

ex. mobile app notification
phone call
text message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Passwordless authentication

A

security keys to sign in without the need for passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Self service password reset

A

password change
password reset
account lock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Mutilfactor authentication available for Microsoft Entra

A

Account lockout

Block/ unblock users

Report suspicious activity

notifications

open authorization tokens (OATH)

Phone call settings

providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Account lockout

A

specify how many failed attempts

the lockout is only applied when a PIN code is entered for MFA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Block / unblock users

A

block MFA attempts - if device is stolen/lost

block last for 90 days

unblock users if fit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Where can you view suspicious activity events

A

in the audit logs and risk detection reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Report suspicious activity and fraud alert

A

If Fraud Alert is enabled with Automatic Blocking and Report Suspicious Activity is enabled, the user will be added to the blocklist and set as high-risk and in-scope for any other policies configured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

OATH tokens

A

Microsoft Entra ID supports the use of OATH TOTP (Time-based One Time Password) SHA-1 tokens that refresh codes every 30 or 60 seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

OATH TOTP

A

hardware tokens typically come with a secret key, or seed, pre-programmed in the token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Passwordless authentication options

A

Microsoft Authenticator
FIDO2- compliant security keys
Windows Hello for Business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What devices would be best for Microsoft Authenticator

A

Shared devices
Kiosks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What devices would be best for FIDO2 compliant security keys

A

Dedicated non-windows devices
Dedicated windows 10 computers
Kiosks and shared computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What devices would be best for Windows Hello for Business

A

Dedicated Windows 10 computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

T or F

When you deploy passwordless authentication you should first enable one or more pilot groups

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Your communications to end users should include

A

Guidance on combined registration for both Microsoft Entra multifactor authentication and self-service password reset (SSPR)

Downloading Microsoft Authenticator

Registering in Microsoft Authenticator

Signing in with your phone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

T or F
Microsoft Authenticator turns any iOS or Android phone into a strong, password less credential

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

T or F

Microsoft Entra logs registration of security keys and the Authenticator app, and any other changes to the authentication methods

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Active Directory Federation Services (AD FS) Integration

A

directed here if user chooses “use your password instead”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Device registration

A

to used the authenticator app for password less authentication, the device needs to be registered in the Microsoft Entra tenant and cannot be a shared device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

3 types of passwordless sign in deployments available with security keys

A

Microsoft Entra web apps on a supported browser

Microsoft Entra joined Windows 10 devices

Microsoft Entra hybrid joined Windows 10 devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

For Microsoft Entra web apps and Microsoft Entra joined Windows devices, use:

A

Windows 10 version 1809 or higher using a supported browser like Microsoft Edge or Mozilla Firefox (version 67 or higher).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

For hybrid Microsoft Entra domain joined devices, use:

A

Windows 10 version 2004 or later.
Fully patched domain servers running Windows Server 2016 or 2019.
Latest version of Microsoft Entra Connect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How can you restrict keys

A

Authenticator Attestation GUID (AAGUID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

T or F

Microsoft Entra Password Protection detects and blocks known weak passwords and their variants, and can also block weak terms that are specific to your organization

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

t or f

On-premises deployment of Microsoft Entra Password Protection uses the same global and custom banned password lists that are stored in Microsoft Entra ID, and does the same checks for on-premises password changes as Microsoft Entra ID does for cloud-based changes

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Domain Controllers (DCs)

A

never communicate directly with the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

T or F

Microsoft Entra Password Protection supports incremental deployment across DCs in a Microsoft Entra ID domain

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

When can the Microsoft Entra Password Protection DC agent software validate passwords?

A

When it’s installed on a DC and only for password changes that are sent to that DC

33
Q

How to guarantee consistent behavior and universal Microsoft Entra Password Protection?

A

DC agent software must be installed on all DCs in a domain

34
Q

T or F

Partial deployments aren’t secure and aren’t recommended for DC agent software

A

True.

partial deployment should only occur for testing purposes

35
Q

What does The Microsoft Entra Password Protection Proxy service run on

A

any domain joined machine in the current Microsoft Entra ID forest

36
Q

What is the services primary purpose for Microsoft entry Password Protection Proxy?

A

to forward password policy download requests from DCs to Microsoft Entra ID and then return the responses from Microsoft Entra ID to the DC

37
Q

Where does the password filter DLL of the DC Agent receive user password validation request from

A

The OS and then the filter forwards them to the DC agent service that is running locally on the DC

38
Q

How does the DC agent service handle password validation requests?

A

processes them by using the current password policy and returns the result pass or fail

39
Q

How often does the DC Agent service check the age of the current policy

A

hourly

40
Q

What are Microsoft Entra Password Protection policies a combination of?

A

Microsoft global banned password list and. the per-tenant custom based password list

41
Q

What does the DC Agent never listen on?

A

a network available port

42
Q

T or F

The proxy service is stateless

A

True

it never caches policies or any other state downloaded from Azure

43
Q

what happens if their is no password policy available on the local DC?

A

the password is automatically accepted and an event message is logged to warn the administrator

44
Q

T or F

there can be a delay between password policy configuration change

A

true

45
Q

t or f

Microsoft Entra Password Protection acts as a supplement to existing Microsoft entra ID policies, not a replacement

A

true

46
Q

Microsoft Entra ID creates a certificate that is by default valid for how many years

A

3

47
Q

where can you change the certificate duration?

A

in the microsoft entry admin center

48
Q

When you enable federation on SAML application, Microsoft Entra ID does what?

A

Creates a certificate that is by default valid for 3 years

49
Q

T or F

Communication is critical to the success of any new service

A

True

Make sure you were letting your users know that a change is coming, when it has arrived, and what to do now

50
Q

SAML

A

Security Assertion Markup Language

51
Q

T or F

SSO for pre integrated enterprise applications are free

A

True

52
Q

T or F

Objects in your directory and features may require specific licenses

A

True

53
Q

Shared accounts - SSO

A

create a security group for each combination of user set and credentials

54
Q

T or F

Choosing a SSO method depends on how the application is configured for authentication

A

True

55
Q

Options for cloud applications to use SSO

A

OpenID Connect
OAuth
SAML
password-based
Linked

56
Q

Can SSO be disabled?

A

yes

57
Q

Options for on premises applications for SSO

A

password based
Integrated Windows Authentication
header-based
linked

58
Q

OpenID Connect and OAuth

A

if the application supports it

59
Q

SAML

A

when possible for apps that dont use OpenID Connect or OAuth

60
Q

Password-based

A

when the application has an HTML sign in page.

password based is also known as password vaulting

61
Q

Linked

A

choose linked when the application is configured for SSO in another identity provider service

62
Q

Disabled

A

choose disabled SSO when the application isn’t ready to be configured for SSO

63
Q

Integrated Windows Authentication (IWA)

A

for apps that uses IWA or claims aware applications

64
Q

Header based

A

for when the app uses headers for authentication

65
Q

T or F

You can integrate your cloud enabled SaaS applications with Microsoft Entra ID

A

True

66
Q

Cloud enabled SaaS providers

A

Atlassian Cloud
ServiceNow
Slack
SuccessFactors
Workday

67
Q

Cloud Integrations

A

AWS
Alibaba Cloud (role bases SSO)
Google Cloud Platform
Salesforce
SAP (Systems, Applications, and Products in Data Processing) Cloud Identity Platform

68
Q

Integrating Slack with Microsoft Entra ID enables you to

A

control who has access to Slack in Microsoft Entra ID

enable your users to be automatically signed in to Slack with their Microsoft Entra accounts

manage your accounts in on central location

69
Q

what is needed to integrate slack and microsoft entra id?

A

a microsoft entra subscription

slack single sign on enameled subscription

70
Q

How can you configure the integration of Slack into Microsoft Entra ID?

A

add Slack from the gallery to your list of managed SaaS apps

71
Q

How to configure and test Microsoft Entra SSO for Slack

A

enable the feature to users and then create a test user

72
Q

Configure Microsoft Entra SSO

A

must be signed on as at least a cloud application administrator

go to - identity
applications,
enterprise applications,
slack,
single sign on

on SSO page select SAML

73
Q

DIDs

A

user generated, self owned, globally unique identifiers rooted in decentralized systems trust systems

74
Q

what are verifiable credentials?

A

data objects consisting of claims made by the issuer attesting information about a subject

75
Q

t or f

the issuer’s DID creates a digital signature as proof that they attest to this information

A

True

76
Q

how do most organizations provide credentials to employees?

A

centralized identity systems

77
Q

How decentralized identity systems work

A

the issuer, user, and relying party (RP) each have a role in establishing and ensuring ongoing trusted exchange of each others credentials.

78
Q

What passwordless authentication methods does Microsoft recommend?

A

Windows Hello
FIDO2 security keys
Microsoft Authenticator app

Azure Security Engineer Associate (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions