You have a Microsoft Entra tenant. You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by…

The correct answer is A. Windows Hello for Business B. an FIDO2 security key C. certificate-based authentication (multi-factor). Explanation Phishing-resistant MFA methods are authentication approaches that cannot be intercepted or redirected by attackers through social engineering, because they rely on cryptographic binding between the credential and the legitimate site. Windows Hello for Business (A)…

Submitted by renata2k· Mar 6, 2026Implement authentication and access management solution

Question

You have a Microsoft Entra tenant. You need to create a Conditional Access policy to manage administrative access to the tenant. The solution must ensure that administrators are authenticated by using a phishing-resistant multi-factor authentication (MFA) method. Which three authentication methods should you include in the solution? Each correct answer presents a complete solution.

Options

AWindows Hello for Business
Ban FIDO2 security key
Ccertificate-based authentication (multi-factor)
Dvoice call
ESMS
Femail OTP
Gcertificate-based authentication (single-factor)
HMicrosoft Authenticator

How the community answered

(25 responses)

A
72% (18)
D
12% (3)
F
4% (1)
G
4% (1)
H
8% (2)

Explanation

Phishing-resistant MFA methods are authentication approaches that cannot be intercepted or redirected by attackers through social engineering, because they rely on cryptographic binding between the credential and the legitimate site. Windows Hello for Business (A) uses device-bound cryptographic keys tied to the user's identity, FIDO2 security keys (B) use hardware-based public key cryptography, and multi-factor certificate-based authentication (C) requires both a certificate (something you have) plus a PIN/biometric - all three are classified by Microsoft as phishing-resistant because they are cryptographically bound to the legitimate relying party. The distractors - voice call (D), SMS (E), and email OTP (F) - are vulnerable to interception, SIM-swapping, and real-time phishing attacks, making them explicitly not phishing-resistant. Microsoft Authenticator (H) satisfies standard MFA but is not classified as phishing-resistant by Microsoft unless used with passwordless phone sign-in with number matching in specific configurations. Single-factor CBA (G) is excluded because it only satisfies one factor and therefore does not meet MFA requirements.

Memory Tip: Think "HFC = Hardware, Face/Fingerprint, Certificate" - all three rely on hardware-bound cryptography that a phisher cannot steal over a network, unlike codes sent via phone or email.

Topics

#Conditional Access#Multi-factor Authentication (MFA)#Phishing Resistance#Authentication Methods

Community Discussion

No community discussion yet for this question.

Full SC-300 Practice