Practice Test GeeksSC-300 - Microsoft Identity and Access Administrator Practice Test
← All SC-300 Flashcard Decks

Azure AD Identity Protection Flashcards

6 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Azure AD Identity Protection flashcards as text

  1. Which risk detection in Identity Protection is triggered when a user's credentials appear in a publicly disclosed data breach?

    Answer: Leaked credentials

    The 'Leaked credentials' detection is triggered when Microsoft discovers that the user's username and password pair has appeared in a public credential dump or dark web listing.

  2. What does the 'Atypical travel' risk detection in Azure AD Identity Protection indicate?

    Answer: Two sign-ins occurred from geographically distant locations within an impossibly short timeframe

    Atypical travel detection flags when two authentications occur from locations so far apart that traveling between them would be physically impossible in the elapsed time.

  3. An administrator marks a risky user as 'Confirm user compromised' in Identity Protection. What immediate effect does this action have?

    Answer: The user's risk level is set to high and the account may be blocked based on policy

    Confirming a user as compromised sets their user risk to high, which can trigger the user risk policy to block sign-in or require password reset depending on policy configuration.

  4. Which report in Azure AD Identity Protection shows a list of all users who have active risk detections associated with their accounts?

    Answer: Risky users report

    The 'Risky users' report lists all users with current active risk detections, allowing administrators to investigate and take remediation actions on a per-user basis.

  5. In Identity Protection, which risk detection category is classified as 'real-time' rather than 'offline'?

    Answer: Anonymous IP address

    Anonymous IP address detection is evaluated in real-time during sign-in, whereas detections like leaked credentials and atypical travel are computed offline after the sign-in event.

  6. A company wants to automatically force a password reset for any user whose risk level reaches 'High'. Which Identity Protection configuration achieves this?

    Answer: Configure the user risk policy to require password change at high risk

    The user risk policy can be configured with a threshold of 'High' and a control of 'Allow access and require password change,' which forces a secure password reset via SSPR for compromised accounts.