Practice Test GeeksSC-300 - Microsoft Identity and Access Administrator Practice Test
← All SC-300 Flashcard Decks

Azure AD Identity Protection Flashcards

6 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Azure AD Identity Protection flashcards as text

  1. Which Azure AD Identity Protection feature integrates with Microsoft Sentinel to stream risk events for advanced threat hunting?

    Answer: Identity Protection diagnostic settings

    Identity Protection's diagnostic settings allow risk detection and risky user events to be streamed to Log Analytics, which Microsoft Sentinel can then ingest for SIEM-level threat hunting.

  2. What is the primary purpose of the 'Workbooks' section within Azure AD Identity Protection?

    Answer: To visualize risk trends and identity health metrics using pre-built dashboards

    The Workbooks section provides pre-built Azure Monitor workbooks that visualize Identity Protection data such as risk trends, detection volumes, and remediation rates.

  3. An Identity Protection sign-in risk policy is set to require MFA for medium and high risk sign-ins. A user is prompted for MFA and successfully completes it. What happens to the sign-in risk?

    Answer: The risk is automatically dismissed as remediated

    When a user successfully satisfies the MFA challenge required by the sign-in risk policy, the risk for that specific sign-in event is self-remediated and automatically dismissed.

  4. Which risk detection indicates that a user's sign-in properties such as browser, ASN, and IP address significantly differ from the user's historical sign-in patterns?

    Answer: Unfamiliar sign-in properties

    The 'Unfamiliar sign-in properties' detection compares current sign-in attributes against the user's historical profile and flags anomalies that deviate significantly from established patterns.

  5. A user successfully completes SSPR to reset their password after being flagged by Identity Protection. What is the result on their user risk level?

    Answer: User risk is automatically remediated and reset to none

    A secure password reset through SSPR signals to Identity Protection that the credential risk has been addressed, automatically remediating the user's risk level back to none.

  6. Which Identity Protection configuration setting controls the percentage of the organization's users who must be covered by the MFA registration policy?

    Answer: Users scope — All users or specific groups

    The user scope setting in the MFA registration policy allows administrators to target all users or specific included/excluded groups, controlling the breadth of registration enforcement.