MS-100 Risk Assessment & Management 3

Question 1

An organization uses Microsoft Defender for Identity. Which attack scenario does it specifically detect in an on-premises Active Directory environment?

Accepted Answer

Pass-the-hash and pass-the-ticket lateral movement attacks

Answer

Microsoft Defender for Identity monitors on-premises AD traffic to detect credential-based attacks like pass-the-hash, pass-the-ticket, and other lateral movement techniques.

Question 2

A company needs to assess their current Microsoft 365 security posture against industry benchmarks. Which tool provides a quantified score with prioritized improvement actions?

Accepted Answer

Microsoft Secure Score

Answer

Microsoft Secure Score provides a numerical security posture rating and lists prioritized improvement actions to help organizations increase their defenses.

Question 3

Which Azure AD Identity Protection risk detection fires when a user's sign-in location is geographically impossible given their previous sign-in location and timing?

Accepted Answer

Atypical travel

Answer

The 'Atypical travel' detection identifies sign-ins from two geographically distant locations within a time window too short for realistic travel.

Question 4

An admin wants to ensure that users can self-remediate risky sign-ins without admin intervention. Which combination enables this?

Accepted Answer

Sign-in risk policy requiring MFA + users registered for SSPR and MFA

Answer

When a sign-in risk policy requires MFA and users are already registered for MFA, they can self-remediate risky sign-ins by completing the MFA challenge without admin help.

Question 5

A global admin reviews the 'Users flagged for risk' report and sees a user with a 'High' risk level. The user's risk was triggered by 'Leaked credentials'. What is the recommended immediate action?

Accepted Answer

Require the user to reset their password and dismiss the risk after verification

Answer

For leaked credentials, the best practice is to require an immediate password reset (to invalidate the compromised credential) and then dismiss the risk after confirming the account is secure.

MS-100 - Microsoft 365 Identity and Services Practice Test

MS-100 - Microsoft 365 Identity and Services Practice Test

MS-100 Risk Assessment & Management 3