MS-100 Risk Assessment & Management 5 — Questions and Answers
Question 1: An organization needs to ensure that access reviews are conducted quarterly for all users with the Teams Administrator role. Which tool automates this process in Microsoft 365?
- Azure AD Identity Protection
- Azure AD Access Reviews in PIM (Correct answer)
- Microsoft Compliance Manager
- Microsoft Secure Score
Correct answer: Azure AD Access Reviews in PIM
Azure AD Access Reviews (available through PIM and Identity Governance) allow admins to schedule recurring reviews of role membership to ensure access remains appropriate.
Question 2: Which risk score threshold in Azure AD Identity Protection is recommended for a user risk policy that requires a password reset to balance security and user disruption?
- Low and above — catches all risks but causes frequent disruption
- High — targets only the most severe compromises with minimal false positives (Correct answer)
- Medium and above — broad coverage with acceptable disruption rate
- None — rely only on Conditional Access sign-in risk policies
Correct answer: High — targets only the most severe compromises with minimal false positives
Setting the user risk policy to 'High' targets only the most clearly compromised accounts, minimizing disruption to legitimate users while addressing the greatest threats.
Question 3: A security analyst sees a 'Password spray' risk detection in Identity Protection. What attack pattern does this detection identify?
- A single account subjected to thousands of password guesses in rapid succession
- Multiple accounts attacked with a small number of commonly used passwords to avoid lockout (Correct answer)
- A credential stuffing attack using known username/password pairs from data breaches
- A brute-force attack on the tenant's legacy authentication endpoints
Correct answer: Multiple accounts attacked with a small number of commonly used passwords to avoid lockout
Password spray attacks try a few common passwords (e.g., 'Password1') across many accounts simultaneously to evade per-account lockout thresholds.
Question 4: An administrator needs to export Identity Protection risk detection data for long-term retention and analysis in a SIEM. Which method supports this?
- Download from the Azure portal UI only, limited to 2,500 rows
- Stream data to Azure Monitor via Diagnostic Settings or use the Microsoft Graph API (Correct answer)
- Configure a Logic App to scrape the Identity Protection dashboard daily
- Export via the Microsoft 365 admin center compliance export tool
Correct answer: Stream data to Azure Monitor via Diagnostic Settings or use the Microsoft Graph API
Identity Protection data can be streamed to Azure Monitor (Log Analytics/Event Hub) via Diagnostic Settings or queried programmatically via the Microsoft Graph API for SIEM integration.
Question 5: A company's risk management policy states that any admin role activation must be approved by a second administrator. Which PIM configuration enforces this?
- Set the role assignment to 'Active' with a short expiration time
- Configure role settings in PIM to require approval with designated approvers (Correct answer)
- Enable MFA enforcement in the Conditional Access policy for admins
- Set the user risk policy to block High risk users from activating roles
Correct answer: Configure role settings in PIM to require approval with designated approvers
PIM role settings allow administrators to require approval from designated approvers before a user can activate an eligible role assignment.
Question 6: Which Microsoft 365 security feature helps identify OAuth applications that have been granted excessive permissions and may pose a risk?
- Azure AD Identity Protection app risk detections
- Microsoft Defender for Cloud Apps OAuth app governance policies (Correct answer)
- Microsoft Secure Score OAuth improvement actions
- Azure AD Enterprise Application conditional access policies
Correct answer: Microsoft Defender for Cloud Apps OAuth app governance policies
Microsoft Defender for Cloud Apps provides OAuth app governance, allowing admins to discover, review, and revoke risky third-party OAuth app permissions granted by users.
Question 7: An enterprise risk assessment identifies that users are frequently bypassing MFA by using legacy authentication protocols. What is the recommended remediation in Microsoft 365?
- Increase the MFA session token lifetime
- Create a Conditional Access policy to block legacy authentication protocols (Correct answer)
- Require users to re-register MFA every 30 days
- Enable Identity Protection sign-in risk policy at Medium threshold
Correct answer: Create a Conditional Access policy to block legacy authentication protocols
Blocking legacy authentication via Conditional Access prevents clients from using older protocols (POP3, IMAP, SMTP AUTH) that don't support modern MFA challenges.
MS-100 Risk Assessment & Management 5
An organization needs to ensure that access reviews are conducted quarterly for all users with the Teams Administrator role.
Which tool automates this process in Microsoft 365?