MS-100 Risk Assessment & Management 5

Question 1

An organization needs to ensure that access reviews are conducted quarterly for all users with the Teams Administrator role. Which tool automates this process in Microsoft 365?

Accepted Answer

Azure AD Access Reviews in PIM

Answer

Azure AD Access Reviews (available through PIM and Identity Governance) allow admins to schedule recurring reviews of role membership to ensure access remains appropriate.

Question 2

Which risk score threshold in Azure AD Identity Protection is recommended for a user risk policy that requires a password reset to balance security and user disruption?

Accepted Answer

High — targets only the most severe compromises with minimal false positives

Answer

Setting the user risk policy to 'High' targets only the most clearly compromised accounts, minimizing disruption to legitimate users while addressing the greatest threats.

Question 3

A security analyst sees a 'Password spray' risk detection in Identity Protection. What attack pattern does this detection identify?

Accepted Answer

Multiple accounts attacked with a small number of commonly used passwords to avoid lockout

Answer

Password spray attacks try a few common passwords (e.g., 'Password1') across many accounts simultaneously to evade per-account lockout thresholds.

Question 4

An administrator needs to export Identity Protection risk detection data for long-term retention and analysis in a SIEM. Which method supports this?

Accepted Answer

Stream data to Azure Monitor via Diagnostic Settings or use the Microsoft Graph API

Answer

Identity Protection data can be streamed to Azure Monitor (Log Analytics/Event Hub) via Diagnostic Settings or queried programmatically via the Microsoft Graph API for SIEM integration.

Question 5

A company's risk management policy states that any admin role activation must be approved by a second administrator. Which PIM configuration enforces this?

Accepted Answer

Configure role settings in PIM to require approval with designated approvers

Answer

PIM role settings allow administrators to require approval from designated approvers before a user can activate an eligible role assignment.

MS-100 - Microsoft 365 Identity and Services Practice Test

MS-100 - Microsoft 365 Identity and Services Practice Test

MS-100 Risk Assessment & Management 5