MS-500 Research & Evidence-Based Practice 5

Question 1

In Azure AD Identity Protection, which risk detection indicates that a user authenticated from an IP address associated with anonymous proxy or Tor exit node services?

Accepted Answer

Anonymous IP address

Answer

The Anonymous IP address detection fires when a sign-in originates from a known anonymizing proxy, VPN, or Tor exit node.

Question 2

Which Azure AD Identity Protection policy should be configured to automatically require MFA or block access when the sign-in risk level is high?

Accepted Answer

Sign-in risk policy

Answer

The sign-in risk policy evaluates risk at authentication time and can enforce MFA or block access based on the detected risk level.

Question 3

Microsoft recommends configuring the user risk policy remediation to which action so that high-risk users can self-remediate without admin intervention?

Accepted Answer

Require password change

Answer

Requiring a secure password change allows high-risk users to remediate their account themselves by resetting credentials, which clears the risk.

Question 4

An admin wants to review all Azure AD Identity Protection risk events detected over the past 30 days, including details on detection type and risk level. Which report provides this?

Accepted Answer

Risk detections report

Answer

The Risk detections report lists every individual risk event with detection type, risk level, and associated sign-in or user.

Question 5

Microsoft 365 Defender automatically correlates alerts from Defender for Endpoint, Defender for Office 365, and Defender for Identity into what unified investigation object?

Accepted Answer

Incidents

Answer

Microsoft 365 Defender correlates related cross-product alerts into incidents, providing a single pane for end-to-end attack investigation.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Research & Evidence-Based Practice 5