SC-300 Azure AD Identity Protection 2 — Questions and Answers
Question 1: Which risk detection in Identity Protection is triggered when a user's credentials appear in a publicly disclosed data breach?
- Unfamiliar sign-in properties
- Leaked credentials (Correct answer)
- Atypical travel
- Suspicious inbox forwarding
Correct answer: Leaked credentials
The 'Leaked credentials' detection is triggered when Microsoft discovers that the user's username and password pair has appeared in a public credential dump or dark web listing.
Question 2: What does the 'Atypical travel' risk detection in Azure AD Identity Protection indicate?
- A user signed in from an anonymous IP address
- Two sign-ins occurred from geographically distant locations within an impossibly short timeframe (Correct answer)
- A user signed in from a country not previously associated with their account
- A sign-in was performed using a malware-infected device
Correct answer: Two sign-ins occurred from geographically distant locations within an impossibly short timeframe
Atypical travel detection flags when two authentications occur from locations so far apart that traveling between them would be physically impossible in the elapsed time.
Question 3: An administrator marks a risky user as 'Confirm user compromised' in Identity Protection. What immediate effect does this action have?
- The user's MFA registration is deleted
- The user's password is immediately reset by the system
- The user's risk level is set to high and the account may be blocked based on policy (Correct answer)
- The user receives an email notification about the compromise
Correct answer: The user's risk level is set to high and the account may be blocked based on policy
Confirming a user as compromised sets their user risk to high, which can trigger the user risk policy to block sign-in or require password reset depending on policy configuration.
Question 4: Which report in Azure AD Identity Protection shows a list of all users who have active risk detections associated with their accounts?
- Risky sign-ins report
- Risky users report (Correct answer)
- Risk detections report
- Identity Secure Score report
Correct answer: Risky users report
The 'Risky users' report lists all users with current active risk detections, allowing administrators to investigate and take remediation actions on a per-user basis.
Question 5: In Identity Protection, which risk detection category is classified as 'real-time' rather than 'offline'?
- Leaked credentials
- Anonymous IP address (Correct answer)
- Atypical travel
- Suspicious inbox manipulation rules
Correct answer: Anonymous IP address
Anonymous IP address detection is evaluated in real-time during sign-in, whereas detections like leaked credentials and atypical travel are computed offline after the sign-in event.
Question 6: A company wants to automatically force a password reset for any user whose risk level reaches 'High'. Which Identity Protection configuration achieves this?
- Configure the sign-in risk policy to block high-risk sign-ins
- Configure the user risk policy to require password change at high risk (Correct answer)
- Enable the MFA registration policy for all users
- Create a Conditional Access policy requiring MFA for all apps
Correct answer: Configure the user risk policy to require password change at high risk
The user risk policy can be configured with a threshold of 'High' and a control of 'Allow access and require password change,' which forces a secure password reset via SSPR for compromised accounts.
SC-300 Azure AD Identity Protection 2
Which risk detection in Identity Protection is triggered when a user's credentials appear in a publicly disclosed data breach?