SC-300 Azure AD Identity Protection 2

Question 1

Which risk detection in Identity Protection is triggered when a user's credentials appear in a publicly disclosed data breach?

Accepted Answer

Leaked credentials

Answer

The 'Leaked credentials' detection is triggered when Microsoft discovers that the user's username and password pair has appeared in a public credential dump or dark web listing.

Question 2

What does the 'Atypical travel' risk detection in Azure AD Identity Protection indicate?

Accepted Answer

Two sign-ins occurred from geographically distant locations within an impossibly short timeframe

Answer

Atypical travel detection flags when two authentications occur from locations so far apart that traveling between them would be physically impossible in the elapsed time.

Question 3

An administrator marks a risky user as 'Confirm user compromised' in Identity Protection. What immediate effect does this action have?

Accepted Answer

The user's risk level is set to high and the account may be blocked based on policy

Answer

Confirming a user as compromised sets their user risk to high, which can trigger the user risk policy to block sign-in or require password reset depending on policy configuration.

Question 4

Which report in Azure AD Identity Protection shows a list of all users who have active risk detections associated with their accounts?

Accepted Answer

Risky users report

Answer

The 'Risky users' report lists all users with current active risk detections, allowing administrators to investigate and take remediation actions on a per-user basis.

Question 5

In Identity Protection, which risk detection category is classified as 'real-time' rather than 'offline'?

Accepted Answer

Anonymous IP address

Answer

Anonymous IP address detection is evaluated in real-time during sign-in, whereas detections like leaked credentials and atypical travel are computed offline after the sign-in event.

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 Azure AD Identity Protection 2