SC-300 Azure AD Identity Protection 3

Question 1

Which Azure AD Identity Protection feature integrates with Microsoft Sentinel to stream risk events for advanced threat hunting?

Accepted Answer

Identity Protection diagnostic settings

Answer

Identity Protection's diagnostic settings allow risk detection and risky user events to be streamed to Log Analytics, which Microsoft Sentinel can then ingest for SIEM-level threat hunting.

Question 2

What is the primary purpose of the 'Workbooks' section within Azure AD Identity Protection?

Accepted Answer

To visualize risk trends and identity health metrics using pre-built dashboards

Answer

The Workbooks section provides pre-built Azure Monitor workbooks that visualize Identity Protection data such as risk trends, detection volumes, and remediation rates.

Question 3

An Identity Protection sign-in risk policy is set to require MFA for medium and high risk sign-ins. A user is prompted for MFA and successfully completes it. What happens to the sign-in risk?

Accepted Answer

The risk is automatically dismissed as remediated

Answer

When a user successfully satisfies the MFA challenge required by the sign-in risk policy, the risk for that specific sign-in event is self-remediated and automatically dismissed.

Question 4

Which risk detection indicates that a user's sign-in properties such as browser, ASN, and IP address significantly differ from the user's historical sign-in patterns?

Accepted Answer

Unfamiliar sign-in properties

Answer

The 'Unfamiliar sign-in properties' detection compares current sign-in attributes against the user's historical profile and flags anomalies that deviate significantly from established patterns.

Question 5

A user successfully completes SSPR to reset their password after being flagged by Identity Protection. What is the result on their user risk level?

Accepted Answer

User risk is automatically remediated and reset to none

Answer

A secure password reset through SSPR signals to Identity Protection that the credential risk has been addressed, automatically remediating the user's risk level back to none.

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 - Microsoft Identity and Access Administrator Practice Test

SC-300 Azure AD Identity Protection 3