Identity & Access Management Flashcards

A security analyst needs to detect when a user's Entra ID refresh token is used from a new IP address after being stolen. Which solution provides token theft detection?

Answer: Microsoft Entra ID Protection token protection (Conditional Access)

Entra ID Protection's token protection Conditional Access policy cryptographically binds tokens to the device, detecting and blocking stolen token replay from different devices.

Which Microsoft Entra ID feature allows an organization to require users to accept terms of use before accessing a specific application, enforced via Conditional Access?

Answer: Terms of Use policies

Entra ID Terms of Use policies can be integrated into Conditional Access to require users to accept legal agreements before gaining access to specified applications.

During incident response, an analyst needs to immediately revoke all active sessions for a compromised Entra ID user. Which PowerShell command accomplishes this?

Answer: Revoke-AzureADUserAllRefreshToken

Revoke-AzureADUserAllRefreshToken (or the Microsoft Graph equivalent) invalidates all refresh tokens, forcing the user to re-authenticate and evicting any attacker with stolen tokens.

Which Microsoft Defender for Identity feature proactively identifies and scores sensitive accounts and devices to prioritize investigation of lateral movement alerts?

Answer: Entity tags (Sensitive account tagging)

Sensitive entity tagging in Defender for Identity marks high-value accounts and devices, so lateral movement paths targeting them generate higher-priority alerts.

An organization uses Entra ID Access Reviews to manage group membership. Who can be configured as the reviewer for an access review of a privileged role?

Answer: The manager of the user, specific users, or group owners

Access Reviews in Entra ID support multiple reviewer types including managers, designated users, resource owners, or self-review by the access holders themselves.

A Microsoft Sentinel playbook needs to automatically block a risky user in Entra ID when a High severity identity alert fires. Which Logic App connector action should the playbook use?

Answer: Revoke user sessions using the Azure AD connector action

The Azure AD Logic App connector includes actions to revoke user sessions and block sign-in, enabling automated response to identity-based Sentinel alerts.

Which Entra ID feature enables an analyst to see a complete timeline of a specific user's risk events, sign-ins, and remediation actions in a single view?

Answer: Identity Protection > Risky Users > User Details panel

The Risky Users detail panel in Entra ID Protection shows the user's risk history, associated detections, sign-in events, and remediation actions in one consolidated view.