SC-300 · Question #85
Hotspot Question You have a Microsoft 365 tenant. You need to identify users who have leaked credentials. The solution must meet the following requirements: - Identify sign-ins by users who are suspec
The correct answer is To classify leaked credentials as high-risk, use:: Azure Active Directory (Azure AD) Identity Protection; To trigger remediation, use:: Sign-in risk; To mitigate the risk, select:: Grant access but require password change. This question tests knowledge of Azure AD Identity Protection's risk detection and Conditional Access policies to handle leaked/compromised credentials in Microsoft 365.
Question
Answer Area
- To classify leaked credentials as high-risk, use:Azure Active Directory (Azure AD) Identity ProtectionAzure Active Directory (Azure AD) Identity ProtectionAzure Active Directory (Azure AD) Privileged Identity Management (PIM)Identity GovernanceSelf-service password reset (SSPR)
- To trigger remediation, use:Sign-in riskClient apps not using Modern authenticationDevice stateSign-in riskUser locationUser risk
- To mitigate the risk, select:Grant access but require password changeApply app enforced restrictionsBlock accessGrant access but require app protection policyGrant access but require password change
How the community answered
(1 responses)- Azure Active Directory (Azure AD) Identity Protection|Client apps not using Modern authentication|Apply app enforced restrictions100% (1)
Explanation
This question tests knowledge of Azure AD Identity Protection's risk detection and Conditional Access policies to handle leaked/compromised credentials in Microsoft 365.
Approach. To identify users with leaked credentials, you use 'Azure AD Identity Protection' which has a built-in risk detection called 'Leaked credentials' that flags sign-ins as high-risk events. To immediately enforce a control while still allowing access, you configure a 'User risk policy' (or Conditional Access policy with user risk condition) set to require 'Multi-Factor Authentication (MFA)' or password change - this mitigates the risk in real-time without blocking the user entirely. The three selections would be: (1) Azure AD Identity Protection for the detection mechanism, (2) 'Leaked credentials' as the risk detection type (classified as a high-risk event), and (3) A User Risk Conditional Access Policy requiring MFA/password change as the immediate remediation control that still allows application access.
Concept tested. Azure AD Identity Protection risk detections (specifically leaked credentials as a high-risk sign-in event) and Conditional Access User Risk Policies that enforce MFA or password reset as a real-time remediation action without fully blocking user access to applications.
Topics
Community Discussion
1done