Exam MS-102 topic 1 question 150 discussion

Correct answer. Atypical travel and Unfamiliar sign-in properties have learning period. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.

Just looking at this, the only thing the system should care about is the anonymous login since the user is new. Microsoft likes to paint their security products as being useful, not generating false positives for normal behavior. NYC login isn't bad by itself and remote desktop connections almost certainly have some sort of reputation/trust associated with them established by the IT department. The fact that they call out the the recent user creation date lends further credence they want you to demonstrate we know what detections require time to learn a new user.

E. anonymous IP address, atypical travel, and unfamiliar sign-in properties

- anonymous IP adress and atypical travel only

Agree with NrdAlrt, for atypical travel etc, it would make a difference if the user wasn't connecting over an RDP. Seeing as there's a RDP connection setup by the IT team, these would have to be trusted locations in the network to be able to access Sharepoint in the first place.

Anonymous IP address: User1 signed in from an anonymous IP address. Atypical travel: User1 established Remote Desktop connections to hosts in Berlin and Hong Kong, indicating atypical travel from New York City. Unfamiliar sign-in properties: The sign-in from an anonymous IP address and the sign-in from the Remote Desktop connections could be considered unfamiliar sign-in properties, as they deviate from the usual patterns of sign-ins.

B is correct as the other two indicators are still in learning mode for a newly created user https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#atypical-travel he system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties Newly created users are in "learning mode" period where the unfamiliar sign-in properties risk detection is turned off while our algorithms learn the user's behavior.

should be E https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection

Should be A i think