Exam SC-300 topic 1 question 29 discussion

Actual exam question from Microsoft's SC-300

Question #: 29
Topic #: 1

DRAG DROP -
You need to resolve the recent security incident issues.
What should you configure for each incident? To answer, drag the appropriate policy types to the correct issues. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Show Suggested Answer

Suggested Answer:

Box 1: A user risk policy -
User-linked detections include:
Leaked credentials: This risk detection type indicates that the user's valid credentials have been leaked. When cybercriminals compromise valid passwords of legitimate users, they often share those credentials.
User risk policy.
Identity Protection can calculate what it believes is normal for a user's behavior and use that to base decisions for their risk. User risk is a calculation of probability that an identity has been compromised. Administrators can make a decision based on this risk score signal to enforce organizational requirements. Administrators can choose to block access, allow access, or allow access but require a password change using Azure AD self-service password reset.

Box 2: A sign-in risk policy -
Suspicious browser: Suspicious browser detection indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser.

Box 3: A sign-in risk policy -
A sign-in risks include activity from anonymous IP address: This detection is discovered by Microsoft Defender for Cloud Apps. This detection identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Note: The following three policies are available in Azure AD Identity Protection to protect users and respond to suspicious activity. You can choose to turn the policy enforcement on or off, select users or groups for the policy to apply to, and decide if you want to block access at sign-in or prompt for additional action.
* User risk policy
Identifies and responds to user accounts that may have compromised credentials. Can prompt the user to create a new password.
* Sign in risk policy
Identifies and responds to suspicious sign-in attempts. Can prompt the user to provide additional forms of verification using Azure AD Multi-Factor Authentication.
* MFA registration policy
Makes sure users are registered for Azure AD Multi-Factor Authentication. If a sign-in risk policy prompts for MFA, the user must already be registered for Azure
AD Multi-Factor Authentication.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

by Imee at Sept. 22, 2022, 3:23 p.m.

Comments

Submit Cancel

0byte

Highly Voted 2 years, 1 month ago

The given answer is correct. Currently supported risk detections are Sign-in risk detections: Activity from anonymous IP address Additional risk detected Admin confirmed user compromised Anomalous Token Anonymous IP address Atypical travel Azure AD threat intelligence Impossible travel Malicious IP address Malware linked IP address Mass Access to Sensitive Files New country Password spray Suspicious browser Suspicious inbox forwarding Suspicious inbox manipulation rules Token Issuer Anomaly Unfamiliar sign-in properties User risk detections: Additional risk detected Anomalous user activity Azure AD threat intelligence Leaked credentials Possible attempt to access Primary Refresh Token (PRT) https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

upvoted 23 times

rvln7

3 months, 2 weeks ago

1. A user risk policy 2. A sign in risk policy 3. A conditional access policy- "resources ACCESSED from an anonymous IP address"- if something is ACCESSED, it has nothing to do with a sign-in policy.

upvoted 2 times

...

chikorita

1 year, 8 months ago

why "Azure AD threat intelligence" is part of both?

upvoted 1 times

Holii

1 year, 6 months ago

Azure AD Threat Intelligence are real-time detections on user behavior using machine learning. It's not tied to one type of "User Risk" vs "Sign-in Risk", it scans all sorts of behaviors for anything that may be illegitimate/malicious traffic. No link to provide, just look it into it yourself.

upvoted 1 times

...

2 years ago

ON EXAM 14/11/2022

upvoted 4 times

Vaerox

11 months ago

But was it correct?

upvoted 1 times

...