MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a conditional access policy to bypass MFA for this user

  Why it's wrong here

  Creating a conditional access policy to bypass MFA for this user would not remediate the identity risk; it would only remove the security control from the very account that is flagged as risky. Conditional access policies enforce access decisions based on conditions like sign-in risk, but they do not alter the user's risk score or clear detections in Entra ID Protection. Bypassing MFA for a risky user increases the likelihood of unauthorized access and is explicitly counter to the principle of step-up authentication, which is the recommended response.

• ✗

  Suppress the alert in Microsoft Defender XDR

  Why it's wrong here

  Suppressing an alert in Microsoft Defender XDR merely hides the detection from security operations; it does not change the user's risk state in Microsoft Entra ID Protection or clear the underlying risky sign-in. Defender XDR and Entra ID Protection are independent signal pipelines, so dismissing an alert on one platform leaves the identity risk intact, potentially causing the user to remain blocked by risk-based policies. This action is effectively ignoring the issue rather than resolving it, leaving the account in a compromised or suspicious state.

• ✓

  Use the Microsoft Entra ID Protection reports to confirm the user as safe

  Why this is correct

  Using the Microsoft Entra ID Protection reports to confirm the user as safe is the correct manual remediation action when investigation shows the risk detection is a false positive or the account is validated as legitimate. Selecting 'Confirm user safe' on the Risky users report dismisses the risk, resets the user's risk level, and removes the user from the risky users list, allowing sign-ins to proceed normally without requiring a password reset. This action should be performed only after verifying the user's identity and activity, as it is a permanent dismissal that prevents risk-based conditional access policies from challenging the user in the future.

• ✗

  Dismiss the risk in the Risky users report

  Why it's wrong here

  Dismissing the risk in the Risky users report closes the risk incident but does not mark the user as safe or clear the underlying risk from the account. Unlike 'Confirm user safe,' 'Dismiss user risk' is not a remediation step—it leaves the risk level intact and does not trigger any corrective action like a password reset. The user may therefore remain subject to additional risk-based challenges or blocks, and a genuinely compromised account could continue to be exploited without detection, making dismissal appropriate only when intentionally accepting the risk.

Go deeper

Related to this question