SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Access the Azure AD Identity Protection portal, then review the risky users report, then select a specific user, then analyze the risk events for that user, then take remediation action.

  Why this is correct

  This is the correct order because you must first access the portal to see the reports, then review risky users to identify a compromised account, select the user to drill down, analyze the specific risk events to understand the compromise, and finally take action to remediate.

• ✗

  Access the Azure AD Identity Protection portal, then select a specific user, then analyze the risk events for that user, then review the risky users report, then take remediation action.

  Why it's wrong here

  This sequence is incorrect because the logical flow for investigating a user compromise requires identifying risky users before attempting to select one for detailed analysis. After accessing the Azure AD Identity Protection portal, the 'risky users report' serves as the primary dashboard to identify and prioritize accounts exhibiting suspicious activity. Attempting to select a specific user and analyze their risk events without first reviewing this aggregated report would be inefficient and lack a clear investigative target, as you wouldn't know which user warrants immediate attention.

• ✗

  Access the Azure AD Identity Protection portal, then review the risky users report, then take remediation action, then select a specific user, then analyze the risk events.

  Why it's wrong here

  This order is incorrect because taking remediation action prematurely, immediately after reviewing the risky users report but before selecting a specific user and analyzing their individual risk events, is not a best practice. While the report identifies potential compromises, effective remediation requires understanding the specific nature and severity of the risk events associated with a particular user. Without this detailed analysis, any action taken might be inappropriate, insufficient, or overly disruptive, as the specific context of the compromise would be unknown.

• ✗

  Access the Azure AD Identity Protection portal, then analyze the risk events, then review the risky users report, then select a specific user, then take remediation action.

  Why it's wrong here

  This is incorrect because analyzing risk events without first selecting a user is not possible; you must select a user to view their specific risk events. The logical order is to review the list, then select a user, then analyze.

Go deeper

Related to this question