Microsoft Entra Identity Protection Risk Event Types
Exhibit
Refer to the exhibit.
```json
{
"riskDetections": [
{
"riskEventType": "unfamiliarFeatures",
"riskLevel": "medium",
"userDisplayName": "John Doe",
"signInDateTime": "2026-03-15T10:30:00Z",
"ipAddress": "203.0.113.5"
}
]
}
```Refer to the exhibit. You are reviewing a risk detection in Microsoft Entra Identity Protection. The risk event indicates 'unfamiliarFeatures' with medium risk level for user John Doe from IP 203.0.113.5. What is the most likely cause of this risk detection?
Quick Answer
The unfamiliarFeatures detection is Identity Protection's baseline-deviation signal — it doesn't check a sign-in against a blocklist or a threat feed, it checks it against the user's own history, flagging properties like a new device, browser, or location that haven't appeared in that user's recent sign-in pattern before. That's the distinguishing trait to hold onto for the exam, because Identity Protection has several risk detections that can sound similar at a glance: impossible travel specifically compares two sign-ins that are geographically implausible within the elapsed time between them, leaked credentials matches sign-in username/password pairs against known-compromised credential dumps, and anonymous IP address flags traffic from Tor or anonymizer services regardless of the user's history. UnfamiliarFeatures is the odd one out in that it's purely behavioral and personalized per user rather than checking against an external or absolute signal. A medium risk level here reflects that the model found something genuinely new about this sign-in without the stronger corroborating evidence that would push it to high — recognizing which specific behavioral anomaly a detection name refers to, rather than treating all Identity Protection risks as interchangeable, is what this question type is testing.
⚠ Common exam trap
Many exam-takers confuse 'unfamiliarFeatures' with 'impossible travel' or 'anonymous IP address', but Microsoft Entra Identity Protection categorizes each risk detection type separately, and the question's specific risk event name directly points to unfamiliar sign-in properties, not to other detection types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The sign-in was from an unfamiliar location or device.
The 'unfamiliarFeatures' risk detection in Microsoft Entra Identity Protection specifically identifies sign-ins that exhibit properties unfamiliar to the user's typical behavior, such as a new device, browser, or geographic location. The detection is based on machine learning models that compare the current sign-in against the user's historical sign-in patterns, and a medium risk level indicates a moderate likelihood that the sign-in is not legitimate. This matches option D, as the risk event is triggered by a sign-in from an unfamiliar location or device, not by impossible travel, leaked credentials, or anonymous IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
There was an impossible travel event detected.
Why it's wrong here
Impossible travel is a different risk event type.
- ✗
John Doe's credentials were leaked on the dark web.
Why it's wrong here
Leaked credentials would be a different risk event type.
- ✗
The sign-in originated from an anonymous IP address.
Why it's wrong here
Anonymous IP is a different risk event type.
- ✓
The sign-in was from an unfamiliar location or device.
Why this is correct
UnfamiliarFeatures detects sign-ins from unfamiliar locations or devices.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. You are reviewing a risk detection report in Microsoft Entra Identity Protection. The report shows a user with high risk level and two risk events. What does the status 'remediated' indicate?
medium- A.The risk is still active and requires investigation.
- ✓ B.The risk has been resolved by a remediation action such as password reset.
- C.The user's account has been confirmed as compromised.
- D.The risk was dismissed by an administrator as false positive.
Why B: In Microsoft Entra Identity Protection, the 'remediated' status indicates that the risk associated with the user has been resolved through an automated or manual remediation action, such as a password reset or completion of a multi-factor authentication (MFA) challenge. This means the detected risk event is no longer considered active, and the user's account has been brought back to a secure state. Option B correctly identifies that the risk was resolved by a remediation action.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.