CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Azure AD Identity Protection Risk Detection
Learn how to identify risk detections in Azure AD Identity Protection with this detailed question walkthrough.
When preparing for the AZ-500 exam, candidates often stumble on questions related to Azure AD Identity Protection. Understanding the conditions that trigger risk detections is crucial, as these can significantly impact security measures within an organization.
The question
Your organization has implemented Azure AD Identity Protection to help detect potential vulnerabilities affecting your organization’s identities. Which of the following conditions can trigger a risk detection in Azure AD Identity Protection?
- A. A user has not logged in for 90 days
- B. A user account password is expired
- C. A sign-in attempt from an unfamiliar location
- D. A user changes their profile picture
Think before you scroll
Before looking at the options, consider what actions or situations could indicate a potential security threat. Not all conditions relate to risk detection in the context of identity protection. Focus on behaviors that suggest unauthorized access or compromise.
The answer
The correct option is C: A sign-in attempt from an unfamiliar location. This scenario indicates a possible security threat, as it may suggest that someone is trying to access an account from a location not previously associated with that user.
Why the other options lose
- A. A user has not logged in for 90 days: This condition does not indicate a security risk. It's more of a user account status issue that relates to inactivity rather than potential compromise.
- B. A user account password is expired: While an expired password can lead to security concerns, it does not trigger a risk detection on its own. It is a standard part of account management and does not imply unauthorized access.
- D. A user changes their profile picture: Changing a profile picture is a benign activity. It does not signify any security threat or compromise to the user’s identity.
The concept behind it
The principle behind Azure AD Identity Protection focuses on detecting behaviors that may indicate unauthorized access. Monitoring sign-in attempts from unfamiliar locations is a key tactic in identifying potential breaches. Understanding this helps in recognizing other similar scenarios that could trigger security alerts.
Exam trap to remember
Remember: Risk detections are often tied to suspicious behaviors, not routine account management tasks. Focus on actions suggesting unauthorized access.