SC-200 Certification Practice Question #84

Question

You have an Azure subscription that contains a user named User1.

User1 is assigned an Azure Active Directory Premium Plan 2 license.

You need to identify whether the identity of User1 was compromised during the last 90 days.

What should you use?

Accepted Answer

The goal is to determine whether a specific user's identity (User1) was compromised in the last 90 days. The risky users report is the user-centric report that surfaces whether an account "currently or were considered at risk of compromise," and its per-user Risk history shows the events that changed the user's risk over the last 90 days — making it the report you start from to answer "was this identity compromised." This matches the official Suggested answer and the overwhelming Most Voted (49 votes; 21-👍 top comment). Confidence is held at 76% because there is a genuine, well-reasoned community split: several testers (A, ~11+ 👍) note that the Risk detections report is the report with an explicit 90-day date filter, and MS Learn confirms risk detections retains "up to the past 90 days." The two reports are closely related (risk detections feed risky users), but B is favored because the question is framed around the user/identity being compromised rather than enumerating individual detections, and D is eliminated outright since risky sign-ins only covers 30 days.

More SC-200 practice questions