SC-300 Certification Practice Question #21

Question

You need to resolve the recent security incident issues.
What should you configure for each incident? To answer, drag the appropriate policy types to the correct issues. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Accepted Answer

The question maps each Identity Protection risk to the policy type that natively remediates it. MS Learn's risk-detection tables are decisive: "Leaked credentials" is listed under User risk detections (so a user risk policy applies), while both "Suspicious browser" and the "anonymous IP address" detections are Sign-in risk detections (so a sign-in risk policy applies to rows 2 and 3). This matches the given answer and the top Highly-Voted comment (0byte, 25 👍). Two notable dissents pull confidence below the high band: rvln7 (5 👍) reads row 3's "resources accessed" as a Conditional Access scenario, and chzon (16 👍) plus others note Microsoft now recommends migrating risk policies to risk-based Conditional Access. Both are legitimate real-world observations, but "A Conditional Access policy" is a single tile that can be used once or more — and the detection-to-risk-policy mapping (user vs sign-in) is the discrimination the question tests, so the risk-policy answers remain the keyed solution.

More SC-300 practice questions