SC-200 Practice Question 3751
Exam: SC-200
Domain: Respond to security incidents
Difficulty: easy
A user account is exhibiting anomalous sign-in behavior from multiple countries simultaneously. In Microsoft Entra ID Protection, what manual action can an analyst take on the user entity page to remediate the user risk immediately?
Answer Options
A
Click "Confirm user compromised" or "Reset password"
B
Delete the user account from the directory immediately
C
Reboot the local workstation of the user
D
Send a warning text message to the user
Correct Answer
A: Click "Confirm user compromised" or "Reset password"
Explanation
Clicking "Confirm user compromised" forces the user risk to High and triggers Conditional Access policies, or clicking "Reset password" immediately invalidates active sessions and credentials.