Microsoft Entra ID Identity Protection is a risk-based conditional access capability that "automates the detection and remediation of identity-based risks" and enables admins to investigate risky users and sign-ins.
SCI guidance explains that Identity Protection evaluates signals such as user risk and sign-in risk, raises risk detections, and can automatically remediate by enforcing actions like password reset or blocking access via risk-based policies. The portal provides rich investigation experiences for risky users, risky sign-ins, and risk detections, allowing security teams to review evidence and confirm/dismiss risks. In addition, identity risk data can be exported through Azure Monitor/diagnostic settings and integrated with SIEM/SOAR tools, enabling "export of risk detections and security alerts to third-party solutions" for correlation and response.
Tasks such as configuring external access for partner organizations are handled by B2B collaboration features, and creating/assigning sensitivity labels belongs to Microsoft Purview Information Protection-not Identity Protection. Therefore, the tasks Identity Protection supports are: export risk detection (B), automate detection and remediation of identity-based risks (C), and investigate risks related to user authentication (D).

Explanation:

Reference:
In Microsoft SCI terminology, authorization is the stage that answers "what can this authenticated user do?" Microsoft Learn explains that authorization is "the process of determining what a user is allowed to do or access after they have been authenticated" and governs access to specific resources (apps, APIs, data) through policies such as role assignments, permissions, and Conditional Access. By contrast, authentication is "the process of proving identity," for example by entering a password, using MFA, or presenting a certificate- authentication verifies who the user is, not what they can access.
SCI guidance further clarifies adjacent concepts: single sign-on (SSO) streamlines the authentication experience by allowing a user to sign in once and then access multiple applications without repeated prompts; it does not decide the user's rights within those apps. Federation establishes trust between identity providers and service providers to enable cross-domain authentication, but authorization decisions still occur based on the receiving service's policies and the user's claims/roles.
Therefore, when the sentence asks for "the process of identifying whether a signed-in user can access a specific resource," the correct concept is authorization, because it evaluates the user's permissions and enforces access control after successful authentication.

Explanation:
An external email address can be used to authenticate self-service password reset (SSPR). # Yes A notification to the Microsoft Authenticator app can be used to authenticate self-service password reset (SSPR). # Yes To perform self-service password reset (SSPR), a user must already be signed in and authenticated to Azure AD. # No For Microsoft Entra self-service password reset (SSPR), users must register one or more authentication methods that can later be used when they forget their password or are locked out. Microsoft's end-user guidance states that an email address option lets users configure "an alternate email address that can be used without requiring your forgotten or missing password," and that this method is available only for password reset. In practice, this alternate address is typically a personal or external email (for example, Gmail), so using an external email to authenticate SSPR is valid.
SSPR can also use the Microsoft Authenticator app as an authentication method. Microsoft documents that Authenticator push notifications, including number matching, are supported for several scenarios, explicitly listing self-service password reset (SSPR) among them. This means a push notification to the app on the user' s device can be used to verify identity during SSPR.
Finally, SSPR is designed for situations where the user cannot sign in. Official SSPR process descriptions explain that users start from the "Can't access your account?" or password-reset page, provide their username, and then use their registered methods to prove identity. They do not need to be already authenticated to Azure AD; SSPR exists precisely to recover access when sign-in fails.

Explanation:

(CIEM) solution. CIEM is a security technology category that helps organizations manage identity and access permissions across multi-cloud environments, including Microsoft Azure, AWS, and Google Cloud Platform (GCP).
According to Microsoft's official Security, Compliance, and Identity (SCI) training and documentation (especially relevant in SC-300 and SC-900 learning paths):
"Microsoft Entra Permissions Management is a CIEM solution that provides comprehensive visibility and control over permissions for all identities and resources across multicloud environments." Key features of Microsoft Entra Permissions Management as a CIEM include:
* Discovery of over-privileged accounts and unused permissions.
* Enforcement of the principle of least privilege.
* Detailed permissions analytics and reporting.
* Support for Azure, AWS, and GCP environments.
This solution is designed to address the growing risk of identity sprawl and permission misuse in cloud platforms, which traditional identity governance or SIEM tools do not address effectively.
Incorrect Options:
* CSPM (Cloud Security Posture Management) focuses on cloud misconfiguration, not identity permissions.
* SIEM (e.g., Microsoft Sentinel) aggregates logs/events for threat detection, not entitlement visibility.
* XDR (e.g., Microsoft Defender XDR) is focused on detection and response across endpoints, identities, and data-not entitlement management.
# Therefore, the correct and Microsoft-verified classification is: a cloud infrastructure entitlement management (CIEM) solution.

Explanation:

In Microsoft Sentinel, Logic Apps are used as playbooks for automation and orchestration (SOAR)-to take actions after alerts/incidents occur (notify, enrich, remediate). They are not the component that detects or identifies anomalies; detections come from analytics rules, UEBA (user and entity behavior analytics), Fusion (ML-powered correlation), and anomaly rules. Workbooks are interactive dashboards and visualizations for monitoring and reporting; they don't correlate alerts. Correlation of alerts into incidents is handled by analytics rules (including alert grouping and Fusion) within Sentinel's detection pipeline. Finally, Sentinel's Hunting experience provides KQL-based queries and templates that are mapped to the MITRE ATT&CK tactics/techniques, enabling analysts to explore threats in a framework-aligned way. Thus, automation via Logic Apps # anomaly detection; Workbooks # incident correlation; Hunting tooling does align to MITRE ATT&CK.