Explanation:

In Microsoft's SCI learning content, the core objective of protecting information is framed by the CIA triad.
Microsoft explains that "confidentiality, integrity, and availability are foundational security principles." Within this model, integrity is described as the assurance that information remains trustworthy and unchanged from its intended state. The SCI materials state that integrity means "preventing unauthorized modification and ensuring the accuracy and completeness of data." When a requirement says, "ensuring that the data you retrieve is the same as the data you stored," it directly maps to this integrity principle-verifying that data hasn't been altered, corrupted, or tampered with during storage or transmission.
Microsoft's guidance further highlights that integrity is supported by controls that "detect or prevent unauthorized changes," including cryptographic hashes, checksums, and digital signatures that can "provide proof that content hasn't been modified." By contrast, confidentiality focuses on restricting access (for example, through least privilege and encryption), and availability focuses on "reliable and timely access to information and systems." Because the scenario emphasizes that the retrieved data is identical to the stored data, it is not about access or uptime but about preserving correctness and detecting alteration-which is precisely the integrity objective in Microsoft's Security, Compliance, and Identity guidance.

In Microsoft's cloud security terminology, Cloud Security Posture Management (CSPM) is the solution specifically designed to perform continuous security assessments of cloud resources and generate alerts when misconfigurations or vulnerabilities are detected. In Microsoft Defender for Cloud, the CSPM capabilities continuously analyze Azure, multi-cloud, and hybrid resources against built-in security benchmarks and regulatory standards. The platform evaluates configurations, detects insecure settings, missing protections, and exposure paths, then raises security recommendations and alerts so administrators can remediate issues that increase risk.
Microsoft's security and SCI learning content describes CSPM as providing "continuous assessment, visibility, and guidance to improve the security posture of your cloud environment," including automatic alerting when high-risk issues or vulnerabilities are found. These assessments are mapped to standards and best practices, helping organizations reduce risk proactively instead of waiting for an active attack.
By contrast, DevSecOps is a practice or methodology, not a specific product. A Cloud Workload Protection Platform (CWPP) focuses on runtime protection of workloads such as VMs, containers, and PaaS services. A SIEM solution (like Microsoft Sentinel) ingests and correlates logs and alerts from many sources but does not itself perform the core security posture assessments of cloud configurations. Therefore, the SCI domain clearly aligns this function with CSPM.

Explanation:

Microsoft states that Identity Protection is used to "detect potential vulnerabilities affecting your organization' s identities, configure automated responses, and investigate suspicious actions related to your organization's identities." It evaluates user risk and sign-in risk using detections such as "leaked credentials, anonymous IP address, unfamiliar sign-in properties, [and] impossible travel." These built-in detections confirm that the service can detect whether valid user credentials have been found in public or criminal datasets-commonly referred to as leaked credentials-thereby reducing identity compromise risk.
Identity Protection includes policy controls that "automate the response to detected risks," specifically the User risk policy and Sign-in risk policy. Microsoft describes that these policies can "require password change when user risk is detected" and "require multi-factor authentication when sign-in risk is detected." Therefore, Identity Protection can invoke MFA based on risk as part of Conditional Access-backed risk policies.
However, Identity Protection does not perform group lifecycle management. Microsoft positions group membership automation under Azure AD dynamic groups/Identity Governance, not Identity Protection.
Consequently, adding users to groups based on risk level is not a function of Identity Protection, which focuses on detection, risk evaluation, and policy-driven remediation (e.g., MFA or password reset), not group assignment.

Explanation:

Microsoft describes Identity Protection as a capability that "detects risky users and risky sign-ins using real- time and offline detections and allows you to configure automated responses." Microsoft is explicit that detections aren't limited to after authentication; rather, signals are evaluated during sign-in and also by offline analytics, where "some detections are offline and can take up to 48 hours to appear." Therefore, saying it only
"generates risk detections once a user is authenticated" is incorrect.
For risk scoring, Microsoft states that Identity Protection "assigns a risk level to each detection," and that
"risk levels are Low, Medium, or High," which are then used by user-risk and sign-in-risk policies to drive remediation (for example, requiring password change or MFA).
Microsoft also defines the two core risk concepts: "User risk represents the probability that a given identity or account is compromised," while "Sign-in risk represents the probability that a given authentication request isn' t authorized by the identity owner." These definitions underpin Conditional Access and Identity Protection policies that can require additional verification or block access based on the assessed risk.
Taken together, the documentation confirms: detections are not restricted to post-authentication (No), detections carry Low/Medium/High levels (Yes), and user risk is the probability the identity is compromised (Yes).