Microsoft Updated AZ-900 Exam Questions and Answers by gurfateh

You would use the Azure Activity Log, not Azure Monitor to view which user turned off a specific virtual machine during the last 14 days.

Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more than 90 days in the past.

In this question, we would create a filter to display shutdown operations on the virtual machine in the last 14 days.

References:

https://docs.microsoft.com/en-us/ azure/azure-resource-manager/resource-group-audit

Azure AD Identity Protection includes two risk policies: sign-in risk policy and user risk policy. A sign-in risk represents the probability that a given authentication request isn’t authorized by the identity owner.

There are several types of risk detection. One of them is Anonymous IP Address. This risk detection type indicates sign-ins from an anonymous IP address (for example, Tor browser or anonymous VPN). These IP addresses are typically used by actors who want to hide their login telemetry (IP address, location, device, etc.) for potentially malicious intent.

You can configure the sign-in risk policy to require that users change their password.

References:

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy