Skip to content

Commit 32854bf

Browse files
authored
Update geographical references in knowledge check YAML
1 parent c0a2936 commit 32854bf

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

learn-pr/wwl-azure/implement-identity-based-security-azure-machine-learning/7-knowledge-check.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ quiz:
2424
- content: "Create service principals for each contractor with certificate-based authentication and Contributor role on all workspaces, storing certificates in Azure Key Vault with 90-day expiration"
2525
isCorrect: false
2626
explanation: "This option uses service principals incorrectly—these are for applications, not human users—and grants excessive permissions (Contributor instead of Reader) while complicating authentication unnecessarily."
27-
- content: "Your security team reports suspicious activity: a data scientist's account authenticated to Azure Machine Learning studio from three different countries within 2 hours, which is physically impossible. The affected user confirms their password hasn't been shared. You need to prevent this type of attack while minimizing impact on legitimate users who travel frequently for conferences. Which Conditional Access policy configuration best addresses this threat?"
27+
- content: "Your security team reports suspicious activity: a data scientist's account authenticated to Azure Machine Learning studio from three different countries/regions within 2 hours, which is physically impossible. The affected user confirms their password hasn't been shared. You need to prevent this type of attack while minimizing impact on legitimate users who travel frequently for conferences. Which Conditional Access policy configuration best addresses this threat?"
2828
choices:
2929
- content: "Create a policy requiring compliant device plus MFA for all Azure Machine Learning access from any location, with session sign-in frequency set to 1 hour to force frequent reauthentication"
3030
isCorrect: false
3131
explanation: "This option creates excessive friction—hourly reauthentication disrupts long-running training jobs and doesn't specifically address the geographic impossibility threat."
32-
- content: "Block all Azure Machine Learning access from locations outside your company's home country, with no exceptions, and require VPN connectivity for international travelers"
32+
- content: "Block all Azure Machine Learning access from locations outside your company's home country/region, with no exceptions, and require VPN connectivity for international travelers"
3333
isCorrect: false
3434
explanation: "This option completely prevents legitimate international collaboration and conference attendance, contradicting business requirements while creating VPN performance bottlenecks."
3535
- content: "Implement risk-based sign-in policy that requires MFA for medium and high-risk authentications, combined with Impossible Travel anomaly detection that automatically blocks suspicious sign-ins pending security review"
@@ -45,4 +45,4 @@ quiz:
4545
explanation: "This option improves on client secrets through certificate authentication but still requires credential storage and retrieval code, adding complexity without achieving credential-free authentication available through managed identity."
4646
- content: "Create user-assigned managed identity with Owner role on the entire Azure subscription to ensure it has permissions for all current and future pipeline requirements"
4747
isCorrect: false
48-
explanation: "This option violates least-privilege by granting excessive Owner permissions at subscription scope—the pipeline doesn't need ability to delete resources or modify security settings, and user-assigned identity adds management overhead compared to system-assigned for single-resource scenarios."
48+
explanation: "This option violates least-privilege by granting excessive Owner permissions at subscription scope—the pipeline doesn't need ability to delete resources or modify security settings, and user-assigned identity adds management overhead compared to system-assigned for single-resource scenarios."

0 commit comments

Comments
 (0)