Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  Only viable answer

• Chose C1

  Only viable answer.

• Chose C1

  12:09 PMClaude responded: C.C. Activity from infrequent country Why: The key phrase is "a location that was never used by other users in your organization." That's a relative comparison against your org's collective baseline — it's not about whether the country is suspicious in general, it's about whether it's unprecedented within your tenant. Activity from infrequent country does exactly that — it looks at recent sign-in locations across your organization and flags when someone authenticates from a country that no one (or almost no one) in the org has ever signed in from. It's org-baseline-aware.