Exam AZ-500 topic 2 question 7 discussion

To support the third answer. Yes, if a user signs in from a computer containing malware that is communicating with bot servers, the user should change their password. This is an important security measure for several reasons: Malware on the computer may include keyloggers or other tools that can capture passwords as they are entered1. The malware communicating with bot servers indicates an active security breach, which could potentially expose sensitive information including login credentials2. Changing passwords is a crucial step in securing accounts after a potential compromise3. User3 = Yes

"##Sign-ins from infected devices This risk event type identifies sign-ins from devices infected with malware, that are known to actively communicate with a bot server. This is determined by correlating IP addresses of the user’s device against IP addresses that were in contact with a bot server. This risk event identifies IP addresses, not user devices. If several devices are behind a single IP address, and only some are controlled by a bot network, sign-ins from other devices my trigger this event unnecessarily, which is the reason for classifying this risk event as “Low”." https://github.com/toddkitta/azure-content/blob/master/articles/active-directory/active-directory-identityprotection-risk-events-types.md

Exactly,any event not related to credentials leakage, we may say as Low Risk Level.

Infected Devices: Medium Risk

No. The only Low Risk Level is Sign-ins from IP addresses with suspicious activity. Everything else is medium\high