You have a Microsoft 365 subscription and Microsoft 365 E5 licenses assigned to your users. You need to enforce users with potentially compromised user accounts to reset their passwords. What should you configure? 

Answer options:

A.Identity Protection – User risk policy
B.Conditional Access – Disable legacy authentication
C.Azure AD admin center – Self service password reset
D.Identity Protection – Sign-in risk policy

Correct Answer: A 
You should create a User risk policy in Azure Identity Protection. User risk policy will detect potential risks associated with the user account and block the user or enforce password change if the associated risk is above the configured user risk level(low, medium or high): 

Option B is incorrect. This will disable legacy authentication attempt to your tenant. 
Option C is incorrect. This will enable your users to reset their own password in Azure (or even in local AD if password writeback is enabled and licensing requirements are met)
Option D is incorrect. Sign-in risk policies affects the risk associated with the sign-in, and not the user account itself. Therefor this Is not the correct answer. 
Reference: 
To know more about User risk policies, please refer to the link below: 

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies