A company wants to implement Azure AD Identity Protection. Following are the key requirements: Prompt users if the credentials are compromised
Identify suspicious login attempts
Which of the following policies implement the above requirements? 
Choose two answers.

Answer options:

A.User risk policy
B.Azure policy
C.Sign in risk policy
D.MFA registration policy

Answer: A, C 
Option A is CORRECT, it is used if the credentials are compromised 
Option B is incorrect as it is a Service to create policies in Azure 
Option C is CORRECT, it is considered for any suspicious sign-ins like multiple incorrect login attempts 
Option D is incorrect, it ensures that user registers for MFA 
Reference:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa