An analyst sees a risky sign-in and a risky user classification. Which distinction is correct?

1. Sign-in risk concerns a particular authentication event; user risk concerns the likelihood the identity is compromised
2. Both values mean the user's subscription budget is exceeded
3. User risk automatically proves every activity is malicious
4. Sign-in risk is solely a storage encryption setting