AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically detect users whose credentials have been leaked and require them to reset their password at their next sign-in. Additionally, they want to block sign-ins from anonymous IP addresses (e.g., Tor network). Which combination of Microsoft Entra ID features should they enable to meet both requirements?
⚠ Common exam trap
Candidates often confuse Conditional Access with Identity Protection risk policies, not realizing that leaked credential detection and anonymous IP blocking are native Identity Protection risk policies, not Conditional Access controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection user risk policy and sign-in risk policy
Identity Protection user risk policy can automatically detect leaked credentials and force a password reset at next sign-in, while the sign-in risk policy can block sign-ins from anonymous IP addresses (e.g., Tor). These two policies together address both requirements without needing additional Conditional Access or MFA policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access with MFA policy and Identity Protection sign-in risk policy
Why it's wrong here
While Conditional Access can be configured to require MFA when a sign-in risk level matches, it cannot itself force a user password reset; that is an Identity Protection user-risk remediation action. The sign-in risk policy in Identity Protection can block sign-ins from anonymous IPs, but MFA and sign-in risk policies do not detect leaked credentials trigger a password change. Therefore this combo partially addresses anonymous IPs but completely misses the mandatory password reset requirement.
- ✓
Identity Protection user risk policy and sign-in risk policy
Why this is correct
Identity Protection's user risk policy evaluates signals such as leaked credentials and, when the user risk score is elevated, automatically requires the user to perform a secure password change during sign-in. Its sign-in risk policy independently assesses real-time signals, including anonymous IP addresses, and can block the sign-in. Together, these two policies directly and automatically enforce both stated requirements, making this the correct answer.
- ✗
Privileged Identity Management and Conditional Access
Why it's wrong here
Privileged Identity Management focuses exclusively on just-in-time, time-bound activation of privileged Azure AD roles and Azure resource roles, not on detecting leaked credentials or enforcing security actions for regular users. Conditional Access can add MFA or block sign-ins, but without an Identity Protection user risk policy it cannot trigger a password reset due to elevated user risk. This combination lacks anything that addresses the mandatory password reset scenario.
- ✗
Microsoft Entra ID Connect Health and Identity Protection
Why it's wrong here
Microsoft Entra ID Connect Health provides operational monitoring of hybrid identity components such as AD FS and Connect sync, alerting on health issues but not offering any risk-based access controls. Identity Protection provides risk detections, but merely having it enabled is insufficient; you must configure the user risk and sign-in risk policies to force password resets and block anonymous IPs. This pairing does not include those enforcement policies and therefore cannot meet the requirements.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.