AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically block sign-ins from anonymous IP addresses (e.g., Tor) and force users from risky sign-ins to reset their password. They want to minimize administrative effort and use built-in features. Which Microsoft Entra ID feature should they enable?
⚠ Common exam trap
Many exam-takers confuse Conditional Access policies with Identity Protection risk policies, assuming that location-based blocking can replace dynamic risk detection, but Conditional Access lacks the built-in anonymous IP detection and automated password reset triggers that Identity Protection provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Protection risk policies (sign-in risk and user risk).
Microsoft Entra ID Identity Protection provides built-in risk policies that automatically detect and block sign-ins from anonymous IP addresses (e.g., Tor) via the sign-in risk policy, and force password reset for users flagged with high user risk via the user risk policy. These policies operate without manual intervention, minimizing administrative effort while leveraging Premium P2 capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Identity Protection risk policies (sign-in risk and user risk).
Why this is correct
Identity Protection includes built-in policies that automatically detect sign-in risks (including anonymous IP addresses) and user risks (e.g., leaked credentials). The sign-in risk policy can block the sign-in, and the user risk policy can require a password reset. This minimizes manual configuration.
- ✗
Conditional Access policies with locations and grant controls.
Why it's wrong here
Conditional Access can block specific IP ranges but cannot automatically detect anonymous proxies like Tor as a built-in risk. It would require custom IP lists and does not trigger password reset based on user risk. Identity Protection is needed for risk detection.
- ✗
Microsoft Entra ID Privileged Identity Management (PIM).
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time activation, approval workflows, and MFA enforcement for Azure AD roles and Azure resources, but it is fundamentally an identity governance tool, not a risk detection engine. It does not evaluate sign-in risk signals such as anonymous IP addresses or leaked credentials, nor does it automatically block a sign-in or force a password reset. In this scenario, the required capabilities are precisely those of Identity Protection risk policies—not PIM's role-activation lifecycle.
- ✗
Microsoft Entra ID Access Reviews.
Why it's wrong here
Access Reviews are periodic, scheduling-based attestations where owners confirm whether users still need access to groups, applications, or roles; they are designed for compliance and certification, not for real-time security enforcement. They do not inspect risk signals like an anonymous IP (e.g., a Tor exit node) at sign-in time, and they cannot automatically revoke a session or request a password change when leaked credentials are detected. Because the company needs immediate, automatic response to detected risks, Access Reviews are irrelevant here.
Go deeper
Related to this question
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.