AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID. They need to automatically block sign-ins from users whose accounts have been identified as high-risk for compromise. They also want users to be prompted to reset their password when the risk is detected. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access (which handles location, device, and app conditions) with Identity Protection's risk-based policies, but only Identity Protection directly evaluates user risk and triggers automated password reset remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection with user risk policy
Identity Protection with a user risk policy is the correct feature because it allows automatic blocking of sign-ins when a user's account is flagged as high-risk by Microsoft's machine learning models. Additionally, the policy can be configured to require a secure password reset (self-service password reset) as a remediation action, directly meeting both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Protection with user risk policy
Why this is correct
Identity Protection with a user risk policy is the appropriate solution because it continuously analyzes signals such as leaked credentials and anomalous sign-in patterns to assign a risk score to each user. You can configure a user risk policy to automatically block sign-ins or require MFA and a password change when the risk level is high. This directly meets the need to automatically react to user risk without requiring manual intervention.
- ✗
Conditional Access with location policy
Why it's wrong here
A Conditional Access location policy restricts access based on the user's network origin, such as named IP ranges or geographic countries. It does not consume the user's risk score, nor does it have any logic to force a password change when an account is suspected as compromised. This makes it a poor fit because the requirement is specifically about automatically addressing user risk, not enforcing geographic boundaries.
- ✗
Microsoft Entra ID MFA
Why it's wrong here
Microsoft Entra ID MFA is an authentication control that requires a second verification factor during sign-in, but it does not evaluate the user's risk score or trigger remediation actions like blocking a high-risk user or forcing a password change. While it could be invoked by a Conditional Access policy, MFA by itself is not an identity risk engine. Therefore, it would not automatically respond to a detected user-risk condition.
- ✗
Microsoft Entra ID Privileged Identity Management
Why it's wrong here
Privileged Identity Management is designed to provide just-in-time, time-bound role activation with approval workflows for Microsoft Entra ID and resource roles. It does not monitor user risk or assess whether an identity has been compromised; it only controls when a privileged role is active. Consequently, PIM cannot automatically block a user or require a password reset based on risky behavior, making it unsuitable for this requirement.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.