AZ-305 Practice Question: Design identity, governance, and monitoring solutions
An organization wants to enforce MFA only when sign-in risk is medium or high. Which Microsoft Entra capability should be used?
⚠ Common exam trap
Many candidates confuse Azure RBAC (which controls resource access) with Conditional Access (which controls authentication and session conditions), leading them to pick a permission-based option instead of the risk-based policy engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access with Identity Protection risk signals
Conditional Access policies can integrate with Microsoft Entra Identity Protection risk signals to enforce MFA based on the calculated sign-in risk level (low, medium, high). When the risk is medium or high, the policy triggers MFA, meeting the requirement precisely. This is the only Microsoft Entra capability that directly uses risk-based conditional enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC deny assignments only
Why it's wrong here
Azure RBAC deny assignments are designed to enforce resource-level actions, such as blocking a user from creating virtual machines or accessing storage, by overriding role assignments. However, sign-in risk is an authentication-time signal computed by Azure AD Identity Protection before any resource authorization occurs. Deny assignments cannot inspect session risk or trigger MFA; they simply revoke permission to perform specific Azure resource operations.
- ✓
Conditional Access with Identity Protection risk signals
Why this is correct
Conditional Access policies can directly reference Identity Protection sign-in risk levels (low, medium, high) and evaluate them during the authentication event. Configuring a policy to require MFA when sign-in risk is medium or high achieves the exact requirement, while optionally adding a block action for high risk. This is the built-in Azure AD mechanism for dynamic, risk-based step-up authentication.
- ✗
Access reviews only
Why it's wrong here
Access reviews are a governance tool that periodically audits and recertifies a user's existing entitlements, such as group membership or application access, according to a schedule defined by an owner. They are a manual or semi-automated attestation flow, not a real-time authentication check, and they cannot intercept a sign-in attempt to prompt for MFA. Since sign-in risk is a transient property of the current sign-in event, access reviews cannot enforce risk-based MFA.
- ✗
Administrative units only
Why it's wrong here
Administrative units are Azure AD containers used to scope administrative role permissions to specific groups of users, letting you delegate management of a subset of the directory. They affect who can manage user accounts or devices, but they do not evaluate authentication events or sign-in risk signals. Without a Conditional Access policy, an administrative unit cannot require MFA or change the sign-in experience.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.