AZ-500 Manage identity and access Practice Question
A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?
⚠ Common exam trap
It's easy for candidates to confuse 'User risk' with 'Sign-in risk' or incorrectly combine 'Block access' with other grant controls, failing to realize that 'Block access' must be the sole grant control and that excluding trusted locations is the correct way to scope the policy to untrusted locations only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.
It combines a condition for 'User risk' set to 'High' with an exclusion of 'All trusted locations' under the 'Locations' condition, then grants 'Block access'. This ensures that the block only applies when the sign-in originates from an untrusted location, meeting the requirement to automatically block sign-ins for high-risk users only from locations not in the company's trusted IP list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.
Why it's wrong here
This policy incorrectly requires both user risk High and sign-in risk High to block. In Azure AD Identity Protection, user risk reflects a user's historically assessed compromise likelihood, whereas sign-in risk reflects real-time risk of a specific authentication attempt. If a high user-risk account signs in with low sign-in risk, this policy would not block it, violating the requirement. Additionally, there is no exclusion for trusted locations, so sign-ins from corporate IPs that meet the risk conditions would also be blocked.
- ✓
Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.
Why this is correct
This is correct because it combines the specific condition—User risk High—with a location exclusion for all trusted IP ranges, ensuring the block only applies to sign-ins that originate from untrusted locations. Conditional Access evaluates the user risk condition and the location condition together, and with the grant control set to Block access, any matching sign-in is denied. This matches the requirement precisely: only high user risk accounts attempting sign-in from outside the corporate network are blocked.
- ✗
Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.
Why it's wrong here
In Conditional Access, the Grant section enumerates access controls and you cannot combine 'Block access' with 'Require multi-factor authentication' in the same policy—Block access is an exclusive grant that denies the authentication outright. Even if you attempted to use MFA as an alternative, requiring MFA would allow the session to proceed if the user satisfies MFA, contradicting the goal of blocking high risk users. Moreover, this option lacks the trusted location exclusion, so the policy would apply to all locations, which is not aligned with the requirement to exclude trusted networks.
- ✗
Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.
Why it's wrong here
This policy does not include any user risk condition; it targets every user and every location ('Any location'), and sets the grant to Block access. That would effectively deny all sign-ins across the entire organization, including from trusted locations and for users with no risk, which is far more restrictive than the stated requirement. The correct policy must first scope to high user risk and then exclude trusted locations, not block everyone indiscriminately.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.