AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Assign the user to the policy, set condition 'User risk level: High' and condition 'Locations: All locations except trusted', and set 'Grant' to 'Block access'

  Why this is correct

  In a Conditional Access policy, conditions are combined with a logical AND, so this configuration triggers only when Identity Protection has computed the user's account risk as High and the sign-in originates from a location that is not on the trusted list. The Grant control is set to Block access, which denies the authentication session outright rather than allowing it with additional challenges. Because user risk is a cumulative account-level signal, pairing it with the trusted-location exception precisely targets high-risk users signing in from untrusted networks while leaving trusted-network activity unaffected.

• ✗

  Assign the user to the policy, set condition 'Sign-in risk level: High' and condition 'Locations: All trusted locations', and set 'Grant' to 'Block access'

  Why it's wrong here

  This option is incorrect for two independent reasons. First, sign-in risk measures the likelihood that the current authentication attempt is compromised, whereas user risk reflects the overall likelihood that the user account has been compromised; the requirement asks for user risk, not sign-in risk. Second, setting 'Locations: All trusted locations' makes the policy apply only to sign-ins from trusted IPs or trusted locations, which means it would block trusted-network logins and completely ignore the untrusted locations you actually want to block. The policy therefore targets the wrong risk signal and the wrong location set, failing the stated requirement.

• ✗

  Assign the user to the policy, set condition 'User risk level: High' and set 'Grant' to 'Require multi-factor authentication'

  Why it's wrong here

  Setting 'Grant' to 'Require multi-factor authentication' forces the user to complete an additional authentication factor but still allows access once that factor is satisfied, so it does not meet the requirement to block access. Additionally, this option omits any location condition, which means the MFA requirement would be applied to all High user risk sign-ins regardless of whether they come from a trusted or untrusted location. The requirement is to deny access for high-risk users signing in outside the trusted network, not merely to escalate the authentication challenge.

• ✗

  Create a risk detection policy in Identity Protection that triggers a user risk policy, and have Conditional Access use the risk policy

  Why it's wrong here

  Identity Protection's user risk policy can automatically block sign-ins when user risk is high, but that policy is a standalone mechanism and does not include location conditions. The scenario explicitly asks for a Conditional Access policy that considers both user risk level and location, which requires a single Conditional Access policy with conditions for 'User risk level' and 'Locations'. There is no supported architecture where a separate Identity Protection risk policy is triggered and then 'used by' Conditional Access; Conditional Access consumes risk signals directly from Identity Protection but cannot incorporate an entirely separate risk policy as a location-aware condition.

Go deeper

Related to this question