- A
Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'
A separate policy for medium user risk applied to all users will require MFA when medium risk is detected. The existing policy will continue to block Finance users with high risk. Policy evaluation is not mutually exclusive; the block takes precedence for high risk, and the MFA requirement applies for medium risk.
- B
Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'
Why wrong: Modifying the existing policy to cover both high and medium user risk would require MFA for medium risk but would also remove the block for high risk (or require MFA for high risk, which is not the requirement). The policy cannot have different grant controls for different risk levels within the same policy.
- C
Use Identity Protection's 'User risk policy' instead of Conditional Access
Why wrong: Identity Protection's user risk policy uses the same risk levels but is applied globally. It cannot be scoped to specific departments (Finance) for the block action while requiring MFA for all users. Conditional Access is needed for the department scope.
- D
Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'
Why wrong: Blocking access for medium user risk is more restrictive than required. The requirement is to require MFA, not block.
Quick Answer
The answer is to create a second Conditional Access policy targeting all users with the condition 'User risk level: Medium' and the grant control 'Require multi-factor authentication'. This is correct because Azure AD Conditional Access policies are evaluated independently and combined at runtime, meaning the existing block policy for high-risk Finance users does not automatically address medium user risk for anyone. A separate policy is required to enforce MFA for medium risk across all users, including Finance, as the block action on high risk does not override or cascade to lower risk levels. On the AZ-500 exam, this scenario tests your understanding that user risk policies are granular and must be explicitly configured per risk level, with a common trap being the assumption that a block policy implicitly handles lower risks. Remember the memory tip: "Risk levels are like separate doors—each one needs its own key policy."
AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'
Option A is correct because Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'
Why this is correct
A separate policy for medium user risk applied to all users will require MFA when medium risk is detected. The existing policy will continue to block Finance users with high risk. Policy evaluation is not mutually exclusive; the block takes precedence for high risk, and the MFA requirement applies for medium risk.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'
Why it's wrong here
Modifying the existing policy to cover both high and medium user risk would require MFA for medium risk but would also remove the block for high risk (or require MFA for high risk, which is not the requirement). The policy cannot have different grant controls for different risk levels within the same policy.
- ✗
Use Identity Protection's 'User risk policy' instead of Conditional Access
Why it's wrong here
Identity Protection's user risk policy uses the same risk levels but is applied globally. It cannot be scoped to specific departments (Finance) for the block action while requiring MFA for all users. Conditional Access is needed for the department scope.
- ✗
Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'
Why it's wrong here
Blocking access for medium user risk is more restrictive than required. The requirement is to require MFA, not block.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often think a single policy can handle multiple risk levels with different grant controls, but Conditional Access policies enforce a single grant control per policy, so separate policies are required for different risk level actions.
Detailed technical explanation
How to think about this question
Conditional Access policies are evaluated using an 'AND' logic within a policy (all conditions must be met) and an 'OR' logic across policies (if any policy applies, the most restrictive grant control is enforced). In this scenario, a user in Finance with high risk would be blocked by the first policy, while a user with medium risk (any department) would be prompted for MFA by the second policy. The 'User risk level' condition relies on real-time risk assessments from Azure AD Identity Protection, which uses machine learning models to detect compromised credentials and other anomalies.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Manage identity and access — study guide chapter
Learn the concepts, then practise the questions
- →
Manage identity and access practice questions
Targeted practice on this topic area only
- →
All AZ-500 questions
1,000 questions across all exam domains
- →
Microsoft Azure Security Engineer Associate AZ-500 study guide
Full concept coverage aligned to exam objectives
- →
AZ-500 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-500 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Secure identity and access practice questions
Practise AZ-500 questions linked to Secure identity and access.
Secure compute, storage, and databases practice questions
Practise AZ-500 questions linked to Secure compute, storage, and databases.
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel practice questions
Practise AZ-500 questions linked to Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel.
Manage identity and access practice questions
Practise AZ-500 questions linked to Manage identity and access.
Secure networking practice questions
Practise AZ-500 questions linked to Secure networking.
AZ-500 fundamentals practice questions
Practise AZ-500 questions linked to AZ-500 fundamentals.
AZ-500 scenario practice questions
Practise AZ-500 questions linked to AZ-500 scenario.
AZ-500 troubleshooting practice questions
Practise AZ-500 questions linked to AZ-500 troubleshooting.
Practice this exam
Start a free AZ-500 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-500 question test?
Manage identity and access — This question tests Manage identity and access — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication' — Option A is correct because Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).
What should I do if I get this AZ-500 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.