AZ-500 Manage identity and access Practice Question
A company has Azure AD Identity Protection enabled. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on Identity Protection risk?
⚠ Common exam trap
A common mix-up: candidates confuse 'Sign-in risk' (based on the sign-in event's characteristics like IP) with 'User risk' (based on user account compromise likelihood), leading them to incorrectly choose Option C or to think that manually listing IPs in Locations (Option B) is the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access'.
Identity Protection detects sign-ins from known malicious IP addresses and assigns a 'Sign-in risk' level (e.g., High). By adding a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access', the Conditional Access policy will automatically block those sign-ins. This directly uses Identity Protection's risk detection to enforce the block without needing to manually maintain IP address lists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access'.
Why this is correct
In Azure AD Identity Protection, a sign-in from a known malicious IP is one of the real-time sign-in risk detections that raises the sign-in risk level to High. A Conditional Access policy with the 'Sign-in risk' condition set to High and a grant control of 'Block access' enforces a block on that specific risky sign-in, exactly meeting the requirement. This is the correct risk-based control because it relies on Identity Protection's detection rather than a static list.
- ✗
Add a condition for 'Locations' and specify the known malicious IP ranges as 'Blocked locations'.
Why it's wrong here
Configuring a Conditional Access 'Locations' condition with the known malicious IP ranges as blocked locations is a static, list-based control. It does not evaluate Identity Protection's sign-in risk detection, so it would block or allow sign-ins solely on source IP match, not on risk. Additionally, it creates administrative overhead because the IP list must be manually maintained, whereas Identity Protection dynamically identifies malicious IPs as part of its detection.
- ✗
Add a condition for 'User risk' set to 'High' and a grant control of 'Require multi-factor authentication'.
Why it's wrong here
'User risk' reflects the likelihood that the user account itself is compromised based on signals like leaked credentials, not the risk of a particular sign-in event. A sign-in from a known malicious IP triggers 'Sign-in risk,' not user risk, so this condition would not evaluate the attack described. Furthermore, the grant control 'Require multi-factor authentication' only asks for MFA; it does not block the sign-in, so even if user risk were high, the stated intent to block would be unmet.
- ✗
Add a condition for 'Device state' set to 'Not compliant' and a grant control of 'Block access'.
Why it's wrong here
The 'Device state' condition filters on whether the device is compliant or hybrid Azure AD joined, which is unrelated to the sign-in's risk level or the source IP. A Conditional Access policy with 'Not compliant' and 'Block access' would block all sign-ins from non-compliant devices, including legitimate users, without ever consulting Identity Protection's sign-in risk detections. This approach does not target the known malicious IP scenario and is therefore incorrect.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.