mediumMultiple ChoiceObjective-mapped
MS-102 A company uses Microsoft Entra ID P2 licenses Practice Question
A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically require a password change for users with medium sign-in risk, but only when the sign-in originates from outside the corporate network. Users with high sign-in risk should be blocked entirely. A group of break-glass accounts must be excluded from all policies. Which feature should the administrator implement?
⚠ Common exam trap
Candidates often confuse Identity Protection risk policies (which lack location scoping) with Conditional Access policies (which support both risk and location conditions), leading them to select Option B despite its inability to meet the location requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies with sign-in risk and location conditions
Conditional Access policies in Microsoft Entra ID allow combining sign-in risk conditions with location conditions (e.g., 'Not trusted IPs' or 'All trusted locations' set to false) to target only sign-ins from outside the corporate network. The policy can be configured to require a password change for medium risk and block access for high risk, while excluding break-glass accounts via the 'Exclude' tab using a dedicated group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access policies with sign-in risk and location conditions
Why this is correct
Conditional Access policies are the actual enforcement layer for risk-based access controls in Microsoft Entra ID. The sign-in risk condition, calculated in real time by Identity Protection, can be combined with location conditions such as named locations or trusted IPs to require MFA, force a password change, or block access entirely. This is the correct approach because it directly applies risk and geographic context to the authentication request, and your P2 licenses include the required risk detection features.
- ✗
Identity Protection risk policies
Why it's wrong here
While Identity Protection defines risks, the actual enforcement policies are created in Conditional Access using risk conditions. However, Identity Protection can create user risk policies directly. For sign-in risk, the policy is created in Conditional Access.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is designed for just-in-time and time-bound activation of privileged roles, such as Global Administrator or Role Administrator, with approval workflows and MFA on role activation. It does not evaluate sign-in risk or location conditions as part of the access decision for normal user sign-ins. PIM is therefore not a substitute for risk-based Conditional Access policies.
- ✗
Azure AD Identity Governance
Why it's wrong here
Azure AD Identity Governance provides identity lifecycle controls, including access reviews, entitlement management, and certification campaigns, to ensure that users have the right access over time. It does not perform real-time risk evaluation of individual sign-in attempts. While it complements Conditional Access by governing access after it is granted, it cannot respond to sign-in risk or location conditions during authentication.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.