A county employee account attempts to sign in at 03:00 from a country the worker has never visited. What access-control response best reflects a risk-based decision?
Select an answer to reveal the explanation.
Short Explanation
Weird hour plus brand-new country is the security desk tapping you on the shoulder: prove it is really you. Risk-based access does not panic-delete the IdP—it steps up auth or holds the session until the risk looks normal again.
Full Explanation
Risk-based (adaptive) access control adjusts authentication and authorization strength using signals such as impossible travel, unusual hours, device posture, or threat intel. Step-up MFA or temporary denial until risk clears preserves availability for legitimate users while containing account takeover. Ignoring risk after a password match, or overreacting by shutting down the IdP or collapsing to shared logons, fails that balance.