A county employee account attempts to sign in at 03:00 from a country the worker has never visited. What access-control response best reflects a risk-based decision?

Risk-based or adaptive access control raises or lowers assurance using contextual signals—impossible travel, unfamiliar countries, odd hours, device reputation, or threat intel—without treating a correct password as sufficient proof. A county account signing in at 03:00 from a never-visited country should trigger step-up authentication (stronger MFA, out-of-band proof) or a temporary block until risk clears. That response contains likely account takeover while preserving a path for the legitimate traveler who can complete the challenge, which matches municipal availability and integrity goals better than binary all-or-nothing panic.

Silently granting full access after a password match ignores high-fidelity risk telemetry and is how credential stuffing and stolen sessions succeed against city SSO. Disabling the entire identity provider for all users until morning over-corrects: one risky session becomes a citywide outage, harming 911-adjacent and citizen services that still need identity. Converting municipal accounts to shared kiosk logons reduces alert noise only by destroying individual accountability, which worsens investigation and least-privilege practice.

Exam caveat: adaptive controls adjust authentication/authorization strength; they are not the same as permanently rewriting someone’s MAC label or deleting the IdP. Operational check: tune impossible-travel and geo-velocity policies for traveling staff and VPN egress quirks, ensure step-up challenges are phishing-resistant where feasible, log and ticket every high-risk block, and measure false-positive rates so help desk and security operations stay aligned.