You need to reduce account takeover risk using Microsoft Entra ID Protection. Requirements: block or interrupt risky sessions, require password change when a user is confirmed high-risk, and require MFA for medium and above sign-in risk. What should you implement? (Choose two)

The User risk policy in Microsoft Entra ID Protection directly addresses the requirement to require a password change for high-risk users. Scoping it to all users except a break-glass group is a standard best practice for such policies. The Sign-in risk policy directly addresses the requirement to require MFA for medium and above sign-in risk. Scoping it to all users except service accounts prevents disruption to automated processes. Turning on security defaults enforces MFA but doesn't specifically address risk-based password changes or sign-in risk levels. Creating a Conditional Access policy to block high sign-in risk users is too restrictive; the requirement is to require MFA for medium and above, not block. The legacy per-user MFA portal is not a risk-based solution and is not recommended for new configurations.