CAS-005: CompTIA SecurityX

The sign-in records show the affected user's traffic repeatedly originating from an IP address that the authentication server geo-tags as Germany even though the account is assigned a France location, triggering blocks despite MFA being satisfied each time. Because that pattern only affects location-based evaluation and not MFA or device status, inaccurate IP-to-location mapping in the authentication service best explains the recurring false blocks.