Sign-in risk policy is the correct option.

Sign-in risk policy examines individual authentication events and uses signals and detectors to calculate a risk score for each sign in so you can require additional controls or block access based on that per sign in analysis.

User risk policy is not correct because it assesses the risk that a user account has been compromised across events and behaviors rather than computing a risk score for each individual sign in.

Azure AD Conditional Access policy is not correct because Conditional Access is the enforcement framework that can act on risk signals but it is not the Identity Protection configuration that performs the per sign in risk calculation itself.

MFA registration policy is not correct because that policy forces or guides users to register authentication methods and does not analyze sign in signals to compute a per sign in risk score.

Full AWS Practitioner Certification Question