The proposed sequence is incorrect because the administrator should not first apply the Identity Profile's Block Access From settings before defining the underlying network and geography restrictions.

Identity Security Cloud tenant restrictions are configured in two logical stages. First, the organization defines the networks and geographic rules that determine what locations are trusted or untrusted. Network restrictions are based on configured IP address ranges, while geographic restrictions can use trusted or blocked-country definitions. After these global security definitions exist, restrictions are applied to specific user populations through their Identity Profiles.

The Identity Profile does indeed contain Block Access From options such as Off Network and Untrusted Geography, so that part of the statement identifies a real configuration location. However, SailPoint explicitly warns that enabling Off Network without first defining an applicable network can block all users associated with that identity profile from accessing Identity Security Cloud.

Therefore, selecting Block Access From is a required application step, but describing it as the first configuration action makes the proposed solution invalid.

Study Guide Reference: Access Management — Restricting Tenant Access, Network Definitions, Geographic Restrictions and Identity Profile Security.

===============