What will happen when a user attempts to log In to Salesforce from an IP address that is outside the login IP range on the user's profile but within the organization-wide trusted IP range?

Since the profile-level IP restriction prevents login, the user will not be able to access Salesforce, making any activation processes irrelevant.

Answering a security question is a part of identity verification for untrusted IPs, but if login is blocked by profile IP restrictions, the user cannot even reach the identity verification step.

When a user attempts to log in from an IP address outside their profile's specified login IP range, Salesforce will deny access immediately. Profile-level IP restrictions are a stringent security control that overrides the broader organization-wide trusted IP range for direct login, meaning the user will not be able to log in at all.

The user will be denied login access due to profile IP restrictions, so the system activation process, which is typically bypassed by trusted IP ranges anyway, will not occur.