Exam MD-101 topic 6 question 5 discussion

Actual exam question from Microsoft's MD-101

Question #: 5
Topic #: 6

HOTSPOT
-

You have an Azure AD tenant that contains the users shown in the following table.

You have the devices shown in the following table.

You have a Conditional Access policy named CAPolicy1 that has the following settings:

• Assignments
o Users or workload identities: User1, User2
o Cloud apps or actions: Office 365 Exchange Online
o Conditions: Device platforms: Windows, iOS
• Access controls
o Grant: Require multi-factor authentication

You have a Conditional Access policy named CAPolicy2 that has the following settings:

• Assignments
o Users or workload identities: User1, User2
o Cloud apps or actions: Office 365 Exchange Online
o Conditions
• Device platforms: Android, iOS
• Filter for devices
• Device matching the rule: Exclude filtered devices from policy
• Rule syntax: device.displayName – contains "1"
• Access controls
• Grant: Block access

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Show Suggested Answer

Suggested Answer:

by RoGr at April 23, 2023, 9:30 a.m.

Comments

Submit Cancel

Amir1909

1 year, 4 months ago

No Yes No

upvoted 1 times

...

4D33L

1 year, 10 months ago

I'd say it's NNN. The third question is easy to get fooled on. Device2 would be blocked because it's IOS and it's not being filtered. Read carefully

upvoted 3 times

...

dlast

1 year, 12 months ago

NNY First 2 answers are no because Device1 is Android which is not included in CAPolicy1. Second is Y because CAPolicy2 only applies to Device2

upvoted 1 times

dlast

1 year, 11 months ago

I'm considering that 3rd question might be No. This because in the 2nd policy it states that device 1 excluded leaving device 2 included, meaning the block will apply.

upvoted 1 times

...

e635466

2 years ago

N -> CAPolicy1 is not for Android AND CAPolicy2 device1 is filtered so this device has access without MFA beacause MFA is disabled on User1 Y -> Same as the first but with MFA because it's enabled on User2 N -> CAPolicy requires MFA but User2 has is enabled. CAPolicy2 blocks access. Policy2 overrules Policy1 (most restrictive)

upvoted 4 times

picho707

1 year, 7 months ago

Policy1 => User1/User2 => Win/IOS => MFA Policy2 => User1/User2 => Andriod/IOS > Exclude devices with a "1" in the name. Exclude Device1. User1 = MFA Disable User2 = MFA Enforced User1 / Device1 = MFA Disabled / Device1 Excluded = No User2 / Device1 = MFA Enforced / Device1 Excluded = Yes Use2 / Device2 = MFA Enforced / Device2 Blocked = No

upvoted 3 times

...

RoGr

2 years, 1 month ago

I'd say NNY

upvoted 4 times

...