Exam MS-101 All Questions

View all questions & answers for the MS-101 exam

Exam MS-101 topic 1 question 27 discussion

Actual exam question from Microsoft's MS-101

Question #: 27
Topic #: 1

HOTSPOT -
You have the Microsoft Azure Active Directory (Azure AD) users shown in the following table.

Your company uses Microsoft Intune.
Several devices are enrolled in Intune as shown in the following table.

The device compliance policies in Intune are configured as shown in the following table.

You create a conditional access policy that has the following settings:
✑ The Assignments settings are configured as follows:
1. Users and groups: Group1
2. Cloud apps: Microsoft Office 365 Exchange Online
3. Conditions: Include All device state, exclude Device marked as compliant
✑ Access controls is set to Block access.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1: Yes.
User1 is in Group1. The Conditional Access Policy applies to Group1. The Conditional Access Policy blocks access unless the device is marked as compliant.
BitLocker is disabled for Device1. Device1 is in Group3 which is assigned device Policy1. The BitLocker policy in Policy1 is not configured so BitLocker is not required.
Therefore, Device1 is compliant so User1 can access Exchange online from Device1.
Box 2: No.
User1 is in Group1. The Conditional Access Policy applies to Group1. The Conditional Access Policy blocks access unless the device is marked as compliant.
BitLocker is disabled for Device2. Device2 is in Group4 which is assigned device Policy2. The BitLocker policy in Policy2 is Required so BitLocker is required.
Therefore, Device2 is not compliant so User1 cannot access Exchange online from Device2.
Box3: Yes.
User2 is in Group2. The Conditional Access Policy applies to Group1. The Conditional Access Policy does not apply to Group2. So even though Device2 is non- compliant, User2 can access Exchange Online using Device2 because there is no Conditional Access Policy preventing him/her from doing so.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/conditions

by Prianishnikov at April 2, 2021, 9:17 a.m.

Comments

Submit Cancel

Goena

Highly Voted 4 years, 2 months ago

Yes: user 1 is member of group 1 No: user 1 is member of group 1 but device 2 is not compliant Yes: user 2 is not member of group 1

upvoted 39 times

...

Prianishnikov

Highly Voted 4 years, 2 months ago

YES-NO-YES

upvoted 15 times

...

OomensRob

Most Recent 1 year, 10 months ago

just to clarify: Conditional Access policies are triggered by a condition which enforces a rule (access granted/not granted/MFA required etc.) Compliance Policies apply a state to a device (Compliant/Non-Compliant). Like a sticker on the device. It doesn't DO anything to the device other than applying the sticker (I appreciate that this is not 100% accurate but in the given context of the question it is). You can apply Conditional Access Policies BECAUSE a device has the sticker, but it's not mandatory. You can have non-compliant devices without any problems signing in to anything. User 2 may be non-compliant, but there is no policy preventing anything for user 2. Y-N-Y

upvoted 1 times

...

Kevinfm_81

2 years, 12 months ago

My thought is Y,N,N. Wouldn't User 2 default to the Intune Device Policy?

upvoted 4 times

...

J_IOIT

3 years, 1 month ago

'Device state' has been depreciated, replaced with filter for devices now. https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#device-state-deprecated

upvoted 1 times

...

venwaik

3 years, 1 month ago

Y,N,N. box3: User2 does not have the conditional access policy affecting him, but he does have the compliance policy (policy 2) affecting him. This policy states that device2 is required to have bitlocker enabled. This device hasn't and User2 cannot access MS Exchange Online because of that. Third answer should be NO.

upvoted 2 times

venwaik

3 years, 1 month ago

Keep in mind that you can mark devices with no compliance policy assigned. If the question would've state that, the answer on box3 was YES. The question doesn't and policy4 is affecting device2 on bitlocker level, so the answer on box3 is NO.

upvoted 2 times

...

Chipper

3 years, 7 months ago

Why is user 1 yes? The access control is specified to block access. Am I missing something?

upvoted 1 times

Chipper

3 years, 7 months ago

Nevermind, I see why now....

upvoted 4 times

...

[Removed]

3 years, 7 months ago

If "✑ Access controls is set to Block access.", doesn't this mean that All Users in Group 1 cannot access Exchange Online in the first place? So NNN should be the answer?

upvoted 3 times

chewitt

2 years, 4 months ago

So User 1 will be able to access exchange online IF the device is compliant. Groups 3 & 4 are groups for what makes the device compliant.

upvoted 1 times

...

us3r

3 years, 8 months ago

Y. N. Y.

upvoted 2 times

...

scottims

4 years, 1 month ago

Yes-No-No while the policy is assigned to user Group 1, device 2 is not compliant as Policy 4 requires BL to be enabled.

upvoted 1 times

bellorg

4 years, 1 month ago

CA policy works in the name of user, so if user is not in group CA policy don't apply.

upvoted 2 times

LillyLiver

3 years, 4 months ago

True, but the compliance police is requiring BitLocker, which is disabled on device2. So Device2 is marked as non-compliant and not allowed. Answer is Y,N,N.

upvoted 2 times

dyers

2 years, 8 months ago

Just because the device is non-compliant, it still will not match the CA, so those rules don't even apply. CA kind of builds from the top down, who matches the policy? Group 1 (User 1), then you apply conditionals, all device states except compliant. But you see how user 3 instantly fails to match the user or group category so no CA is applied and with no CA a licensed user can log in to exchange. So YNY

upvoted 3 times

...

keefe

4 years, 1 month ago

same, YNN, because Policy2 is required and assigned to G4 where Dev2 is member of

upvoted 1 times

...

AnoniMouse

4 years, 1 month ago

I think the answer should be YES, NO, YES, here is why: User1 is a member of Group1 (where the policy is assigned). Device1 belongs to Group3 which has Policy1 that doesn't enforce BL so if BL is disabled it doesn't matter thus this device according to Policy1 is compliant. User1 is a member of Group1 (where the policy is assigned), but Device2 is a member of Group4 which has a policy that requires BL to be ON but it is off, so it is NOT compliant. So even if the user is compliant, the device is NOT, hence User1 from Device2 cannot access User2 is a member of Group2 and there is no conditional access for this group, so there is nothing to evaluate, hence Users2 should be able to access the application from both devices actually

upvoted 9 times

...

ALPHA_DELTA

4 years, 2 months ago

User1 can access Microsoft Exchange Online from Device1: Yes, because Device 1 is member of group 3. Policy 1 is assigned to group 3, policy 1 does not require Bitlocker encryption thus Device is 1 compliant. The conditional access policy conditions exclude Devices marked as compliant, thus access is allowed. User1 can access Microsoft Exchange Online from Device2: No, because Device 2 is a member of Group 4. Policy 2 is assigned to group 4, policy 2 requires Bitlocker encryption, Device 2 does not have bitlocker encryption thus is Device 2 marked as non compliant. Conditional access policy Access controls is set to Block access, so Device 2 is not allowed. User2 can access Microsoft Exchange Online from Device2: No, because Device 2 is non compliant (see answer above why) and also User 2 is not in group 1 and thereby is also not allowed access.

upvoted 5 times

Prianishnikov

4 years, 2 months ago

No, YES-NO-YES

upvoted 3 times

...

PersonT

4 years, 2 months ago

last one: depends how the tenant has configured " Mark devices with no compliance policy assigned". According to below devices with no compliance policy assigned are marked as Compliant (default). Checked in my lab and its true, so Yes.. https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

upvoted 1 times

PersonT

4 years, 2 months ago

misread. its no.

upvoted 1 times

...

ALPHA_DELTA

4 years, 2 months ago

I was wrong, its Y-N-Y

upvoted 3 times

...

PP39

4 years, 2 months ago

the answer is incorrect, should Yes NO Yes

upvoted 2 times

...

bkrich

4 years, 2 months ago

I also think its YES-NO-YES User1 / Device1 = Yes, because the conditional access policy is scoped for Group1 and User1 is a member. Using Device1 which is apart of Group3, Group3 bitlocker is Not Configured so it should be compliant and pass the Conditional Access User1 / Device2 = No, because Device2 is apart of Group4 which requires bitlocker so it wouldn't be compliant even though User1 is apart of Group1 User2 / Device1 = Yes, because User2 is not scoped in the Conditional Access Policy being that it is apart of Group2, so I would think the conditional address wouldn't apply to users in Group2 and it will be able to access EXO regardless of the conditional access policy

upvoted 4 times

kiketxu

4 years, 2 months ago

Agreed. YES/NO/YES.

upvoted 2 times

...

AnoniMouse

4 years, 1 month ago

I think you are confusing here. The third answer should be NO. You wrote "User2 / Device1" but the question states "User2 / Device2" not device 1

upvoted 1 times

...

prabhjot

2 years, 2 months ago

It is User 2 / Device 2 ( not device 1)

upvoted 1 times

...