Exam MS-100 topic 4 question 57 discussion

Wildcard for fabrikan*.com will not work, Wildcards are not supported for domain entries. So Answer IMHO, must be YYY References https://docs.microsoft.com/en-us/sharepoint/restricted-domains-sharing https://docs.microsoft.com/en-us/azure/frontdoor/front-door-wildcard-domain#:~:text=Azure%20DNS%20supports%20wildcard%20records,(from%20the%20wildcard%20domain). https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide

The answer is not correct. It should be N-Y-N. Fabrikam1.com is not the same domain as Fabrikam.com. Only Fabrikam.com is blocked. So [email protected] is allowed and can be invited and share collection1. Lastly, us.contoso.com is a subdomain of contoso.com. When you block a top-level domain, it will automatically block the subdomains. However, you can block a subdomain and it would not affect the top-level domain. You could see a reference below https://github.com/MicrosoftDocs/office-docs-powershell/issues/2413

I have just tested this. Edited Azure AD external collaboration settings, blocked domain = gmail*.com - After enabling this, I cannot invite guest users with domain of gmail.com (I know this is not part of the question, but just writing this to confirm what happens) Created site collection and couple test docs. - External sharing setting set to what is shown, only I have blocked sharing to protonmail.com - I can share files to anyone at gmail.com - I cannot share files to anyone at protonmail.com - I can share to email of us.protonmail.com - After sharing file to my gmail account, I received the email and could open the document after signing in with the gmail address used when sharing, and after entering a verification code. Please test yourselves and let me know if I'm wrong here, but from my testing, answers should be YYY

It is YYY, read the documentation referred to and especially the link in that article to Restricted doman sharing: https://learn.microsoft.com/en-us/sharepoint/restricted-domains-sharing Twice on that page you can read in a purple box: Wildcards are not supported for domain entries. Period, so no need to link to unrelated documentation about tenant allow/block list or whatever cause that is something completely different. Box 1: Yes, cause the Fabrikam*.com entry is invalid Box 2: Yes, cause the Fabrikam*.com entry is invalid Box 3: Yes, cause us.contoso.com should be added seperately

Answers are still correct. Wildcards are supported so a quick test on inviting a guest user worked as described.

on exam three days ago

it must be YYY , according to the exibit invitation for Fabrikam is preventet and sharing for the contoso.

Answer is: YYY Wildcards are not supported for domain entries, therefore it would work

Think we need to pay attention to the link from MallonoX - https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#url-syntax-for-the-tenant-allowblock-list Hard to argue with that.

A similar question to this was in my exam on 06/April/2022. I passed.

The answer is YYY https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#url-syntax-for-the-tenant-allowblock-list - Wildcards (*) are allowed in the following scenarios: A left wildcard must be followed by a period to specify a subdomain. For example, *.contoso.com is allowed; *contoso.com is not allowed. => fabrikam*.com is not allowed! - The tilde (~) character is available in the following scenarios: A left tilde implies a domain and all subdomains. For example ~contoso.com includes contoso.com and *.contoso.com. because the ~ is not been used: => contoso.com would be blocked => us.contoso.com would NOT be blocked!

i thought contoso.com is under blocked domain . why is it a yes ?

the answer is correct!

100% Y N Y In my tenant: gimai*.com is blocked contoso.com is blocked Guest invite sent to: gmail.com IS BLOCKED gimai.com IS ALLOWED (INVITE SENT, USER CREATED) us.contoso.com IS ALLOWED (INVITE SENT, USER CREATED)

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#url-syntax-for-the-tenant-allowblock-list Actually the answer should be Y-Y-N fabrikam*.com is not a valid syntax so 1 & 2 is YES. us.contoso.com is blcoked by contoso.com read the URL entry scenarios carefully

N-N-Y is correct, blocking fabrikam*.com means that fabrikam.com and fabrikam1.com are both not allowed. Just test it, easy peasy lemon squeezy!

the fabrikam*.com entry is invalid and would be ignored https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#url-syntax-for-the-tenant-allowblock-list