Exam AZ-500 topic 2 question 25 discussion

User 1 from Boston: is user 1 member of Group 1 - yes - Block is user 1 member of Group 2 - yes Exclusion takes priority - Allow Policy 1 does not apply Policy 2 Applies Policy 3 and 4 does not apply User 1 - Allowed Is user 2 member of Group 1 - No Is user 2 member of Group 2 - Yes - Exclusion takes Priority - Allow Policy 1 does not apply - Allow Policy 2 does not apply - no Result Policy 3 - User is in group 2 - but in Seattle - Policy does not apply Policy 4 - User 2 can be anywhere - Allowed with MFA User 2 allowed Is user 2 member of Group 1 - No Is user 2 member of Group 2 - Yes - Exclusion takes Priority - Allow Policy 1 does not apply - Allow Policy 2 does not apply - no Result Policy 3 - User is in group 2 - And in Boston - Policy applies - Block Policy 4 - User 2 can be anywhere - But Block Policy take precedence in Policy 3 User 2 not allowed Y - Y - N

Policy 1 & 3 - Boston location - block access so option 1 & 3 is No Option 2 - user 2 - policy 4 - require MFA and user is disabled for MFA so answ is NO for 2nd option. so according to me: N-N-N

Yes, Yes, No.

in exam 08/12/2023

Explanation: User1 can access - Remember, exclusions take precedence. Policy1 won't apply since group2 is excluded, policy2 allows, policy3 won't apply since group1 is excluded, policy4 won't apply. User2 can access - there are no policies blocking the Seattle range User2 cannot access - policy1 won't apply since group2 is excluded, policy2 allows, but policy3 blocks access for group2

In exam 13 Oct

for case1 : User1 from Boston, Policy1 is NOT applied for User1. see https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-users-groups : Exclude users When organizations both include and exclude a user or group, the user or group is excluded from the policy. The exclude action overrides the include action in policy.

TRUSTED IP LOCATIONS overrides MFA. N,Y,N The trusted IPs feature of Azure AD Multi-Factor Authentication bypasses multi-factor authentication prompts for users who sign in from a defined IP address range. You can set trusted IP ranges for your on-premises environments. When users are in one of these locations, there's no Azure AD Multi-Factor Authentication prompt. The trusted IPs feature requires Azure AD Premium P1 edition.

Y-Y-N this is the correct answer. To be sure i create the same configuration on my test tenant. Policy 1 and 3 don't work because exclusion has priority over inclusion

YYN is the answer. https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips The trusted IPs feature of Azure AD Multi-Factor Authentication bypasses multi-factor authentication prompts for users who sign in from a defined IP address range. You can set trusted IP ranges for your on-premises environments. When users are in one of these locations, there's no Azure AD Multi-Factor Authentication prompt. The trusted IPs feature requires Azure AD Premium P1 edition.

In Exam April 11, 2023

Should be Y,Y,N exclude group takes precedence over include groups

Yes Yes No

In exam 29/01/2023 + many questions about Microsoft Sentinel

Hi all, Passed my exam (13JAN2023) with 918. 50 questions (45 + 5 of a case study). Around 95% of the questions are here. I've compiled the questions and my answers in a ppt, feel free to check it out and hope it helps. https://www.dropbox.com/s/ay00xp2fnloq1ex/AZ%20500%20-%20Exam%20Topics.pptx?dl=0 Use pass az500prep to open the file. Thanks to all the people that comment on questions, I wouldn't have passed without them :)

The correct answers are Y,Y,N User1 can access - Remember, exclusions take precedence. Policy1 won't apply since group2 is excluded, policy2 allows, policy3 won't apply since group1 is excluded, policy4 won't apply. User2 can access - there are no policies blocking the Seattle range User2 cannot access - policy1 won't apply since group2 is excluded, policy2 allows, but policy3 blocks access for group2.

For the first question, Is user1 a member of group 1 - yes - Block. No more evaluation takes place after that, so question #1 is a definite NO.