Exam SC-300 topic 2 question 27 discussion

Anonymous IP triggers sign-in risk policy (not user risk policy) So user1 gets only user risk policy —> not affected, can login YES User2 affected by the sign-in risk policy, and has no MFA so cannot login NO User 3 gets both policies, but only policy 2 is used for the anonymous IP, and he has MFA, so can login YES Ref: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

Sign-in from an anonymous IP address falls into Sign-in risk. This means only members of Group 2 will be affected by Identity Protection. User1 can log in from any IP as user’s IP is not scrutinized. The user is not in scope of Sign-In policy. User2 cannot login. This user is in scope of the Sign-In policy and will be challenged to perform MFA. Since MFA is disabled, MFA challenge will be unsuccessful – login fails. User3 can log in. This is user is also in scope of the Sign-In policy, but since user’s MFA is working (hence assuming a successful MFA challenge) the user will be granted access. I’d say: Y-N-Y

YES NO YES

Anonymous IP applies to "Sign-in Risk Policy" ONLY Yes - User1 is not a member of Group2, so they are not affected by Group2 Sign-in Policy and can sign in No - User2 is a member of Group2 and does not have MFA enabled, so they are blocked from sign-in Yes - User3 is a member of Group2 and has MFA, so they can login

i'll go with yes no yes, as they assume that user1/3 are already logged in the scope of the policy, so the user-risk policy has nothing to do with anonimous ips

Definitely YES NO YES.. 1) Yes- ---User1 is not member Group2. So, when User1 login via Anonymous IP User Sign-in policy isn't applied for this user and can login without any interrupt. 2) No- ---User2 is member of Group2 which is Risky sing-in policy applied due to login via Anonymous IP and User2 MFA disabled which related policy asks for but user2 won't be able to complete for sign-in. 3) Yes- ---User3 is member of Group2 which is Risky sing-in policy applied due to login via Anonymous IP and User3's MFA is enabled and in use. So, this user can continue with MFA once it asked by the Risky sign-in policy.. Note: User Risky Policy works based on Leaked credentials and Azure AD threat intelligence according to on user risk level. Check Microsoft Learn for more info. Note2: Risky Sign-in Policy works based on Anonymous IP address Atypical travel, Malware, linked IP address, Unfamiliar sign-in properties, Leaked credentials, and Password spray. It triggered according to each login attempt's source, method etc.

All seems correct about what is said for user 1 and 3, But I don't agree on user 2.... User 2 has the status disabled, this simply means MFA is not enforced, but it can still be used. To quote MS: "When the MFA status is disabled, it means that the user is not required to provide additional authentication beyond their password to access their account. However, it is possible that MFA is still being used in some capacity, such as for certain applications or services." Disabled only means the user is not enrolled in per-user MFA, but it doesn't mean MFA is not configured... https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates So answer "should" be Y-Y-Y... but you neven know what MS is after so it is always a gamble.. It is not like you can defend your answer.

Even the reference provided in the answer says sign in risk prompts for MFA if configured which it is. So its YNY

Yes No Yes

Yes No Yes

# 2 should be no Makes sure users are registered for Azure AD Multi-Factor Authentication. If a sign-in risk policy prompts for MFA, the user must already be registered for Azure AD Multi-Factor Authentication.

para mi la respuesta correcta es Yes, No, Yes

Yes No Yes

The correct answer is Yes - No - No I agree with zokaniedereenhet: User 3 is member of both group 1 and 2. Group 1 had blocking action. Block wins over grant so user can't login. https://danielchronlund.com/2018/11/23/how-multiple-conditional-access-policies-are-applied/

I agree given answer (Y,N,N) is correct. User 3 is member of both group 1 and 2. Group 1 had blocking action. Block wins over grant so user can't login. https://danielchronlund.com/2018/11/23/how-multiple-conditional-access-policies-are-applied/

Given answer is correct!