SC-300 Certification Practice Question #131

Question

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table.

The users have the devices shown in the following table.

You create the following two Conditional Access policies:

•	Name: CAPolicy1
•	Assignments
  o	Users or workload identities: Group1
  o	Cloud apps or actions: Office 365 SharePoint Online
  o	Conditions
        	Filter for devices: Exclude filtered devices from the policy
        	Rule syntax: device.displayName -startsWith “Device”
  o	Access controls
        	Grant: Block access
        	Session: 0 controls selected
  o	Enable policy: On

•	Name: CAPolicy2
•	Assignments
  o	Users or workload identities: Group2
  o	Cloud apps or actions: Office 365 SharePoint Online
  o	Conditions: 0 conditions selected
•	Access controls
  o	Grant: Grant access
        	Require multifactor authentication
  o	Session: 0 controls selected
•	Enable policy: On

All users confirm that they can successfully authenticate using MFA.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

CAPolicy1 blocks Group1 but EXCLUDES devices where `device.displayName -startsWith "Device"` — a **positive** operator (StartsWith) in exclude mode. The MS Learn filter-for-devices behavior table states that with positive operators on an **unregistered device**, the device filter is **not applied** (all device properties are null because the device doesn't exist in the directory). Device1's join type is *None* (unregistered), so the exclusion can't be evaluated, CAPolicy1's block therefore applies to User1, and User1 cannot access Site1 → **No**. User2 is only in Group2, so CAPolicy1 never applies; CAPolicy2 grants access with MFA and MFA works → **Yes**. User3 is in Group1+Group2, but Device3 is Azure AD registered (a registered device), so the positive-operator filter IS evaluated, matches "Device3", and excludes User3 from CAPolicy1's block; CAPolicy2 then grants with MFA → **Yes**. Confidence is held in the low-80s because there is a genuine community split (a YYY camp, including one lab WhatIf test, argues the exclusion applies unconditionally) — but the MS Learn behavior table on positive operators vs. unregistered devices clearly favors N,Y,Y.

More SC-300 practice questions