SC-300 Certification Practice Question #139

Question

You have a Microsoft Entra tenant that contains the users shown in the following table.

You have a user risk policy that has the following settings:

•	Assignments:
o	Include: Group1
o	Exclude: Group2
•	Sign-in risk: Medium and above
•	Access controls:
o	Grant access: Require password change

When the users attempt to sign in, user risk levels are detected as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

User2 is a member of Group2 (the excluded group) only, and User3 is a member of both Group1 and Group2 — and per MS Learn, the exclude action always overrides include, so both User2 and User3 fall outside the policy and are not required to change their password (No, No). User1 belongs only to the included Group1 and has a High risk level, which meets the "Medium and above" threshold, so the policy applies and User1 must change their password (Yes). The dominant community comments (Frank9020, penatuna) and the most-voted spatrick comment all affirm the exclusion-precedence rule that drives User2/User3 to No. Confidence is held at 83% because the question text is internally inconsistent (it calls the policy a "user risk policy" yet the settings reference "Sign-in risk," and the table lists generic risk levels), prompting a minority NNN view; the published answer key resolves this in favor of Y,N,N.

More SC-300 practice questions