SC-300 Certification Practice Question #152

Question

You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2. The subscription contains the users shown in the following table.

You create the following Conditional Access policies:

•	Name: Policy1
•	Users:
 o	  Include: Group1
 o	  Exclude: Group2
•	Target resources:
 o	  Include: All cloud apps
•	Grant:
 o	  Grant access: Require multi-factor authentication
•	Session:
 o	  Persistent browser session: Never persistent

•	Name: Policy2
•	Users:
 o	  Include:
   -	    Directory roles: Global Administrator
   -	    Users and groups: User3
 o	  Exclude: Group2
•	Target resources:
 o	  Include: All cloud apps
•	Session:
 o	  Sign-in frequency:
   -	    Periodic authentication: 2 hours

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

Row 1 hinges on KMSI: Policy1 targets Group1 (User1) with "Persistent browser session: Never persistent," and MS Learn explicitly lists "Persistent browser session control is configured in a Conditional Access policy" as a scenario where the Stay signed in? prompt is intentionally not shown — so User1 is not prompted (No). Rows 2 and 3 both turn on the exclusion rule: User2 (Global Admin, in Group2) and User3 (named in Policy2, in Group2) are both members of the excluded Group2, and MS Learn states unambiguously that the exclude action overrides the include action, so neither receives Policy2's 2-hour sign-in frequency (No, No). The two highest-voted comments (16 👍 combined, both Highly Voted) both land on N,N,N. Confidence is held at 80% because there is a genuine, well-argued community split on row 3 — several commenters (10 👍 combined) invoke a "direct assignment overrides group exclusion" principle; MS Learn's exclude-overrides-include statement is the tiebreaker and favors No, but the documentation does not address the named-user-vs-group-exclusion edge case as explicitly as one would like.

More SC-300 practice questions