SC-300 Certification Practice Question #160

Question

You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table.

The subscription contains a Conditional Access policy that has the following settings:

•	Name: Policy1
•	Assignments
o	Include
 -	Users and Groups: Group1
 -	Directory roles: Global Administrator
o	Exclude
 -	Users and Groups: Group2
o	Target resources
 -	Include
 -	All cloud apps
 -	Access controls
 -	Grant
 -	Require multifactor authentication

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

Conditional Access assignment resolution is decided by MS Learn's stated rule that the exclude action overrides the include action whenever a principal is both included and excluded. User1 belongs only to the included Group1 and is in no excluded group, so MFA is required → Yes. User2 is in the included Group1 but also in the excluded Group2; the exclusion wins → No. User3 is included via the Global Administrator directory role but is also a member of the excluded Group2; MS Learn does not give directory-role inclusions precedence over group exclusions, and there is no implicit always-MFA-for-admins enforcement (security defaults are not in play), so the exclusion overrides the role and User3 is not subject to the policy → No. Confidence is held at 80% because the community is genuinely split on Row 3 (two ≈2-👍 comments argue Yes), but the official documentation language is unambiguous that exclusions override inclusions for both users/groups and roles, making Y/N/N the documented answer.

More SC-300 practice questions