SC-300 Certification Practice Question #168

Question

You have a Microsoft 365 E5 subscription that contains three groups named Group1, Group2, and Group3, and the users shown in the following table.

You create a Conditional Access policy named CA1 that has the following settings:

•	Users
  o	  Include
    -	   Users and groups: Group1
  o	  Exclude
    -	   Users and groups: Group2
    -	   Directory roles: Global Administrator
  o	  Target resources
    -	   Include: All cloud apps
  o	  Access controls
    -	   Grant: Require multifactor authentication

You create a Conditional Access policy named CA2 that has the following settings:

•	Users
  o	  Include
    -	   Users and groups: Group2
  o	  Exclude
    -	   Users and groups: Group3
  o	  Target resources
    -	   Include: All cloud apps
  o	  Access controls
    -	   Grant: Block access

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

Row 1: User1 is in Group1 (CA1 include) but is a Global Administrator, and CA1 excludes the Global Administrator directory role; within the user assignment the exclude operator is OR, so matching that one role excludes User1 entirely and the exclude overrides the include → CA1 does not apply → no MFA prompt → **No**. Row 2: User2 is in Group2 (CA2 include) and not in Group3 (CA2 exclude) → CA2's Block applies → **Yes** (prevented). Row 3: User3 is in Group2 (CA2 include) but also Group3 (CA2 exclude); exclude overrides include → CA2 doesn't apply, and User3 is in no other blocking policy → **No** (not prevented). The headline community vote (YYN) is wrong on Row 1 because it overlooks the Global Administrator exclusion; MS Learn is unambiguous that the exclude action wins, so MS Learn is used as the tiebreaker and confidence is lowered to reflect the community split (dissenters ca7757d / 1da02e4 agree with the docs-based NYN).

More SC-300 practice questions