AZ-500 Exam - Question 50

Question

HOTSPOT -You have an Azure Active Directory (Azure AD) tenant named contoso. com that contains the users shown in the following table. You create and enforce an Azure AD Identity Protection user risk policy that has the following settings:✑ Assignment: Include Group1, Exclude Group2✑ Conditions: Sign-in risk of Medium and above✑ Access: Allow access, Require password changeFor each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

Box 1: Yes -User1 is member of Group1. Sign in from unfamiliar location is risk level Medium. Box 2: Yes -User2 is member of Group1. Sign in from anonymous IP address is risk level Medium. Box 3: No -Sign-ins from IP addresses with suspicious activity is low. Note:Azure AD Identity protection can detect six types of suspicious sign-in activities:✑ Users with leaked credentials✑ Sign-ins from anonymous IP addresses✑ Impossible travel to atypical locations✑ Sign-ins from infected devices✑ Sign-ins from IP addresses with suspicious activity✑ Sign-ins from unfamiliar locationsThese six types of events are categorized in to 3 levels of risks ג€" High, Medium & Low:References:http://www. rebeladmin. com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/.

Geeky93 · Answer

Wrong answer.

Should be :

YES, NO, NO
"When organizations both include and exclude a user or group the user or group is excluded from the policy, as an exclude action overrides an include in policy. "
Source : 
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-users-groups

rctm_bm · Answer

Agree with Geeky93, but not sure with 3rd answer. Given question with malware refers to infected device  wich is Medium Risk Level, so the answer should be YES.
YES,NO,YES

ABIYGK · Answer

Explanation:
Box 1: Yes - User1 is member of Group1. Sign in from unfamiliar location is risk level Medium.
Box 2. No - "When organizations both include and exclude a user or group the user or group is excluded from the policy, as an exclude action overrides an include in policy. "

Box 3: Yes - Sign-ins from infected device is Medium.

fireb · Answer

Based on changes on Azure over the years, the answer should be: 
Yes, Yes, Yes.

bhattroh · Answer

Yes, No, Yes... Second one has MFA enabled and also in Group 2 which is excluded from protection policy

sommyo · Answer

Y-Y-Y
Unfamiliar location - medium risk
Anonymous IP - medium risk
Infected device - medium risk

P4ndem1c · Answer

A: Yes,No,Yes
Last one is wrong as device is infected with malware thus classed as Medium

heatfan900 · Answer

Y, N, N. 
USER 1 belongs to GROUP 1 and meet the Medium or Higher Conditions
USER 2 belong to GROUP 1 and 2. Since Group 2 is excluded, the user will then be excluded even though he belongs to GROUP 1. When a user is in two different groups and one is excluded, they are excluded, even if the other group they belong to is included in the RISK POLICY.
USER 3 is signing in from an infected device. This risk event identifies IP addresses, not user devices. If several devices are behind a single IP address, and only some are controlled by a bot network, sign-ins from other devices my trigger this event unnecessarily, which is the reason for classifying this risk event as “Low”.

Jkayx94 · Answer

Yes, No Yes.

B - Exclusion takes precedence of Inclusion

C - Device is Infected with Malware, regardless if it's communicating with a botnet, it's detected as Malware = Medium Risk = Included in CAP.

Andre369 · Answer

1.	 If User1 signs in from an unfamiliar location, he must change his password.
•	Yes. User1 is a member of Group1, which is included in the policy's assignment. If User1 signs in from an unfamiliar location, it meets the condition of a Medium or above sign-in risk. According to the policy's access settings, User1 must change his password.
2.	If User2 signs in from an anonymous IP address, she must change her password.
•	No. User2 is a member of Group1 and Group2, but Group2 is excluded from the policy's assignment. Therefore, the policy does not apply to User2. Even if User2 signs in from an anonymous IP address, it won't trigger the password change requirement.
3.	If User3 signs in from a computer containing malware that is communicating with known bot servers, he must change his password.
•	No. Although User3 is a member of Group1 and meets the sign-in risk condition, the policy's access settings do not require a password change. The policy allows access without mandating a password change.
Based on the evaluation, the correct answers are:
1.	Yes
2.	No
3.	No

massnonn · Answer

For me is Y-N-Y

ESAJRR · Answer

YES, NO, NO

ArchitectX · Answer

It should be Yes No No

JunetGoyal · Answer

Yes NoYes

GaryKing123 · Answer

So having MFA enabled, disabled or even required doesn't impact the answer here I believe. In Entra under CA, now when you Grant access you can either have "require MFA" or "require authentication strength" or "require password change" among various options

MeisAdriano · Answer

NO: unfamiliar location i think is similar to IP suspected, so low level not medium level risk.
NO: "anonymous" IP address is the same of "unfamiliar location", similar to suspicious IP address, so the risk is low
YES: because infected device is medium risk (not IP suspected that is low rish). The question says on medium and above sign-in risk you have to require password change.

wardy1983 · Answer

Explanation:
Box 1: Yes -
User1 is member of Group1. Sign in from unfamiliar location is risk level Medium.
Box 2 no
"When organizations both include and exclude a user or group the user or group is excluded from the policy, as an exclude action overrides an include in policy. "
Box 3: No -
Sign-ins from IP addresses with suspicious activity is low.

AZ-500 Exam - Question 50

Discussion