AZ-500 Exam - Question 74

Question

HOTSPOT -You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:✑ Assignments: Include Group1, exclude Group2✑ Conditions: Sign-in risk level: Medium and above✑ Access: Allow access, Require multi-factor authenticationYou need to identify what occurs when the users sign in to Azure AD. What should you identify for each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

References:http://www. rebeladmin. com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/ https://docs. microsoft. com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies https://docs. microsoft. com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks.

Bjarki2330 · Answer

Answers are correct:

1) MFA is enabled and whenever on next log-in he will have to sign up anyway, regardless of the policy, therefore prompted.

2) Blocked - "Users must register for Azure AD MFA and SSPR before they face a situation requiring remediation. Users not registered are blocked and require administrator intervention."

3) Blocked - See text in 2)

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

canonigo · Answer

1- Prompt for MFA -> User is excluded, but MFA is Enabled, user is always prompted for MFA.
2.- Prompt for MFA -> Risk is medium and policy applies
3.- Single Authentication -> Policy doesn't apply, risk low

somenick · Answer

Latest update: Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised.
So this question is obsolete

heatfan900 · Answer

USER 1 WILL ALWAYS BE PROMPTED REGARDLESS OF POLICY ASSIGNMENT BECAUSE MFA IS ENFORCED AGAINST THEIR ACCT.

USER 2 WILL BE BLOCKED BECAUSE THEY ARE SOLELY IN GROUP 1 AND THE MEET THE CONDITIONS OF THE POLICY ASSIGNED WITH MFA DISABLED WHICH GOES AGAINST THE POLICY REQUIREMENTS.

USER 3 WILL BE ALLOWED TO LOGIN WITH USERNAME AND PASSWORD ONLY BECAUSE, ALTHOUGH THEY ARE IN GROUP 1 THEY DO NOT MEET THE CONDITIONS AND DO NOT HAVE MFA ENFORCED DIRECTLY AGAINST THEIR ACCT. SIGNING IN FROM AN INFECTED DEVICE IS CONSIDERED LOW RISK..

majstor86 · Answer

MFA
Blocked
Username and password

Patchfox · Answer

As gigiscual said: Users must register for Azure AD MFA and SSPR BEFORE they face a situation requiring remediation. Users not registered are blocked and require administrator intervention.
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies
So, User2 will be blocked. 
But I do not agree with answer three because Microsoft classify sign-ins from infected devices with low risk.

[Removed] · Answer

MFA
Blocked
Single Authentication

stack120566 · Answer

1.   Sign in Username and Pw only ..   user1 is member of group 2  ( excluded from risk policy )
2.   Blocked ..  MFA required but User 2 MFA status is disabled 
3.   Sign In with UserName and Pw only...    Low risk so policy does not apply

ltjones12 · Answer

The first 2 are correct, the third is "sign in with username and pw only". It's low risk, and MFA is disabled for the user

certmonk · Answer

All 3 should be prompted for MFA. Because all of them are in Group1 and the Access level is set to Allow access Require MFA. For 2 and 3 the user should still be prompted for MFA but since they have MFA disabled so they will not be able to proceed with MFA.

fro_prince · Answer

2 and 3 - blocked
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

TweetleD · Answer

sign ins from an infected device is classified as a low risk so user3 will be able to sign in by using a username and password only

snake_alejo · Answer

my answers based on that:

user1 will ask MFA for being a medium threat.
user2 will ask for MFA for being a medium type threat (unfamiliar location.)
User 3 does not apply the policy since the risk, according to Microsoft, is low.

in no case user 1 and 2 are blocked.

CJ32 · Answer

1.) Username and Password only. User is a part of Group 2. Exclusion takes precedence.
2.) Blocked. User MUST sign up for MFA beforehand or they will be blocked. (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies)
3.) Blocked. Same reasoning as above.

DaveBinDC · Answer

Answers are correct.
The key here is that user MUST complete MFA registration for the identity protection sign-in risk policy to take effect.  Since USER1 is the only one that is MFA enabled (registered), he is the only one that will be forced to use MFA to sign in.  The other two will be blocked.  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

Ivanvazovv · Answer

All "Sign in from unfamiliar location", "Sign in from infected device" and "Sign in from anonymous IP address" are medium risk thus all satisfy the condition to require MFA. User1 will be prompted from MFA regardless. So all three sign ins require MFA.

gumibobo · Answer

right answers

AZ-500 Exam - Question 74

Discussion