mediumMultiple ChoiceObjective-mapped
MS-102 A company uses Microsoft Entra ID P1 licenses Practice Question
A company uses Microsoft Entra ID P1 licenses. They want to allow access to a sensitive cloud application only from the company's trusted office IP ranges (10.0.0.0/24). However, the executive team (group "Execs") must be able to access the app from any location. Which Conditional Access policy configuration should the administrator use?
⚠ Common exam trap
Watch out — candidates often confuse 'grant access with a condition' with 'block access with a condition', mistakenly thinking that granting access from trusted locations will automatically block access from untrusted locations, but in Conditional Access, grant controls only allow access when conditions are met—they do not implicitly deny access when conditions are not met unless a block control is explicitly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B: Include all users, exclude Execs group, and block access with condition 'Location not in trusted locations'.
The requirement is to block access from untrusted locations for all users except the Execs group. By including all users, excluding the Execs group, and setting a block control with the condition 'Location not in trusted locations', the policy ensures that only non-Exec users are blocked when accessing from outside the trusted IP range, while Execs remain unrestricted. This aligns with the principle of explicitly blocking unwanted access rather than granting access with conditions that could be bypassed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A: Include all users, exclude Execs group, and grant access with condition 'Location not in trusted locations'.
Why it's wrong here
A is incorrect because the Grant control is a permissive action, not a restrictive one. Applying 'Grant access' when the location condition evaluates to 'not in trusted locations' explicitly allows non-Exec users from untrusted IP addresses to sign in, which is exactly the behavior the company wants to prevent. While excluding the Execs group does exempt executives from the policy, it does nothing to block the non-Exec users who are the actual target of the security requirement.
- ✓
B: Include all users, exclude Execs group, and block access with condition 'Location not in trusted locations'.
Why this is correct
B is correct: scoping to All users with the Execs group excluded means every non-Executive user is evaluated by the policy, and applying the Block access control when the Location condition matches 'not in trusted locations' denies those users if they try to access the app from an unrecognized or untrusted IP address. Because the Execs group is placed in the exclusion list, executives remain completely exempt and can still access the app from any location, including outside trusted networks. This creates the exact intended split: non-Execs are restricted, Execs are not.
- ✗
C: Include Execs group, exclude all others, and grant access with condition 'Location in trusted locations'.
Why it's wrong here
C is wrong because it reverses the policy target: by including only the Execs group, non-Executives are not evaluated by this Conditional Access policy, so there is no restriction whatsoever on where the rest of the organization can sign in from. For Execs, the grant access control combined with 'Location in trusted locations' would require executives to be inside a trusted named location on every access, which would block them from untrusted locations—the opposite of their intended exemption. The policy therefore both fails to secure non-Execs and incorrectly restricts the Execs group.
- ✗
D: Include all users, include Execs group as an additional condition, and grant access with condition 'Location in trusted locations'.
Why it's wrong here
D is incorrect because adding the Execs group as an 'additional condition' is not an exclusion; in Conditional Access, exclusions are handled separately in the assignments section via the Exclude list, and simply including a group alongside All users leaves Execs fully subject to the policy. The grant access control that requires 'Location in trusted locations' would then force executives to originate from a trusted IP address on every access, blocking them from the very remote/untrusted locations they are supposed to be allowed to use. Meanwhile, there is no Block control or location-based deny for non-Execs coming from untrusted locations, so the core requirement is still unaddressed.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.