Deploy and manage a Microsoft 365 tenant →easyMultiple Choice

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "displayName": "Block access for external users from unknown IPs",
    "conditions": {
      "applications": {
        "includeApplications": ["All"]
      },
      "users": {
        "includeUsers": ["All"]
      },
      "locations": {
        "includeLocations": ["AllTrusted"]
      }
    },
    "grantControls": {
      "builtInControls": ["block"]
    }
  }
}
```

Refer to the exhibit. You have a Conditional Access policy configured as shown. What is the effect of this policy?

⚠ Common exam trap

The trap here is that candidates mistakenly think 'Block access' combined with 'Trusted IPs' blocks untrusted IPs, when in fact the policy explicitly blocks the trusted IPs, leaving untrusted IPs unaffected by this policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It blocks access from trusted IP addresses.

The policy is configured to 'Block access' for 'All users' and 'All cloud apps' when the location condition is set to 'Trusted IPs'. This means that when a user attempts to access from an IP address defined as trusted in the organization's named locations, access is explicitly blocked. The effect is that trusted IP addresses are blocked, not untrusted ones.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It requires multi-factor authentication for trusted IPs.
Why it's wrong here
This is incorrect because the policy's access control is Block, not Require multi-factor authentication. A policy that required MFA would use the Grant control 'Require multi-factor authentication' and would still allow the user to sign in after successfully completing MFA. Here, the Block control means the request is denied outright, so MFA is never considered or prompted.
✗
It blocks access from all locations.
Why it's wrong here
This is incorrect because the policy's location condition includes only the named location 'All Trusted IPs' (or a trusted-IP range), not 'Any location' or all possible source addresses. Conditional Access policies are evaluated only when the request's source IP matches an included location; requests from outside that included set are out of scope and will not be blocked by this policy. Therefore, it cannot block access from all locations.
✗
It blocks access from untrusted IP addresses.
Why it's wrong here
This is incorrect because untrusted IP addresses are not included in the policy's location condition; only trusted IP addresses are included. The policy engine will apply the Block control only to sign-ins whose source IP matches a trusted-IP range. A request from an untrusted IP will not trigger this policy, even though other Conditional Access policies could still apply to that request based on their own conditions.
✓
It blocks access from trusted IP addresses.
Why this is correct
This is correct. The policy is scoped to the location condition 'All trusted IPs' and its access control is set to Block. When a user signs in from an IP address that falls within the configured trusted-IP range, the policy condition is satisfied and access is denied. This demonstrates that a 'trusted' network can still be blocked in Conditional Access when the grant control is Block rather than a permissive Grant control.

Go deeper

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question