Exam AZ-500 topic 2 question 113 discussion

Going with NYY This is not a new question. Please see Question #62Topic 2 for discussion Reference: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#score-calculation https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations#enable-on-premises-password-protection https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy

NYY bc of audit mode.

First of all - AUDIT AND ENFORCE MODE This just applies to ON-PREM. Password protection is always on for cloud identities. https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations#enable-on-premises-password-protection Second of all - Azure AD Password Protection's Modern Approach Azure AD Password Protection doesn't rely on a points system. Instead uses, -Banned Password Lists -Smart Detection Algorithms -Policy Enforcement Summarizing, Complexity Points Don't Override Banned Terms. Third of all, N –Policy applies when the password is changed N – The new password matches the banner (Complexity doesn’t override Banned Terms) Y – Audit mode is enabled which affects just ON-PREM

I would go for NYY: User1 will be prompted to change the password in the next sign in Password Protection Enforcement: Only applies during password changes, not during sign-ins. Answer: No User2 can change the password to @d@tum_C0mpleX123 Fuzzy Matching: No match. Substring Matching: No direct match. Score Calculation: High score due to complexity. adatum [1] + _ [2] + complex [3] + 1 [4] + 2 [5] + 3 [6] Answer: Yes User3 can change the password to Adatum123! Fuzzy Matching: Exact match with “Adatum.” Substring Matching: Contains “Adatum.” Score Calculation: Low score due to banned word. However, since Audit mode applies, the change will be logged but not blocked. Answer: Yes

User1 - No (password protection is applied at password change) User2 - No (he is native Entra user, audit mode applies only to on-premises AD) User3 - Yes (he is on-premises user that uses audit mode, and the password is not in the list)

NNY is correct. Here is why: 1. Existing passwords cannpot be checked . 2. The custom banned password list considers common character substitution, such as "o" and "0", or "a" and "@". --> Conclussion @d@tum_Complex123 contains a banned word 3. Audit mode is only for OnPremAD

gonna with NNY