Exam MS-102 topic 1 question 18 discussion

Here are my thoughts. No, No, Yes Q: User 1 can run an antivirus scan on device 2. A: No. User 1 belongs to Group 1 and has the permission to "View data, alerts investigations" under role 1. Running an antivirus scan would typically require additional permissions which are not listed here for User 1. Q: User 2 can collect an investigation package from device 2. A: No. User 2 belongs to Group 2 and has the permission to "View data" under role 2. Collecting an investigation package would likely require additional permissions which are not listed for User 2. Q: User 3 can isolate device 2. A: Yes. User 3 belongs to Group 3 and has the role of Microsoft Defender for Endpoint Administrator which includes permissions to "View data, alerts investigations, active remediations, manage security settings." These permissions encompass the ability to take actions such as isolating a device.

Answer is correct https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection

No, No, No Q1: No User1 is in Group1, which has no access to Device2. Q2: No. User2 is in Group2, which has access to Device2, but Role2 has no permission collecting an investigation packages. Q3: No. User3 is in Group3, which has full Defender admin permissions, but Group3 does not have access to Device1.

No,No,No Esto significa que aunque User3 tenga el rol más alto con todos los permisos, si su grupo (Group3) no tiene acceso al grupo de dispositivos donde está Device1 (ATP1), no podrá actuar sobre ese dispositivo.

Esto significa que aunque User3 tenga el rol más alto con todos los permisos, si su grupo (Group3) no tiene acceso al grupo de dispositivos donde está Device1 (ATP1), no podrá actuar sobre ese dispositivo.

Given answers are correct. https://learn.microsoft.com/en-us/defender-endpoint/user-roles#permission-options

Given answer is correct.

1) No: Even if alerts Investigation allows users to run a scan as explained in the link below, Device2 is not in user1's Scope. Otherwise, he cannot run a scan on Device 2. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/user-roles?view=o365-worldwide 2) No N)Yes

No,No,No Box3: User3 can Remediation Action but, Group3 do not assinged ATP1. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection

Box3: No? Because Defferent Group In User and Device.