Exam MS-101 topic 2 question 55 discussion

group 1 for both

Indeed Group 1 for both. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide half way on the page: When a device is matched to more than one group, it is added only to the highest ranked group.

Case sensitive no? So for me: Computer 1 = Group 2 "And statement removes Comp 2" Computer 2 = Group 3

Correct: Group1 and Group1 because only the highest rank applies, you ignore the rest.

I disagree with the answer. I understand that when Microsoft Defender ATP applies the policy, it applies it to the group with the highest rank. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide But if you look at the question, that's not it. "Of which groups are Computer1 and Computer2 members?", that is, he wants to know in which group inserted in the computer, so the answer would be "Computer1 - Group1 and Group2". At no point does it ask which policy it will apply for Microsoft Defender ATP, If it were this question, I agree that it would be group1 only. The same thing when he asks "Computer2", that is, again he asks about group members and not what policy will apply in ATP, so the answer would be " Group1 and Group3" Final anwser Computer1 - Group1 and Group2 Computer2 - Group1 and Group3

Group 1 and Group 1 - If a device in this group matches groups with a higher rank, it will show in the preview but will only be added to the group with the highest rank.

On exam today 23 Oct 2022. I answered group 1 and 2, then 1 and 3. Think I got this wrong but I passed. I must have missed the ranks column.

In Sep 16th 22's exam.

Group 1 for both. Came on exam 09-05-2022

Group 1 for both. For the group detection we are " Start with" or "Equal", so no sensitive in this case.

Isn't case sensitive? COMP vs Comp

Grp 1 for both. As many of you point out, "If a device is also matched to other groups, it's added only to the highest ranked device group". Thx you all.

The right answer is Group 1 only for both: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide "Specify the matching rule that determines which device group belongs to the group based on the device name, domain, tags, and OS platform. If a device is also matched to other groups, it's added only to the highest ranked device group."

Computer1 Group2 Only, Computer2 Group3 Only

Isn't it Group 2 for Computer1? Because it starts with comp AND had Windows 10 OS and not just comp?

I don't think the names are case sensitive. That would require multiple policies or a renaming requirement for devices. I go with Group 1 for both.

"You can promote or demote the rank of a device group so that it is given higher or lower priority during matching. When a device is matched to more than one group, it is added only to the highest ranked group." I believe group matching is case sensitive as well. So the answers should be Group 2 only and Group 3 only https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide