Exam MD-101 All Questions

View all questions & answers for the MD-101 exam

Exam MD-101 topic 4 question 30 discussion

Actual exam question from Microsoft's MD-101

Question #: 30
Topic #: 4

HOTSPOT -
Your network contains an Active Directory domain. Active Directory is synced with Microsoft Azure Active Directory (Azure AD).
There are 500 Active Directory domain-joined computers that run Windows 10 and are enrolled in Microsoft Intune.
You plan to implement Microsoft Defender Exploit Guard.
You need to create a custom Microsoft Defender Exploit Guard policy, and then distribute the policy to all the computers.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exploit-protection

by bertik at June 7, 2021, 1:35 p.m.

Comments

Submit Cancel

bertik

Highly Voted 4 years ago

I would said : Tool : Windows Security app Method : GPO https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml?view=o365-worldwide

upvoted 16 times

PiPe

3 years, 4 months ago

Agreed

upvoted 1 times

...

RodrigoT

3 years, 2 months ago

I also agree. There is no possible way to create the settings using Microsoft Defender Security Center. The link bellow says: "You use the Windows Security app or PowerShell to create a set of mitigations (known as a configuration). You can then export this configuration as an XML file and share it with multiple devices on your network. Then, they all have the same set of mitigation settings." https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml?view=o365-worldwide Since you are on-premises environment and the other 2 options are wrong, you should use GPO do deploy the policies using the XML created.

upvoted 2 times

RodrigoT

3 years, 1 month ago

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection?view=o365-worldwide You can enable each mitigation separately by using any of these methods: Windows Security app Microsoft Intune Mobile Device Management (MDM) Microsoft Endpoint Configuration Manager Group Policy PowerShell In the scenario of this question we are using GPO. On the previous page Question #16 we used the Intune method.

upvoted 4 times

...

Mujja

Highly Voted 4 years ago

Distribution method is obvious, GPO, as none of the others are correct. So an exported XML from the Windows Security App, added to GPO Windows Defender Exploit Guard > Exploit Protection > Use a common set of exploit protection settings > Browse to XML

upvoted 5 times

...

AliNadheer

Most Recent 2 years, 4 months ago

i would say a more correct answers is: Microsoft Endpoint Manager Admin Center > Device configuration profile > choose windows then template > An Endpoint Protection Configuration Profile> microsoft exploit guard > exploit protection. upload XML here however based on the options given logically i would say: Tool to use: windows defender security center Distribution method: GPO

upvoted 1 times

...

jt2214

2 years, 4 months ago

Mods please fix this. I'm paying for contributor access. Windows Sec App GPO

upvoted 1 times

...

Afsan

2 years, 4 months ago

Tool : Windows Security app Method : GPO

upvoted 1 times

...

silver_bullet666

2 years, 11 months ago

We are configuring Exploit Guard, not Exploit Protection (one component of Exploit Guard). Exporting XML from Windows settings is only for Exploit Protection. I have a feeling that this question means to say we are configuring Exploit Protection rather than Exploit Guard. see this breakdown of Exploit Guard components, https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/

upvoted 1 times

...

jage01

3 years, 4 months ago

Tool : Windows Security app Method : GPO Manyfeatures from the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. You can enable each mitigation separately by using any of these methods: * Windows Security app * Microsoft Intune * Mobile Device Management (MDM) * Microsoft Endpoint Configuration Manager * Group Policy * PowerShell https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection?view=o365-worldwide#windows-security-app

upvoted 1 times

...

jibutoms

4 years ago

This should be: Windows Security App : "App & Browser control" --> Exploit protection --> Export setting XML Endpoint Security policy : Exploit protection, Import the XML

upvoted 4 times

...