Exam MD-101 topic 1 question 29 discussion

Actual exam question from Microsoft's MD-101

Question #: 29
Topic #: 1

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft
Intune.
You have been tasked with making sure that the workstations are only able to run applications that you have explicitly permitted.
Solution: You make use of Windows Defender Antivirus.
Does the solution meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️
Instead use Windows Defender Application Control (WDAC).
Windows Defender Application Control and virtualization-based protection of code integrity.
Using WDAC to restrict devices to only authorized apps has these advantages over other solutions:
1. WDAC lets you set application control policy for code that runs in user mode, kernel mode hardware and software drivers, and even code that runs as part of
Windows.
2. WDAC policy is enforced by the Windows kernel itself, and the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
3. Etc.
Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows- defender-application-control

by ercluff at Aug. 4, 2021, 11:54 p.m.

Comments

Submit Cancel

MR_Eliot

3 years, 3 months ago

Selected Answer: B

B should be right

upvoted 1 times

...

b3arb0yb1m

3 years, 7 months ago

B. No is correct.

upvoted 3 times

...

ercluff

3 years, 12 months ago

I believe mobile application management app protection is what the organization is needing. https://docs.microsoft.com/en-us/mem/intune/apps/mam-faq

upvoted 4 times

ercluff

3 years, 12 months ago

B. No on this question

upvoted 7 times

...

ercluff

3 years, 7 months ago

I'll update my answer. It still is B. NO but not MAM App Protection. It is Windows Defender Application Control. Comments from Q. 31 by Angelize and Andrevox are especially well done: ""Angelize' comment concisely states: "Application Guard only affects Edge (and Office if you have a plugin - the correct answer should be Windows Defender Application Control." Andrevox' explanation is the best: "Application Guard, a hardware-based endpoint defense, is a security tool that is built into Microsoft Edge. Application Guard isolates enterprise-defined untrusted sites from the desktop (host) in a virtual machine (VM) to prevent malicious activity from reaching the desktop. For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. ... This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. "

upvoted 2 times

...