Exam MD-101 topic 1 question 30 discussion

Actual exam question from Microsoft's MD-101

Question #: 30
Topic #: 1

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft
Intune.
You have been tasked with making sure that the workstations are only able to run applications that you have explicitly permitted.
Solution: You make use of Windows Defender SmartScreen.
Does the solution meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️
Instead use Windows Defender Application Control (WDAC).
Windows Defender Application Control and virtualization-based protection of code integrity.
Using WDAC to restrict devices to only authorized apps has these advantages over other solutions:
1. WDAC lets you set application control policy for code that runs in user mode, kernel mode hardware and software drivers, and even code that runs as part of
Windows.
2. WDAC policy is enforced by the Windows kernel itself, and the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
3. Etc.
Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows- defender-application-control

by ercluff at Aug. 4, 2021, 11:58 p.m.

Comments

Submit Cancel

ercluff

Highly Voted 3 years, 12 months ago

B. NO - Mobile Application Management App Protection is what is needed.

upvoted 5 times

ercluff

3 years, 7 months ago

I'll update my answer. It still is B. NO but not MAM App Protection. It is Windows Defender Application Control. Comments from Q. 31 by Angelize and Andrevox are especially well done: ""Angelize' comment concisely states: "Application Guard only affects Edge (and Office if you have a plugin - the correct answer should be Windows Defender Application Control." Andrevox' explanation is the best: "Application Guard, a hardware-based endpoint defense, is a security tool that is built into Microsoft Edge. Application Guard isolates enterprise-defined untrusted sites from the desktop (host) in a virtual machine (VM) to prevent malicious activity from reaching the desktop. For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. ... This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. "

upvoted 2 times

RodrigoT

3 years, 5 months ago

You're right, Windows Defender Application CONTROL, don't confuse this with Windows Defender Application Guard (that is for Edge).

upvoted 3 times

...

MR_Eliot

Most Recent 3 years, 3 months ago

Selected Answer: B

B, smart screen is just protection and nothing more.

upvoted 1 times

...

b3arb0yb1m

3 years, 7 months ago

B. No is correct.

upvoted 3 times

...

CaloyB_IT

3 years, 8 months ago

B - MAM is what is needed https://docs.microsoft.com/en-us/mem/intune/apps/mam-faq

upvoted 2 times

RodrigoT

3 years, 5 months ago

Sorry dude but you're wrong. This is the right answer: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create Windows Defender Application Control (WDAC) is used to restrict devices to run only approved apps.

upvoted 1 times

...

Webleyboy

3 years, 8 months ago

Windows Defender Application Guard is needed for this. Next question on this website is also saying: Windows Defender Application Guard.

upvoted 1 times

RodrigoT

3 years, 5 months ago

And the next question is also NO. The right option is: Windows Defender Application CONTROL. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create Windows Defender Application Control (WDAC) is used to restrict devices to run only approved apps.

upvoted 3 times

...