Exam SC-400 topic 6 question 3 discussion

Why choose E instead of A? Why do we need to enroll the computers in Defender for Endpoint (so that they appear in Endpoint DLP dashboard automatically), where in fact we can download the package of Endpoint DLP directly and onboard it on the endpoints? E doesn't make any sense to me. By answering E, you are adding another solution (MDE) which is not even required. Answer is AC

Hybrid Join (or cloud join) is required for DLP to correctly work... so C. Then A to apply DLP... to do a good job it would have been B (to automatically onboard entra ID (Hybrid)Joined devices to Intune, C to hybrid join the clients and finally A to deploy DLP policies... but here we need 2, so C & A for me

Answer correct AE

A. Deploy a Microsoft 365 Endpoint DLP configuration package to the computers. E. Enroll the computers in Microsoft Defender for Endpoint protection. Not C because it’s unnecessary for Endpoint DLP and would violate the "least possible changes" requirement.

It is what the test is actually testing. I think the "modern work / desktop admin" types are overthinking the "least possible changes" aspect. It is testing if you understand you need to connect with MDE (or Purview onboarding, which is not an option) and to use endpoint DLP.

A. Deploy a Microsoft 365 Endpoint data loss prevention (Endpoint DLP) configuration package to the computers. Endpoint DLP allows you to monitor and control data loss from organizational devices. This directly addresses the need to enforce DLP policies on these machines.

Please read before posting. Not very helpful. AE - correct once. with love~

If I'm interpreting this correctly; A- Deploy package to endpoints (can be achieved via GPO in this case since endpoints are domain joined). C- Hybrid AD join is configured via AD Connect, which doesn't impact devices directly. Only way that has no impact on endpoints and both A and C directly correlate as C is a requirement for A to work.

The answer is AC - why? If you onboard the devices to Defender for Endpoint then you need to add exclusionss to DFE for the current AV, and for DFE to the current AV, hence there are additional changes required to the client devices

Device onboarding is shared across Microsoft 365 and Microsoft Defender for Endpoint (MDE). If you've already onboarded devices to MDE, they will appear in the managed devices list and no further steps are necessary to onboard those specific devices. ll devices must be one of these: Azure Active Directory (Azure AD) joined Hybrid Azure AD joined AAD registered https://learn.microsoft.com/en-us/microsoft-365/compliance/device-onboarding-overview?view=o365-worldwide#onboard-windows-10-and-windows-11-devices-into-microsoft-365-overview

Here is my take on this, In order to deploy and manage endpoint DLP you require a trust type (Hybrid Azure AD joined, AADJ or AADR)(https://learn.microsoft.com/en-us/microsoft-365/compliance/device-onboarding-overview?view=o365-worldwide#prepare-your-windows-devices), since Fabrikam already syncs with AAD, the changes required to achieve Hybrid AADJ is minimal. (C) MDE is not configured by default, but in this scenario it should be done to minimize the changes required to achive the solution. Fabrikam already has MCAS deployed with all the necessary connectors to their cloud applications. One of the requirement for MCAS, Cloud Discovery, requires Defender for Endpoint (https://learn.microsoft.com/en-us/defender-cloud-apps/get-started#step-4-set-up-cloud-discovery) (E) So answers are good (CE)

I wrote the exam today, this question was on it, I choose AC, scored 890!

ANSWER IS CE. All DLP policies must be applied to computers that run Windows 10, with the least possible changes to the computers. Requirement is LEAST POSSIBLE CHANGES Enroll into MS DEFENDER FOR ENDPOINT PROTECTION IS FASTER AND EFFORTLESS COMPARE TO USING DEPLOYMENT PACKAGE WHICH IS WHY I CHOOSE - E for C - is it common sense

It states, that Azure AD Connect is set up - by default there is no Hybrid Azure AD join. So i would say, the answer is correct: Hybrid Azure AD join followed by the enrollment in Defender for Endpoint.

I think correct answer is A,C