Exam MS-500 All Questions

View all questions & answers for the MS-500 exam

Exam MS-500 topic 2 question 17 discussion

Actual exam question from Microsoft's MS-500

Question #: 17
Topic #: 2

HOTSPOT -
You have a Microsoft 365 subscription that uses a default domain name of contoso.com.
Microsoft Azure Active Directory (Azure AD) contains the users shown in the following table.

Microsoft Endpoint Manager has two devices enrolled as shown in the following table:

Both devices have three apps named App1, App2, and App3 installed.
You create an app protection policy named ProtectionPolicy1 that has the following settings:
✑ Protected apps: App1
✑ Exempt apps: App2
✑ Windows Information Protection mode: Block
You apply ProtectionPolicy1 to Group1 and Group3. You exclude Group2 from ProtectionPolicy1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

by ChrisBr at Oct. 18, 2019, 3:57 a.m.

Comments

Submit Cancel

DTz

Highly Voted 4 years, 11 months ago

I believe you guys are thinking in terms of TO instead of FROM. The policy is set to block. "Block: Blocks enterprise data FROM LEAVING protected apps." The protected app is App1. So the policy would prevent data from LEAVING App1. 1. Device 1 is an Android Device and WIP won't work at all -> Answer YES 2. App2 is exempt, but the policy protects >App1< from data LEAVING it. So the copy gets blocked -> Answer NO 3. This is effectively the same as #2. Sure, App3 is not impacted, but App1 is, and you cannot copy data FROM App1 -> Answer NO

upvoted 157 times

stromnessian

3 years, 9 months ago

IMHO DTz's answer is incorrect - try it yourself. To save time, try pasting from a protected app into Explorer, as it's a system process and therefore exempt.

upvoted 2 times

...

Joshing

3 years, 10 months ago

For anyone who has read DTz answer and is thinking of testing it. Don't bother (I of course wasted my time). He is 100% correct. As he said data coming from a Protected app is protected. It is protected and is allowed to be used with other Protected apps. You set apps to Exempt if they are unenlightened. You can Deny the app so it won't be able to work with corporate data or Allow it so it can work with corporate data but you have the risk of data being copied out of this app due to the protection not being in place. Exempting something and using Deny is the same as not including the app within Protected Apps section within WIP. They won't be able to use corporate data. Here is a great article on this matter - https://campbell.scot/windows-information-protection-wip-app-protection-policies-protected-and-exempt-denied-and-allowed-what-do-they-mean/

upvoted 8 times

Joshing

3 years, 9 months ago

Clarity for question 2: The reasoning why you can't Copy and Paste into App2 is due to the app being unenlightened so the Context this app runs will be "Personal". You can copy and paste out of it to another app but Copy and Pasting from App1 to App2 wouldn't work as App1 is enlightened and runs under the corporate context and wouldn't allow pasting into an app running in the personal context.

upvoted 1 times

...

STFN2019

4 years, 11 months ago

this makes more sense

upvoted 4 times

...

mehnaz

4 years, 10 months ago

This is perfect. I believe this too.When one creates app protection policy, the option of choosing WIP MODE is applicable only for windows 10 devices which means this policy has been created for Windows 10 devices only. So answer is YES, NO , NO

upvoted 9 times

mehnaz

4 years, 10 months ago

CORRECT; Its has to be YES, YES NO. because Group 2 is exempted

upvoted 1 times

mehnaz

4 years, 10 months ago

FINAL Correction: Its has to be Yes ,NO No

upvoted 2 times

...

Pitch09

4 years ago

https://docs.microsoft.com/en-us/mem/intune/apps/windows-information-protection-policy-create

upvoted 1 times

...

Load full discussion...

...

ChrisBr

Highly Voted 5 years, 7 months ago

I think this is not correct... 1. Device 1 is an Android Device and WIP won't work at all -> Answer YES 2. App 2 is an excempt App so this should work -> Answer YES 3. APP 3 is neither a protected nor an excempt app. WIP should Block -> Answer NO

upvoted 64 times

madmouse256

5 years, 1 month ago

ChrisBr is correct. Here is a link to detailed explanation how WIP App Protection Policies are working https://docs.microsoft.com/en-us/mem/intune/apps/windows-information-protection-policy-create#add-a-protection-mode

upvoted 2 times

...

Toorop

5 years, 5 months ago

I think it should be Yes, Yes, No as well.

upvoted 8 times

Sizz

5 years, 4 months ago

Answer is correct if it's just talking about App Protection Policies... These are iOS and Android only... The question confuses matter by talking about WIP at all. Source - https://docs.microsoft.com/en-us/intune/apps/app-protection-policy#supported-platforms-for-app-protection-policies

upvoted 6 times

RonS

5 years, 1 month ago

Answer is correct it is specifically asking about App protection not WIP! Sizz link is correct

upvoted 4 times

xofowi5140

5 years ago

ProtectionPolicy1 have Windows Information Protection mode: Block

upvoted 6 times

...

Jhill777

4 years, 9 months ago

MAM can only manage enlightened apps. Since they call them App1, 2, 3, I don't think we can assume anything.

upvoted 1 times

...

matthu

5 years, 1 month ago

pretty sure it's yes yes no. the wording sucks for this question, but it's talking about a WIP app protection policy, not a MAM app protection policy. Only WIP policies have those options specified, MAM policy options are different. androids aren't protected by WIP policies so that's a yes, App 2 is exempt so 1 -> 2 is yes, and 1 -> 3 should be no since it's no because 1 is protected and 3 isn't exempt https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

upvoted 4 times

...

dakasa

2 years, 9 months ago

Correct Y, Y, N. Here is information about the exemption of the app. An exception allows you to specifically choose which unmanaged apps can transfer data to and FROM managed apps. https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policies-exception

upvoted 1 times

...

McMac

Most Recent 1 year, 11 months ago

This is clearly about App Protection Policies, so should be N, N, N ?

upvoted 1 times

...

Msleizaktest1

2 years, 3 months ago

On exam 24/02/2023

upvoted 3 times

beer32

2 years, 2 months ago

answer is correct ??

upvoted 1 times

...

ColmTheMeanie

2 years, 3 months ago

https://learn.microsoft.com/en-us/mem/intune/apps/windows-information-protection-policy-create Microsoft Endpoint Manager has discontinued future investments in managing and deploying Windows Information Protection. You can expunge this from your memories now

upvoted 1 times

...

pete26

2 years, 8 months ago

Starting in July 2022, Microsoft is deprecating Windows Information Protection. Microsoft Endpoint Manager is discontinuing future investments in managing and deploying Windows Information Protection (WIP). Just move on to the next question. The process of deprecation is to be completed by December 2022.

upvoted 4 times

...

Whatsamattr81

2 years, 11 months ago

You learn something every day. Been obsessing on this question. WIP will not work on android (I was getting confused between WIP and AIP). Device 1 is android.

upvoted 2 times

...

DarkAndy

2 years, 11 months ago

Valid on exam. Jun 10, 2022

upvoted 7 times

...

MK500

3 years ago

The question does not specify which platform the policy is created for. The is only one policy which can either be for Android or for Windows 10. If the policy is for Android, the answer would be NO, YES, YES. If it is for Windows 10, answer is YES, YES, NO.

upvoted 1 times

...

cinziasun

3 years ago

Correct answer is YNN. 1. Yes because device 1 is an Adroid Device and it's not included in policy; 2. No becasue App1 and device windows are included in policy; 3. No for the same reason of Q2.

upvoted 2 times

...

LillyLiver

3 years, 2 months ago

Well... I'm torn. I want to believe everyone saying that Q1 is Yes. It makes sense that WIP doesn't apply to Android devices so you can copy the data all day if you want. But I'm reading what the block mode does, and I don't know that I truly believe that theory. From: https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure#:~:text=Table%202%20%20%20%20Mode%20%20,off%20and%20doesn%27t%20help%20to%20pr%20...%20 Block: WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise. I don't think that WIP is going to allow the ability to copy the data from App1 to App3. Also App3 isn't included in the policy anywhere. Every time I've read something about WIP if an app isn't a part of the policy, it's unenlightened and you can't do anything with it. So I say it's N/Y/N.

upvoted 1 times

LillyLiver

3 years, 1 month ago

I'm coming back to this problem-child of a question a couple weeks later. I've changed my mind a little after looking at this some more. Q1: N - The WIP is only going to apply to Win 10. And it's also protecting App1. So since App1 is protected with the block, meaning "...This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise." So Android can't even get to App1 to copy anything in the first place. Q2: N - True, Device2 is a Windows 10 box, but App2 is excluded from the policy so it can't copy to App2 either. Q3: N - Same as Q2, only you have App3. App3 isn't protected so it can't have App1 data copied to it. So my answer has changed slightly to N,N,N.

upvoted 2 times

...

martinods

3 years, 4 months ago

YNN- You can use Windows Information Protection (WIP) policies with Windows 10 apps to protect apps without device enrollment. https://docs.microsoft.com/en-us/mem/intune/apps/windows-information-protection-policy-create

upvoted 1 times

...

martinods

3 years, 4 months ago

app protection policy works on Android 1. Device 1 is an Android Device and app protection policy works on it -> Answer NO 2. App2 is exempt, but the policy protects >App1< from data LEAVING it. So the copy gets blocked -> Answer NO 3. This is effectively the same as #2. Sure, App3 is not impacted, but App1 is, and you cannot copy data FROM App1 -> Answer NO

upvoted 2 times

...

mkoprivnj

3 years, 6 months ago

Y, N, N

upvoted 1 times

...

Rstilekar

3 years, 6 months ago

Corrected ans in short is # YES NO NO 1. Device 1 is an Android Device and WIP won't work at all -> Answer YES 2. App 2 is an exempt App but not App1 -> Answer NO.... The reasoning why you can't Copy and Paste into App2 is due to the app being unenlightened so the Context this app runs will be "Personal". You can copy and paste out of App2 to another app but Copy and Pasting from App1 to App2 wouldn't work as App1 is enlightened and runs under the corporate context and wouldn't allow pasting into an app running in the personal context 3. APP 3 is neither a protected nor an excempt app. WIP should Block -> Answer NO

upvoted 1 times

...

Fcnet

3 years, 8 months ago

Just to clarify. What is the goal here ? You want to block the copy feature from any app. Except from app1 and app2 as app2 is exempted from the policy and app1 can copy from and to itself. Wich means if you try to copy from app3 it won't work (from any device). So the answer is No - Yes - No You won't be able to copy from App3 what ever device it is. To reach this goal, you have to create at least 2 app protection policies : one for android and one for Windows.

upvoted 1 times

Fcnet

3 years, 8 months ago

When you click the "Create Policy" menu in MEM / Intune in App Protection Policies you get a drop-down to choose between Windows10 and later or iOS / iPadOS or Android (from endpoint.microsoft.com / home / apps / app protection policies / create policy choose one from ios/android/windows) How to create an app policy for Windows : (wip) https://docs.microsoft.com/en-us/mem/intune/apps/quickstart-create-assign-app-policy How to create an app policy for Android : (wip) https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policies

upvoted 1 times

Fcnet

3 years, 8 months ago

If only one policy has been created then the answer should be No - Yes - Yes if the policy for android only has been created, but nothing tells us only one android policy has been created except the name protectionPolicy1 but it is not clear if it's a policy for android or for Windows…. In summary if we wan't to gain the goal : avoid the copy paste from any appx except app2 and app1 from any device / android and Windows we have to create 2 policies : one for android and one for windows And the answer would be No - Yes - No

upvoted 1 times

...

stromnessian

3 years, 9 months ago

The answer is... ...it depends! The question does not provide enough information. Are the apps enlightened? Is the data work or personal? If we assume that the data is being copied from a work context in App1: YES - This is WIP, so nothing to do with Android, i.e. the policy will not be applied. YES - Exempt apps can interact with any work or personal data. NO - The app is not included in the policy so will have the enterprise context of personal, so can only interact with personal data. I read with interest the explanation from DTz, but in my humble opinion it is wrong. "Block" does not prevent enterprise data from leaving protected apps. If you think about it, that would be silly as users have to be able to copy and paste between enterprise apps. What "block" does is prevent copying from a work context to a personal one.

upvoted 2 times

...

Load full discussion...