Exam MS-101 topic 3 question 78 discussion

Actual exam question from Microsoft's MS-101

Question #: 78
Topic #: 3

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.
You create a Microsoft Defender for Identity instance named Contoso.
The tenant contains the users shown in the following table.

You need to modify the configuration of the Defender for Identity sensors.
Solution: You instruct User1 to modify the Defender for Identity sensor configuration.
Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: A 🗳️

by ercluff at March 5, 2022, 2:18 a.m.

Comments

Submit Cancel

ercluff

Highly Voted 3 years, 3 months ago

B. NO – User2 lacks the permissions needed to modify the Defender for Identity sensors. User1’s status as a Defender for ID administrator, User3’s status as and Azure AD Security Admin, and User4’s status as an Azure AD Global Admin give them the necessary power to modify the Defender for Identity sensors.

upvoted 7 times

ercluff

3 years, 3 months ago

Topic 3, Questions 66, 69, and 78 present these other three user accounts status and permissions to perform the Defender for Identity modifications.

upvoted 3 times

...

Swimpy

Most Recent 1 year, 11 months ago

Selected Answer: A

https://learn.microsoft.com/en-us/defender-for-identity/role-groups Just scroll down near to the end or search for: "Update Defender for Identity Configuration - Sensors (download, regenerate key, configure, delete)"

upvoted 1 times

...

Meebler

2 years, 3 months ago

A. Yes, this solution meets the goal. As User1 is a member of the Defender for Identity Contoso Administrators group, they have the necessary permissions to modify the Defender for Identity sensor configuration.

upvoted 2 times

Meebler

2 years, 3 months ago

even if User1 does not have any Azure roles assigned, as long as they are a member of the Defender for Identity Contoso Administrators group, they will have the necessary permissions to modify the Defender for Identity sensor configuration. The Defender for Identity Contoso Administrators group is specifically created to allow its members to manage Defender for Identity instance and its sensors.

upvoted 1 times

...

IPalot

2 years, 5 months ago

Selected Answer: A

Answer is Yes. Nowadays it is called ATP (advanced threat protection) Defender for Identity provides three types of security groups: Azure ATP (instance name) Administrators, Azure ATP (instance name) Users, and Azure ATP (instance name) Viewers The administrator role has every action 'available' to his name. Check out: https://learn.microsoft.com/en-us/defender-for-identity/role-groups

upvoted 1 times

...