Exam MS-101 topic 3 question 110 discussion

It specifically says, *need to prevent*, if asked for *configure* then C was considered or even E but it talks about prevent means you need CAS and CAS would work on basis on compliance policy here

You don't "need" E, you may set encryption, complex password and defender via GPO don't assume what is not told. Question is about keep device away if not complaint and thats require just compliance policy and conditional access

Another sneeky Microsoft test question. Practically speaking, you would need B, D, and E. The compliance policy would fix a risk level for a connecting device so that the conditional access policy could determine whether or not to allow that device to access network resources. It would only make logical sense to have a device configuration profile to set the complex passwords, storage device encryption, and Defender anti-virus requirments into action, but Microsoft seems more interested in excluding non-compliant devices than in seeing that devices meet compliance. You judge.

you can do complex password in compliance policy :https://docs.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows

i would think it is more like B &D

I think its B&E in device restrictions you can manage complex password policy