Exam MS-101 topic 1 question 102 discussion

Actual exam question from Microsoft's MS-101

Question #: 102
Topic #: 1

HOTSPOT
-

You have a Microsoft 365 subscription that contains an Endpoint data loss prevention (Endpoint DLP) policy named Policy1 and the devices shown in the following table.

For Policy1, the Audit or restrict activities on devices settings are configured as shown in the Activities exhibit. (Click the Activities tab.)

For Policy1, the Allow override from Endpoint devices settings are configured as shown in the Devices exhibit. (Click the Devices tab.)

Test users discover that they cannot copy data to their network shares while working remotely.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Jame at Jan. 6, 2023, 8:32 a.m.

Comments

Submit Cancel

madfoxmax

Highly Voted 2 years, 6 months ago

I expected the opposite of the answer. Device 1 can print, but only after they override. Device 2 is not enrolled in defender, so no policy should apply correct? and device 3 can't save to a network share because it's block and no override is available.

upvoted 23 times

Jakub2023

2 years, 1 month ago

Correct, YYN is the right answer. - The override setting does allow the user to... override the policy restriction. - Without Defender for Endpoint enrolment, the policy won't apply. - AAD joined, AAD registered and Hybrid joined devices are all covered.

upvoted 4 times

...

egsalvadori

Highly Voted 2 years, 6 months ago

I believe that the answer is the opposite: Y-Y-N, anyone care to comment?

upvoted 10 times

Arlecchino

2 years, 5 months ago

At first, I though YNN but now I agree on YYN as madfoxmax explained.

upvoted 2 times

...

GotDamnImIn

Most Recent 2 years, 2 months ago

i think this is Y-Y-N

upvoted 2 times

...

Lelek

2 years, 4 months ago

OK, that "Allow override from Endpoint devices" screen no longer exists, now this option has entered the "Audit or restrict activities on devices" option, selecting the Block with Block with override option, so the user will receive the warning that the content was blocked, but this warning appears if he wants to, he can print it anyway. Given this information, the first option should be "YES" The second option should be "YES", as the device is not managed by Endpoint, so it has no locks. The third option should be "NO", because the copy network share is blocked and there is no override for this option. Correct answer is YES, YES, NO

upvoted 5 times

...