Exam MD-100 topic 3 question 104 discussion

Actual exam question from Microsoft's MD-100

Question #: 104
Topic #: 3

DRAG DROP
-

You have a computer that runs Windows 11 and has Windows Sandbox enabled.

You need to configure a Windows Sandbox environment. The solution must meet the following requirements:

• Support a virtual GPU.
• Mount the C:\Temp folder as read only.
• Prevent users from copying files to the sandbox by using the clipboard.

How should you complete the configuration file? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Harv717 at Jan. 8, 2023, 3:49 p.m.

Comments

Submit Cancel

Harv717

Highly Voted 2 years, 6 months ago

<vGPU>Enable</vGPU> <ReadOnly>True</ReadOnly> <ProtectedClient>Enable</ProtectedClient> https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file

upvoted 5 times

...

JePe

Most Recent 2 years, 1 month ago

Protected client Applies more security settings to the sandbox Remote Desktop client, decreasing its attack surface. <ProtectedClient>value</ProtectedClient> Supported values: Enable: Runs Windows sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. Disable: Runs the sandbox in standard mode without extra security mitigations. Default: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode.

upvoted 1 times

...

JePe

2 years, 1 month ago

Answer C should be enabled as shown in the Link mentioned by Harv717 <vGPU>Enable</vGPU> <ReadOnly>True</ReadOnly> <ProtectedClient>Enable</ProtectedClient> is the only correct answer.

upvoted 1 times

...

thaeriel

2 years, 3 months ago

<vGPU>Enable</vGPU> <ReadOnly>True</ReadOnly> <ProtectedClient>Disable</ProtectedClient> Why? 1st = you need to activate the vgpu, so Enable 2nd = And here is the key; because <Clipboard redirection> is on DEFAULT you need to enable read only so there still can't be anything copied 3rd = Disable (you do not need extra security mitigations Protected client Applies more security settings to the sandbox Remote Desktop client, decreasing its attack surface. <ProtectedClient>value</ProtectedClient> Supported values: Enable: Runs Windows sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. Disable: Runs the sandbox in standard mode without extra security mitigations. Default: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode. https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file

upvoted 2 times

...

jasyan

2 years, 5 months ago

This question was on my exam like this as well. Why is the fill in the blank for <protectedclient> and not <clipboardRedirection>Disable</Clipboardredirection> instead.

upvoted 1 times

...

Heruith

2 years, 5 months ago

<VGPU>Enable</VGPU> <ReadOnly>True</ReadOnly> <ProtectedClient>Enable</ProtectedClient>

upvoted 1 times

...