Question
You have an Azure AD tenant that contains the users shown in the following table.
| Name | Member of |
|---|---|
| User1 | Group1 |
| User2 | Group2 |
| User3 | Group3 |
Your company uses Microsoft Defender for Endpoint. Microsoft Defender for Endpoint contains the roles shown in the following table.
| Name | Permission | Assigned user group |
|---|---|---|
| Microsoft Defender for Endpoint administrator (default) | View data, Alerts investigation, Active remediation actions, Manage security settings | Group3 |
| Role1 | View data, Alerts investigation | Group1 |
| Role2 | View data | Group2 |
Microsoft Defender for Endpoint contains the device groups shown in the following table.
| Rank | Device group | Device name | User access |
|---|---|---|---|
| 1 | ATP1 | Device1 | Group1 |
| Last | Ungrouped devices (default) | Device2 | Group2 |
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Explanation
Statement 1 (No): Role1 gives User1 the Alerts investigation permission, which does cover running antivirus scans, but a role applies only to devices in device groups the user's Microsoft Entra group can access. Device2 is in the Ungrouped devices group, whose user access is limited to Group2, so User1 cannot act on Device2. Statement 2 (No): User2 can access Device2 through Group2, but Role2 contains only View data. Collecting an investigation package requires the Alerts investigation permission. Statement 3 (Yes): User3 is in Group3, which holds the default Microsoft Defender for Endpoint administrator role. That role includes Active remediation actions, which covers isolating a device, and it has access to all device groups regardless of the user access configured on ATP1.
