Question
You are investigating a potential attack that deploys a new ransomware strain.
You have three custom device groups. The groups contain devices that store highly sensitive information.
You plan to perform automated actions on all devices.
You need to be able to temporarily group the machines to perform actions on the devices.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Assign a tag to the device group. Correct
- B. Add the device users to the admin role.
- C. Add a tag to the machines. Correct
- D. Create a new device group that has a rank of 1. Correct
- E. Create a new admin role.
- F. Create a new device group that has a rank of 4.
Explanation
In Defender for Endpoint, device group membership can be based on a device tag, so you add a tag to the machines and use that tag as the matching condition of a new device group. A device belongs only to the highest-ranked group it matches, so the temporary group must have rank 1 to take precedence over the three existing custom groups; a rank of 4 would leave the devices in their current groups. Admin roles control who can manage devices, not how devices are grouped for automated actions.
