You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable…

Question

Options

• AFrom the Security & Compliance admin center, configure the DKIM signatures for the domain.
• BFrom a domain controller, create a Group Policy object (GPO) that enables the Restrict
• CFrom the Security & Compliance admin center, create a device security policy.
• DFrom a domain controller, create a Group Policy object (GPO) that enabled the Turn On

• A
  8% (3)
• B
  3% (1)
• C
  6% (2)
• D
  83% (30)

Explanation

Windows Defender Credential Guard is a virtualization-based security (VBS) feature enabled through Group Policy, specifically the 'Turn On Virtualization Based Security' policy setting found under Computer Configuration > Administrative Templates > System > Device Guard. Within that policy, you can enable Credential Guard and choose the protection level. Because all computers are domain-joined, a GPO deployed from a domain controller is the correct and scalable way to enable this. The Security & Compliance admin center (options A and C) manages data governance and compliance policies, not endpoint security features like Credential Guard. DKIM (A) is an email authentication mechanism entirely unrelated to endpoint protection.

No community discussion yet for this question.