SC-100 Question #317: Real Exam Question with Answer & Explanation

Question

You have a Microsoft 365 E5 subscription. The subscription contains 500 devices that run Windows 11 Pro and are enrolled in Microsoft Intune. You need to evaluate the use of Microsoft Defender Vulnerability Management to provide recommended configuration changes for the devices. Which Endpoint security settings should you use to review the recommended changes?

Options

• ASecurity tasks
• BAttack surface reduction
• CEnd point detection and response
• DDevice compliance

Explanation

{"question_number": 5, "correct_answer": "B", "explanation": "Microsoft Defender Vulnerability Management surfaces security configuration recommendations for enrolled devices, and many of these map directly to Attack surface reduction (ASR) rule configurations. In Microsoft Intune's Endpoint security node, the Attack surface reduction section is where you review and deploy ASR policies - the specific category of configuration changes that Defender Vulnerability Management most commonly recommends for hardening Windows 11 endpoints. Security tasks (A) is where Intune receives and tracks remediation tickets from Defender for Endpoint but is action-oriented, not a review surface. Endpoint detection and response (C) covers MDE onboarding settings. Device compliance (D) governs compliance policies, not configuration hardening.", "generated_by": "claude-sonnet", "llm_judge_score": 3}

No community discussion yet for this question.