Protecting Endpoints with Security Policies Flashcards

Which Windows Defender feature protects specific folders (like Documents and Desktop) from unauthorized changes by ransomware?

Answer: Controlled folder access

Controlled folder access monitors and protects designated folders from unauthorized changes by untrusted apps, providing protection against ransomware.

A company needs to ensure sensitive files on Windows 10 are encrypted and access is restricted to corporate apps only. Which feature should be configured?

Answer: Windows Information Protection (WIP)

Windows Information Protection (WIP) encrypts corporate data and restricts access to designated enterprise apps, protecting data without interfering with personal data.

Which Intune endpoint security feature allows an administrator to onboard Windows 10 devices to Microsoft Defender for Endpoint?

Answer: Endpoint detection and response (EDR) policy

The Endpoint detection and response (EDR) policy in Intune's endpoint security section is used to onboard Windows devices to Microsoft Defender for Endpoint.

Which attack surface reduction rule prevents Office applications from creating executable content (such as .exe files)?

Answer: Block Office applications from creating executable content

The ASR rule 'Block Office applications from creating executable content' prevents macro-enabled Office files from writing and executing malicious payloads.

What does Credential Guard in Windows 10 protect against?

Answer: Pass-the-hash and pass-the-ticket attacks

Windows Defender Credential Guard uses virtualization-based security to isolate LSASS secrets, protecting against pass-the-hash and pass-the-ticket credential theft attacks.

An Intune security baseline is deployed but a setting conflicts with a device configuration profile. Which policy wins?

Answer: The most restrictive setting wins

When there are conflicts between Intune policies, Intune applies the most restrictive setting for that specific configuration, resulting in the most secure outcome.