Microsoft 365 Certified: Administrator Expert Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 2

  User3 is a full Defender admin, but still cannot isolate Device1. Device group scoping always wins ANswer to all three is NO

• 1

  Ans - No-No-No User1 can run an antivirus scan on Device2 → No (User1 is in Group1, and Group1 only has access to the ATP1 device group that contains Device1; Device2 is in Ungrouped devices which is assigned to Group2). User2 can collect an investigation package from Device2 → No (User2/Group2 can see Device2 via the Ungrouped devices device group, but Role2 only has View data permissions, not response actions like “collect investigation package”). User3 can isolate Device1 → No (User3 has the Administrator role permissions, but the role is assigned to Group3, and Group3 isn’t granted access to the ATP1 device group that contains Device1).

• 1

  Y,N;Y Alerts investigation - Manage alerts, initiate automated investigations, run scans, collect investigation packages, manage device tags, and download only portable executable (PE) files