Manage & Protect Flashcards by Dylan Tran

What does Windows Defender ATP stand for?

Windows Defender Advanced Threat Protection

How well did you know this?

Not at all

Perfectly

Where are two places you can get Windows Defender ATP?

Windows 10 Enterprise/Education E5 Subsciption

Part of Microsoft Threat Protection

How well did you know this?

Not at all

Perfectly

Can you find the Security portal in Azure?

Yes

How well did you know this?

Not at all

Perfectly

Six features of Windows Defender ATP?

Threat Vulnerability
-Constantly looking at your system for vulnerabilities

Attack Surface Reduction
-Example by not running services Organisation does not need

Endpoint Detection

Automated Remediation
-Attack is detected and ATP takes steps to eradicate

Secure Score
-x/100. Represents how secure your Infrastructure is overall

APIs
-Makes it easy to implement in your existing security workflows

How well did you know this?

Not at all

Perfectly

What does Credential Guard do?

Virtualizes security of credentials, meaning the credential is separated from the OS

How well did you know this?

Not at all

Perfectly

Requirements of Credential Guard

Virtulization
-64 Bit Cpu

Secure Boot

TMP 1.2 or 2.0

UEFI Lock

How well did you know this?

Not at all

Perfectly

What are 3 ways you can configure Credential Guard?

Group Policy

Registry

Hardware Readiness Tool

How well did you know this?

Not at all

Perfectly

4 Components for Exploit Guard?

Exploit Protection

Attack Surface Reduction Rules

Network protection

Controlled folder access

How well did you know this?

Not at all

Perfectly

Do all 4 of the Exploit Guard rely on Windows Defender Antivirus? (Real Time protection)

Yes

How well did you know this?

Not at all

Perfectly

Where can you locate the Virus Real Time protection settings?

Settings -> Updates & Security -> Windows Security -> Virus & Threat Protection settings

How well did you know this?

Not at all

Perfectly

Can you use an Evaluation Tool for Exploit Guard to see if it is right for your environment?

Yes through scrips provided by Microsoft, an audit mode and a Windows defender Test Ground

How well did you know this?

Not at all

Perfectly

What does Application Control Limit?

Apps

Scripts including Powershell

MSIs

How well did you know this?

Not at all

Perfectly

Two ways to configure Windows Defender Application Control?

Group Policy

Intune

How well did you know this?

Not at all

Perfectly

What are the 2 components of the retired Windows Defender Device Guard?

Windows Defender Exploit Guard

Windows Defender Application Control

How well did you know this?

Not at all

Perfectly

What does the Windows Defender Application Guard protect within?

Edge

How well did you know this?

Not at all

Perfectly

How do you turn on Windows Defender Application Guard?

Windows Feature on and Off

How well did you know this?

Not at all

Perfectly

If you upload On Prem AD to the cloud, does it become Azure AD?

No, when you upload On Prem AD it just stays in the cloud and acts as infrastructure as a service and receive the benefits of the cloud things.

How well did you know this?

Not at all

Perfectly

Does Hybrid AD join Azure AD?

Yes

How well did you know this?

Not at all

Perfectly

What is an Azure Tenant?

Your instance of Azure AD when you sign up for the Cloud

How well did you know this?

Not at all

Perfectly

What is a Single Tenant?

You only access resources in your oganization

How well did you know this?

Not at all

Perfectly

What is a Multi Tenant?

You access resources across organizations

How well did you know this?

Not at all

Perfectly

What is an Azure AD Acct?

Identity stored in Azure AD; Work or School account

How well did you know this?

Not at all

Perfectly

What is a Custom Domain?

Domain other than onmicrosoft.com

How well did you know this?

Not at all

Perfectly

What is an Acct Admin?

Billing owner of the subscription (classic)

How well did you know this?

Not at all

Perfectly

What is a Service Admin?

Manage all resources (classic)

What is an Owner?

Manage all resources (RBAC)

What is an Azure AD Global Admin?

Persons who created the Azure ad Tenant

What is a MSA?

Microsoft Account

What is a directory role?

A role within Azure such as admin roles and permissions

What do you get as part of the Azure AD Free License?

User & Group Management On Prem directory sync Basic Reports SS0 - Azure, O365, SaaS

What do you get as part of the Azure AD Basic License?

All of Azure AD Free Cloud-Centric app access Azure AD Application Proxy

What do you get as part of the Azure AD Premium P1?

Hybrid users for On-Prem and cloud resource access Advanced administration

What do you get as part of the Azure AD Premium P2?

Azure Directory Identity Protection Privileged Identity Management (control what Admins can do)

What do you get as part of the "Pay as you go"

Pay as you go... Azure AD Business to client

What is the goal of device management in Azure AD?

To support a BYOD infrastructure and have "anytime, anywhere" availability and to protect corporate data

What devices do Azure AD accomodate?

Windows iOS Anroid macOS

What does "registering" mean withing the Azure AD?

Providing an identity for a device (to enable or disable device) MDM for security and compliance (Intune)

What does "joining" mean withing the Azure AD?

An extension of registering (changes local state) User logon using identity: Autopilot, bulk, self service Designed for cloud but works with hybrid Windows 10 ONLY

What are the benefits of "joining" the Azure AD?

SSO Roaming Windows Store for Business Windows Hello Restriction of access Seamless on-prem access

What are the some use cases of "joining" the Azure AD?

Transitioning -From On-Prem to Azure AD On-Prem AD not possible Users really just need O365 or other MS SaaS Seasonal Workers, Contractors

What are the some use cases of "joining" a Hybrid Azure AD?

SCCM & GP Win32 apps might rely on traditional AD You love imaging Have a bunch of W7 or W8.1

How would (4 way) devices authenticate before joining Azure AD in a Federated Environment?

Authenticate through two required protocols: WS-Fed (join) and WS-Trust (login) SAML -Authentication through a web interface Smartcards with AD Federation Services Windows Hello for Business (recommendation)

What does the MDM Migration Analysis Tool (MMAT) do?

Tells you what would happen if you transfer your Group Policies to Intune

What should you use to manage your devices?

EITHER: MDM-only (strongly recommened by Microsoft) Co-management (Intune + SCCM) MDM Migration Analysis Tool (MMAT)

Ways to get device joined to Azure AD?

Self Service - User Interaction - OOBE - Default admin right when done this way - 1511+ Autopilot - User interaction - OOBE - CAN configure admin rights - 1709+ Bulk Enrollment - No user interaction - OOBE - No admin Rights - 1703+

What options should you consider during your planning of Azure AD Join?

How devices authenticate to join Azure AD (eg. Federated Environments) What will you use to manage devices (Either Intune or SCCM or both) How devices are joined to Azure AD (Self Services, Autopilot or Bulk Enrollment)

Where do you add a custom domain name in Azure?

Azure Active Directory -> Custom Domain Names

Where can you add Groups in Azure? and what group types can you choose from?

Azure Active Directory -> Groups Security or office 365

How do you add groups/users to Azure AD?

Azure Active Directory -> Devices -> Device Settings Click "users may join devices to Azure AD" and choose SELECTED

How would a user join Azure AD by themselves?

Settings -> Accounts -> Access work or school| "Join Azure Active Directory"

What is required to be setup when joining the Azure AD on behalf on the user?

Windows Hello and MFA

How do you enroll devices in Intune?

Azure Active Directory -> Mobility (MDM and MAM) -> Intune -> Configure Change scope to "Some" and add the groups Configure the user profile making sure usage location is filled

Do you have to assign a License to a user to use Intune?

Yes, choose one of the licences that has Intune eg E3

What does the app Company portal do?

Deploy company apps and configurations to users

Where can you find documentation within Intune?

Azure -> Intune -> Quick Start

Where can you change the default Compliance policy settings and should you?

Intune -> Device Compliance -> Compliance policy Settings Yes you definitely should as devices with no compliance settings are set to compliant...by default..

How do you check the hardware specifications of a device?

Intune -> Devices - All devices -> Click into device Click on hardware

Which Windows Analytics solution uses Windows diagnostic data to provide notification of Windows Information Protection misconfigurations that send prompts to end users?

Device Health

Which components of Windows Defender Exploit Guard protects the endpoint against web-based threats by blocking any outbound process on the device to untrusted hosts/IP through Windows Defender SmartScreen?

Network Protection

What action does the Fresh Start reset feature in Intune perform on a PC running Windows 10, version 1703 or later?

Removes any apps that are installed

Which component of Windows Intune creates a configuration profile that includes that best practices and recommendations on settings that impact security?

Security Baseline

If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, what allows Microsoft Edge to open the site in an Isolated Hyper-V-enabled container, which is separate from the host operating system?

Windows Defender Application Guard

What are the two ways to get devices enrolled in Intune?

Users can self-enroll their devices You can configure policies to force automatic enrollment without any user involvement

What is the maximum number of devices can a single Intune user enroll with a single Intune license?

What happens to Windows Defender Antivirus if you have another antivirus product running and up-to-date on your Windows 10 device?

Windows 10 will disable Windows Defender Antivirus

Which service of Windows defender is designed to lock down the device against a wide variety of attack vectors and block behaviors commonly used in malware attacks, while enabling enterprises to balance their security risk and productivity requirements?

Exploit Guard

Which actions can be performed on a device enrolled in Intune?

Retire Wipe Remote Lock Synchronize Device Reset Passcode

How many mobile devices can the device enrollment manager (DEM) account enroll in Intune?

1000

Which Windows Analytics solution provides for the identification of devices that crash frequently, and therefore might need to be rebuilt or replaced and identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes?

Device health

What kind of non-Windows devices can you enroll with Company Portal?

Android macOS iOS

How can you provide and up to the minute listing of devices enrolled in Intune?

Browse the list of enrolled devices in Intune: then "Devices > All devices"

Which port does the Linux and Windows Log Analytics agent communicate outbound to the Azure Monitor service?

TCP Port 443

Yes or No: Can Intune allow you to configure and enable MAM policies over managed applications, without implementing Intune MDM or any 3rd party MDM solution?

Yes You will need to push a certificate for trust

Which methods does Intune support for enrolling iOS company-owned devices?

Apple's Device Enrollment Program (DEP) Apple School Manager Apple Configurator Setup Assistant enrollment Apple Configurator direct enrollment

For optimal performance, Microsoft recommends how much RAM for computers that have Application Guard enabled?

8GB

What happens if you install .msi files from the Internet on a computer protected by Windows Defender Application Control?

It's blocked

Which components of Windows Defender Exploit Guard is a set of exploit mitigations that replaced the Enhanced Mitigation Experience Toolkit?

Exploit Protection

Which components of Windows Defender Exploit Guard is a set of controls that enterprises can enable to prevent malware from getting on the machine by blocking Office, scripts and email-based threats?

Attack Surface Reduction

Yes Or No Is Windows Defender Application Guard supported on VMS and VDI environment?

No....but seen it tho...

What is the difference in the recommendations for Windows security baselines for group policy vs Intune?

All settings are the same except some settings in group policy baseline that are specific to an on-premises domain controller

What are the four components of Windows Defender Exploit Guard?

Exploit Protection Attack surface reduction Network Protection Controlled folder access

What happens when you check the "Retain enrollment state and user account" option when you perform a Wipe in Intune?

Keeps user accounts and data Wipes all MDM Policies Resets user settings back to default Resets the operating system to its default state and settings

Which component of Windows Defender Exploit Guard protects sensitive data from ransomware by blocking untrusted processes from accessing your protected folders?

Controlled Folder Access

What is the difference between a "Wipe" and "Retire" in Intune?

Retire leaves the user's personal data on the device while a Wipe does not retain user files, user-installed apps or non-default settings

What version of Android operating system is required to enroll the device with the Microsoft Intune App?

Android 6.0+