Task 3.2: Specify requirements for securing server and client endpoints

• AKeep the MMA-based onboarding and point the agents at a new Log Analytics workspace dedicated to the servers

  Incorrect

  That's the previous, MMA-based implementation: it keeps the dependency the requirements rule out, and the modern unified solution has replaced it.

• BUpgrade the servers in place to Windows Server 2022 with Defender for Endpoint still installed, then let them report

  Incorrect

  The vendor doesn't certify a newer version, and an in-place upgrade of Windows Server 2016 with Defender for Endpoint installed isn't supported: the server must be offboarded and the product uninstalled first.

• CRun only the onboarding script used for the 2022 servers, since every supported Windows Server version has the EDR sensor built in

  Incorrect

  The EDR sensor is built in only from Windows Server 2019; on Windows Server 2016 the unified solution's installation package must install it.

• DMove them to the modern unified solution, with Defender Antivirus installed as a feature and fully updated first

  Correct

  The unified solution onboards Windows Server 2016 without the Microsoft Monitoring Agent and with a much expanded feature set; on Windows Server 2016, Defender Antivirus must be installed as a feature and fully updated before installation.

Before April 2022, onboarding Windows Server 2016 and 2012 R2 to Defender for Endpoint required the Microsoft Monitoring Agent. The modern, unified solution package removes that dependency and provides a much expanded feature set, and Microsoft documents migration scenarios from the MMA-based solution. On Windows Server 2016, Microsoft Defender Antivirus must be installed as a feature and fully updated before installation. Windows Server 2019 and later have the EDR sensor built in, and upgrading the operating system of a Windows Server 2016 machine with Defender for Endpoint installed isn't supported.

• AFull Intune device enrollment with compliance policies, so that corporate data can be wiped from the phones

  Incorrect

  Staff refuse enrollment, so this requirement can't be met.

• BA VPN profile pushed to every personal phone

  Incorrect

  A VPN protects traffic but doesn't control data inside apps, and it needs management.

• CIntune app protection policies on the apps, required through Conditional Access

  Correct

  App protection policies protect corporate data in apps without enrolling the device, including copy-paste restrictions and selective wipe.

• DIntune app configuration policies that preconfigure Outlook and Teams with the corporate account settings

  Incorrect

  App configuration policies supply settings to apps; they don't stop copying data into personal apps or wipe corporate data.

Intune app protection policies protect corporate data on mobile devices without requiring enrollment, controlling how data is accessed and shared by apps, such as preventing copy-paste into personal apps, and allowing selective wipe of corporate data. Conditional Access can require an app protection policy before granting access.

• ALegacy Microsoft LAPS deployed with Group Policy, storing each device's password in an attribute of its computer object

  Incorrect

  Legacy LAPS needs on-premises AD and Group Policy, which Entra-joined, Intune-managed laptops don't use.

• BWindows LAPS managed by Intune, backing up each password to Entra ID and rotating it

  Correct

  Windows LAPS gives each device its own rotated password, backed up to Entra ID, with retrieval for authorized admins.

• CA shared password changed every quarter

  Incorrect

  A shared password still lets one leak unlock every laptop.

• DRemoving the local administrator account from the image

  Incorrect

  Helpdesk still needs a recoverable local admin for support.

Windows LAPS automatically manages and backs up the password of a local administrator account on Microsoft Entra-joined or Active Directory-joined devices. With Intune, devices can back up their password to Microsoft Entra ID or on-premises AD, rotate it on a schedule, and admins with the right permissions can view or manually rotate it.

• ADefender for Endpoint installed on each PLC and HMI

  Incorrect

  Installing software on OT devices is forbidden, and PLCs can't run it.

• BWeekly active vulnerability scans of the OT network, scheduled during planned maintenance windows to limit any disruption

  Incorrect

  Active scanning is ruled out because it can disrupt processes.

• CDefender for IoT sensors on SPAN ports or TAPs, cloud-connected to Azure

  Correct

  OT sensors monitor passively and agentlessly from mirrored traffic, and cloud-connected sensors feed the Azure portal and Sentinel.

• DDefender for Endpoint device discovery in standard mode, run from the plant's engineering workstations

  Incorrect

  Standard discovery actively probes devices, which operations forbids, and visibility of OT devices and protocols needs Defender for IoT.

Defender for IoT provides agentless, network layer monitoring for OT. Its network sensors connect to a SPAN port or network TAP, identify specialized protocols and device behaviors, and when cloud-connected they send data to the Azure portal, with connections to Microsoft Sentinel.

• AUsers from installing any application

  Incorrect

  That would be application control.

• BChanges to key Defender security settings

  Correct

  Tamper protection locks Defender settings against unwanted changes.

• CPhishing emails from reaching inboxes

  Incorrect

  That's email protection.

• DRansomware from encrypting backups that are stored in the cloud

  Incorrect

  Cloud backup protection is a backup feature.

Tamper protection helps prevent malicious apps and actors from changing important security settings, such as disabling real-time protection or cloud-delivered protection.

• AThe Security Compliance Toolkit

  Correct

  The baselines are published in the Security Compliance Toolkit.

• BThe Azure Marketplace

  Incorrect

  Baselines aren't Marketplace offers.

• CThe Microsoft Store

  Incorrect

  The Store doesn't distribute baselines.

• DThe Service Trust Portal

  Incorrect

  That portal publishes Microsoft's compliance documents.

Microsoft's Windows security baselines can be downloaded from the Microsoft Download Center as part of the Security Compliance Toolkit, which also includes tools to help manage the baselines.

• AOnly inside each PLC's firmware

  Incorrect

  Sensors aren't installed on PLCs.

• BOnly as a browser extension

  Incorrect

  Sensors aren't browser components.

• CA virtual machine or a physical appliance

  Correct

  OT sensors are deployed on either a VM or a physical appliance.

• DOnly on employees' laptops

  Incorrect

  Sensors sit on the network, not on laptops.

Defender for IoT OT network sensors are deployed on either a virtual machine or a physical appliance that monitors network traffic, not on the OT devices themselves.

• AAndroid Enterprise fully managed devices

  Incorrect

  Fully managed is for corporate-owned devices used only for work, with the whole device under management.

• BAndroid device administrator management

  Incorrect

  Device administrator management is deprecated and no longer available for devices with Google Mobile Services.

• CAndroid Enterprise corporate-owned work profile

  Incorrect

  That option is for corporate-owned devices approved for personal use, not phones the users own.

• DAndroid Enterprise personally owned work profile

  Correct

  Enrollment creates a work profile for work apps and data that Intune manages, while personal apps and data stay separate and unaffected by Intune.

For bring-your-own-device scenarios, Intune supports the Android Enterprise personally owned work profile. Enrollment creates a separate work profile that holds work apps and data, which administrators manage with Intune policies; personal apps and data stay in another part of the device and aren't affected by Intune. Fully managed and corporate-owned work profile enrollment are for corporate-owned devices, and Android device administrator management is deprecated for devices with Google Mobile Services.