SC-100 Certification Practice Question #175

Question

Your company has a main office and 10 branch offices. Each branch office contains an on-premises file server that runs Windows Server and multiple devices that run either Windows 11 or macOS. The devices are enrolled in Microsoft Intune.

You have a Microsoft Entra tenant.

You need to deploy Global Secure Access to implement web filtering for device traffic to the internet. The solution must ensure that all the web traffic from the devices in the branch offices is controlled by using Global Secure Access.

What should you do first in each branch office?

Accepted Answer

Global Secure Access controls device internet traffic by routing it through Microsoft's Security Service Edge, and the component that acquires and tunnels that traffic on each managed device is the Global Secure Access client. Because the branch devices (Windows 11 / macOS) are already enrolled in Intune, the natural "first" step in each office is to push the GSA client via an Intune deployment policy — MS Learn documents this exact Intune-based client install for both platforms. The IPsec/remote-network path (B) is the clientless alternative for unmanaged devices, which doesn't fit here. Suggested Answer, the unanimous Most Voted, multiple 3-👍 comments, and MS Learn all converge on D.

More SC-100 practice questions