SC-200 Certification Practice Question #182

Question

You have a Microsoft 365 subscription named contoso.com that contains a Windows 11 device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint.

You perform the following actions:

•	From Defender for Endpoint, create the device groups shown in the following table.

•	Onboard an Android device named Device2 to Defender for Endpoint.

To which device groups will each device be added? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Defender for Endpoint adds a device to **only the single highest-ranked group it matches** — a device is never in two groups simultaneously, which immediately eliminates the "and" combinations and "Ungrouped" options. **Device1** (Windows 11, name begins "Device") matches both Group2 (Name Starts with Device) and Group3 (Name Starts with Device AND Domain = contoso.com), but Group2 has the higher rank (rank 2 vs rank 3), so first-match/highest-rank wins → **Group2 only**. **Device2** is an Android device, so it matches Group1 (OS In Android), which is rank 1 (the highest), and the OS condition is evaluated before/above the name conditions → **Group1 only**. This is exactly the single community answer, and it is fully supported by the MS Learn ranking rule. Confidence is held just below 90 because only one low-vote comment exists and no official Suggested Answer is captured.

More SC-200 practice questions