Exam MS-500 topic 4 question 75 discussion

I believe answer 3 should be "no". As device 3 would match group 1 as it is higher priority. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide#:~:text=You%20can%20promote%20or%20demote%20the%20rank%20of%20a%20device%20group%20so%20that%20it%27s%20given%20higher%20or%20lower%20priority%20during%20matching.%20When%20a%20device%20is%20matched%20to%20more%20than%20one%20group%2C%20it%27s%20added%20only%20to%20the%20highest%20ranked%20group.

Box1 - User1 can manage alerts for Device2 → Yes Reason: User1 is security administrator. By default he has full access. When you first log in to the Microsoft 365 Defender portal, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Azure AD. Box2 - User3 can manage alerts for Device3 → No Reason: User3 (User Administrator) has no default access. He is a member of ADGroup3. Role 3 is assigned to ADGroup3. Remediation level for Group3: Semi – Require approval for all folders So user3 cannot manage alerts for Device3 Box3: Remediation level for device3: Semi – Require approval for all folders → No Device3 is Windows 10 device and will match Group1 (Highest Rank group) A device group with a rank of 1 is the highest ranked group. When a device is matched to more than one group, it's added only to the highest ranked group.