Free Microsoft Endpoint MD-102 Actual Exam Questions - Question 10 Discussion
HOTSPOT - You have a Microsoft 365 subscription. You plan to enroll devices in Microsoft Intune that have the platforms and versions shown in the following table. 
You need to configure device enrollment to meet the following requirements: Ensure that only devices that have approved platforms and versions can enroll in Microsoft Intune. Ensure that devices are added to Azure AD groups based on a selection made by users during the enrollment. Which device enrollment setting should you configure for each requirement? To answer, select the appropriate options in the answer area. 
Policy applies only to targeted apps, so restrictions don’t affect all work profile apps.
I agree that option B fits well for the backup restriction, but I want to point out why option A doesn’t work here. The policy doesn’t disable screen capture globally; it only applies to managed apps. So, any app not targeted by the policy isn't affected. This means A is too broad. Also, option C talks about data transfer restrictions, which aren’t explicitly set in the policy shown. So, focusing on the backup restriction being blocked for targeted apps (B) is the best match based on the policy details.
Option B blocks data backup, which matches the policy’s restrictions.
I think B fits better since it blocks data backup, which is in the policy settings.
B C A B