Which two configurations should you modify?

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution. NOTE: Each correct selection is worth one point.
A . the Onboarding settings from Device management in Microsoft Defender Security Center
B . Cloud App Security anomaly detection policies
C . Advanced features from Settings in Microsoft Defender Security Center
D . the Cloud Discovery settings in Cloud App Security

Answer: CD

Explanation:

All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for Endpoint.

Reference: https://docs.microsoft.com/en-us/cloud-app-security/mde-govern