You have configured Defender for Endpoint for your Windows 10 devices managed by Microsoft Endpoint Manager. You wish to enable Microsoft Defender Application Guard. Which Device configuration profile should you choose? 
 

Answer options:

A.Identity protection
B.SCEP certificate
C.Secure assessment
D.Endpoint Protection

Correct Answer: D 
You can enable Microsoft Defender Application Guard by using the Endpoint Manager Endpoint Protection configuration profile: 

These policies help protect your users by opening untrusted web sites 
in a secure isolated container that isn`t accessible by other parts of the operating system.
Option A is incorrect. The Identity Protection profile lets you manage Windows Hello for Business settings on Windows devices.
Option B is incorrect. The SCEP certificate profile lets you put up a Simple Certificate Enrollment Protocol (SCEP) certificate to enable certificate-based authentication.
Option C is incorrect. Secure assessment is an education profile which features includes the Take a Test app and settings to add a test URL and choose how end-users sign into the test.
Reference: 
To know more about Microsoft Defender Application Guard, please refer to the link below: 

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview