The correct options are Network share coverage and exclusion settings extend endpoint DLP policies to file shares and mapped network drives and Advanced content classification and enforcement is available only on Windows devices.

Network share coverage and exclusion settings extend endpoint DLP policies to file shares and mapped network drives is correct because endpoint DLP can be configured to include or exclude network shares and mapped drives so that the same monitoring and enforcement rules that apply to local files also apply to files on SMB and other network locations. Coverage settings bring those remote locations into scope and exclusion settings let administrators exempt specific shares or paths from policy checks.

Advanced content classification and enforcement is available only on Windows devices is correct because the more advanced inspection and enforcement capabilities depend on Windows specific components and file system integration. Those advanced features rely on OS level hooks and drivers that are not available on macOS so vendors often limit them to Windows endpoints.

Restricted app groups take precedence over entries in the restricted apps list when both appear in the same rule is incorrect because precedence is not determined simply by grouping. Policy evaluation follows the product's rule resolution order and specificity rather than a blanket rule that groups always override individual list entries.

You can configure file path exclusions for both Windows and macOS clients is incorrect because file path exclusions are typically implemented using Windows path semantics and kernel level filtering. In this product those exclusion controls are supported on Windows endpoints and do not apply in the same way on macOS.

Full AWS Practitioner Certification Question