Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 101:

  HOTSPOT

  You network contains an Active Directory domain. The domain contains 200 computers that run Windows 8.1. You have a Microsoft Azure subscription.

  You plan to upgrade the computers to Windows 10.

  You need to generate an Upgrade Readiness report for the computers.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Create an Azure Log Analytics workspace and add a solution

  Once you have an Azure subscription, follow the steps below to get stared with Upgrade Readiness.

  Setup a subscription to Microsoft Operations Management Suite (OMS).

  You will be prompted to link the OMS workspace to an Azure subscription.

  Once the link with an Azure subscription is complete, your workspace should be ready and you will be redirected to your blank workspace.

  Enable Upgrade Analytics. To do this, click on the Solutions Gallery In the Solutions Gallery page, scroll to the right to locate and select the Upgrade Analytics

  (Preview) tile.

  ..

  Now that your Upgrade Analytics subscription is ready, the last requirement is to configure Upgrade Analytics with the details of which version of Windows 10 you are targeting. To do this, click on the tile for Upgrade Analytics Preview . On the

  Upgrade Analytics Preview page, click on the gear icon labelled Solution Settings.

  Box 2: Configure the Commercial ID

  For the commercialIDValue variable, use the "Commercial ID" that was generated when you setup your Upgrade Readiness solution. If you don't have this, you can pull it out from your OMS workspace.

  Reference:

  https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/getting-started-with-upgrade-readiness/ba-p/714705 https://docs.microsoft.com/sv-se/archive/blogs/ukplatforms/upgrade-readiness-client-configuration

• Question 102:

  HOTSPOT

  You have unrooted devices enrolled in Microsoft Intune as shown in the following table.

  

  The devices are members of a group named Group1.

  In Intune, you create a device compliance location that has the following configurations:

  1.

  Name: Network1

  2.

  IPv4 range: 192.168.0.0/16

  In Intune, you create a device compliance policy for the Android platform. The policy has following configurations:

  1.

  Name: Policy1

  2.

  Device health: Rooted devices: Block

  3.

  Locations: Location: Network1

  4.

  Mark device noncompliant: Immediately

  5.

  Assigned: Group1

  In Intune device compliance policy has the following configurations:

  1.

  Mark devices with no compliance policy assigned as: Compliant

  2.

  Enhanced jailbreak detection: Enabled

  3.

  Compliance status validity period (days): 20

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  D1 YES (no compliance policy applies to Windows device)

  D2 YES (no compliance policy applies, as the policy applies to a different subnet)

  D3 YES (Policy applies, but device is compliant as it is UNROOTED, and therefore will not be marked as noncompliant)

  Reference:

  https://docs.microsoft.com/en-us/intune/device-compliance-get-started

• Question 103:

  Your network contains an Active Directory domain named contoso.com. The domain contains 500 computers that run Windows 7. Some of the computers are used by multiple users.

  You plan to refresh the operating system of the computers to Windows 10.

  You need to retain the personalization settings to applications before you refresh the computers. The solution must minimize network bandwidth and network storage space.

  Which command should you run on the computer? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: scanstate.exe The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. For example, to create a Config.xml file in the current directory, use: scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

  Box 2: genconfig:file.xml

  Reference: https://docs.microsoft.com/en-us/windows/deployment/usmt/usmt-scanstate-syntax#how-to-use-ui-and-ue

• Question 104:

  HOTSPOT

  You have a hybrid Microsoft Azure Active Directory (Azure AD) tenant.

  You configure a Windows Autopilot deployment profile as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: import a CSV file into Windows Autopilot

  You can perform Windows Autopilot device registration within your organization by manually collecting the hardware identity of devices (hardware hashes) and uploading this information in a comma-separated-values (CSV) file.

  Box 2: joined to Azure AD only As per exhibit (Azure AD joined).

  Reference:

  https://docs.microsoft.com/en-us/mem/autopilot/add-devices

  https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid

• Question 105:

  HOTSPOT

  Your company uses Windows Defender Advanced Threat Protection (Windows Defender ATP). Windows Defender ATP includes the machine groups shown in the following table.

  

  You onboard a computer to Windows Defender ATP as shown in the following exhibit.

  

  What is the effect of the Windows Defender ATP configuration? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 106:

  HOTSPOT

  You have a Microsoft 365 subscription.

  Users have iOS devices that are not enrolled in Microsoft 365 Device Management.

  You create an app protection policy for the Microsoft Outlook app as shown in the exhibit. (Click the Exhibit tab.)

  

  You need to configure the policy to meet the following requirements: Prevent the users from using the Outlook app if the operating system version is less than 12.0.0. Require the users to use an alphanumeric passcode to access the Outlook app.

  What should you configure in an app protection policy for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Conditional launch Configure conditional launch settings to set sign-in security requirements for your access protection policy.

  By default, several settings are provided with pre-configured values and actions. You can delete some of these, like the Min OS version. You can also select additional settings from the Select one dropdown.

  Note: There are three categories of policy settings: Data relocation, Access requirements, and Conditional launch.

  Box 2. Access requirements Access requirements include:

  PIN for access: Select Require to require a PIN to use this app. The user is prompted to set up this PIN the first time they run the app in a work or school context.

  The PIN is applied when working either online or offline.

  You can configure the PIN strength using the settings available under the PIN for access section.

  Reference:

  https://docs.microsoft.com/en-us/intune/app-protection-policy-settings-ios

• Question 107:

  HOTSPOT

  Your network contains an Active Directory domain that is synced to Microsoft Azure Active Directory (Azure AD).

  You have a Microsoft Office 365 subscription. All computers are joined to the domain and have the latest Microsoft OneDrive sync client (OneDrive.exe) installed.

  On all the computers, you configure the OneDrive settings as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: The Documents folder Silently move known folders to OneDrive is enabled. Known folder include: Desktop, Documents, Pictures, Screenshots, and Camera Roll Box 2: enable OneDrive files On-Demand OneDrive Files On-Demand enables users to view, search for, and interact with files stored in OneDrive from within File Explorer without downloading them and taking up space on the local hard drive.

  Reference: https://docs.microsoft.com/en-us/onedrive/redirect-known-folders https://docs.microsoft.com/en-us/onedrive/plan-onedrive-enterpris

• Question 108:

  HOTSPOT

  Your network contains an Active Directory domain. Active Directory is synced with Microsoft Azure Active Directory (Azure AD).

  There are 500 domain-joined computers that run Windows 10. The computers are joined to Azure AD and enrolled in Microsoft Intune.

  You plan to implement Windows Defender Exploit Guard.

  You need to create a custom Windows Defender Exploit Guard policy, and then distribute the policy to all the computers.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  References: https://docs.microsoft.com/en-us/intune/endpoint-protection-windows-10

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection

• Question 109:

  HOTSPOT

  Your company has a Microsoft Azure Active Directory (Azure AD) tenant and computers that run Windows 10.

  The company uses Microsoft Intune to manage the computers.

  The Azure AD tenant has the users shown in the following table.

  

  The device type restrictions in Intune are configured as shown in the following table:

  

  User3 is a device enrollment manager (DEM) in Intune.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No User1 is part of Group1 which only allows enrollment of Android, iOS devices (NOT Windows devices)

  Box 2: Yes User2 is part of Group1 and Group2 but Group2 has Priority 2 which is higher priority than Group 1, so only Policy2 applies. Policy2 allows enrollment of Windows devices

  Box 3: No User3 is not part of any group and is therefore in "All users"

  The "All users" Device Restriction Types only allow Android and Windows (MDM) but not iOS.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/enrollment/device-enrollment-manager-enroll https://docs.microsoft.com/en-us/intune-user-help/enroll-your-device-in-intune-android

• Question 110:

  HOTSPOT

  You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You need to set a custom image as the wallpaper and sign-in screen.

  Which two settings should you configure in Device restrictions? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Sign-in screen, or Locked screen, image is set under Locked screen experience Wallpaper image, or Desktop background picture, URL is set under Personalization. References:

  https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10