Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 111:

  HOTSPOT

  Your company uses Microsoft Intune to manage Windows 10, Android, and iOS devices.

  Several users purchase new iPads and Android devices.

  You need to tell the users how to enroll their device in Intune.

  What should you instruct the users to use for each device? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  The Intune Company Portal app is used to enroll Android, iOS, macOS, and Windows devices

  Reference: https://docs.microsoft.com/en-us/intune-user-help/enroll-device-android-company-portal https://docs.microsoft.com/en-us/intune-user-help/enroll-your-device-in-intune-ios https://docs.microsoft.com/en-us/intune-user-help/enroll-your-device-in-intune-macos-cp

• Question 112:

  You have two computers that run Windows 10. The computers are enrolled in Microsoft Intune as shown in the following table.

  

  Windows 10 update rings are defined in Intune as shown in the following table.

  

  You assign the update rings as shown in the following table.

  

  What is the effect of the configurations on Computer1 and Computer2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 3 days Box 2: No effect Since Computer2 is a member of a group that is excluded in both assignments, neither are applied to Computer2. So 'No effect' for Computer2.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#exclude-groups-from-a-profile-assignment

  see link; https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#exclude-groups-from-a-profile-assignment

  "xclusion takes precedence over inclusion in the following same group type scenarios:

  Including user groups and excluding user groups

  Including device groups and excluding device group For example, you assign a device profile to the All corporate users user group, but exclude members in the Senior Management Staff user group. Since both groups are user groups, All corporate users except the Senior Management staff get the profile."

• Question 113:

  HOTSPOT

  Your network contains an Active Directory domain. The domain contains 1,200 computers that run Windows 8.1.

  You deploy an Upgrade Readiness solution in Microsoft Azure and configure the computers to report to Upgrade Readiness.

  From Upgrade Readiness, you open a table view of the applications.

  You need to filter the view to show only applications that can run successfully on Windows 10.

  How should you configure the filter in Upgrade Readiness? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: UpgradeDecision To approve an asset for upgrade, select the name in the list, and then select one of the following options from the Upgrade decision list:

  Review in progress Ready Ready (with remediation)

  Unable Not reviewed

  Box 2: Ready to upgrade

  Reference:

  https://docs.microsoft.com/en-us/mem/configmgr/desktop-analytics/deploy-prod#

• Question 114:

  HOTSPOT

  You have a Microsoft 365 subscription.

  You need to configure access to Microsoft Office 365 for unmanaged devices. The solution must meet the following requirements:

  1.

  Allow only the Microsoft Intune Managed Browser to access Office 365 web interfaces.

  2.

  Ensure that when users use the Intune Managed Browser to access Office 365 web interfaces, they can only copy data to applications that are managed by the company.

  Which two settings should you configure from the Microsoft Intune blade? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Client Ensure that when users use the Intune Managed Browser to access Office 365 web interfaces, they can only copy data to applications that are managed by the company.

  Box 2: Conditional Access Allow only the Microsoft Intune Managed Browser to access Office 365 web interfaces.

  Organizations can use Azure AD Conditional Access policies to ensure that users can only access work or school content using Edge for iOS and Android. To do this, you will need a conditional access policy that targets all potential users.

  These policies are described in Conditional Access: Require approved client apps or app protection policy.

  Reference: https://docs.microsoft.com/en-us/intune/app-configuration-managed-browser#application-protection-policies-for-protected-browsers

• Question 115:

  HOTSPOT

  You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You need to configure an Intune device configuration profile to meet the following requirements:

  1.

  Prevent Microsoft Office applications from launching child processes.

  2.

  Block users from transferring files over FTP.

  Which two settings should you configure in Endpoint protection? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft Defender Firewall

  Block users from transferring files over FTP.

  Microsoft Defender Firewall settings include MdmStore/Global/DisableStatefulFtp, which could be used to disable stateful FTP.

  Box 2: Microsoft Defender Exploit Guard

  Prevent Microsoft Office applications from launching child processes.

  Attack surface reduction rules in the Microsoft Defender.

  These rules include: Block all Office applications from creating child processes

  Note: Attack surface reduction rule merge behavior is as follows:

  Attack surface reduction rules from the following profiles are evaluated for each device the rules apply to:

  Devices > Configuration policy > Endpoint protection profile > *Microsoft Defender Exploit Guard* > Attack Surface Reduction

  Endpoint security > Attack surface reduction policy > Attack surface reduction rules

  Endpoint security > Security baselines > Microsoft Defender for Endpoint Baseline > Attack Surface Reduction Rules.

  Reference:

  https://docs.microsoft.com/en-us/intune/endpoint-protection-windows-10

• Question 116:

  HOTSPOT

  You have 1,000 computers that run Windows 10 and are members of an Active Directory domain.

  You create a workspace in Microsoft Azure Log Analytics.

  You need to capture the event logs from the computers to Azure.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Log Analytics Box 2: Install the Microsoft Monitoring Agent Azure Monitor agent currently supports the following core functionality:

  *

  Collect guest logs and metrics from any machine in Azure, in other clouds, or on-premises. Azure Arc-enabled servers are required for machines outside of Azure.

  *

  Centrally manage data collection configuration using data collection rules, and management configuration using Azure Resource Manager (ARM) templates or policies.

  *

  Use Windows event filtering or multi-homing for Windows or Linux logs.

  *

  Improved extension management.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows https://docs.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-migration

• Question 117:

  HOTSPOT

  You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. All Windows 10 devices are enrolled in Microsoft Intune.

  You configure the following settings in Windows Information Protection (WIP):

  1.

  Protected apps: App1

  2.

  Exempt apps: App2

  3.

  Windows Information Protection mode: Silent

  App1, App2, and App3 use the same file format.

  You create a file named File1 in App1.

  You need to identify which apps can open File1.

  What apps should you identify? To answer, select the appropriate options in the answer area,

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune#exempt-apps-from-wip-restrictions

• Question 118:

  HOTSPOT

  Your company has a computer named Computer1 that runs Windows 10 Pro.

  The company develops a proprietary Universal Windows Platform (UWP) app named App1. App1 is signed with a certificate from a trusted certification authority (CA).

  You need to sideload App1 to Computer1.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Configure the For developers settings in the Settings app How to allow Windows 10 to sideload apps on your computer

  1.

  Open Settings.

  2.

  Click on Update and security.

  3.

  Click on For developers.

  4.

  Under "Use developer features," select the Sideload apps option.

  5.

  Click Yes to confirm the risks involved running an app outside the Windows Store.

  6.

  Restart your computer if applicable to complete the task.

  Box 2: Run the Add-AppxPackage cmdlet

  Install the App.

  From the folder with the .msix package, run the Windows PowerShell Add-AppxPackage command to install the .msix package.

  Reference: https://docs.microsoft.com/en-us/windows/application-management/sideload-apps-in-windows-10

• Question 119:

  HOTSPOT

  You have a Microsoft Intune subscription.

  You create the Windows Autopilot deployment profile-shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Correct answers: change desktop settings only for themselves, keyboard layout.

  Proo that you will able to change the keyboard layout:

  In the link below there is a LAB with the exact same scenario. There is also a demo video that shows and says: "You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen".

  https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm

  Reference:

  https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/user-driven

• Question 120:

  HOTSPOT

  You have 200 computers that run Windows 10.

  You need to create a provisioning package to configure the following tasks:

  1.

  Remove the Microsoft News and the Xbox Microsoft Store apps.

  2.

  Add a VPN connection to the corporate network.

  Which two customizations should you configure? To answer, select the appropriate customizations in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: ConnectivityProfiles Add a VPN connection to the corporate network.

  ConnectivityProfiles is used to configure profiles that a user will connect with, such as an email account or VPN profile.

  Box 2: Policies Remove the Microsoft News and the Xbox Microsoft Store apps.

  ApplicationManagement policies, such as ApplicationManagement/DisableStoreOriginatedApps, are included in policies on Windows 10.

  Reference:

  https://docs.microsoft.com/en-us/windows/configuration/wcd/wcd-connectivityprofiles https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions

  https://docs.microsoft.com/en-us/windows/configuration/wcd/wcd-policies