Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 131:

  DRAG DROP

  Your company uses Microsoft Intune. You have a Microsoft Store for Business account.

  You need to ensure that you can deploy Microsoft Store for Business apps by using Intune.

  Which three actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct.

  You will receive credit for any of the correct orders you select.

  Select and Place:

  

  Correct Answer:

  

  Step 1: From the Microsoft Endpoint Manager admin center, enable the Microsoft Store for Business connector.

  Enable Microsoft store for business (Intune>Apps>Microsoft store for business> Enable).

  Step 2: From the Microsoft Store for Business portal, activate Intune as a management tool.

  Before you enable synchronization in the Intune console, you must configure your store account to use Intune as a management tool.

  1.

  Ensure that you sign into the Microsoft Store for Business using the same tenant account you use to sign into Intune.

  2.

  In the Business Store, choose the Manage tab, select Settings, and choose the Distribute tab.

  3.

  If you don't specifically have Microsoft Intune available as a mobile device management tool, choose Add management tool to add Microsoft Intune.

  Step 3: From the Microsoft Endpoint Manager admin center, initiate a sync.

  If you've already associated your Microsoft Store for Business account with your Intune admin credentials, you can manually sync your Microsoft Store for

  Business apps with Intune using the following steps.

  1.

  Select Tenant administration > Connectors and tokens > Microsoft Store for Business.

  2.

  Click Sync to get the apps you've purchased from the Microsoft Store into Intune.

  Reference: https://docs.microsoft.com/en-us/mem/intune/apps/windows-store-for-business

• Question 132:

  DRAG DROP

  You have 500 Windows 10 devices enrolled in Microsoft Intune.

  You plan to use Exploit protection in Microsoft Endpoint Manager to enable the following system settings on the devices:

  1.

  Data Execution Prevention (DEP)

  2.

  Force randomization for images (Mandatory ASLR)

  You need to configure a Windows 10 device that will be used to create a template file.

  Which protection areas on the device should you configure in the Windows Security app before you create the template file?

  To answer, drag the appropriate protection areas to the correct settings. Each protection area may be used once, more than once, or not at all.

  You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: App and browser control

  

  Note: Data Execution Prevention (DEP): This mitigation prevents code from being run from data-only memory pages.

  Box 2: App and browser control Force randomization for images (Mandatory ASLR). This mitigation forcibly relocates images not compiled with /DYNAMICBASE.

  Reference:

  https://support.microsoft.com/en-us/windows/app-browser-control-in-windows-security-8f68fb65-ebb4-3cfb-4bd7-ef0f376f3dc3

• Question 133:

  DRAG DROP

  You have a Microsoft 365 subscription that contains two users named User1 and User2.

  You need to ensure that the users can perform the following tasks:

  1.

  User1 must be able to create groups and manage users.

  2.

  User2 must be able to reset passwords for nonadministrative users.

  The solution must use the principle of least privilege.

  Which role should you assign to each user?

  To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all.

  You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: User Administrator User admin Assign the user admin role to users who you want to access and manage user password resets and manage users and groups. They can also open and manage support requests to Microsoft support.

  Box 2: Helpdesk Administrator Assign the Helpdesk admin role to users who want to reset passwords, force users to sign out for any security issues. They can also open and manage support requests to Microsoft support. The Helpdesk admin can only help non-admin users and users assigned these roles: Directory reader, Guest inviter, Helpdesk admin, Message center reader, and Reports reader.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/admin-roles-page

• Question 134:

  DRAG DROP

  You have a Microsoft Deployment Toolkit (MDT) server named MDT1.

  When computers start from the LiteTouchPE_x64.iso image and connect to MDT1, the welcome screen appears as shown in the following exhibit.

  

  You need to prevent the welcome screen from appearing when the computers connect to MDT1.

  Which three actions should you perform in sequence?

  To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Modify the Bootstrap.ini file.

  Add this to your bootstrap.ini file and then update the deployment share and use the new boot media created in that process:

  SkipBDDWelcome=YES Box 2: Modify the CustomSettings.ini file.

  SkipBDDWelcome Indicates whether the Welcome to Windows Deployment wizard page is skipped.

  For this property to function properly it must be configured in both CustomSettings.ini and BootStrap.ini. BootStrap.ini is processed before a deployment share

  (which contains CustomSettings.ini) has been selected.

  Box 3: Update the deployment share.

  Reference:

  https://docs.microsoft.com/en-us/mem/configmgr/mdt/toolkit-reference#table-6-deployment-wizard-pages

• Question 135:

  DRAG DROP

  Your company has a Microsoft 365 E5 tenant.

  All the devices of the company are enrolled in Microsoft Endpoint Manager.

  You need to create advanced reports by using custom queries and visualizations from raw Microsoft Endpoint Manager data.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Purchase an Azure subscription.

  Complex reporting functionality require an Azure subscription.

  Step 2: Create a Log Analytics workspace.

  Each Azure resource requires its own diagnostic setting. The diagnostic setting defines the following for a resource:

  *

  One or more destinations to send the logs. Current destinations include Log Analytics workspace, Event Hubs, and Azure Storage.

  *

  Categories of logs and metric data sent to the destinations defined in the setting. The available categories will vary for different resource types.

  *

  Retention policy for data stored in Azure Storage.

  Step 3: Add diagnostic settings.

  You can create and view custom reports using the following steps:

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select Reports > Diagnostic settings add a diagnostic setting.

  3.

  Etc.

  Reference: https://docs.microsoft.com/en-us/mem/intune/fundamentals/reports

• Question 136:

  DRAG DROP

  Your network contains an Active Directory domain.

  You install the Microsoft Deployment Toolkit (MDT) on a server.

  You have a custom image of Windows 10.

  You need to deploy the image to 100 devices by using MDT.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create a deployment share.

  Set up the MDT production deployment share.

  Step 2:Add the Windows 10 image.

  Add a custom image.

  The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10.

  Step 3: Create a task sequence.

  Create the deployment task sequence.

  Reference:

  https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt

• Question 137:

  DRAG DROP

  You have a Microsoft Deployment Toolkit (MDT) deployment share named DS1.

  You import a Windows 10 image to DS1.

  You have an executable installer for an application named App1.

  You need to ensure that App1 will be installed for all the task sequences that deploy the image.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Add App1 to DS1 Add an application in the MDT console.

  Step 2: Identify the GUID of App1.

  Step 3: Modify the CustomSettings.ini

  It is possible in the CustomSettings.ini file, to check the default program to add the following line:

  ApplicationsXXX ={GUID-APPLICATION}

  or to force the installation of the application box checked and grayed out:

  MandatoryApplicationsXXX ={GUID-APPLICATION}

  Reference:

  https://rdr-it.com/en/mdt-installation-of-applications-when-deploying-windows/

• Question 138:

  DRAG DROP

  You have a Microsoft Deployment Toolkit (MDT) deployment share that has a path of D:\MDTShare.

  You need to add a feature pack to the boot image.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Copy the feature pack to D:\MDTShare\Tools\x86

  Add a feature pack, DaRT 10 (part of MDOP 2015), to the boot images.

  1.

  Copy the CAB files to the deployment share: MDTShare\Tools\x86

  2.

  In the Deployment Workbench, right-click the MDTShare deployment share and select Properties. Step 2: Modify the Windows PE properties of the deployment share

  3.

  On the Windows PE tab, in the Platform drop-down list, make sure x86 is selected.

  4.

  On the Features sub tab, select the Microsoft Diagnostics and Recovery Toolkit (DaRT) checkbox.

  

  Etc.

  Step 3: Update the deployment share

  Like the MDT Build Lab deployment share, the MDT Production deployment share needs to be updated after it has been configured. This is the process during which the Windows PE boot images are created.

  Reference:

  https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt

• Question 139:

  DRAG DROP

  Your company has a number of Windows 7 computers that you want to upgrade to Windows 10.

  The computers all have a single MBR disk, and a disabled TPM chip. Also, the computers have hardware virtualization disabled, Data Execution Prevention (DEP) enabled, and UEFI firmware running in BIOS mode.

  You have been tasked with making sure that Secure Boot can be used by the computers.

  Which of the following actions should you take? (Choose two.) Answer by dragging the correct options from the list to the answer area.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Convert the MBR disk to a GPT disk If you want to ensure that your drive boots into a certain mode, use drives that you've preformatted with the GPT file format for UEFI mode, or the MBR file format for BIOS mode. When the installation starts, if the PC is booted to the wrong mode, Windows installation will fail. To fix this, restart the PC in the correct firmware mode.

  Step 2: Convert the firmware from BIOS to UEFI

  Reference: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/boot-to-uefi-mode-or-legacy-bios-mode

• Question 140:

  DRAG DROP

  You have a Microsoft Intune subscription that is configured to use a PFX certificate connector to an on-premises Enterprise certification authority (CA).

  You need to use Intune to configure autoenrollment for Android devices by using public key pair (PKCS) certificates.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Obtain the root certificate.

  Export the root certificate from the Enterprise CA.

  To authenticate a device with VPN, WiFi, or other resources, a device needs a root or intermediate CA certificate.

  Step 2: From the Microsoft Endpoint Manager admin center, create a trusted certificate profile

  Create a trusted certificate profile

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select and go to Devices > Configuration profiles > Create profile.

  3.

  Enter the following properties:

  Platform:

  Profile: Select Trusted certificate. Or, select Templates > Trusted certificate.

  Select Create.

  4.

  Etc.

  Step 3: From the Microsoft Endpoint Manager admin center, create a PKCS certificate profile

  Create a PKCS certificate profile

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select and go to Devices > Configuration profiles > Create profile.

  3.

  Enter the following properties:

  Platform:

  Profile: Select PKCS certificate. Or, select Templates > PKCS certificate.

  Select Create.

  4.

  Etc.

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure