Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 151:

  You implement Boundary1 based on the planned changes.

  Which devices have a network boundary of 192.168.1.0/24 applied?

  A. Device2 only

  B. Device3 only

  C. Device1, Device2, and Device5 only

  D. Device1, Device2, Device3, and Device4 only

  Correct Answer: D

  Device5 does not belong to Group1 or to Group2.

  Note: Deploy a network boundary configuration profile that will have the following settings:

  Name: Boundary1 Network boundary: 192.168.1.0/24

  Scope tags: Tag1 Assignments:

  Included groups: Group1, Group2

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/network-boundary-windows

• Question 152:

  You have a Windows 10 device named Computer1 enrolled in Microsoft Intune.

  You need to configure Computer1 as a public workstation that will run a single customer-facing, full-screen application.

  Which template should you use to create a configuration profile for Computer1 in the Microsoft Endpoint Manager admin center?

  A. Kiosk

  B. Device restrictions

  C. Shared multi-user device

  D. Endpoint protection

  Correct Answer: A

  On Windows 10/11 devices, you can configure these devices to run in single-app kiosk mode. On Windows 10 devices, you can configure these devices to run in multi-app kiosk mode.

  Single app, full-screen kiosk

  Runs only one app on the device, such as a web browser or Store app.

  Select a kiosk mode: Choose Single app, full-screen kiosk.

  Etc.

  Reference: https://docs.microsoft.com/en-us/mem/intune/configuration/kiosk-settings-windows

• Question 153:

  Which users can purchase and assign App1?

  A. User3 only

  B. User1 and User3 only

  C. User1, User2, User3, and User4

  D. User1, User3, and User4 only

  E. User3 and User4 only

  Correct Answer: C

  Global Administrator and Billing Administrator - IT Pros with these accounts have full access to Microsoft Store. They can do everything allowed in the Microsoft Store Admin role, plus they can sign up for Microsoft Store.

  https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business https://docs.microsoft.com/en-us/microsoft-store/assign-apps-to-employees

• Question 154:

  Which user can enroll Device6 in Intune?

  A. User4 and User2 only

  B. User4 and User1 only

  C. User4, User1, and User2 only

  D. User1, User2, User3, and User4

  Correct Answer: D

  All the users can enroll devices to Intune.

• Question 155:

  Which devices are registered by using the Windows Autopilot deployment service?

  A. Device1 only

  B. Device3 only

  C. Device1 and Device3 only

  D. Device1, Device2, and Device3

  Correct Answer: C

  Scenario: Windows Autopilot Configuration

  Assignments

  Included groups: Group1

  Excluded groups: Group2

  Device1 is member of Group1.

  Device2 is member of Group1 and member of Group2.

  Device3 is member of Group1.

  Group1 and Group2 have a Membership type of Assigned.

  Exclusion takes precedence over inclusion in the following same group type scenarios.

  Reference: https://learn.microsoft.com/en-us/mem/intune/apps/apps-inc-exl-assignments

• Question 156:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that runs Windows 10.

  You save a provisioning package named Package1 to a folder named C:\Folder1.

  You need to apply Package1 to Computer1.

  Solution: From the Settings app, you select Access work or school, and then you select Add or remove a provisioning package. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  B is the correct Answer. To apply a provisioning package, this can be done from a USB frive. not from settings.

  Answer is no - since .ppkg is stored at C.

  For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation.

  https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-apply-package

• Question 157:

  You have a Microsoft Intune subscription associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  Users use one of the following three suffixes when they sign in to the tenant: us.contoso.com, eu.contoso.com, or contoso.com.

  You need to ensure that the users are NOT required to specify the mobile device management (MDM) enrollment URL as part of the enrollment process. The solution must minimize the number of changes.

  Which DNS records do you need?

  A. three TXT records

  B. one CNAME record only

  C. one TXT record only

  D. three CNAME records

  Correct Answer: D

  To simplify enrollment, create a domain name server (DNS) alias (CNAME record type) that redirects enrollment requests to Intune servers. Otherwise, users trying to connect to Intune must enter the Intune server name during enrollment. If the company uses more than one UPN suffix, you need to create one CNAME for each domain name and point each one to EnterpriseEnrollment- s.manage.microsoft.com. For example, users at Contoso use the following formats as their email/UPN: [email protected] [email protected] [email protected]

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enroll#simplify-windows-enrollment-without-azure-ad-premium

• Question 158:

  Your network contains an Active Directory domain. The domain contains 100 computers that run Windows 10.

  You need to prevent users and apps from accessing dangerous websites.

  What should you configure?

  A. Microsoft Defender Application Control

  B. Microsoft Defender Exploit Guard

  C. Microsoft Defender Application Guard

  D. Microsoft Defender Firewall

  Correct Answer: B

  Network protection, a part of Microsoft Defender Exploit Guard, helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-network-protection?view=o365-worldwide

• Question 159:

  You have computers that run Windows 10 and are joined to Azure Active Directory (Azure AD).

  All users sign in to the computers by using their Azure AD account.

  Enterprise State Roaming is enabled.

  From the Settings app, a user named User1 adds a Microsoft account.

  Which account will be used for the Synchronizing Windows setting?

  A. the work account only

  B. the Microsoft account only

  C. both the Microsoft account and the work account

  Correct Answer: A

  What account is used for settings sync?

  In Windows 8.1, settings sync always used consumer Microsoft accounts. Enterprise users had the ability to connect a Microsoft account to their Active Directory domain account to gain access to settings sync. In Windows 10, this connected

  Microsoft account functionality is being replaced with a primary/secondary account framework.

  The primary account is defined as the account used to sign in to Windows. This can be a Microsoft account, an Azure Active Directory (Azure AD) account, an on- premises Active Directory account, or a local account. In addition to the

  primary account, Windows 10 users can add one or more secondary cloud accounts to their device. A secondary account is generally a Microsoft account, an Azure AD account, or some other account such as Gmail or Facebook. These

  secondary accounts provide access to additional services such as single sign-on and the Windows Store, but they aren't capable of powering settings sync.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/devices/enterprise-state-roaming-faqs

• Question 160:

  You have computers that run Windows 10, are joined to Azure Active Directory (Azure AD), and are enrolled in Microsoft Intune.

  You have an Azure web app named App1. App1 only allows connections over HTTPS. App1 uses a certificate from an on-premises certification authority (CA).

  You need to ensure that the computers can connect to App1 from Microsoft Edge.

  Which type of device configuration profile should you create in Microsoft Endpoint Manager?

  A. trusted certificate

  B. Simple Certificate Enrollment Protocol (SCEP) certificate

  C. imported public key pair (PKCS) certificate

  D. public key pair (PKCS) certificate

  Correct Answer: A

  SCEP is to onroll certificates to Intune Devices (not necessary)

  PKCS is to onroll certificates to Intune Devices (not necessary)

  To trust the (internal) certificate of app1 you need to import the internal root certificate to the 'trused root certification authorities' of the device.

  You must create a configuration Profile - Trusted certificate to deploy the root certificate to the intune devices

  Answer = trusted certificate

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure