Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 161:

  You have a hybrid deployment of Azure Active Directory (Azure AD) that contains 50 Windows 10 devices. All the devices are enrolled in Microsoft Endpoint Manager.

  You discover that Group Policy settings override the settings configured in Microsoft Endpoint Manager policies.

  You need to ensure that the settings configured in Microsoft Endpoint Manager override the Group Policy settings.

  What should you do?

  A. From the Microsoft Endpoint Manager admin center, create an Administrative Templates device profile

  B. From Group Policy Management Editor, configure the Computer Configuration settings in the Default Domain Policy

  C. From the Microsoft Endpoint Manager admin center, create a custom device profile

  D. From Group Policy Management Editor, configure the User Configuration settings in the Default Domain Policy

  Correct Answer: C

  Creating the policy Let's create a new policy in Intune to control the GP vs. MDM winner

  1. Navigate to portal.azure.com and locate Intune

  Create profile◌ֳProfiles◌ֳ2. Select Device configuration

  3.

  Under Platform select Windows 10 and later

  4.

  Under Profile type select custom and add

  5.

  Name the custom setting with something intuitive

  6.

  For OMA-URI add the policy OMA-URI string: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP

  7.

  For Data type select Integer and add the number

  Note: The following describes which policy wins according to Windows 10 version.

  Windows 10 versions 1709 and earlier Group Policy will override MDM policies, even if an identical policy is configured in MDM.

  Windows 10 version 1803 and beyond there is a new Policy CSP (configuration service provider) setting called ControlPolicyConflict that includes the policy of

  MDMWinsOverGP, where the preference of which policy wins can be controlled, i.e. Microsoft Intune MDM policy.

  Note 2: the ControlPolicyConflict policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy

  (GP) are set on the device.

  Reference:

  https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict https://uem4all.com/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/

• Question 162:

  Your network contains an Active Directory domain. The domain contains computers that run Windows 10.

  All users use Roaming User Profiles.

  You have a user named Public1 that is used to sign-in to a public computer.

  You need to prevent changes to the user settings of Public1 from being saved to the user profile.

  What should you do?

  A. Rename the Roaming User Profile folder to Public1.man

  B. Rename Ntuser.dat to Ntuser.v6

  C. Rename Ntuser.dat to Ntuser.man

  D. Rename the Roaming User Profile folder to Public1.v1

  Correct Answer: C

  User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from NTuser.dat to NTuser.man. The .man extension causes the user profile to be a read-only profile.

  Reference: https://docs.microsoft.com/en-us/windows/client-management/mandatory-user-profile

• Question 163:

  You use a Microsoft Intune subscription to manage iOS devices.

  You configure a device compliance policy that blocks jailbroken iOS devices.

  You need to enable Enhanced jailbreak detection.

  What should you configure?

  A. the device compliance policy

  B. the Compliance policy settings

  C. a network location

  D. a configuration profile

  Correct Answer: B

  There are two parts to compliance policies in Intune: Compliance policy settings and Device compliance policy.

  Under "Compliance Policy Settings" itself, you can find the setting "Enhanced Jailbreak Detection (applies only to iOS/iPadOS)"

  https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

  Answer B. Compliance policy settings These settings are generic and define the default behavior of the compliance policy. Here you can define what happens with a device which has no compliance policy assigned, by default this device will be marked as “Not Compliant”. You can also configure the usage of “Enhanced jailbreak detection” which is only supported on iOS/iPadOS and uses location services to more regularly check for a jailbreak.

• Question 164:

  You have a Windows 10 device named Device1 that is joined to Active Directory and enrolled in Microsoft Intune.

  Device 1 is managed by using Group Policy and Intune.

  You need to ensure that the Intune settings override the Group Policy settings.

  What should you configure?

  A. a device configuration profile

  B. an MDM Security Baseline profile

  C. a device compliance policy

  D. a Group Policy Object (GPO)

  Correct Answer: A

  Creating the policy Let's create a new policy in Intune to control the GP vs. MDM winner

  1. Navigate to portal.azure.com and locate Intune

  Create profile◌ֳProfiles◌ֳ2. Select Device configuration

  3.

  Under Platform select Windows 10 and later

  4.

  Under Profile type select custom and add

  5.

  Name the custom setting with something intuitive

  6.

  For OMA-URI add the policy OMA-URI string: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP

  7.

  For Data type select Integer and add the number

  Note: The following describes which policy wins according to Windows 10 version.

  Windows 10 versions 1709 and earlier Group Policy will override MDM policies, even if an identical policy is configured in MDM.

  Windows 10 version 1803 and beyond there is a new Policy CSP (configuration service provider) setting called ControlPolicyConflict that includes the policy of

  MDMWinsOverGP, where the preference of which policy wins can be controlled, i.e. Microsoft Intune MDM policy.

  Note 2: the ControlPolicyConflict policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy

  (GP) are set on the device.

  Reference:

  https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict

  https://uem4all.com/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/

• Question 165:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com and a Microsoft Intune subscription.

  Contoso.com contains a user named [email protected].

  You have a computer named Computer1 that runs Windows 8.1.

  You need to perform an in-place upgrade of Computer1 to Windows 10.

  Solution: From Windows 8.1, you run setup.exe from the Windows 10 installation media.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  How To Upgrade To Windows 10 Using ISO File

  1. Open your existing Windows edition and locate the ISO file. Now right click on this file and Mount, restart the machine. After rebooting, open File Explorer and locate the DVD drive, you'll find that the ISO file is already mounted to it with a temporary drive letter (as you can see in below shown window, where D: is temporary drive letter). Open this drive and click on the setup.exe file.

  Reference: https://www.kapilarya.com/how-to-upgrade-to-windows-10-using-iso-file

• Question 166:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com and a Microsoft Intune subscription.

  Contoso.com contains a user named [email protected].

  You have a computer named Computer1 that runs Windows 8.1.

  You need to perform an in-place upgrade of Computer1 to Windows 10.

  Solution: You start Computer1 from the Windows 10 installation media and use the Install option.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: From Windows 8.1, you run setup.exe from the Windows 10 installation media. How To Upgrade To Windows 10 Using ISO File

  1. Open your existing Windows edition and locate the ISO file. Now right click on this file and Mount, restart the machine. After rebooting, open File Explorer and locate the DVD drive, you'll find that the ISO file is already mounted to it with a temporary drive letter (as you can see in below shown window, where D: is temporary drive letter). Open this drive and click on the setup.exe file.

  Reference: https://www.kapilarya.com/how-to-upgrade-to-windows-10-using-iso-file

• Question 167:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com and a Microsoft Intune subscription.

  Contoso.com contains a user named [email protected].

  You have a computer named Computer1 that runs Windows 8.1.

  You need to perform an in-place upgrade of Computer1 to Windows 10.

  Solution: You assign a Windows 10 license to User1. You instruct User1 to sign in to Computer1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: From Windows 8.1, you run setup.exe from the Windows 10 installation media. How To Upgrade To Windows 10 Using ISO File

  1. Open your existing Windows edition and locate the ISO file. Now right click on this file and Mount, restart the machine. After rebooting, open File Explorer and locate the DVD drive, you'll find that the ISO file is already mounted to it with a temporary drive letter (as you can see in below shown window, where D: is temporary drive letter). Open this drive and click on the setup.exe file.

  Reference: https://www.kapilarya.com/how-to-upgrade-to-windows-10-using-iso-file

• Question 168:

  You are configuring an SSTP VPN.

  When you attempt to connect to the VPN, you receive the message shown in the exhibit. (Click the Exhibit tab.)

  

  What should you do to ensure that you can connect to the VPN?

  A. Change the VPN type

  B. Generate a computer certificate from the root certification authority (CA)

  C. Install the root certificate

  Correct Answer: B

  Error message: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

  We need to install a proper root certificate

  Note: Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client

  certificate is not installed, authentication fails.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site

• Question 169:

  You have a Microsoft Deployment Toolkit (MDT) deployment share named DS1.

  In the Out-of-Box Drivers node, you create folders that contain drivers for different hardware models.

  You need to configure the Inject Drivers MDT task to use PnP detection to install the drivers for one of the hardware models.

  What should you do first?

  A. Create a selection profile

  B. Import an OS package

  C. Add a Validate task to the task sequence

  D. Add a Gather task to the task sequence

  Correct Answer: A

  By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles.

  Reference: https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt

• Question 170:

  Your network contains an Active Directory domain. The domain contains computers that run Windows 8.1 and the users shown in the following table.

  

  You plan to use the Microsoft Assessment and Planning (MAP) Toolkit to collect inventory data. The MAP Toolkit has the following configurations:

  1.

  Inventory scenario: Windows computers

  2.

  Discovery method: Use Active Directory Domain Services (AD DS)

  You need to identify which user to use for the MAP Toolkit inventory discovery. The solution must use principle of least privilege.

  What should you identify?

  A. User3

  B. User1

  C. User4

  D. User2

  Correct Answer: A

  Discovery method: Use Active Directory Domain Services (AD DS)

  Credentials required " The wizard requires a domain account that is to be used to query AD DS. At a minimum, this account should be a member of the Domain

  Users group in the domain. For each computer to be included in the WMI inventory process, the wizard also requires an account that is a member of the local

  Administrators group on that computer.

  Reference:

  https://social.technet.microsoft.com/wiki/contents/articles/17808.map-toolkit-choose-a-discovery-method.aspx