Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 191:

  Reference: https://danielchronlund.com/2018/11/27/how-to-replace-your-old-gpos-with-intune-configuration-profiles/

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains several Windows 10 devices. When you join new Windows 10 devices to contoso.com, users are prompted to set up a four-digit pin.

  You need to ensure that the users are prompted to set up a six-digit pin when they join the Windows 10 devices to contoso.com.

  Solution: From the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Endpoint Management admin center, you create and assign a device restrictions profile.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, from the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Endpoint Management admin center, you configure the Windows Hello for Business enrollment options.

  References: https://docs.microsoft.com/en-us/intune/protect/windows-hello

• Question 192:

  Your network contains an on-premises Active Directory domain and an Azure Active Directory (Azure AD) tenant. The Default Domain Policy Group Policy Object (GPO) contains the settings shown in the following table.

  

  You need to migrate the existing Default Domain Policy GPO settings to a device configuration profile.

  Which type of device configuration profile should you create?

  A. Custom

  B. Endpoint protection

  C. Administrative Templates

  D. Device restrictions

  Correct Answer: A

  Intune (and other MDM solutions) build there policy configurations and user interfaces on top of CSPs(Configuration Service Providers) . However, some CSPs and its settings might not be exposed in the interface directly but such a setting

  can be set anyway by entering its OMA-URI manually. Think of an OMA-URI as sort of a registry key that you can set to make the underlying configuration setting happen.

  In Intune this is called a Custom Policy.

  Example:

  

• Question 193:

  You have an Azure Active Directory group named Group1. Group1 contains two Windows 10 Enterprise devices named Device1 and Device2.

  You create a device configuration profile named Profile1. You assign Profile1 to Group1.

  You need to ensure that Profile1 applies to Device1 only.

  What should you modify in Policy1?

  A. Scope (Tags)

  B. Settings

  C. Applicability Rules

  D. Assignments

  Correct Answer: D

  You create a profile, and it includes all the settings you entered. The next step is to deploy or "assign" the profile to your user or device groups. When it's assigned, the users and devices receive your profile, and the settings you entered are applied.

  Reference: https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-assign

• Question 194:

  You use Microsoft Intune to manage client computers. The computers run one of the following operating systems:

  1.

  Windows 8.1

  2.

  Windows 10 Pro

  3.

  Windows 10 Enterprise

  4.

  Windows 10 Enterprise LTSC

  You plan to manage Windows updates on the computers by using update rings.

  Which operating systems support update rings?

  A. Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Enterprise LTSC only

  B. Windows 8.1, Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Enterprise LTSC

  C. Windows 10 Enterprise and Windows 10 Enterprise LTSC only

  D. Windows 10 Pro and Windows 10 Enterprise only

  Correct Answer: D

  D. Windows 10 Pro and Windows 10 Enterprise only

  Update rings are supported for the following Windows editions:

  Windows 10/11 Pro

  Windows 10/11 Enterprise

  Windows 10/11 Team - for Surface Hub devices

  Windows Holographic for Business

  Update ring policies are supported for devices that run Windows 10 version 1607 or later, and Windows 11

  Incorrect:

  The Long-Term Servicing Channel (LTSC) is designed for Windows 10 devices and use cases where the key requirement is that functionality and features don't change over time. Examples include medical systems (such as those used for

  MRI and CAT scans), industrial process controllers, and air traffic control devices.

  These devices share characteristics of embedded systems: they are typically designed for a specific purpose and are developed, tested, and certified before use.

  They are treated as a whole system and are, therefore, commonly upgraded by building and validating a new system, turning off the old device, and replacing it with the new, certified device.

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure https://techcommunity.microsoft.com/t5/windows-it-pro-blog/ltsc-what-is-it-and-when-should-it-be-used/ba-p/293181

• Question 195:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to use Windows Autopilot to configure the Windows 10 devices shown in the following table.

  

  Which devices can be configured by using Windows Autopilot self-deploying mode?

  A. Device2 and Device3 only

  B. Device3 only

  C. Device2 only

  D. Device1, Device2, and Device3

  Correct Answer: B

  Self-deploying mode uses a device's TPM 2.0 hardware to authenticate the device into an organization's Azure AD tenant. Therefore, devices without TPM 2.0 can't be used with this mode.

  Reference: https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/self-deploying

• Question 196:

  You have an Azure Active Directory (Azure AD) tenant and 100 Windows 10 devices that are Azure AD joined and managed by using Microsoft Intune. You need to configure Microsoft Defender Firewall and Microsoft Defender Antivirus on the devices. The solution must minimize administrative effort. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings.

  B. To configure Microsoft Defender Firewall, crate a device configuration profile and configure the Device restrictions settings.

  C. To configure Microsoft Defender Firewall, create a Group Policy Object (GPO) and configure Windows Defender Firewall with Advanced Security.

  D. To configure Microsoft Defender Antivirus, create a Group Policy Object (GPO) and configure Windows Defender Antivirus settings.

  E. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Device restrictions settings.

  F. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings.

  Correct Answer: EF

  F: With Intune, you can use device configuration profiles to manage common endpoint protection security features on devices, including:

  1.

  Firewall

  2.

  BitLocker

  3.

  Allowing and blocking apps

  4.

  Microsoft Defender and encryption

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-protection-configure https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-policy#create-an-endpoint-security-policy

• Question 197:

  Your network contains an Active Directory domain named contoso.com. The domain contains computers that run Windows 10 and are joined to the domain.

  The domain is synced to Microsoft Azure Active Directory (Azure AD).

  You create an Azure Log Analytics workspace and deploy the Update Compliance solution.

  You need to enroll the computers in the Update Compliance solution.

  Which Group Policy setting should you configure?

  A. Specify intranet Microsoft update service location

  B. Allow Telemetry

  C. Configure the Commercial ID

  D. Connected User Experiences and Telemetry

  Correct Answer: C

  Microsoft uses a unique commercial ID to map information from user computers to your Azure workspace. Copy your commercial ID key from any of the Windows Analytics solutions you have added to your Windows Portal, and then deploy it to user computers.

  Reference: https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-get-started

• Question 198:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that runs Windows 10.

  You save a provisioning package named Package1 to a folder named C:\Folder1.

  You need to apply Package1 to Computer1.

  Solution: At a command prompt, you change the current folder to C:\Folder1, and then you run the RegSvr32.exe Package1.ppkgcommand.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  To install a provisioning package, navigate to Settings > Accounts > Access work or school > Add or remove a provisioning package > Add a package, and select the package to install.

  Reference: https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-apply-package

• Question 199:

  You have devices enrolled in Microsoft Intune as shown in the following table.

  

  On which devices can you apply app configuration policies?

  A. Device1, Device2, Device3, and Device4

  B. Device2 only

  C. Device3 and Device4 only

  D. Device1 and Device2 only

  E. Device2, Device3, and Device4 only

  Correct Answer: C

  You can create and use app configuration policies to provide configuration settings for both iOS/iPadOS or Android apps.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-overview

• Question 200:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that runs Windows 10.

  You save a provisioning package named Package1 to a folder named C:\Folder1.

  You need to apply Package1 to Computer1.

  Solution: From the Settings app, you select Access work or school, and then you select Add or remove a provisioning package.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  To install a provisioning package, navigate to Settings > Accounts > Access work or school > Add or remove a provisioning package > Add a package, and select the package to install.

  Reference: https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-apply-package