Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 201:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that runs Windows 10.

  You save a provisioning package named Package1 to a folder named C:\Folder1.

  You need to apply Package1 to Computer1.

  Solution: From File Explorer, you go to C:\Folder1, and then you double-click the Package1.ppkg file.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Double clicking should work: https://youtu.be/UU6l7-CMSRc

  See article: https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-how-it-works "Downloaded from a network connection and copied to a local folder-Double-click the package file"

  https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-apply-package Insert the USB drive to a desktop computer, navigate to Settings > Accounts > Access work or school > Add or remove a provisioning package > Add a package, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation.

• Question 202:

  Your company has an internal portal that uses a URL of http://contoso.com.

  The network contains computers that run Windows 10. The default browser on all the computers is Microsoft Edge.

  You need to ensure that all users only use Internet Explorer to connect to the internal portal. The solution must ensure that Microsoft Edge can be used to connect to all other websites.

  What should you do from each computer?

  A. From Internet Explorer, configure the Compatibility View settings

  B. From the local policy, configure Enterprise Mode

  C. From Microsoft Edge, configure the Advanced Site Settings

  D. From the Settings app, configure the default web browser settings

  Correct Answer: B

  Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11.

  If you have specific websites and apps that have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites open in

  Internet Explorer 11 automatically. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to automatically open using IE11 with the Send all intranet sites to IE group

  policy.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-edge/deploy/emie-to-improve-compatibility

• Question 203:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory group named Group1 that contains Windows 10 Enterprise devices and Windows 10 Pro devices.

  From Microsoft Intune, you create a device configuration profile named Profile1.

  You need to ensure that Profile1 applies to only the Windows 10 Enterprise devices in Group1.

  Solution: You create a scope tag, and then you add the scope tag to the Windows 10 Enterprise devices. You edit the settings of Profile1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: You configure an applicability rule for Profile1. You assign Profile1 to Group1.

  Note: Applicability rules allow administrators to target devices in a group that meet specific criteria. For example, you create a device restrictions profile that applies to the All Windows 10/11 devices group. And, you only want the profile

  assigned to devices running Windows Enterprise.

  To do this task, create an applicability rule.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-create

• Question 204:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory group named Group1 that contains Windows 10 Enterprise devices and Windows 10 Pro devices.

  From Microsoft Intune, you create a device configuration profile named Profile1.

  You need to ensure that Profile1 applies to only the Windows 10 Enterprise devices in Group1.

  Solution: You configure an applicability rule for Profile1. You assign Profile1 to Group1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Applicability rules allow administrators to target devices in a group that meet specific criteria. For example, you create a device restrictions profile that applies to the All Windows 10/11 devices group. And, you only want the profile assigned to

  devices running Windows Enterprise.

  To do this task, create an applicability rule.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-create

• Question 205:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory group named Group1 that contains Windows 10 Enterprise devices and Windows 10 Pro devices.

  From Microsoft Intune, you create a device configuration profile named Profile1.

  You need to ensure that Profile1 applies to only the Windows 10 Enterprise devices in Group1.

  Solution: You create an Azure Active Directory group that contains only the Windows 10 Enterprise devices. You assign Profile1 to the new group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: You configure an applicability rule for Profile1. You assign Profile1 to Group1.

  Note: Applicability rules allow administrators to target devices in a group that meet specific criteria. For example, you create a device restrictions profile that applies to the All Windows 10/11 devices group. And, you only want the profile

  assigned to devices running Windows Enterprise.

  To do this task, create an applicability rule.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-create

• Question 206:

  You have a computer named Computer1 that runs Windows 10.

  Computer1 is used by a user named User1.

  You need to ensure that when User1 opens websites from untrusted locations by using Microsoft Edge, Microsoft Edge runs in an isolated container.

  What should you do first?

  A. From Windows Features, turn on Windows Defender Application Guard.

  B. From Windows Features, turn on Hyper-V Platform.

  C. From Windows Security, configure the Virus and threat protection settings.

  D. From Windows Security, configure the Device security settings.

  Correct Answer: A

  For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet. As an enterprise administrator, you define what is among trusted web sites, cloud resources, and internal networks. Everything not on your list is considered untrusted. If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, Microsoft Edge opens the site in an isolated Hyper-V- enabled container.

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview

• Question 207:

  You have computers that run Windows 10 and are managed by using Microsoft Intune.

  Users store their files in a folder named D:\Folder1.

  You need to ensure that only a trusted list of applications is granted write access to D:\Folder1.

  What should you configure in the device configuration profile?

  A. Microsoft Defender SmartScreen

  B. Microsoft Defender Exploit Guard

  C. Microsoft Defender Application Guard

  D. Microsoft Defender Application Control

  Correct Answer: B

  The four components of Windows Defender Exploit Guard are:

  1.

  Controlled folder access: Protects sensitive data from ransomware by blocking untrusted processes from accessing your protected folders

  2.

  Attack Surface Reduction (ASR)

  3.

  Exploit protection

  4.

  Network protection

  Reference: https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-worldwide

• Question 208:

  You have a hybrid Microsoft Azure Active Directory (Azure AD) tenant, a Microsoft System Center Configuration Manager (Current Branch) environment, and a Microsoft 365 subscription. You have computers that run Windows 10 as shown in the following table.

  

  You plan to use Microsoft 365 Device Management.

  Which computers support co-management by Configuration Manager and Device Management?

  A. Computer3 only

  B. Computer1 and Computer2 only

  C. Computer2 only

  D. Computer1, Computer2, and Computer3

  Correct Answer: D

  From the reference given:

  "Windows 10 devices must be connected to Azure AD. They can be either of the following types:

  1.) Hybrid Azure AD-joined, where the device is joined to your on-premises Active Directory and registered with your Azure Active Directory.

  2.) Azure AD-joined only. (This type is sometimes referred to as "cloud domain-joined")

  Computer 1 will first need to be joined to AAD or registered to AAD.

  If Computer1 does get registered or joined to the AAD it does support co-management. But not in the state it is in now. Thus if I would get this question I would answer:

  Computer 2 and 3, if that option is not available I would go option D

  The question states – “You PLAN” to use Microsoft 365 Device Management.

  Which computers SUPPORT co-management by Configuration Manager and Device Management?

  As it stands, none can currently be managed by Device management because the prerequisite is that Windows devices has the Configuration Manager client and is ENROLLED to INTUNE.

  The question does not state if the devices are already enrolled to Intune but they all SUPPORT the function when properly configured...

  https://docs.microsoft.com/en-us/mem/configmgr/comanage/overview

• Question 209:

  You have a shared computer that runs Windows 10.

  The computer is infected with a virus.

  You discover that a malicious TTF font was used to compromise the computer.

  You need to prevent this type of threat from affecting the computer in the future.

  What should you use?

  A. Windows Defender Exploit Guard

  B. Windows Defender Application Guard

  C. Windows Defender Credential Guard

  D. Windows Defender System Guard

  E. Windows Defender SmartScreen

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard

• Question 210:

  You have a public computer named Public1 that runs Windows 10.

  Users use Public1 to browse the internet by using Microsoft Edge.

  You need to view events associated with website phishing attacks on Public1.

  Which Event Viewer log should you view?

  A. Applications and Services Logs > Microsoft\Windows > DeviceGuard > Operational

  B. Applications and Services Logs > Microsoft > Windows > Security-Mitigations > User Mode

  C. Applications and Services Logs > Microsoft > Windows > SmartScreen > Debug

  D. Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

  Correct Answer: C

  Viewing Windows event logs for Microsoft Defender SmartScreen.

  Microsoft Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log, in the Event Viewer.

  Reference:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview#viewing-windows-event-logs-for-microsoft-defender-smartscreen