Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 221:

  You have 500 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You plan to distribute certificates to the computers by using Simple Certificate Enrollment Protocol (SCEP).

  You have the servers shown in the following table.

  

  NDES issues certificates from the subordinate CA.

  You are configuring a device profile as shown in the exhibit. (Click the Exhibit tab.)

  You need to complete the SCEP profile.

  

  A. Server1

  B. Server2

  C. Server3

  D. Server4

  Correct Answer: C

  As NDES issues certificates from the subordinate CA located at Server3, the root certificate should be used for Server3.

• Question 222:

  You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You redirect Windows known folders to Microsoft OneDrive for Business.

  Which folder will be included in the redirection?

  A. Saved Games

  B. Documents

  C. Music

  D. Downloads

  E. Favorites

  F. AppData

  G. Videos

  Correct Answer: B

  There are two primary advantages of moving or redirecting Windows known folders (Desktop, Documents, Pictures, Screenshots, and Camera Roll) to Microsoft

  OneDrive for the users in your domain:

  Your users can continue using the folders they're familiar with. They don't have to change their daily work habits to save files to OneDrive.

  Saving files to OneDrive backs up your users' data in the cloud and gives them access to their files from any device.

  Reference:

  https://docs.microsoft.com/en-us/onedrive/redirect-known-folders

• Question 223:

  Your company has 200 computers that run Windows 10. The computers are managed by using Microsoft Intune.

  Currently, Windows updates are downloaded without using Delivery Optimization.

  You need to configure the computers to use Delivery Optimization.

  What should you create in Intune?

  A. a device configuration profile

  B. a device compliance policy

  C. an app protection policy

  D. a Windows 10 update ring

  Correct Answer: A

  With Intune, use Delivery Optimization settings for your Windows devices to reduce bandwidth consumption when those devices download applications and updates. Configure Delivery Optimization as part of your device configuration profiles.

  Reference: https://docs.microsoft.com/en-us/intune/delivery-optimization-windows

• Question 224:

  Your company has a System Center Configuration Manager deployment that uses hybrid mobile device management (MDM). All Windows 10 devices are Active Directory domain-joined.

  You plan to migrate from hybrid MDM to Microsoft Intune standalone.

  You successfully run the Intune Data Importer tool.

  You need to complete the migration.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. In Intune, add a device enrollment manager (DEM).

  B. Change the tenant MDM authority to Intune.

  C. Assign all users Intune licenses.

  D. Create a new Intune tenant.

  Correct Answer: BC

  References: https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/migrate-hybridmdm-to-intunesa https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/migrate-prepare-intune https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/change-mdm-authority

• Question 225:

  Your company has a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. All users have computers that run Windows 10. The computers are joined to Azure AD and managed by using Microsoft Intune.

  You need to ensure that you can centrally monitor the computers by using Windows Analytics.

  What should you create in Intune?

  A. a device configuration profile

  B. a conditional access policy

  C. a device compliance policy

  D. an update policy

  Correct Answer: A

  To use Update Compliane (iclude in Desktop analytics solution), Commercial ID and telemetry must be enable. Device configuration (cith custom OMA-URI settings) allow to do that. https://docs.microsoft.com/en-us/windows/deployment/

  update/update-compliance-configuration-mem

  With CommercialID in hand, you're ready to go to the MEM admin center portal and start putting your keyboard to work making a custom OMA-URI device configuration profile to enable Update Compliance settings. You're going to need a

  total of four custom policy settings to configure devices to play nice with

  Update Compliance Reference:

  https://www.jeffgilb.com/update-compliance-with-intune/

• Question 226:

  You need to assign the same deployment profile to all the computers that are configured by using Windows Autopilot. Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Join the computers to Microsoft Azure Active Directory (Azure AD)

  B. Assign a Windows Autopilot deployment profile to a group

  C. Join the computers to an on-premises Active Directory domain

  D. Create a Microsoft Azure Active Directory (Azure AD) group that has dynamic membership rules and uses the operatingSystem tag

  E. Create a Group Policy object (GPO) that is linked to a domain

  F. Create a Microsoft Azure Active Directory (Azure AD) group that has dynamic membership rules and uses the ZTDID tag

  Correct Answer: BF

  B: It is possibly to automatically assign a Windows AutoPilot deployment profile to Windows AutoPilot devices. That makes it a lot easier for administrators, as this prevents the administrators from potentially forgetting to assign the deployment profile to newly imported devices.

  F: ZTDId: A unique value assigned to all imported Windows AutoPilot devices.

  Reference: https://www.petervanderwoude.nl/post/automatically-assign-windows-autopilot-deployment-profile-to-windows-autopilot-devices/

• Question 227:

  Your company plans to deploy tablets to 50 meeting rooms.

  The tablets run Windows 10 and are managed by using Microsoft Intune. The tablets have an application named App1.

  You need to configure the tablets so that any user can use App1 without having to sign in. Users must be prevented from using other applications on the tablets.

  Which device configuration profile type should you use?

  A. Kiosk

  B. Endpoint protection

  C. Identity protection

  D. Device restrictions

  Correct Answer: A

  A single-app kiosk uses the Assigned Access feature to run a single app above the lock screen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app.

  Reference: https://docs.microsoft.com/en-us/windows/configuration/kiosk-single-app

• Question 228:

  Your company has a Microsoft 365 subscription.

  The company uses Microsoft Intune to manage all devices.

  The company uses conditional access to restrict access to Microsoft 365 services for devices that do not comply with the company's security policies.

  You need to identify which devices will be prevented from accessing Microsoft 365 services.

  What should you use?

  A. The Device Health solution in Windows Analytics.

  B. Windows Defender Security Center.

  C. The Device compliance blade in the Intune admin center.

  D. The Conditional access blade in the Azure Active Directory admin center.

  Correct Answer: C

  Monitor Intune Device compliance policies.

  1.

  Open the Intune Device compliance dashboard:

  2.

  Sign in to the Microsoft Endpoint Manager admin center.

  3.

  Select Devices > Overview > Compliance status tab.

  Note: Compliance reports help you review device compliance and troubleshoot compliance-related issues in your organization. Using these reports, you can view information on:

  �

  The overall compliance states of devices

  �

  The compliance status for an individual setting

  �

  The compliance status for an individual policy

  �

  Drill down into individual devices to view specific settings and policies that affect the device

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor

• Question 229:

  Your network contains an Active Directory domain named contoso.com. The domain contains 200 computers that run Windows 10.

  Folder Redirection for the Desktop folder is configured as shown in the following exhibit.

  

  The target is set to Server1.

  You plan to use known folder redirection in Microsoft OneDrive for Business.

  You need to ensure that the desktop content of users remains on their desktop when you implement known folder redirection.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Clear the Grant the user exclusive rights to Desktop check box.

  B. Change the Policy Removal setting.

  C. Disable Folder Redirection.

  D. Clear the Move the contents of Desktop to the new location check box.

  Correct Answer: BC

  Correct answer is BC as per Microsoft's important tip: "Important

  The OneDrive Known Folder Move Group Policy objects won't work if you previously used Windows Folder Redirection Group Policy objects to redirect the Documents, Pictures, or Desktop folders to a location other than OneDrive. Remove the Windows Group Policy objects for these folders before you enable the OneDrive Group Policy objects. The OneDrive Group Policy objects won't affect the Music and Videos folders, so you can keep them redirected with the Windows Group Policy objects. For info about Windows Folder Redirection, see Deploy Folder Redirection with Offline Files."

  https://diychris.com/index.php/2019/05/24/your-it-administrator-has-set-a-policy-that-prevents-changes-to-known-folders-please-remove-this-policy-and-try-again/

  https://docs.microsoft.com/en-us/answers/questions/360973/disable-folder-redirection-policy.html

• Question 230:

  Your network contains an Active Directory named contoso.com. The domain contains two computers named Computer1 and Computer2 that run Windows 10.

  Folder Redirection is configured for a domain user named User1. The AppData\Roaming folder and the Desktop folder are redirected to a network share.

  User1 signs in to Computer1 and performs the following tasks:

  1.

  Configures screen saver to start after five minutes of inactivity

  2.

  Modifies the default save location for Microsoft Word

  3.

  Creates a file named File1.docx on the desktop

  4.

  Modifies the desktop background

  What will be retained when User1 signs in to Computer2?

  A. File1.docx and the desktop background only

  B. File1.docx, the screen saver settings, the desktop background, and the default save location for Word

  C. File1.docx only

  D. File1.docx, the desktop background, and the default save location for Word only

  Correct Answer: A

  Answer is A for sure!

  Desktop background is saved in:

  "C:\Users\\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper".

  Your user profile stores your individual settings under Windows. It is used to re-create your preferred system environment when you log on. This includes everything from your wallpaper and desktop, to your email settings and network

  connections. A roaming profile is stored on a central server which can be accessed from all domain computers. This allows you to have the same environment settings on every machine to which you log on. Your roaming profile is copied to a

  machine when you log on, and the synchronized back to the server when you log off.

  On KAPLAN exam - The only difference is that in their question there was not a Desktop background change. In their official explanation they say that the document in the desktop folder surely is retained. The other settings like screen saver,

  default save location for Word, and map a network drive (their option instead of our desktop background) are NOT retained. They explained that the Appdata\Roaming folder stores default templates, some configuration files (like desktop

  background, and support data. To redirect everything you would have to use a roaming user profile, not Folder Redirection.

  So for this scenario the final answer is A. the file and desktop background.