Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 231:

  You are creating a device configuration profile in Microsoft Intune.

  You need to implement an ADMX-backed policy.

  Which profile type should you use?

  A. Identity protection

  B. Custom

  C. Device restrictions

  D. Device restrictions (Windows 10 Team)

  Correct Answer: B

  Ingest the Microsoft Edge ADMX file into Intune To ingest the ADMX file, follow these steps:

  1.

  Download the Microsoft Edge policy templates file (MicrosoftEdgePolicyTemplates.cab) from the Microsoft Edge Enterprise landing page and extract the contents. The file that you want to ingest is msedge.admx.

  2.

  Sign in to the Microsoft Azure portal.

  3.

  Select Intune from All Services, or search for Intune in the portal search box.

  4.

  From Microsoft Intune - Overview, select Device configuration | Profiles.

  5.

  On the top command bar, select + Create profile.

  6.

  Provide the following profile information:

  Name: Enter a descriptive name. For this example, "Microsoft Edge ADMX ingested configuration".

  Description: Enter an optional description for the profile.

  Platform: Select "Windows 10 and later"

  Profile type: Select "Custom"

  7.

  On Custom OMA-URI Settings, click Add to add an ADMX ingestion.

  8.

  Etc.

  Reference:

  https://docs.microsoft.com/en-us/deployedge/configure-edge-with-mdm

  

• Question 232:

  You have computers that run Windows 10 Pro. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You need to upgrade the computers to Windows 10 Enterprise.

  What should you configure in Intune?

  A. A device enrollment policy

  B. A device cleanup rule

  C. A device compliance policy

  D. A device configuration profile

  Correct Answer: D

  Intune: Upgrade Windows Pro to Enterprise.

  1.

  First, create a Microsoft Intune configuration policy. In the Azure Portal navigate to Microsoft Intune -> Device Configuration -> Profiles. Click Create Profile.

  2.

  Next, create a new Windows 10 and later profile, with a type of Edition Upgrade. Click Settings

  3.

  Etc.

  Reference: https://blogs.technet.microsoft.com/skypehybridguy/2018/09/21/intune-upgrade-windows-from-pro-to-enterprise-automatically/

• Question 233:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains several Windows 10 devices.

  When you join new Windows 10 devices to contoso.com, users are prompted to set up a four-digit pin.

  You need to ensure that the users are prompted to set up a six-digit pin when they join the Windows 10 devices to contoso.com.

  Solution: From the Azure Active Directory admin center, you modify the User settings and the Device settings.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, from the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Device Management admin center, you configure the Windows Hello for Business enrollment options.

  Reference: https://docs.microsoft.com/en-us/intune/protect/windows-hello

• Question 234:

  Your company uses Microsoft Intune.

  More than 500 Android and iOS devices are enrolled in the Intune tenant.

  You plan to deploy new Intune policies. Different policies will apply depending on the version of Android or iOS installed on the device.

  You need to ensure that the policies can target the devices based on their version of Android or iOS.

  What should you configure first?

  A. Corporate device identifiers in Intune

  B. Device settings in Microsoft Azure Active Directory (Azure AD)

  C. Device categories in Intune

  D. Groups that have dynamic membership rules in Microsoft Azure Active Directory (Azure AD)

  Correct Answer: D

  We can create dynamic groups by using the deviceOSVersion or deviceOSType properties, and then apply Intune configuration policies to those groups.

  Reference:

  https://docs.microsoft.com/en-us/archive/blogs/pauljones/dynamic-group-membership-in-azure-active-directory-part-2 https://docs.microsoft.com/en-ie/mem/intune/enrollment/device-group-mapping

• Question 235:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has several Windows 10 devices that are enrolled in Microsoft Intune.

  You deploy a new computer named Computer1 that runs Windows 10 and is in a workgroup.

  You need to enroll Computer1 in Intune.

  Solution: From the Settings app on Computer1, you use the Connect to work or school account settings. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Use MDM enrolment.

  MDM only enrollment lets users enroll an existing Workgroup, Active Directory, or Azure Active directory joined PC into Intune. Users enroll from Settings on the existing Windows PC.

  References:

  https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods

• Question 236:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has several Windows 10 devices that are enrolled in Microsoft Intune.

  You deploy a new computer named Computer1 that runs Windows 10 and is in a workgroup.

  You need to enroll Computer1 in Intune.

  Solution: You install the Company Portal app on Computer1 and use the Devices tab from the app.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/mem/intune/user-help/enroll-windows-10-device

• Question 237:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has several Windows 10 devices that are enrolled in Microsoft Intune.

  You deploy a new computer named Computer1 that runs Windows 10 and is in a workgroup.

  You need to enroll Computer1 in Intune.

  Solution: From Computer1, you sign in to https://portal.manage.microsoft.com and use the Devices tab.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The Company Portal apps, Company Portal website, and Intune app on Android are where users access company data and can do common tasks. Common task may include enrolling devices, installing apps, and locating information (such as for assistance from your IT department).

  https://docs.microsoft.com/en-us/mem/intune/apps/company-portal-app

• Question 238:

  You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You need to ensure that only applications that you explicitly allow can run on the computers.

  What should you use?

  A. Windows Defender Credential Guard

  B. Windows Defender Exploit Guard

  C. Windows Defender Application Guard

  D. Windows Defender Application Control

  Correct Answer: D

  Application control can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel). Application control policies can also block unsigned scripts and MSIs, and restrict Windows PowerShell to run in Constrained Language Mode.

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-to-device-guard-virtualization-based-security-and-windows-defender-application-control

• Question 239:

  You have a Microsoft Azure Log Analytics workplace that collects all the event logs from the computers at your company.

  You have a computer named Computer1 than runs Windows 10. You need to view the events collected from Computer1.

  Which query should you run in Log Analytics?

  A. Event | where Computer = = "Computer1"

  B. ETWEvent | where SourceSystem = = "Computer1"

  C. ETWEvent | where Computer = = "Computer1"

  D. Event | where SourceSystem = = "Computer1"

  Correct Answer: A

  Windows event records properties include:

  Computer: Name of the computer that the event was collected from.

  The following table provides different examples of log queries that retrieve Windows Event records.

  

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events

• Question 240:

  Your company uses Microsoft Intune to manage devices. You need to ensure that only Android devices that use Android work profiles can enroll in Intune.

  Which two configurations should you perform in the device enrollment restrictions? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From Platform Settings, set Android Enterprise (work profile) to Allow.

  B. From Platform Settings, set Android device administrator Personally Owned to Block.

  C. From Platform Settings, set Android device administrator Personally Owned to Allow.

  D. From Platform Settings, set Android device administrator to Block.

  Correct Answer: AB

  Once you have entered your corporate device indentifiers those devices are automatically enrolled as "Corporate Devices". The next step is to block enrolment of personal devices. You can do this by navigating to Intune > Device Enrollment > Enrollment Restrictions. Under Device Type Restrictions click on Default and then navigate to "Properties". Under properties click "Configure Platforms" and next to android change the selection from allow to block for personally owned devices and click ok

  Reference: https://triplesixseven.com/block-personal-android-devices-from-enrolling-in-intune/