Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 241:

  You use Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) to protect computers that run Windows 10.

  You need to assess the differences between the configuration of Microsoft Defender ATP and the Microsoft-recommended configuration baseline.

  Which tool should you use?

  A. Microsoft Defender Security Center

  B. Windows Analytics

  C. Microsoft Defender ATP Power BI app

  D. Microsoft Secure Score

  Correct Answer: D

  Following the Secure Score recommendations can protect your organization from threats. Secure Score helps organizations:

  �

  Report on the current state of the organization's security posture.

  �

  Improve their security posture by providing discoverability, visibility, guidance, and control.

  �

  Compare with benchmarks and establish key performance indicators (KPIs).

  Note: Products included in Secure Score

  Currently there are recommendations for the following products:

  �

  Microsoft 365 (including Exchange Online)

  �

  Azure Active Directory

  �

  Microsoft Defender for Endpoint

  �

  Microsoft Defender for Identity

  �

  Defender for Cloud Apps

  �

  Microsoft Teams

  �

  Recommendations for other security products are coming soon. The recommendations won't cover all the attack surfaces associated with each product, but they're a good baseline.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide

• Question 242:

  Your company has a Microsoft Azure Active Directory (Azure AD) tenant. All users in the company are licensed for Microsoft Intune.

  You need to ensure that the users enroll their iOS device in Intune.

  What should you configure first?

  A. A Device Enrollment Program (DEP) token.

  B. An Intune device configuration profile.

  C. A Device enrollment manager (DEM) account.

  D. An Apple MDM Push certificate.

  Correct Answer: D

  Prerequisites for iOS enrollment Before you can enable iOS devices, complete the following steps: Make sure your device is eligible for Apple device enrollment. Set up Intune - These steps set up your Intune infrastructure. In particular, device enrollment requires that you set your MDM authority. Get an Apple MDM Push certificate - Apple requires a certificate to enable management of iOS and macOS devices.

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/apple-mdm-push-certificate-get

• Question 243:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains several Windows 10 devices.

  When you join new Windows 10 devices to contoso.com, users are prompted to set up a four-digit pin.

  You need to ensure that the users are prompted to set up a six-digit pin when they join the Windows 10 devices to contoso.com.

  Solution: From the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Device Management admin center, you create and assign a device restrictions profile.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, from the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Device Management admin center, you configure the Windows Hello for Business enrollment options.

  References: https://docs.microsoft.com/en-us/intune/protect/windows-hello

• Question 244:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains several Windows 10 devices.

  When you join new Windows 10 devices to contoso.com, users are prompted to set up a four-digit pin.

  You need to ensure that the users are prompted to set up a six-digit pin when they join the Windows 10 devices to contoso.com.

  Solution: From the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Device Management admin center, you configure the Windows Hello for Business enrollment options.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Hello for Business is an alternative sign-in method that uses Active Directory or an Azure Active Directory account to replace a password, smart card, or a virtual smart card. It lets you use a user gesture to sign in, instead of a password. A user gesture might be a PIN, biometric authentication such as Windows Hello, or an external device such as a fingerprint reader.

  Intune integrates with Hello for Business in two ways:

  1.

  An Intune policy can be created under Device enrollment. This policy targets the entire organization (tenant-wide). It supports the Windows AutoPilot out-of-box-experience (OOBE) and is applied when a device enrolls.

  2.

  An identity protection profile can be created under Device configuration. This profile targets assigned users and devices, and is applied during check-in.

  References: https://docs.microsoft.com/en-us/intune/protect/windows-hello

• Question 245:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains several Windows 10 devices.

  When you join new Windows 10 devices to contoso.com, users are prompted to set up a four-digit pin.

  You need to ensure that the users are prompted to set up a six-digit pin when they join the Windows 10 devices to contoso.com.

  Solution: From the Azure Active Directory admin center, you configure the Authentication methods.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, from the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Device Management admin center, you configure the Windows Hello for Business enrollment options.

  References: https://docs.microsoft.com/en-us/intune/protect/windows-hello

• Question 246:

  Your company implements Microsoft Azure Active Directory (Azure AD), Microsoft 365, Microsoft Intune, and Azure Information Protection. The company's security policy states the following:

  1.

  Personal devices do not need to be enrolled in Intune.

  2.

  Users must authenticate by using a PIN before they can access corporate email data.

  3.

  Users can use their personal iOS and Android devices to access corporate cloud services.

  4.

  Users must be prevented from copying corporate email data to a cloud storage service other than Microsoft OneDrive for Business.

  You need to configure a solution to enforce the security policy.

  What should you create?

  A. a data loss prevention (DLP) policy from the Microsoft 365 Compliance admin center

  B. an insider risk management policy from the Microsoft 365 Compliance admin center

  C. an app protection policy from the Endpoint Manager admin center

  D. a device configuration profile from the Endpoint Manager admin center

  Correct Answer: C

  By implementing app-level policies, you can restrict access to company resources and keep data within the purview of your IT department.

  Note: The important benefits of using App protection policies are the following:

  Protecting your company data at the app level. Because mobile app management doesn't require device management, you can protect company data on both managed and unmanaged devices. The management is centered on the user

  identity, which removes the requirement for device management.

  End-user productivity isn't affected and policies don't apply when using the app in a personal context. The policies are applied only in a work context, which gives you the ability to protect company data without touching personal data.

  App protection policies makes sure that the app-layer protections are in place. For example, you can:

  Require a PIN to open an app in a work context

  Control the sharing of data between apps

  Prevent the saving of company app data to a personal storage location

  MDM, in addition to MAM, makes sure that the device is protected. For example, you can require a PIN to access the device, or you can deploy managed apps to the device. You can also deploy apps to devices through your MDM solution, to

  give you more control over app management.

  Reference:

  https://docs.microsoft.com/en-us/intune/app-protection-policy

• Question 247:

  Your company has computers that run Windows 10. The company uses Microsoft Intune to manage the computers.

  You have an app protection policy for Microsoft Edge. You assign the policy to a group.

  On a computer named Computer1, you open Microsoft Edge.

  You need to verify whether Microsoft Edge on Computer1 is protected by the app protection policy.

  Which column should you add in Task Manager?

  A. Operating system context

  B. UAC virtualization

  C. Enterprise Context

  D. Data Execution Prevention

  Correct Answer: C

  Use Task Manager to check the context of your apps while running in Windows Information Protection (WIP) to make sure that your organization's policies are applied and running correctly.

  Viewing the Enterprise Context column in Task Manager

  You need to add the Enterprise Context column to the Details tab of the Task Manager.

  Make sure that you have an active WIP policy deployed and turned on in your organization.

  Open the Task Manager (taskmgr.exe), click the Details tab, right-click in the column heading area, and click Select Columns.

  The Select columns box appears.

  Scroll down and check the Enterprise Context option, and then click OK to close the box.

  The Enterprise Context column should now be available in Task Manager

  Use Task Manager to check the context of your apps while running in Windows Information Protection (WIP) to make sure that your organization's policies are applied and running correctly.

  Viewing the Enterprise Context column in Task Manager.

  You need to add the Enterprise Context column to the Details tab of the Task Manager.

  Reference:

  https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context https://www.itpromentor.com/win10-mam-wip/

• Question 248:

  Your network contains an Active Directory domain that is synced to Microsoft Azure Active Directory (Azure AD). The domain contains computers that run Windows 10. The computers are enrolled in Microsoft Intune and Windows Analytics.

  Your company protects documents by using Windows Information Protection (WIP).

  You need to identify non-approved apps that attempt to open corporate documents.

  What should you use?

  A. the Device Health solution in Windows Analytics

  B. Microsoft Cloud App Security

  C. Intune Data Warehouse

  D. the App protection status report in Intune

  Correct Answer: D

  The App learning report monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with Block mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly. Note: Access the WIP Learning reports

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select Apps > Monitor > App protection status > Reports.

  Reference: https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/wip-learning

• Question 249:

  Your company has a Microsoft 365 subscription.

  A new user named Admin1 is responsible for deploying Windows 10 to computers and joining the computers to Microsoft Azure Active Directory (Azure AD).

  Admin1 successfully joins computers to Azure AD.

  Several days later, Admin1 receives the following error message: "This user is not authorized to enroll. You can try to do this again or contact your system administrator with the error code (0x801c0003)."

  You need to ensure that Admin1 can join computers to Azure AD and follow the principle of least privilege.

  What should you do?

  A. Assign the Global administrator role to Admin1.

  B. Modify the Device settings in Azure AD.

  C. Assign the Cloud device administrator role to Admin1.

  D. Modify the User settings in Azure AD.

  Correct Answer: B

  If you have rights to manage devices in Intune, you can manage devices for which mobile device management is listed as Microsoft Intune. If the device isn't enrolled with Microsoft Intune, the Manage option won't be available.

  Note: Enable or disable an Azure AD device

  There are two ways to enable or disable devices:

  The toolbar on the All devices page, after you select one or more devices.

  The toolbar, after you drill down for a specific device.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

• Question 250:

  Your network contains an Active Directory domain. The functional level of the forest and the domain is Windows Server 2012 R2.

  The domain contains 500 computers that run Windows 10. All the computers are managed by using Microsoft System Center 2012 R2 Configuration Manager.

  You need to enable co-management.

  What should you do first?

  A. Deploy the Microsoft Intune client.

  B. Raise the forest functional level.

  C. Upgrade Configuration Manager to Current Branch.

  D. Raise the domain functional level.

  Correct Answer: C

  Microsoft System Center 2012 R2 is quite old.

  Co-management requires Configuration Manager version 1710 or later.

  Reference:

  https://docs.microsoft.com/en-us/sccm/comanage/overview#prerequisites