Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 251:

  Your network contains an Active Directory domain named contoso.com. The domain contains computers that run Windows 10 and are joined to the domain.

  The domain is synced to Microsoft Azure Active Directory (Azure AD).

  You create an Azure Log Analytics workspace and deploy the Device Health solution.

  You need to enroll the computers in Windows Analytics.

  Which Group Policy setting should you configure?

  A. Specify intranet Microsoft update service location

  B. Allow Telemetry

  C. Configure the Commercial ID

  D. Connected User Experiences and Telemetry

  Correct Answer: C

  Microsoft uses a unique commercial ID to map information from user computers to your Azure workspace. Copy your commercial ID key from any of the Windows Analytics solutions you have added to your Windows Portal, and then deploy it to user computers.

  References: https://docs.microsoft.com/en-us/windows/deployment/update/windows-analytics-get-started

• Question 252:

  You need to enable Windows Defender Credential Guard on computers that run Windows 10. What should you install on the computers?

  A. Hyper-V

  B. Windows Defender Application Guard

  C. a guarded host

  D. containers

  Correct Answer: A

• Question 253:

  You have 100 devices that run Windows 10 and are joined to Microsoft Azure Active Directory (Azure AD).

  You need to prevent users from joining their home computer to Azure AD.

  What should you do?

  A. From the Device enrollment blade in the Intune admin center, modify the Enrollment restriction settings.

  B. From the Devices blade in the Azure Active Directory admin center, modify the Device settings.

  C. From the Device enrollment blade in the Intune admin center, modify the Device enrollment manages settings.

  D. From the Mobility (MDM and MAM) blade in the Azure Active Directory admin center, modify the Microsoft Intune enrollment settings.

  Correct Answer: A

  As an Intune administrator, you can create and manage enrollment restrictions that define what devices can enroll into management with Intune, including the:

  Number of devices.

  Operating systems and versions.

  You can create multiple restrictions and apply them to different user groups. You can set the priority order for your different restrictions.

  Create a device type restriction

  1.

  Sign in to the Microsoft Endpoint Manager admin center > Devices > Enroll Devices > Enrollment restrictions > Create restriction > Device type restriction.

  2.

  Etc.

  Reference: https://docs.microsoft.com/en-us/intune/enrollment-restrictions-set

• Question 254:

  You have a shared computer that runs Windows 10.

  The computer is infected with a virus.

  You discover that a malicious TTF font was used to compromise the computer.

  You need to prevent this type of threat from affecting the computer in the future.

  What should you use?

  A. Windows Defender Exploit Guard

  B. Windows Defender Application Guard

  C. Windows Defender Credential Guard

  D. Windows Defender System Guard

  E. Windows Defender SmartScreen

  Correct Answer: A

  Exploit protection helps protect against malware that uses exploits to infect devices and spread. Exploit protection consists of many mitigations that can be applied to either the operating system or individual apps.

  Reference:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exploit-protection

• Question 255:

  You have a Microsoft 365 subscription.

  You have 10 computers that run Windows 10 and are enrolled in mobile device management (MDM).

  You need to deploy the Microsoft Office 365 ProPlus suite to all the computers.

  What should you do?

  A. From the Device Management admin center, add an app.

  B. From Microsoft Azure Active Directory (Azure AD), add an app registration.

  C. From Microsoft Azure Active Directory (Azure AD), add an enterprise application.

  D. From the Device Management admin center, create a Windows 10 device profile.

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/windows/client-management/mdm/enterprise-app-management#application-management-goals

• Question 256:

  You manage a Microsoft 365 environment that has co-management enabled.

  All computers run Windows 10 and are deployed by using the Microsoft Deployment Toolkit (MDT).

  You need to recommend a solution to deploy Microsoft Office 365 ProPlus to new computers. The latest version must always be installed. The solution must minimize administrative effort.

  What is the best tool to use for the deployment? More than one answer choice may achieve the goal. Select the BEST answer.

  A. Microsoft Intune

  B. Microsoft Deployment Toolkit

  C. Office Deployment Tool (ODT)

  D. a Group Policy object (GPO)

  E. Microsoft System Center Configuration Manager

  Correct Answer: A

  Intune --> Create device group --> Select o365 app --> deploy to group

  ODT --> Download files -> create XML --> how to trigger install (manual install/MDT Task seq/powershell script/logon script etc)

  SCCM --> create new package via ODT or via wizard --> select DPs to distribute -->deploy to collection

  MDT --> requires ODT to have latest version, but is fastest with install as O365 is installed during TS, so at the end I would use this in production, but is not wat MS asks.

  In the question it states the machines are in co-management, which indicates the presence of ConfigMgr and Intune otherwise machines cannot be co-managed. In configMgr there is a co-management workload you can move to Intune

  specifically for Office 365 management. Office deployment and management from intune is by far the most simple way to deploy the Office apps (MS 365 Apps for business) .

  https://docs.microsoft.com/en-us/mem/configmgr/comanage/workloads#office-click-to-run-apps

  https://docs.microsoft.com/en-us/mem/intune/apps/apps-add-office365#select-microsoft-365-apps

• Question 257:

  Your company has a Microsoft 365 subscription.

  All the users in the finance department own personal devices that run iOS or Android. All the devices are enrolled in Microsoft Intune.

  The finance department adds new users each month.

  The company develops a mobile application named App1 for the finance department users.

  You need to ensure that only the finance department users can download App1.

  What should you do first?

  A. Add App1 to Intune.

  B. Add App1 to a Microsoft Deployment Toolkit (MDT) deployment share.

  C. Add App1 to Microsoft Store for Business.

  D. Add App1 to the vendor stores for iOS and Android applications.

  Correct Answer: A

  Before you can configure, assign, protect, or monitor apps, you must add them to Microsoft Intune.

  Reference:

  https://docs.microsoft.com/en-us/intune/apps-add

• Question 258:

  You have devices enrolled in Microsoft Intune as shown in the following table.

  

  You create an app protection policy named Policy1 that has the following settings:

  1.

  Platform: Windows 10

  2.

  Protected apps: App1

  3.

  Exempt apps: App2

  4.

  Network boundary: Cloud resources, IPv4 ranges

  You assign Policy1 to Group1 and Group2. You exclude Group3 from Policy1.

  Which devices will apply Policy1?

  A. Device1, Device2, Device4, and Device5

  B. Device1, Device4, and Device5 only

  C. Device4 and Device5 only

  D. Device1, Device3, Device4 and Device5

  Correct Answer: C

  Intune device configuration profiles let you include and exclude groups from profile assignment. Exclusion takes precedence over inclusion in same group types.

  Policy1 excludes Group3 and Group3 includes Device1, Device2, and Device3.

  Incorrect Answers:

  A, B, D: Device1, Device2, and Device3 are members of Group3. Policy1 excludes Group3. Exclusion takes precedence over inclusion.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#exclude-groups-from-a-profile-assignment

  https://docs.microsoft.com/en-us/intune/app-protection-policies

• Question 259:

  Your network contains an Active Directory domain named contoso.com that syncs to Azure Active Directory (Azure AD).

  The Active Directory domain contains 200 computers that run Windows 10. The computers are managed by using Microsoft System Center Configuration Manager (Current Branch).

  You need to pilot co-management for only five of the computers.

  What should you create first?

  A. a domain local distribution group in Active Directory

  B. an Intune Connector for Active Directory

  C. a device collection in Configuration Manager

  D. a dynamic device group in Azure AD

  Correct Answer: C

  The Pilot Intune setting switches the associated workload only for the devices in the pilot collection.

  Note: When you enable co-management, you'll assign a collection as a Pilot group. This is a group that contains a small number of clients to test your co-management configurations. We recommend you create a suitable collection before you start the procedure. Then you can select that collection without exiting the procedure to do so.

  References: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-new-devices

• Question 260:

  Your company has a main office and six branch offices. The branch offices connect to the main office by using a WAN link. All offices have a local Internet connection and a Hyper-V host cluster.

  The company has a Microsoft System Center Configuration Manager deployment. The main office is the primary site. Each branch office has a distribution point. All computers that run Windows 10 are managed by using both Configuration

  Manager and Microsoft Intune.

  You plan to deploy the latest build of Microsoft Office 365 ProPlus to all the computers.

  You need to minimize the amount of network traffic on the company's Internet links for the planned deployment.

  What should you include in the deployment plan?

  A. From Intune, configure app assignments for the Office 365 ProPlus suite. In each office, copy the Office 365 distribution files to a Microsoft Deployment Toolkit (MDT) deployment share.

  B. From Intune, configure app assignments for the Office 365 ProPlus suite. In each office, copy the Office 365 distribution files to a Configuration Manager distribution point.

  C. From Configuration Manager, create an application deployment. Copy the Office 365 distribution files to a Configuration Manager cloud distribution point.

  D. From Configuration Manager, create an application deployment. In each office, copy the Office 365 distribution files to a Configuration Manager distribution point.

  Correct Answer: D

  Deploy the Microsoft 365 Apps application in Configuration Manager.

  After the files for the Microsoft 365 Apps application are copied to the appropriate distribution points, the next step is to deploy the application. When you deploy the application, you specify which computers or users get the application and

  when.

  To deploy the application:

  1.

  In the Configuration Manager console, choose Software Library > Application Management > Applications.

  2.

  Select the Microsoft 365 Apps application, and then on the Home tab, in the Deployment group, choose Deploy.

  3.

  Etc.

  Note: If you use Microsoft Endpoint Configuration Manager to deploy software, such as Office, to users and computers in your organization, you can also use that existing Configuration Manager environment to deploy Microsoft 365 Apps. By

  using Configuration Manager, you can control which users and computers get

  Microsoft 365 Apps, where they get the installation files from, and when the Microsoft 365 Apps installation occurs.

  Reference:

  https://docs.microsoft.com/en-us/deployoffice/deploy-office-365-proplus-with-system-center-configuration-manager-2012r2#distribute-the-office-365-proplus- application-to-distribution-points-in-configuration-manager