Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 291:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company uses Windows Autopilot to configure the computer settings of computers issued to users.

  A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company.

  You plan to transfer the computer to a user named User2.

  You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.

  Solution: You perform a remote Windows AutoPilot Reset.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead:

  Windows Autopilot user-driven mode lets you configure new Windows devices to automatically transform them from their factory state to a ready-to-use state. This process doesn't require that IT personnel touch the device.

  The process is very simple. Devices can be shipped or distributed to the end user directly with the following instructions:

  Unbox the device, plug it in, and turn it on.

  Choose a language (only required when multiple languages are installed), locale, and keyboard.

  Connect it to a wireless or wired network with internet access. If using wireless, the user must establish the Wi-Fi link.

  Specify your e-mail address and password for your organization account.

  The rest of the process is automated. The device will:

  Join the organization.

  Enroll in Intune (or another MDM service)

  Get configured as defined by the organization.

  Reference:

  https://docs.microsoft.com/en -us/windows/deployment/windows-autopilot/windows-autopilot-reset-remote

• Question 292:

  You have a Microsoft 365 subscription.

  You are assigned the User administrator role.

  An Azure AD security group named Group1 was deleted five days ago.

  You need to restore Group1.

  What should you do?

  A. Modify the group expiration policy.

  B. From Deleted groups, restore Group1.

  C. Manually recreate Group1.

  D. Ask a global administrator to restore Group1.

  Correct Answer: B

• Question 293:

  You have a Microsoft 365 E5 subscription that contains a user named User1 and the devices shown in the following table.

  

  User1 can access her Microsoft Exchange Online mailbox from both Device 1 and Device2.

  You plan to create a Conditional Access policy named CAPolicy1 that will have the following settings:

  1.

  Assignments

  2.

  Users or workload identities: User1

  3.

  Cloud apps or actions: Office 365 Exchange Online

  4.

  Access controls

  5.

  Grant: Block access

  You need to configure CAPolicy1 to allow mailbox access from Device 1 but block mailbox access from Device2.

  Solution: You add a condition that specifies device platforms.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use solution: You add a condition to filter for devices.

  Note: Conditional Access: Filter for devices When creating Conditional Access policies, administrators have asked for the ability to target or exclude specific devices in their environment. The condition filter for devices gives administrators this capability. Now you can target specific devices using supported operators and properties for device filters and the other available assignment conditions in your Conditional Access policies.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/conditional- access/concept-condition-filters-for-devices

• Question 294:

  You use Windows Defender Advanced Threat Protection (Windows Defender ATP) to protect computers that run Windows 10.

  You need to assess the differences between the configuration of Windows Defender ATP and the Microsoft recommended configuration baseline.

  Which tool should you use?

  A. Windows Defender Security Center

  B. Windows Analytics

  C. Windows Defender ATP Power BI app

  D. Microsoft Secure Score

  Correct Answer: D

  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/overview-securescore

• Question 295:

  You have a Microsoft 365 tenant

  You have devices enrolled in Microsoft intune.

  You assign a conditional access policy nan-ted Policy1 to a group named Group1. Policy1 restricts devices marked as noncompliant from accessing Microsoft OneDrive for Business.

  You need to identify which noncompliant devices attempt to access OneDrive for Business.

  What should you do?

  A. From the Microsoft Endpoint Manager admin center, review the Setting compliance report.

  B. From the Microsoft Endpoint Manager admin center, review the Noncompliant devices reporter.

  C. From the Microsoft Endpoint Manager admin center, review Device compliance report.

  D. From the Azure Active Directory admin center, review the Conditional Access Insights and Reporting workbook.

  Correct Answer: B

  The Noncompliant devices report provides data typically used by Helpdesk or admin roles to identify problems and help remediate issues. The data found in this report is timely, calls out unexpected behavior, and is meant to be actionable.

  Note: Compliance reports help you understand when devices fail to meet your compliance configurations and can help you identify compliance-related issues in your organization.

  Open the compliance dashboard

  Open the Intune Device compliance dashboard:

  Sign in to the Microsoft Endpoint Manager admin center.

  Select Devices > Overview > Compliance status tab.

  When the dashboard opens, you get an overview with all the compliance reports. In these reports, you can see and check for:

  Overall device compliance

  Per-policy device compliance

  Per-setting device compliance

  Threat agent status

  Device protection status

  View compliance reports

  In addition to using the charts on Compliance status, you can go to Reports > Device compliance.

  Sign in to the Microsoft Endpoint Manager admin center. Select Devices > Monitor, and then from below Compliance select the report you want to view. Some of the available compliance reports include:

  Device compliance

  Noncompliant devices

  Devices without compliance policy

  Setting compliance

  Policy compliance

  Noncompliant policies (preview)

  Windows health attestation report

  Threat agent status

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor

• Question 296:

  You have a Microsoft 365 E5 subscription.

  You need to create a Conditional Access policy to ensure that when a user accesses the Microsoft 365 portal, the user will be prompted to sign in again after seven days.

  What should you configure to specify the sign-in frequency?

  A. Session access controls

  B. an assignment that uses the Cloud apps or actions settings

  C. Grant access controls

  D. an assignment condition

  Correct Answer: A

  Conditional Access: Session

  Within a Conditional Access policy, an administrator can make use of session controls to enable limited experiences within specific cloud applications.

  Sign-in frequency

  Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. Administrators can select a period of time (hours or days) or choose to require reauthentication every time.

  Sign-in frequency setting works with apps that have implemented OAUTH2 or OIDC protocols according to the standards. Most Microsoft native apps for Windows, Mac, and Mobile including the following web applications follow the setting. Reference: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-session

• Question 297:

  You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices enrolled in Microsoft Intune.

  You plan to use Endpoint analytics.

  You need to create baseline metrics.

  What should you do first?

  A. Create an Azure Monitor workbook.

  B. Onboard 10 devices to Endpoint analytics.

  C. Create a Log Analytics workspace.

  D. Modify the Baseline regression threshold.

  Correct Answer: B

  Onboarding from the Endpoint analytics portal is required for Intune managed devices. Reference: https://docs.microsoft.com/en-us/mem/analytics/enroll-intune

• Question 298:

  You have 100 computers that run Windows 10 and connect to an Azure Log Analytics workspace.

  Which three types of data can you collect from the computers by using Log Analytics? Each correct answer a complete solution.

  NOTE: Each correct selection is worth one point.

  A. error events from the System log

  B. failure events from the Security log

  C. third-party application logs stored as text files

  D. the list of processes and their execution times

  E. the average processor utilization

  Correct Answer: ADE

  Log Analytics is a tool in the Azure portal to edit and run log queries from data collected by Azure Monitor logs, such as the system log, and interactively analyze their results.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial

• Question 299:

  You have a Microsoft 365 E5 subscription that contains 100 iOS devices enrolled in Microsoft Intune.

  You need to ensure that notifications of iOS updates are deferred for 30 days after the updates are released.

  What should you create?

  A. a device configuration profile based on the Device features template

  B. a device configuration profile based on the Device restrictions template

  C. an update policy for iOS/iPadOS

  D. an iOS app provisioning profile

  Correct Answer: C

  Manage iOS/iPadOS software update policies in Intune, delay visibility of software updates. When you use update policies for iOS, you might have need to delay visibility of an iOS software update. Reasons to delay visibility include:

  Prevent users from updating the OS manually To deploy an older update while preventing users from installing a more recent one To delay visibility, deploy a device restriction template that configures the following settings: Defer software updates = Yes

  This doesn't affect any scheduled updates. It represents days before software updates are visible to end users after release.

  Delay default visibility of software updates = 1 to 90 90 days is the maximum delay that Apple supports.

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/software-updates-ios

• Question 300:

  You have a Microsoft 365 E5 subscription that contains a user named User1 and the devices shown in the following table.

  

  User1 can access her Microsoft Exchange Online mailbox from both Device 1 and Device2.

  You plan to create a Conditional Access policy named CAPolicy1 that will have the following settings:

  1.

  Assignments

  2.

  Users or workload identities: User1

  3.

  Cloud apps or actions: Office 365 Exchange Online

  4.

  Access controls

  5.

  Grant: Block access

  You need to configure CAPolicy1 to allow mailbox access from Device 1 but block mailbox access from Device2.

  Solution: You add a condition that specifies a trusted locations.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use solution: You add a condition to filter for devices.

  Note: Conditional Access: Filter for devices

  When creating Conditional Access policies, administrators have asked for the ability to target or exclude specific devices in their environment. The condition filter for devices gives administrators this capability. Now you can target specific

  devices using supported operators and properties for device filters and the other available assignment conditions in your Conditional Access policies.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices