Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 301:

  You have a Microsoft 365 E5 subscription that contains a user named User! and the devices shown In the following table.

  

  User1 can access her Microsoft Exchange Online mailbox from both Device1 and Device2.

  You plan to create a Conditional Access policy named CAPolicy1 that will have the following settings:

  1.

  Assignments

  2.

  Users or workload identities: User1

  3.

  Cloud apps or actions: Office 365 Exchange Online

  4.

  Access controls

  5.

  Grant Block access

  You need to configure CAPolicy1 to allow mailbox access from Device1 but block mailbox access from Device2.

  Solution: You add a condition to filter for devices.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Conditional Access: Filter for devices When creating Conditional Access policies, administrators have asked for the ability to target or exclude specific devices in their environment. The condition filter for devices gives administrators this capability. Now you can target specific devices using supported operators and properties for device filters and the other available assignment conditions in your Conditional Access policies.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices

• Question 302:

  You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.

  

  You create a Conditional Access policy named CAPolicy1 that will block access to Microsoft Exchange Online from iOS devices. You assign CAPolicy1 to Group1.

  You discover that User1 can still connect to Exchange Online from an iOS device.

  You need to ensure that CAPolicy1 is enforced.

  What should you do?

  A. Configure a new terms of use (TOU).

  B. Assign CAPolicy1 to Group2.

  C. Enable CAPolicy1

  D. Add a condition in CAPolicy1 to filter for devices.

  Correct Answer: B

  Common signals that Conditional Access can take in to account when making a policy decision include the following signals:

  User or group membership

  Policies can be targeted to specific users and groups giving administrators fine-grained control over access.

  Device

  Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.

  Use filters for devices to target policies to specific devices like privileged access workstations.

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

• Question 303:

  You have a Microsoft 365 subscription that contains 1,000 Android devices enrolled in Microsoft intune. You create an app configuration policy that contains the following settings:

  1.

  Device enrollment type: Managed devices

  2.

  Profile Type: All Profile Types

  3.

  Platform: Android Enterprise

  Which two types of apps can be associated with the policy?

  Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Android Enterprise system app

  B. Android store app

  C. Web link

  D. Managed Google Play store app

  E. Built-in Android app

  Correct Answer: AD

• Question 304:

  You have a Microsoft 365 E5 subscription that contains 1,000 Windows 11 devices. All the devices are enrolled in Microsoft Intune.

  You plan to integrate Intune with Microsoft Defender for Endpoint.

  You need to establish a service-to-service connection between Intune and Defender for Endpoint.

  Which settings should you configure in the Microsoft Endpoint Manager admin center?

  A. Connectors and tokens

  B. Premium add-ons

  C. Microsoft Tunnel Gateway

  D. Tenant enrollment

  Correct Answer: A

  Microsoft Defender for Endpoint Important Service and Endpoint Settings You Should Configure Right Now.

  As a prerequisite, however, head to tenant administration > connectors and tokens > Microsoft Defender for Endpoint and confirm the connection is enabled. You previously set this up in the advanced settings of Microsoft 365 Defender.

  Reference: https://petri.com/microsoft-defender-for-endpoint-which-settings-configure-right-now/

• Question 305:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that feature and quality updates install automatically during a maintenance window.

  Solution: From the Windows Update settings, you enable Configure Automatic Updates, select 3 -Auto download and notify for Install, and then enter a time.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  References: https://docs.microsoft.com/en-us/sccm/sum/deploy-use/automatically-deploy-software-updates

• Question 306:

  You have 100 computers that run Windows 8.1.

  You need to identify which computers can be upgraded to Windows 10.

  What should you use?

  A. Microsoft Deployment Toolkit (MDT)

  B. Update Compliance Azure

  C. Windows Assessment Toolkit

  D. Microsoft Assessment and Planning (MAP) Toolkit.

  Correct Answer: D

  Reference: https://www.techielass.com/using-maps-azure-readiness/

• Question 307:

  Your on-premises network contains an Active Directory domain named contoso.com. You perform the following actions:

  1.

  Purchase a new Microsoft 365 subscription.

  2.

  Create a new user named User1.

  3.

  Assign User1 the Security Administrator role.

  You need to ensure that User1 can enable Conditional Access policies.

  What should User1 do first?

  A. Register for Azure Multi-Factor Authentication (MFA).

  B. Request the Conditional Access Administrator role.

  C. Disable Security defaults.

  D. Implement Azure AD Connect.

  Correct Answer: C

  Microsoft provides security defaults that ensure a basic level of security enabled in tenants that don't have Azure AD Premium. With Conditional Access, you can create policies that provide the same protection as security defaults, but with

  granularity. Conditional Access and security defaults aren't meant to be combined as creating Conditional Access policies will prevent you from enabling security defaults.

  Incorrect:

  Not B:

  Not required. Gobal administrator, security administrator, or Conditional Access administrator is enough.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/plan- conditional-access

• Question 308:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain. The domain contains a computer named Computer1 that runs Windows 8.1.

  Computer1 has apps that are compatible with Windows 10.

  You need to perform a Windows 10 in-place upgrade on Computer1.

  Solution: You copy the Windows 10 installation media to a Microsoft Deployment Toolkit (MDT) deployment share. You create a task sequence, and then you run the MDT deployment wizard on Computer1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 309:

  You have a Microsoft 365 E5 subscription and 150 Windows 10 devices.

  All the devices are enrolled in Microsoft Intune.

  You need to use Intune to apply Windows updates to the devices.

  What should you do first?

  A. From the Microsoft Endpoint Manager admin center, configure scope tags.

  B. Create a device restriction policy that has telemetry set to the minimum setting of Required.

  C. From the Microsoft Endpoint Manager admin center, configure a security baseline.

  D. Create a device restriction policy that has telemetry set to Security (Enterprise Only).

  Correct Answer: A

• Question 310:

  You have 25 computers that run Windows 8.1 Pro.

  You have a Microsoft 365 E5 subscription that uses Microsoft Intune.

  You need to upgrade the computers to Windows 10 Enterprise by using an in-place upgrade. The solution must minimize administrative effort.

  What should you use?

  A. Microsoft Endpoint Configuration Manager and a custom image of Windows 10 Enterprise

  B. Subscription Activation

  C. Microsoft Deployment Toolkit (MDT) and a default image of Windows 10 Enterprise

  D. Windows Autopilot

  Correct Answer: B

  https://docs.microsoft.com/en-us/windows/deployment/windows-10-subscription-activation