Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 321:

  Your on-premises network contains a database server and is accessible by using a VPN server.

  You have a Microsoft 365 tenant.

  You manage devices by using Microsoft Endpoint Manager.

  You have an application named App1 that is deployed to every computer enrolled in Microsoft Intune. Each computer has a VPN profile assigned.

  You need to ensure that App1 can access only the database server. App1 must be prevented from accessing other resources on the on-premises network.

  What should you modify in the VPN profile?

  A. Proxy

  B. Network traffic rules

  C. DNS Settings

  D. Conditional Access

  Correct Answer: B

  You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network

  traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

  A network security group contains zero, or as many rules as desired, within Azure subscription limits.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

• Question 322:

  You need to enable Microsoft Defender Credential Guard on computers that run Windows 10.

  What should you install on the computers?

  A. Hyper-V

  B. Microsoft Defender Application Guard

  C. a guarded host

  D. containers

  Correct Answer: A

  Microsoft Defender Credential Guard software requirements.

  The Virtualization-based security requires:

  64-bit CPU

  CPU virtualization extensions plus extended page tables

  Windows hypervisor (does not require Hyper-V Windows Feature to be installed)

  Reference:

  https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements

• Question 323:

  You have an Azure Active Directory (Azure AD) tenant that contains the named locations shown in the following table.

  

  You need to create a Conditional Access policy that will have a condition to include only trusted locations. Which two named locations can be marked as trusted? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Location1

  B. Location2

  C. Location3

  D. Location4

  E. Location5

  Correct Answer: AC

  Trusted locations Administrators can name locations defined by IP address ranges to be trusted named locations

  A: An IPv4 named location can be marked as trusted.

  

  C: An IPv6 named location can be marked as trusted.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

• Question 324:

  You have a Microsoft 365 subscription that contains 100 devices enrolled in Microsoft Intune.

  You need to review the startup processes and how often each device restarts.

  What should you use?

  A. Endpoint analytics

  B. Intune Data Warehouse

  C. Azure Monitor

  D. Device Management

  Correct Answer: B

• Question 325:

  You use Microsoft Intune and Intune Data Warehouse.

  You need to create a device inventory report that includes the data stored in the data warehouse.

  What should you use to create the report?

  A. the Azure portal app

  B. Endpoint analytics

  C. the Company Portal app

  D. Microsoft Power BI

  Correct Answer: D

  You can use the Power BI Compliance app to load interactive, dynamically generated reports for your Intune tenant. Additionally, you can load your tenant data in Power BI using the OData link. Intune provides connection settings to your tenant so that you can view the following sample reports and charts related to:

  Devices

  Enrollment -

  App protection policy

  Compliance policy

  Device configuration profiles

  Software updates

  Device inventory logs Note: Load the data in Power BI using the OData link With a client authenticated to Azure AD, the OData URL connects to the RESTful endpoint in the Data Warehouse API that exposes the data model to your reporting client. Follow these instructions to use Power BI Desktop to connect and create your own reports.

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select Reports > Intune Data warehouse > Data warehouse.

  3.

  Retrieve the custom feed URL from the reporting blade, for example:

  4.

  https://fef.{yourtenant}.manage.microsoft.com/ReportingService/DataWarehouseFEService/dates?api-version=v1.0

  5.

  Open Power BI Desktop.

  6.

  Choose File > Get Data. Select OData feed.

  7.

  Choose Basic.

  8.

  Type or paste the OData URL into the URL box.

  9.

  Select OK.

  10.If you have not authenticated to Azure AD for your tenant from the Power BI desktop client, type your credentials. To gain access to your data, you must authorize with Azure Active Directory (Azure AD) using OAuth 2.0.

  11.Select Organizational account.

  12.Type your username and password.

  13.Select Sign In.

  14.Select Connect.

  15.Select Load.

  Reference: https://docs.microsoft.com/en-us/mem/intune/developer/reports-proc-get-a-link-powerbi

• Question 326:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has several Windows 10 devices that are enrolled in Microsoft Intune.

  You deploy a new computer named Computer1 that runs Windows 10 and is in a workgroup. You need to enroll Computer1 in Intune.

  Solution: From Computer1, you sign in to https://endpoint.microsoft.com and use the Windows enrollment blade.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Use MDM enrolment.

  MDM only enrollment lets users enroll an existing Workgroup, Active Directory, or Azure Active directory joined PC into Intune. Users enroll from Settings on the existing Windows PC.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods

• Question 327:

  You have a Microsoft 365 subscription.

  You have 10 computers that run Windows 10 and are enrolled in mobile device management (MDM).

  You need to deploy the Microsoft 365 Apps for enterprise suite to all the computers.

  What should you do?

  A. From the Endpoint Manager admin center, add an app.

  B. From Microsoft Azure Active Directory (Azure AD), add an app registration.

  C. From Microsoft Azure Active Directory (Azure AD), add an enterprise application.

  D. From the Endpoint Manager admin center, create a Windows 10 device profile.

  Correct Answer: A

  Before you can assign, monitor, configure, or protect apps, you must add them to Intune. Select Microsoft 365 Apps.

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select Apps > All apps > Add.

  3.

  Select Windows 10 in the Microsoft 365 Apps section of the Select app type pane.

  4.

  Click Select. The Add Microsoft 365 Apps steps are displayed.

  Reference: https://docs.microsoft.com/en-us/mem/intune/apps/apps-add-office365

• Question 328:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  In the Microsoft 365 Apps admin center, you create a Microsoft Office customization. Which users can download the Office customization file from the admin center?

  A. Admin1, Admin2, Admin3, and Admin4

  B. Admin1, Admin2, and Admin3 only

  C. Admin3 only

  D. Admin3 and Admin4 only

  E. Admin1 and Admin3 only

  Correct Answer: B

  *

  Admin1

  An application admin has full access to enterprise applications, applications registrations, and application proxy settings.

  *

  Admin2

  Mark your app as publisher verified.

  In Azure AD this user must be a member of one of the following roles: Application Admin, Cloud Application Admin, or Global Admin.

  *

  Admin3

  Office Apps admin - Assign the Office Apps admin role to users who need to do the following:

  -Use the Office cloud policy service to create and manage cloud-based policies for Office

  -Create and manage service requests

  -Manage the What's New content that users see in their Office apps

  -Monitor service health

  Reference:

  Office Apps admin - Assign the Office Apps admin role to users who need to do the following https://docs.microsoft.com/en-us/azure/active-directory/develop/mark-app-as-publisher-verified

• Question 329:

  You have a Microsoft 365 subscription that uses Microsoft Intune.

  You need to ensure that you can deploy apps to Android Enterprise devices.

  What should you do first?

  A. Add a certificate connector.

  B. Link your managed Google Play account to Intune.

  C. Configure the Partner device management settings

  D. Create a configuration profile.

  Correct Answer: B

  Connect your Intune account to your Managed Google Play account.

  Managed Google Play is Google's enterprise app store and sole source of applications for Android Enterprise in Intune. You can use Intune to orchestrate app deployment through Managed Google Play for any Android Enterprise scenario

  (including personally-owned work profile, dedicated, fully managed, and corporate- owned work profile enrollments).

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/apps/apps-add-android-for-work

  https://docs.microsoft.com/en-us/mem/intune/enrollment/connect-intune-android-enterprise

• Question 330:

  You have a Microsoft 365 subscription. The subscription contains 500 computers that run Windows 11 and are enrolled in Microsoft Endpoint Manager. You need to manage the deployment of monthly security updates. The solution must meet the following requirements:

  1.

  Updates must be deployed to a group of test computers for quality assurance.

  2.

  Updates must be deployed automatically 15 days after the quality assurance testing. What should you create in the Microsoft Endpoint Manager admin center?

  A. a security baseline

  B. a device configuration profile

  C. an update ring

  D. a feature update policy

  Correct Answer: C