Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 331:

  You have a Microsoft 365 E5 subscription.

  You need to download a report that lists all the devices that are NOT enrolled in Microsoft Intune and are assigned an app protection policy.

  What should you select in the Microsoft Endpoint Manager admin center?

  A. Apps, and then App protection policies

  B. Apps, and then Monitor

  C. Devices, and then Monitor

  D. Reports, and the Device compliance

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policies-monitor

• Question 332:

  You have a Microsoft 365 subscription.

  You need to deploy Microsoft 365 Apps for enterprise applications to Windows 10 devices.

  What should you do first?

  A. From Microsoft Azure Active Directory (Azure AD), create an app registration.

  B. From the Endpoint Manager admin center, create an app.

  C. From the Endpoint Manager admin center, create an app configuration policy.

  D. From the Endpoint Manager admin center, enable Microsoft Store for Business synchronization.

  Correct Answer: B

  Before you can assign, monitor, configure, or protect apps, you must add them to Intune. One of the available app types is Microsoft 365 apps for Windows 10 devices. By selecting this app type in Intune, you can assign and install Microsoft 365 apps to devices you manage that run Windows 10. Note: Review + create

  1.

  Review the values and settings you entered for the app suite.

  2.

  When you are done, click Create to add the app to Intune.

  3.

  The Overview blade is displayed.

  Reference: https://docs.microsoft.com/en-us/mem/intune/apps/apps-add-office365

• Question 333:

  Your company has devices enrolled in Microsoft Intune as shown in the following table.

  

  In Microsoft Endpoint Manager, you define the company's network as a location named Location1. Which devices can use network location-based compliance policies?

  A. Device2 and Device3 only

  B. Device2 only

  C. Device1 and Device2 only

  D. Device1 only

  E. Device1, Device2, and Device3

  Correct Answer: E

  Intune supported operating systems Intune supports devices running the following operating systems (OS): iOS

  Android

  Windows macOS Note: View the device compliance settings for the different device platforms:

  Android device administrator Android Enterprise iOS macOS Windows Holographic for Business

  Windows 8.1 and later

  Windows 10/11

  Reference: https://docs.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

• Question 334:

  You have a Microsoft 365 E5 subscription that contains 500 macOS devices enrolled in Microsoft Intune.

  You need to ensure that you can apply Microsoft Defender for Endpoint antivirus policies to the macOS devices. The solution must minimize administrative effort.

  What should you do?

  A. From the Microsoft Endpoint Manager admin center, create a configuration profile.

  B. From the Microsoft Endpoint Manager admin center, create a security baseline

  C. Onboard the macOS devices to the Microsoft 365 compliance center.

  D. Install Defender for Endpoint on the macOS devices

  Correct Answer: D

  Just install, and use Defender for Endpoint on Mac.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac

• Question 335:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a workgroup computer named Computer1 that runs Windows 10.

  You need to add Computer1 to contoso.com.

  What should you use?

  A. the Settings app

  B. Computer Management

  C. netdom.exe

  D. dsregcmd.exe

  Correct Answer: D

  If you want to manually join the computer to Azure AD, you can execute the dsregcmd /join command. This command should be run in SYSTEM context (using psexec for example) and will force an attempt to Azure AD.

  Reference: https://365bythijs.be/2019/11/02/troubleshooting-hybrid-azure-ad-join/

• Question 336:

  You have a Microsoft 365 E5 subscription that contains 10 Android Enterprise devices. Each device has a corporate-owned work profile and is enrolled in Microsoft Intune.

  You need to configure the devices to run a single app in kiosk mode.

  Which Configuration settings should you modify in the device restrictions profile?

  A. General

  B. Users and Accounts

  C. System security

  D. Device experience

  Correct Answer: D

  Device experience Use these settings to configure a kiosk-style experience on your dedicated devices, or to customize the home screen experiences on your fully managed devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available. Device experience, Enrollment profile type: Select an enrollment profile type to start configuring Microsoft Launcher or the Microsoft Managed Home Screen on your devices. Your options:

  *

  Dedicated device, Kiosk mode, Single App

  *

  etc.

  Reference: https://docs.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android-for-work

• Question 337:

  You use the Microsoft Deployment Toolkit (MDT) to manage Windows 10 deployments. From Deployment Workbench, you modify the WinPE settings and add PowerShell support.

  You need to generate a new set of WinPE boot image files that contain the updated settings.

  What should you do?

  A. From the Operating Systems node, import a new operating system.

  B. From the Deployment Shares node, update the deployment share.

  C. From the Packages node, import a new operating system package.

  D. From the Advanced Configuration node, create new media.

  Correct Answer: B

  Distribute content to the CM01 (for example) distribution portal.

  In Configuration Manager, you can distribute all packages needed by a task sequence in a single task. In this section, you distribute packages that have not yet been distributed to the CM01 distribution point.

  On CM01:

  1.

  Open the Deployment Workbench, right-click Deployment Shares and click New Deployment Share. Use the following settings for the New Deployment Share Wizard:

  Deployment share path: D:\MDTProduction

  Share name: MDTProduction$

  Deployment share description: MDT Production

  Options:

  2.

  Etc.

  Reference: https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager

• Question 338:

  You have a Microsoft 365 E5 subscription that contains 100 iOS devices enrolled in Microsoft Intune.

  You need to deploy a custom line-of-business (LOB) app to the devices by using Intune.

  Which extension should you select for the app package file?

  A. intunemac

  B. apk

  C. ipa

  D. appx

  Correct Answer: C

  iOS/iPadOS LOB apps: Select Line-of-business app as the app type, select the App package file, and then enter an iOS/iPadOS installation file with the extension .ipa. Reference:https://docs.microsoft.com/en-us/mem/intune/apps/lob-apps-ios

• Question 339:

  You have a Microsoft 365 E5 subscription and 25 Apple iPads.

  You need to enroll the iPads in Microsoft Intune by using the Apple Configurator enrollment method.

  What should you do first?

  A. Upload a file that has the device identifiers for each iPad.

  B. Modify the enrollment restrictions.

  C. Configure an Apple MDM push certificate.

  D. Add your user account as a device enrollment manager (DEM).

  Correct Answer: C

  An Apple MDM Push certificate is required for Intune to manage iOS/iPadOS and macOS devices. After you add the certificate to Intune, your users can enroll their devices.

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/apple-mdm-push-certificate-get

• Question 340:

  You are currently making use of the Antimalware Assessment solution in Microsoft Azure Log Analytics. You have accessed the Protection Status dashboard and find that there is a device that is not reporting. Which of the following could be a reason for this occurring?

  A. Windows Defender System Guard is incorrectly configured.

  B. You need to install the Azure Diagnostic extension.

  C. Windows Defender Application Guard is incorrectly configured.

  D. The Microsoft Malicious Software Removal tool is installed.

  Correct Answer: B

  Azure Diagnostics extension is an agent in Azure Monitor that collects monitoring data from the guest operating system of Azure compute resources including virtual machines.

  Note: As the Azure Diagnostic extension can only be used for Virtual Machines a better answer would be that the Microsoft Monitoring Agent (MMA) is missing.

  Incorrect:

  Not A: Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in

  Windows security. It's designed to make these security guarantees:

  Protect and maintain the integrity of the system as it starts up

  Validate that system integrity has truly been maintained through local and remote attestation

  Not C: For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the

  Internet. As an enterprise administrator, you define what is among trusted web sites, cloud resources, and internal networks. Everything not on your list is considered untrusted. If an employee goes to an untrusted site through either Microsoft

  Edge or Internet Explorer, Microsoft Edge opens the site in an isolated

  Hyper-V-enabled container.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-monitor/agents/diagnostics-extension-overview https://docs.microsoft.com/en-us/azure/azure-monitor/visualize/tutorial-logs-dashboards