Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 371:

  You manage one hundred Microsoft Azure Active Directory (Azure AD) joined Windows 10 devices.

  You want to make sure that users are unable to join their home PC's to Azure AD.

  Which of the following actions should you take?

  A. You should configure the Enrollment restriction settings via the Device enrollment blade in the Intune admin center.

  B. You should configure the Enrollment restriction settings via the Security and Compliance admin center.

  C. You should configure the Enrollment restriction settings via the Azure Active Directory admin center.

  D. You should configure the Enrollment restriction settings via the Windows Defender Security Center.

  Correct Answer: C

  Azure Active Directory (Azure AD) provides a central place to manage device identities and monitor related event information. Configure device settings.

  

  * Users may join devices to Azure AD: This setting enables you to select the users who can register their devices as Azure AD joined devices. The default is All.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

• Question 372:

  You are currently making use of the Antimalware Assessment solution in Microsoft Azure Log Analytics.

  You have accessed the Protection Status dashboard and find that there is a device that is not reporting.

  Which of the following could be a reason for this occurring?

  A. Windows Defender System Guard is incorrectly configured.

  B. You need to install the Azure Diagnostic extension.

  C. Windows Defender Application Guard is incorrectly configured.

  D. The Microsoft Malicious Software Removal tool is installed.

  Correct Answer: C

  References: https://docs.microsoft.com/ga-ie/azure/security-center/security-center-install-endpoint-protection

• Question 373:

  You need to consider the underlined segment to establish whether it is accurate.

  To enable Windows Defender Credential Guard on Windows 10 computers, the computers must have Hyper-V installed.

  Select “No adjustment required” if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  What should you install on the computers?

  A. No adjustment required.

  B. Windows Defender Smartscreen

  C. a virtual machine

  D. a container cluster

  Correct Answer: A

  Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. When Credential Guard is deployed on a VM, secrets are protected from attacks inside the VM. Credential Guard does not provide

  additional protection from privileged system attacks originating from the host.

  Note: Hardware and software requirements

  To provide basic protections against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Windows

  Defender Credential Guard uses:

  Support for Virtualization-based security (required)

  Secure boot (required)

  Trusted Platform Module (TPM, preferred - provides binding to hardware) versions 1.2 and 2.0 are supported, either discrete or firmware

  UEFI lock (preferred - prevents attacker from disabling with a simple registry key change)

  The Virtualization-based security requires:

  64-bit CPU

  CPU virtualization extensions plus extended page tables

  Windows hypervisor (does not require Hyper-V Windows Feature to be installed)

  Reference:

  https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements

• Question 374:

  You are currently making use of the Antimalware Assessment solution in Microsoft Azure Log Analytics.

  You have accessed the Protection Status dashboard and find that there is a device that has no real time protection.

  Which of the following could be a reason for this occurring?

  A. Windows Defender has been disabled.

  B. You need to install the Azure Diagnostic extension.

  C. Windows Defender Credential Guard is incorrectly configured.

  D. Windows Defender System Guard is incorrectly configured.

  Correct Answer: A

  Microsoft Defender Antivirus is usually the primary antivirus/antimalware product on your device. To review protection status

  1. On the Antimalware dashboard, you will review the Protection Status blade and click no real time protection.

  

  2. Search shows a list of servers without protection.

  

  3. At this point you now know what servers do not have realtime protection.

  Computers that do not have System Center Endpoint Protection installed (or if SCEP is not detected) will be reported as no real time protection.

  Reference: https://docs.microsoft.com/ga-ie/azure/security-center/security-center-install-endpoint-protection

• Question 375:

  Your company's Microsoft Azure Active Directory (Azure AD) tenant includes Microsoft Intune, for which all users are licensed.

  You have been tasked with making sure that users enroll their iOS device in Intune.

  Which of the following actions should you take? (Choose all that apply.)

  A. Obtain a Device Enrollment Program (DEP) token from Apple.

  B. Make use of Google Zero Touch.

  C. Create Device enrollment manager (DEM) account.

  D. Make use a QR code.

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/intune/device-enrollment-program-enroll-ios

• Question 376:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune.

  You have been tasked with making sure that the workstations are only able to run applications that you have explicitly permitted.

  Solution: You make use of Windows Defender Application Guard.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Instead use Windows Defender Application Control (WDAC).

  Windows Defender Application Control and virtualization-based protection of code integrity.

  Using WDAC to restrict devices to only authorized apps has these advantages over other solutions:

  1.

  WDAC lets you set application control policy for code that runs in user mode, kernel mode hardware and software drivers, and even code that runs as part of Windows.

  2.

  WDAC policy is enforced by the Windows kernel itself, and the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.

  3.

  Etc.

  Note: Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet. As an enterprise administrator, you define what is among trusted web sites, cloud resources, and

  internal networks. Everything not on your list is considered untrusted. If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, Microsoft Edge opens the site in an isolated Hyper-V-enabled container.

  For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources.

  Reference:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control

• Question 377:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune.

  You have been tasked with making sure that the workstations are only able to run applications that you have explicitly permitted.

  Solution: You make use of Windows Defender SmartScreen.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use Windows Defender Application Control (WDAC).

  Windows Defender Application Control and virtualization-based protection of code integrity.

  Using WDAC to restrict devices to only authorized apps has these advantages over other solutions:

  1.

  WDAC lets you set application control policy for code that runs in user mode, kernel mode hardware and software drivers, and even code that runs as part of Windows.

  2.

  WDAC policy is enforced by the Windows kernel itself, and the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.

  3.

  Etc.

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control

• Question 378:

  You have configured the use of Windows Defender Advanced Threat Protection (Windows Defender ATP) to protect your company's Windows 10 devices. You have been tasked with checking how the configuration of Windows Defender ATP compares to the Microsoft-recommended configuration baseline. Which of the following should you use to achieve your goal?

  A. Windows Defender Security Center

  B. Device Health

  C. Device compliance

  D. Microsoft Secure Score

  Correct Answer: D

  References: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score

• Question 379:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune.

  You have been tasked with making sure that the workstations are only able to run applications that you have explicitly permitted.

  Solution: You make use of Windows Defender Antivirus.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use Windows Defender Application Control (WDAC).

  Windows Defender Application Control and virtualization-based protection of code integrity.

  Using WDAC to restrict devices to only authorized apps has these advantages over other solutions:

  1.

  WDAC lets you set application control policy for code that runs in user mode, kernel mode hardware and software drivers, and even code that runs as part of Windows.

  2.

  WDAC policy is enforced by the Windows kernel itself, and the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.

  3.

  Etc.

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control

• Question 380:

  Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune.

  You are preparing to redirect Windows known folders to Microsoft OneDrive for Business. You need to identify which folders will be included in the process.

  Which of the following are folders that will be included? (Choose all that apply.)

  A. Camera Roll

  B. Saved Games

  C. Desktop

  D. Music

  E. Screenshots

  Correct Answer: ACE

  References: https://docs.microsoft.com/en-us/onedrive/redirect-known-folders