Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 381:

  Your company's environment includes the following

  1.

  Microsoft Azure Active Directory (Azure AD)

  2.

  Microsoft 365

  3.

  Microsoft Intune

  4.

  Azure Information Protection.

  A new security policy declares that enrollment for private devices in Intune is not required. However, to access corporate email information, users have to make use of a PIN for authentication purposes. Also, users are able to access

  corporate cloud services from their private iOS and Android devices. Furthermore, the copying corporate email information to a cloud storage service should not be allowed, unless users are copying the information to Microsoft OneDrive for

  Business.

  You have to make sure that security policy is enforced.

  Which of the following actions should you take?

  A. You should create a data loss prevention (DLP) policy.

  B. You should create a device enrollment policy.

  C. You should create an app protection policy.

  D. You should create a Windows AutoPilot deployment profile.

  Correct Answer: C

  App protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app. A managed app is an app that has app protection policies applied to it, and can be managed by Intune.

  Reference: https://docs.microsoft.com/en-us/intune/app-protection-policy

• Question 382:

  Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune. You are creating a device configuration profile for the workstations. You have been informed that a custom image should be displayed as the Desktop background picture. Which of the following is a Device restriction setting that should be configured?

  A. Locked screen experience

  B. Personalization

  C. Display

  D. General

  Correct Answer: B

  Wallpaper image, or Desktop background picture, URL is set under Personalization.

  References: https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10

• Question 383:

  Your company has a large number of Windows 10 workstations that are managed via Microsoft Intune.

  Delivery Optimization is not being used for Windows updates at present.

  You want to make sure that Delivery Optimization is configured for all of the workstations.

  Which of the following actions should you take?

  A. You should create a device configuration profile via Intune.

  B. You should create a device compliance policy via Intune.

  C. You should create a Windows AutoPilot deployment profile via Intune.

  D. You should create a conditional access policy via Intune.

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/intune/delivery-optimization-windows

• Question 384:

  Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune.

  You are creating a device configuration profile for the workstations. You have been informed that a custom image should be displayed on the sign-in screen.

  Which of the following is a Device restriction setting that should be configured?

  A. Locked screen experience

  B. Personalization

  C. Display

  D. General

  Correct Answer: B

  Wallpaper image, or Desktop background picture,URL isset under Personalization.

  References: https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10

• Question 385:

  All users at your company have Azure AD joined Windows 10 workstations that are managed via Microsoft Intune.

  You have been tasked with making sure that Windows Analytics is used to monitor the workstations centrally.

  Which of the following actions should you take?

  A. You should create a device configuration profile via Intune.

  B. You should create a device compliance policy via Intune.

  C. You should create a Windows AutoPilot deployment profile via Intune.

  D. You should create an app configuration policy via Intune.

  Correct Answer: A

  With Intune, use Delivery Optimization settings for your Windows devices to reduce bandwidth consumption when those devices download applications and updates. Configure Delivery Optimization as part of your device configuration profiles.

  

  Reference: https://www.scconfigmgr.com/2019/03/27/windows-analytics-onboarding-with-intune/

• Question 386:

  You manage a large number of Windows 10 computers.

  You have been tasked with creating a provisioning package that will allow you to remove the Microsoft News and the Xbox Microsoft Store apps, as well as add a VPN connection to the company network.

  Which of the following are the customization settings you should configure?

  A. Connections and Personalization

  B. ConnectivityProfiles and Policies

  C. Connections and Policies

  D. ConnectivityProfiles and Personalization

  Correct Answer: B

  The Policy configuration service provider enables the enterprise to configure policies on Windows 10 ConnectivityProfiles is uses to configure profiles that a user will connect with, such as an email account or VPN profile.

  Reference: https://docs.microsoft.com/en-us/windows/configuration/wcd/wcd-connectivityprofiles https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions https://docs.microsoft.com/en-us/windows/configuration/wcd/wcd-policies

• Question 387:

  Your company plans to deploy tablets to 50 meeting rooms.

  The tablets run Windows 10 and are managed by using Microsoft Intune. The tablets have an application named App1.

  You need to configure the tablets so that any user can use App1 without having to sign in. Users must be prevented from using other applications on the tablets.

  Which device configuration profile type should you use?

  A. Kiosk

  B. Endpoint protection

  C. Identity protection

  D. Device restrictions

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/windows/configuration/kiosk-single-app

• Question 388:

  All of your company's devices are managed via Microsoft Intune.

  conditional access is used to prevent devices that are not compliant with company security policies, from accessing Microsoft 365 services.

  You need to access Device compliance to view the non-compliant devices.

  Where should you access Device compliance from?

  A. System Center Configuration Manager

  B. Windows Defender Security Center.

  C. The Intune admin center.

  D. The Azure Active Directory admin center.

  Correct Answer: C

  Open the Intune Device compliance dashboard:

  1.

  Sign in to the Microsoft Endpoint Manager admin center.

  2.

  Select Devices > Overview > Compliance status tab. Important: Devices must be enrolled into Intune to receive device compliance policies. Note 1: Intune Admin portal URL, Microsoft Endpoint Manager admin center: https://endpoint.microsoft.com Microsoft Intune, which is a part of Microsoft Endpoint Manager, provides the cloud infrastructure, the cloud-based mobile device management (MDM), cloud- based mobile application management (MAM), and cloud-based PC management for your organization. Note 2: Compliance reports help you review device compliance and troubleshoot compliance-related issues in your organization. Using these reports, you can view information on: The overall compliance states of devices The compliance status for an individual setting The compliance status for an individual policy Drill down into individual devices to view specific settings and policies that affect the device

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor https://docs.microsoft.com/en-us/mem/intune/fundamentals/account-sign-up

• Question 389:

  Your company has a Microsoft 365 subscription.

  You have enrolled all the company computers in Microsoft Intune.

  You have been tasked with making sure that devices with a high Windows Defender Advanced Threat Protection (Windows Defender ATP) risk score are locked.

  Which of the following actions should you take?

  A. You should create a device configuration profile.

  B. You should create a device compliance policy.

  C. You should create a Windows AutoPilot deployment profile.

  D. You should create a conditional access policy.

  Correct Answer: B

  References: https://github.com/MicrosoftDocs/IntuneDocs/blob/master/intune/advanced-threat-protection.md

• Question 390:

  You have been tasked with creating a device configuration profile in Microsoft Intune to apply an ADMX-backed policy.

  You need to identify the profile type needed for your purposes.

  Which of the following is the necessary profile type?

  A. Delivery optimization

  B. Custom

  C. Certificates

  D. Administrative templates

  Correct Answer: B

  References: https://blogs.technet.microsoft.com/senthilkumar/2018/05/21/intune-deploying-admx-backed-policies-using-microsoft-intune/