Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 41:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Intune.

  You need to ensure that users can only enroll devices that meet the following requirements:

  1.

  Android devices that support the use of work profiles.

  2.

  iOS devices that run iOS 11.0 or later.

  

  Which two restrictions should you modify? To answer, select the restrictions in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Android device administrator, Platform: Block Restrict devices running on the following platforms:

  Android device administrator

  Android Enterprise work profile iOS/iPadOS macOS

  Windows Note: If you allow both Android platforms for the same group, devices that support work profile will enroll with a work profile. Devices that don't support it will enroll on the Android device administrator platform. Neither work profile nor device administrator enrollment will work until you complete all prerequisites for Android enrollment. Box 2: iOS/PadOS, Allow min/max Range: Min

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set

• Question 42:

  HOTSPOT

  Your network contains an Active Directory domain. Active Directory is synced with Microsoft Azure Active Directory (Azure AD).

  There are 500 Active Directory domain-joined computers that run Windows 10 and are enrolled in Microsoft Intune.

  You plan to implement Microsoft Defender Exploit Guard.

  You need to create a custom Microsoft Defender Exploit Guard policy, and then distribute the policy to all the computers.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exploit-protection

• Question 43:

  HOTSPOT

  You have the on-premises servers shown in the following table.

  

  You have a Microsoft 365 E5 subscription that contains Android and iOS devices. All the devices are managed by using Microsoft Intune.

  You need to implement Microsoft Tunnel for Intune. The solution must minimize the number of open firewall ports.

  To which server can you deploy a Tunnel Gateway server, and which inbound ports should be allowed on the server to support Microsoft Tunnel connections?

  To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Server4

  Microsoft Tunnel is a VPN gateway solution for Microsoft Intune that runs in a container on Linux and allows access to on-premises resources from iOS/iPadOS and Android Enterprise devices using modern authentication and Conditional

  Access.

  Box 2: TCP 443 and UDP 443 only

  Some traffic goes to your public facing IP address for the Tunnel. The VPN channel will use TCP, TLS, UDP, and DTLS over port 443.

  By default, port 443 is used for both TCP and UDP, but this can be customized via the Intune Server Configuration " Server port setting. If changing the default port (443) ensure your inbound firewall rules are adjusted to the custom port.

  Incorrect:

  TCP 1723 is not used.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/protect/microsoft-tunnel-overview

• Question 44:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  MFA has a trusted IP address range of 123.30.20.0/24.

  You have the Azure AD named locations shown in the following table.

  

  You create a Conditional Access policy that has the following settings:

  Name: CAPolicy1 Assignments Users or workload identities Include: Group1 Cloud apps or actions: App1 Conditions Locations Include: All trusted locations Access controls Grant access Require multi-factor authentication

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  Location2 is not trusted.

  Box 2: No

  Location1 is trusted.

  Box 3:No

  MFA IP range is also trusted.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

• Question 45:

  HOTSPOT

  You have an Azure Active Directory Premium Plan 2 subscription that contains the users shown in the following table.

  

  You purchase the devices shown in the following table.

  

  You configure automatic mobile device management (MDM) and mobile application management (MAM) enrollment by using the following settings:

  1.

  MDM user scope: Group1

  2.

  MAM user scope: Group2

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/enrollment/android-enroll https://powerautomate.microsoft.com/fr-fr/blog/mam-flow-mobile/

• Question 46:

  HOTSPOT

  You have a server named Server1 and computers that run Windows 8.1. Server1 has the Microsoft Deployment Toolkit (MDT) installed.

  You plan to upgrade the Windows 8.1 computers to Windows 10 by using the MDT deployment wizard.

  You need to create a deployment share on Server1.

  What should you do on Server1, and what are the minimum components you should add to the MDT deployment share?

  To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Install the Windows Deployment Services role.

  Install and initialize Windows Deployment Services (WDS)

  On the server:

  Open an elevated Windows PowerShell prompt and enter the following command:

  Install-WindowsFeature -Name WDS -IncludeManagementTools

  WDSUTIL /Verbose /Progress /Initialize-Server /Server:MDT01 /RemInst:"D:\RemoteInstall"

  WDSUTIL /Set-Server /AnswerClients:All

  Incorrect:

  * Install the Windows Assessment and Deployment Kit (Windows ADK) MDT installation required the ADK, but MDT is already installed.

  Box 2: Windows 10 image and task sequence only

  Create the reference image task sequence

  In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence.

  Reference:

  https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image

• Question 47:

  HOTSPOT

  You manage a Microsoft Deployment Toolkit (MDT) deployment share named DS1.

  DS1 contains an Out-of-Box Drivers folder named Windows 10 x64 that has subfolders in the format of {make name}\{model name}.

  You need to modify a deployment task sequence to ensure that all the drivers in the folder that match the make and model of the computers are installed without using PnP detection or selection profiles.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Preinstall

  PREINSTALL Completes any tasks that need to be done (such as creating new partitions) before the target operating system is deployed.

  Incorrect:

  *

  INSTALL

  Installs the target operating system on the target computer.

  *

  VALIDATION

  Identifies that the target computer is capable of running the scripts necessary to complete the deployment process.

  Box 2: Inject Drivers

  Inject Drivers This task sequence step injects drivers that have been configured for deployment to the target computer.

  The unique properties and settings for the Inject Drivers task sequence step type are:

  *

  Property: TypeSet this read-only type to Inject Drivers.

  *

  Settings Install only matching drivers: Injects only the drivers that the target computer requires and that match what is available in Out-of-Box Drivers Install all drivers: Installs all drivers Selection profile: Installs all drivers in the selected profile

  Reference: https://docs.microsoft.com/en-us/mem/configmgr/mdt/toolkit-reference

• Question 48:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices enrolled in Microsoft Intune.

  You need to create Endpoint security policies to meet the following requirements:

  1.

  Hide the Firewall and network protection area in the Windows Security app.

  2.

  Disable the provisioning of Windows Hello for Business on the devices.

  Which two policy types should you use? To answer, select the policies in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  In the Antivirus policy settings, you can hide the Firewall and network protection area in the Windows Security app.

  Windows Hello for Business settings are configured in Identity protection.

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/antivirus-security-experience-windows-settings https://docs.microsoft.com/en-us/mem/intune/protect/identity-protection-windows-settings

• Question 49:

  HOTSPOT

  You have 100 Windows 10 devices enrolled in Microsoft Intune.

  You need to configure the devices to retrieve Windows updates from the internet and from other computers on a local network.

  Which Delivery Optimization setting should you configure, and which type of Intune object should you create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Download mode

  Download mode specifies the download method that Delivery Optimization uses to download content.

  Box 2: A configuration profile

  Delivery Optimization settings are configured as part of the device configuration profile.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/configuration/delivery-optimization-settings

  https://docs.microsoft.com/en-us/mem/intune/configuration/delivery-optimization-windows

• Question 50:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  You have devices enrolled in Microsoft Intune as shown in the following table.

  

  From Intune, you create and send a custom notification named Notification1 to Group1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No Windows 10 devices cannot receive notifications.

  Custom notifications can be visible on lock screens on both iOS/iPadOS and Android devices depending on device settings

  Box 2: No User2 is in the wrong group. Only Group1 receives notifications.

  Note: Sending a notification to a group will target only the users of that group; the notification will go to all iOS/iPadOS and Android devices enrolled by that user.

  Box 3: Yes User1 is in the right group and Device3 has the right OS.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/remote-actions/custom-notifications