Microsoft Microsoft Certifications MD-101 Questions & Answers

• Question 71:

  HOTSPOT

  You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

  You need to set a custom image as the wallpaper and sign-in screen.

  Which two settings should you configure in Device restrictions? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Sign-in screen, or Locked screen, image is set under Locked screen experience Wallpaper image, or Desktop background picture, URL is set under Personalization.

  Reference: https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10

• Question 72:

  HOTSPOT

  You upgrade three computers from Windows 8.1 to Windows 10 as shown in the following table.

  

  The in-place upgrade settings used to perform the upgrade are shown in the following table.

  

  After the upgrade, you perform the following actions on each computer:

  1.

  Add a local user account named LocalAdmin1.

  2.

  Install Microsoft Office 2019.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No More than 10 days.

  Please take note!

  The question state that "The in-place upgrade settings used to perform the upgrade are shown in the following table."

  On Computer 2 the setting is None - i.e. Nothing: Everything will be deleted, including files, app and Settings. This is equal to a clean install...

  The Windows.old folder will always be created during a upgrade install, even if you choose the "Nothing" option. "If you choose to “Keep nothing” when you upgrade to Windows 8.1, or if you reset, refresh, or reinstall Windows, your personal

  files are temporarily saved to the Windows.old" with a 10 day limit to do so....

  https://support.microsoft.com/en-us/windows/retrieve-files-from-the-windows-old-folder-f668ada4-701b-204a-73c3-952bc5ceb1c8

  https://answers.microsoft.com/en-us/windows/forum/all/how-to-recover-restore-your-previous-version-of/94368560-9c64-4387-92b9-82a9234216ad

  Reference:

  https://support.microsoft.com/en-us/windows/go-back-to-windows-8-1-40e2d7dc-f640-b0e5-56e1-b41a27e28533

• Question 73:

  HOTSPOT

  Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains Windows 10 devices that are managed by using Microsoft Endpoint Configuration Manager.

  You plan to deploy Microsoft 365 Apps for enterprise to the devices by using Configuration Manager.

  You create a Configuration.xml file as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/deployoffice/overview-update-channels

• Question 74:

  HOTSPOT

  Your network contains an Active Directory domain. Active Directory is synced with Microsoft Azure Active Directory (Azure AD).

  There are 500 Active Directory domain-joined computers that run Windows 10 and are enrolled in Microsoft Intune.

  You plan to implement Microsoft Defender Exploit Guard.

  You need to create a custom Microsoft Defender Exploit Guard policy, and then distribute the policy to all the computers.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#manage-or-deploy-a-configuration https://docs.microsoft.com/en-us/intune/endpoint-protection-windows-10 https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection

• Question 75:

  HOTSPOT

  You have 100 Windows 10 devices that are managed by using Microsoft Endpoint Manager.

  You plan to sideload an app to the devices.

  You need to configure Microsoft Endpoint Manager to enable sideloading.

  Which device profile type and setting should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Device restrictions In a Windows 10/11 device restrictions profile, most configurable settings are deployed at the device level using device groups. Policies deployed to user groups apply to targeted users. The policies also apply to users who have an Intune license, and users that sign in to that device.

  Box 2: Trusted app installation Trusted app installation: Choose if non-Microsoft Store apps can be installed, also known as sideloading. Sideloading is installing, and then running or testing an app that isn't certified by the Microsoft Store. For example, an app that is internal to your company only.

  Reference: https://docs.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10

• Question 76:

  HOTSPOT

  Your company has 1,000 Windows 10 devices that are enrolled in Windows Analytics.

  You need to view the following information:

  1.

  The number of devices that are vulnerable to Spectre and Meltdown vulnerabilities

  2.

  The number of devices that have Windows Defender real-time protection turned off

  Which Windows Analytics solutions should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Device Health Driver health -

  App health (outside of a deployment plan) Frequently crashing devices or driver-induced crashes Windows sign-in health Windows Information Protection Support for Windows Server Box 2: Device Health

  Incorrect:

  * Update Compliance

  Support for Windows Update for Business Delivery Optimization insights Support for Windows 10 long-term servicing channel (LTSC)

  Windows Insider reports Windows Defender status

  * Upgrade Readiness Internet Explorer Site Discovery data Microsoft 365 Apps add-in insights (now available in Configuration Manager)

  Feedback Hub insights

  Reference: https://docs.microsoft.com/en-us/mem/configmgr/desktop-analytics/faq

• Question 77:

  HOTSPOT

  In Microsoft Intune, you have the device compliance policies shown in the following table.

  

  The Intune compliance policy settings are configured as shown in the following exhibit.

  

  On June 1, you enroll Windows 10 devices in Intune as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No Policy1 requires encryption, but on June 4 Device1 is configured with No Drive Encryption, so it is not compliant.

  Box 2: No Policy1 requires encryption, but on June 6 Device1 is configured with No Drive Encryption, so it is not compliant.

  Box 3: Yes Both Policy2 and Policy3 applies to Device2. Policy3, which is the most restrictive applies, which result in Mark device as not compliant = 10 days.

  Note: If you have deployed multiple compliance policies, Intune uses the most restrictive of these policies.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance https://docs.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor#how-intune-resolves-policy-conflicts

• Question 78:

  HOTSPOT

  You have a Microsoft 365 subscription.

  You plan to enroll devices in Microsoft Endpoint Manager that have the platforms and versions shown in the following table.

  

  You need to configure device enrollment to meet the following requirements:

  1.

  Ensure that only devices that have approved platforms and versions can enroll in Endpoint Manager.

  2.

  Ensure that devices are added to Microsoft Azure Active Directory (Azure AD) groups based on a selection made by users during the enrollment.

  Which device enrollment setting should you configure for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Enrollment restrictions As an Intune administrator, you can create and manage enrollment restrictions that define what devices can enroll into management with Intune, including the:

  1.

  Number of devices.

  2.

  Operating systems and versions.

  Box 2: Device categories To make managing devices easier, you can use Microsoft Intune device categories to automatically add devices to groups based on categories that you define.

  Device categories use the following workflow:

  1.

  Create categories that users can choose from when they enroll their device.

  2.

  When users of iOS/iPadOS and Android devices enroll a device, they must choose a category from the list of categories you configured. To assign a category to a Windows device, users must use the Company Portal website.

  3.

  You can then deploy policies and apps to these groups.

  4.

  You can create any device categories you want. For example:

  -Point-of-sale device

  -Demonstration device

  -Sales

  -Accounting

  -Manager

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set https://docs.microsoft.com/en-us/mem/intune/enrollment/device-group-mapping

• Question 79:

  HOTSPOT

  You use Microsoft Endpoint Manager to manage Windows 10 devices.

  You are designing a reporting solution that will provide reports on the following:

  1.

  Compliance policy trends

  2.

  Trends in device and user enrolment

  3.

  App and operating system version breakdowns of mobile devices

  You need to recommend a data source and a data visualization tool for the design.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: The Microsoft Intune Data Warehouse Use the Intune Data Warehouse to build reports that provide insight into your enterprise mobile environment. For example, some of the reports include: Trend of users enrolling in Intune so you can optimize your license purchases App and OS versions breakdown so you can review that status of mobile devices Enrollment and device compliance trends so you can smoothly roll out policy updates.

  Box 2: Microsoft Power BI You can use the Power BI Compliance app to load interactive, dynamically generated reports for your Intune tenant. Additionally, you can load your tenant data in Power BI using the OData link. Intune provides connection settings to your tenant so that you can view the following sample reports and charts related to:

  Devices

  Enrollment -

  App protection policy

  Compliance policy

  Device configuration profiles Software updates

  Device inventory logs

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/developer/reports-nav-create-intune-reports https://docs.microsoft.com/en-us/mem/intune/developer/reports-proc-get-a-link-powerbi

• Question 80:

  HOTSPOT

  Your company uses Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP). Microsoft Defender ATP includes the machine groups shown in the following table.

  

  You onboard a computer to Microsoft Defender ATP as shown in the following exhibit.

  

  What is the effect of the Microsoft Defender ATP configuration? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: