Microsoft MD-102 Online Practice Questions and Exam Preparation

Microsoft MD-102 Online Questions & Answers

• Question 141:

  DRAG DROP

  You have a Microsoft 365 subscription that includes Microsoft Intune.

  You need to implement a Microsoft Defender for Endpoint solution that meets the following requirements:

  1. Enforces compliance for Defender for Endpoint by using Conditional Access

  2. Prevents suspicious scripts from running on devices

  What should you configure? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: An Intune connection

  Enforces compliance for Defender for Endpoint by using Conditional Access

  Configure Conditional Access in Microsoft Defender for Endpoint Take the following steps to enable

  Conditional Access:

  Step 1: Turn on the Microsoft Intune connection from Microsoft 365 Defender

  Step 2: Turn on the Defender for Endpoint integration in Intune

  Step 3: Create the compliance policy in Intune

  Step 4: Assign the policy

  Step 5: Create an Azure AD Conditional Access policy

  Box 2: An Attack surface reduction (ASR) policy rule Prevents suspicious scripts from running on devices

  Attack surface reduction policy for endpoint security in Intune

  When Defender antivirus is in use on your Windows 10/11 devices, you can use Intune endpoint security policies for Attack surface reduction to manage those settings for your devices.

  Attack surface reduction policies help reduce your attack surfaces, by minimizing the places where your organization is vulnerable to cyberthreats and attacks.

  In particular:

  Attack Surface Reduction Rules - Configure settings for attack surface reduction rules that target behaviors that malware and malicious apps typically use to infect computers, including:

  Executable files and scripts used in Office apps or web mail that attempt to download or run files

  Obfuscated or otherwise suspicious scripts

  Behaviors that apps don't usually start during normal day-to-day work Reducing your attack surface means offering attackers fewer ways to perform attacks.

  https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access

  https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-asr-policy

• Question 142:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.

  You create a user named User1.

  You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.

  Solution: From the Microsoft Entra admin center, you assign the Cloud Device Administrator role to User1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Correct:

  From the Microsoft Intune admin center, you assign the Endpoint Security Manager role to User1.

  From the Microsoft Intune admin center, you assign the Help Desk Operator role to User1.

  Incorrect:

  From the Microsoft Entra admin center, you assign the Cloud Device Administrator role to User1.

  From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1.

  Note: Role-based access controls to manage BitLocker

  To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes.

  You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right:

  Help Desk Operator

  Endpoint Security Administrator Reference:

  https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices

• Question 143:

  HOTSPOT

  You have a Microsoft 365 subscription that uses Microsoft Intune and contains the users shown in the following table.

  

  You create a policy set named Set1 as shown in the exhibit. (Click the Exhibit tab.)

  

  You enroll devices in Intune as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 144:

  You have a Microsoft 365 E5 subscription and use Microsoft Intune.

  You plan to implement a Microsoft Cloud PKI solution that will deploy personal user certificates to all Windows devices.

  What is the minimum number of configuration profiles required to support the solution?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

  ---

  Explanation

  To implement a Microsoft Cloud PKI solution and deploy personal user certificates to Windows devices, you typically need at least two configuration profiles:

  SCEP (Simple Certificate Enrollment Protocol) or PKCS Certificate Profile: This profile is required to issue and deploy the user certificates to devices.

  Trusted Certificate Profile: This profile is necessary to distribute the trusted root or intermediate certificate authority (CA) to ensure that the certificates issued by the CA are trusted by the devices.

• Question 145:

  HOTSPOT

  You need to meet the technical requirements for the new HR department computers.

  How should you configure the provisioning package? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 146:

  You manage 1,000 devices by using Microsoft Intune.

  You review the Device compliance trends report.

  For how long will the report display trend data?

  A. 30 days
  B. 60 days
  C. 90 days
  D. 365 days
  B. 60 days

  ---

  Explanation

  https://learn.microsoft.com/en-us/mem/intune/fundamentals/reports#device-compliance-trends-report-historical

• Question 147:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Intune.

  You have the Windows 11 devices shown in the following table.

  

  You deploy the device compliance policy shown in the exhibit. (Click the Exhibit tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 148:

  Your network contains an Active Directory domain. The domain contains a user named Admin1. All computers run Windows 10.

  You enable Windows PowerShell remoting on the computers.

  You need to ensure that Admin1 can establish remote PowerShell connections to the computers. The solution must use the principle of least privilege.

  To which group should you add Admin1?

  A. Access Control Assistance Operators
  B. Remote Desktop Users
  C. Power Users
  D. Remote Management Users
  D. Remote Management Users

  ---

  Explanation

  Remote Management Users Group provides the effective rights for PS remote/remote connection. Remote Desktop Users doesn't, would also require also having local Administrator permission, not least privilege having two roles where one defined role will do.

  https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_remote_requirements?view=powershell-7.3

  User permissions - To create remote sessions and run remote commands, by default, the current user must be a member of the Administrators group on the remote computer or provide the credentials of an administrator. Otherwise, the command fails.

• Question 149:

  HOTSPOT

  You have a Microsoft Entra tenant that contains the devices shown in the following table.

  

  Which devices can be Microsoft Entra joined, and which devices can be Microsoft Entra registered? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Device1 and Device2 only Azure Entra joined

  Review supported devices

  Hybrid Azure AD join supports a broad range of Windows devices. Because the configuration for devices running older versions of Windows requires other steps, the supported devices are grouped into two categories:

  1. Windows current devices

  2. Windows 11

  3. Windows 10

  4. Windows Server 2016

  5. Windows Server 2019 Box 2: Device, Device2, Device3, and Device4 Registered in contoso.com

  Azure Entra registered devices

  The goal of Azure AD registered - also known as Workplace joined - devices is to provide your users with support for bring your own device (BYOD) or mobile device scenarios. In these scenarios, a user can access your organization's resources using a personal device.

  Operating Systems: ++Windows 10 or newer, iOS, Android, macOS, Ubuntu 20.04/22.04 LTS iPAD OS uses iOS.

  https://learn.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan

  https://learn.microsoft.com/en-us/entra/identity/devices/concept-device-registration

• Question 150:

  You use Microsoft Defender for Endpoint to protect computers that run Windows 10.

  You need to assess the differences between the configuration of Microsoft Defender for Endpoint and the Microsoft-recommended configuration baseline.

  Which tool should you use?

  A. Microsoft Defender for Endpoint Power BI app
  B. Microsoft Secure Score
  C. Endpoint Analytics
  D. Microsoft 365 Defender portal
  B. Microsoft Secure Score