Microsoft MD-102 Online Practice Questions and Exam Preparation

Microsoft MD-102 Online Questions & Answers

• Question 191:

  You have a Microsoft 365 subscription that contains a user named User1 and uses Microsoft Intune Suite.

  You use Microsoft Intune to manage devices that run Windows 11.

  You need to remove User1 from the local Administrators group on all enrolled devices.

  What should you configure?

  A. a device compliance policy
  B. an account protection policy
  C. an app configuration policy
  B. an account protection policy

  ---

  Explanation

  Account protection policy for endpoint security in Intune

  Use Intune endpoint security policies for account protection to protect the identity and accounts of your users and manage the built-in group memberships on devices.

  Manage local groups on Windows devices

  Use the Local user group membership (preview) profile to manage the users that are members of the built-in local groups on devices that run Windows 10 20H2 and later, and Windows 11 devices.

  https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy

• Question 192:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  User1 is a Cloud device administrator.

  Local administrative privileges are required when enrolling an already configured Windows 10 device in Intune.

  Cloud Device Administrator

  Users in this role can enable, disable, and delete devices in Azure AD and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

  Note: The Windows 10 devices are joined to Azure AD and enrolled in Microsoft Intune.

  Box 2: Yes

  User2 is an Azure AD joined device local administrator.

  Azure AD Joined Device Local Administrator

  This role is available for assignment only as an additional local administrator in Device settings. Users with this role become local machine administrators on all Windows 10 devices that are joined to Azure Active Directory. They do not have the ability to manage devices objects in Azure Active Directory.

  Box 3: No

  User3 is a Global reader.

  Global Reader

  Users in this role can read settings and administrative information across Microsoft 365 services but can't take management actions.

  https://docs.microsoft.com/en-us/troubleshoot/mem/intune/no-permission-to-enroll-windows-devices

  https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 193:

  You plan to deploy Windows 11 Pro to 200 new computers by using the Microsoft Deployment Toolkit (MDT) and Windows Deployment Services (WDS).

  The company has a Volume Licensing Agreement and uses a product key to activate Windows 11.

  You need to ensure that the new computers will be configured to have the correct product key during the installation.

  What should you configure?

  A. an MDT task sequence
  B. the Device settings in Azure AD
  C. a WDS boot image
  D. a Windows Autopilot deployment profile
  A. an MDT task sequence

  ---

  Explanation

  Create the deployment task sequence.

  The task sequence used to deploy your production Windows 10 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server.

  This includes:

  Specify Product Key: Do not specify a product key at this time

  https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt#a-href-idsec08astep-8-deploy-the-windows-10-client-image

• Question 194:

  HOTSPOT

  You have a hybrid Azure AD tenant.

  You configure a Windows Autopilot deployment profile as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: import a CSV file into Windows Autopilot

  You can perform Windows Autopilot device registration within your organization by manually collecting the hardware identity of devices (hardware hashes) and uploading this information in a comma-separated-values (CSV) file.

  Box 2: joined to Azure AD only

  As per exhibit (Azure AD joined).

  https://docs.microsoft.com/en-us/mem/autopilot/add-devices

  https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid

• Question 195:

  What should you use to meet the technical requirements for Azure DevOps?

  A. An app protection policy
  B. Windows Information Protection (WIP)
  C. Conditional access
  D. A device configuration profile
  C. Conditional access

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-conditional-access?view=azure-devops

• Question 196:

  You have a Microsoft 365 subscription.

  You plan to enroll 25 new devices in Microsoft Intune.

  You need to configure an enrollment notification for the new devices.

  Which two types of notifications can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. SMS
  B. Microsoft Teams message
  C. phone call
  D. push
  E. email
  D. push
  E. email

  ---

  Explanation

  Set up enrollment notifications in Microsoft Intune to notify employees of newly enrolled devices. Enrollment notifications are sent to assigned users via your selected method: email or push notification.

  https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-notifications

• Question 197:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Intune.

  You need to ensure that users can only enroll devices that meet the following requirements:

  1. Android devices that support the use of work profiles.

  2. iOS devices that run iOS 11.0 or later.

  Which two restrictions should you modify? To answer, select the restrictions in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 198:

  You have a Microsoft 365 E5 subscription.

  You need to download a report that lists all the devices that are NOT enrolled in Microsoft Intune and are assigned an app protection policy.

  What should you select in the Microsoft Intune admin center?

  A. Reports, and then Device compliance
  B. Apps, and then App protection policies
  C. Devices, and then Monitor
  D. Apps, and then Monitor
  D. Apps, and then Monitor

  ---

  Explanation

  https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policies-monitor#view-the-app-protection-status-report

• Question 199:

  DRAG DROP

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain.

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains five virtual machines and is NOT connected to the on-premises network.

  You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

  You purchase Windows 365 Enterprise licenses.

  You need to deploy Cloud PC. The solution must meet the following requirements:

  All users must be able to access their Cloud PC at any time without any restrictions.

  The users must be able to connect to the virtual machines on VNet1.

  How should you configure the provisioning policy for Windows 365? To answer, drag the appropriate options to the correct settings. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 200:

  You have a Microsoft Entra tenant named contoso.com that contains a Windows 11 device named Device1 and a user named User1 User! registers Device1 in contoso.com.

  Which capability is available to Device1 after registering in contoso.com.

  A. authenticating to cloud resources by using single sign-on (SSO)
  B. enforcing software updates
  C. enforcing hard drive encryption
  D. enforcing compliance policies
  A. authenticating to cloud resources by using single sign-on (SSO)