Microsoft MD-102 Online Practice Questions and Exam Preparation

Microsoft MD-102 Online Questions & Answers

• Question 221:

  You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune.

  You plan to manage Microsoft Defender Antivirus on the computers.

  You need to prevent users from disabling Microsoft Defender Antivirus.

  What should you do?

  A. From the Microsoft Intune admin center, create a security baseline.
  B. From the Microsoft 365 Defender portal, enable tamper protection.
  C. From the Microsoft Intune admin center, create an account protection policy.
  D. From the Microsoft Intune admin center, create an endpoint detection and response (EDR) policy.
  B. From the Microsoft 365 Defender portal, enable tamper protection.

  ---

  Explanation

  Manage tamper protection for your organization using Microsoft 365 Defender portal

  Tamper protection helps protect certain security settings, such as virus and threat protection, from being disabled or changed. If you're part of your organization's security team, you can turn tamper protection on (or off) tenant wide by using the Microsoft 365 Defender portal (

  https://security.microsoft.com).

  https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-365-defender

• Question 222:

  HOTSPOT

  You have a Microsoft 365 tenant that uses Microsoft Intune to manage personal and corporate devices. The tenant contains Windows 10 devices as shown in the following exhibit.

  

  How will Intune classify each device after the devices are enrolled in Intune automatically? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 223:

  You need to capture the required information for the sales department computers to meet the technical

  requirements.

  Which Windows PowerShell command should you run first?

  A. Install-Module WindowsAutoPilotIntune
  B. Install-Script Get-WindowsAutoPilotInfo
  C. Import-AutoPilotCSV
  D. Get-WindowsAutoPilotInfo
  B. Install-Script Get-WindowsAutoPilotInfo

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/existing-devices

  "This topic describes how to convert Windows 7 or Windows 8.1 domain-joined computers to Windows 10 devices joined to either Azure Active Directory or Active Directory (Hybrid Azure AD Join) by using Windows Autopilot"

• Question 224:

  You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

  You use Intune to manage all devise.

  Users have iOS devices with Microsoft apps installed.

  You need to prevent users from cutting, copying, and pasting data between Microsoft Excel and other apps installed on the devices.

  What should you configure?

  A. an app protection policy
  B. an app configuration policy
  C. an iOS app provisioning profile
  D. policies for Microsoft Office apps
  A. an app protection policy

• Question 225:

  HOTSPOT

  You have three computers that run Windows 10 as shown in the following table.

  

  All the computers have C and D volumes. The Require additional authentication at startup Group Policy settings is disabled on all the computers.

  Which volumes can you encrypt by using BitLocker Drive Encryption (BitLocker)? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10

• Question 226:

  Your company uses Microsoft Intune.

  More than 500 Android and iOS devices are enrolled in the Intune tenant.

  You plan to deploy new Intune policies. Different policies will apply depending on the version of Android or iOS installed on the device.

  You need to ensure that the policies can target the devices based on their version of Android or iOS.

  What should you configure first?

  A. groups that have dynamic membership rules in Azure AD
  B. Device categories in Intune
  C. Corporate device identifiers in Intune
  D. Device settings in Azure AD
  A. groups that have dynamic membership rules in Azure AD

  ---

  Explanation

  We can create dynamic groups by using the deviceOSVersion or deviceOSType properties, and then apply Intune configuration policies to those groups.

  https://docs.microsoft.com/en-us/archive/blogs/pauljones/dynamic-group-membership-in-azure-active-directory-part-2

  https://docs.microsoft.com/en-ie/mem/intune/enrollment/device-group-mapping

• Question 227:

  HOTSPOT

  You have a Microsoft Intune subscription that has the following device compliance policy settings: Mark devices with no compliance policy assigned as: Compliant

  Compliance status validity period (days): 14

  On January1, you enroll Windows 10 devices in Intune as shown in the following table.

  

  On January 4, you create the following two device compliance policies:

  Name: Policy1

  Platform: Windows 10 and later

  Require BitLocker: Require

  Mark device noncompliant: 5 days after noncompliance Scope (Tags): Tag1

  Name: Policy2

  Platform: Windows 10 and later

  Firewall: Require

  Mark device noncompliant: Immediately Scope (Tags): Tag2

  On January 5, you assign Policy1 and Policy2 to Group1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 228:

  You have a Microsoft 365 E5 subscription.

  All devices are enrolled in Microsoft Intune.

  You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA).

  You need to ensure that Policy1 only applies to devices marked as noncompliant.

  Which settings of Policy1 should you configure?

  A. Device platforms under Conditions
  B. Filter for devices under Conditions
  C. Target resources
  D. Grant
  E. Session
  B. Filter for devices under Conditions

• Question 229:

  DRAG DROP

  You have a Microsoft 365 subscription that contains 1,000 Windows 11 devices enrolled in Microsoft Intune.

  You plan to create and monitor the results of a compliance policy used to validate the BIOS version of the devices.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create a PowerShell discovery script and a JSON file

  Discovery script - A PowerShell for Windows or a POSIX-compliant shell script for Linux that you create. The script runs on a device to discover the custom settings defined in your JSON file. The script returns the configuration value of those settings to Intune. You need to upload your script to the Microsoft Intune admin center before you create a compliance policy and then select the script you want to use when creating a policy.

  JSON file - The JSON file defines the custom settings and the value that is to be considered as compliant and can contain messages for users on how to restore the device to compliance for the setting.

  Step 2: Upload the PowerShell script to Intune.

  Step 3: Create and assign a custom compliancy policy.

  Use compliance policies to set rules for devices you manage with Intune.

  Create a policy with custom compliance settings

  Before you begin to create a policy that will include custom settings, review the prerequisites.

  You must first upload an applicable discovery script to Intune, and have a ready JSON to add while creating the policy

  Step 4: Review the compliance dashboard for results.

  Monitor results of your Intune Device compliance policies Open the compliance dashboard Open the Intune Device compliance dashboard:

  Sign in to the Microsoft Intune admin center.

  Select Devices > Overview > Compliance status tab.

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-use-custom-settings

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor

• Question 230:

  You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Microsoft Entra joined and are enrolled in Microsoft Intune.

  You plan to manage Microsoft Defender for Endpoint on the computers.

  You need to prevent users from disabling Microsoft Defender for Endpoint.

  What should you do?

  A. From the Microsoft Intune admin center, create a security baseline.
  B. From the Microsoft Intune admin center, create an antivirus policy.
  C. From the Microsoft Entra admin center, create a Conditional Access policy.
  D. From the Microsoft Intune admin center, create a device compliance policy.
  B. From the Microsoft Intune admin center, create an antivirus policy.