Microsoft MD-102 Online Practice Questions and Exam Preparation

Microsoft MD-102 Online Questions & Answers

• Question 311:

  SIMULATION

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and select the username below.

  To enter your password, place your cursor in the Enter password box and select the password below.

  Microsoft 365 Username: [email protected]

  Microsoft 365 Password: i7A4$3o^HGD3L~=c[9xuOhM%^4:s11Ai

  If the Microsoft Edge browser or Microsoft 365 portal does not load successfully, select the Microsoft Edge browser icon from the task bar, type the URL "https://portal.office.com", and press Enter.

  The following information is for technical support purposes only:

  Lab Instance: 48262079

  You need to create a compliance policy to validate whether all the Windows 10 or later devices enrolled in Microsoft Intune have BitLocker Drive Encryption (BitLocker) enabled.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Manage Disk Encryption policy for Windows devices with Intune

  Create an endpoint security policy for Windows

  Step 1: Sign in to the Microsoft Intune admin center.

  Step 2: Select Endpoint security > Disk encryption > Create Policy.

  Step 3: Set the following options:

  Platform: Windows

  Profile: Choose either BitLocker or Personal Data Encryption [Choose BitLocker]

  

  Step 4: On the Configuration settings page, configure settings for BitLocker to meet your business needs.

  [Skip]

  Select Next.

  Step 5: On the Scope (Tags) page, choose Select scope tags to open the Select tags pane to assign scope tags to the profile. [Skip]

  Select Next to continue.

  Step 6: On the Assignments page, select the groups that receive this profile. [Skip]

  Select Next.

  Step 7: On the Review + create page, when you're done, choose Create. The new profile is displayed in the list when you select the policy type for the profile you created.

  https://learn.microsoft.com/en-us/intune/intune-service/protect/encrypt-devices

• Question 312:

  You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

  You use Intune to manage Windows 11 devices.

  You need to implement Windows Local Administrator Password Solution (Windows LAPS).

  What should you configure?

  A. a configuration profile
  B. an account protection policy
  C. an app protection policy
  D. a device compliance policy
  B. an account protection policy

• Question 313:

  HOTSPOT

  You have the MDM Security Baseline profile shown in the MDM exhibit. (Click the MDM tab.)

  

  You have the ASR Endpoint Security profile shown in the ASR exhibit. (Click the ASR tab.)

  

  You plan to deploy both profiles to devices enrolled in Microsoft Intune.

  You need to identify how the following settings will be configured on the devices:

  Block Office applications from creating executable content Block Win32 API calls from Office macro

  Currently, the settings are disabled locally on each device.

  What are the effective settings on the devices? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Audit mode

  According to the ASR Endpoint Security profile and to the MDM Security Baseline profile, Block Office applications from creating executable content is set to Audit mode.

  Box 2: Disable

  Block Win32 API calls from Office macro: According to MDM Security Baseline profile it is set to disable. According to the ASR Endpoint Security profile it is set to Audit mode.

  The profiles are merged. The Baseline profile overrides the Endpoint Security profile.

  Note:

  When two or more policies have conflicting settings, the conflicting settings are not added to the combined policy, while settings that don't conflict are added to the superset policy that applies to a device.

  Attack surface reduction rule merge behavior is as follows:

  Endpoint security > Security baselines > Microsoft Defender for Endpoint Baseline > Attack Surface Reduction Rules.

  MDM Security Baseline profile ASR Endpoint Security profile.

  https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-asr-policy

• Question 314:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune

  You create a user named User1.

  You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.

  Solution: From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Correct:

  From the Microsoft Intune admin center, you assign the Endpoint Security Manager role to User1.

  From the Microsoft Intune admin center, you assign the Help Desk Operator role to User1.

  Incorrect:

  From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1.

  Note: Role-based access controls to manage BitLocker

  To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes.

  You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right:

  Help Desk Operator

  Endpoint Security Administrator Reference:

  https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices

• Question 315:

  HOTSPOT

  You have a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.

  

  The tenant contains a standalone workgroup computer named Computer1 that runs Window 11. Computer1 contains the local users shown in the following table.

  

  Computer1 needs to be joined to contoso.com.

  Which local users can join Computer1 to contoso.com, and the Microsoft Entra credentials of which user can be used? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: UserA or UserC only.

  Local users:

  * UserA . Yes

  UserA is in the Administrators group..

  * UserB -No

  UserB is Power User.

  * UserC - Yes

  UserC is Device Owner.

  For example, a device owner can enroll their device through the Intune Company Portal app.

  * UserD -No

  UserD is just a User.

  Box 2: Admin1 only

  Credentials of:

  * Admin1 . Yes

  Admin is Global Administrator.

  Global Administrator

  This is a privileged role. Users with this role have access to all administrative features in Microsoft Entra ID, as well as services that use Microsoft Entra identities like the Microsoft 365 Defender portal, the Microsoft Purview compliance portal, Exchange Online, SharePoint Online, and Skype for Business Online. Global Administrators can view Directory Activity logs. Furthermore, Global Administrators can elevate their access to manage all Azure subscriptions and management groups. This allows Global Administrators to get full access to all Azure resources using the respective Microsoft Entra tenant.

  * Admin2 -No

  Admin2 is Cloud Device Administrator.

  Cloud Device Administrator

  This is a privileged role. Users in this role can enable, disable, and delete devices in Microsoft Entra ID and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

  * Admin3 - No

  Admin3 is Directory Writer.

  Directory Writers

  This is a privileged role. Users in this role can read and update basic information of users, groups, and service principals.

  * User1 -No

  User1 is just a User.

  https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

• Question 316:

  You have a Microsoft 365 subscription that includes Microsoft Intune.

  You plan to use Windows Autopilot to deploy Windows 11 devices.

  You need to meet the following requirements during Autopilot provisioning:

  1. Display the app and profile configuration progress.

  2. Block users from using the devices until all apps and profiles are installed

  What should you configure?

  A. an app configuration policy
  B. an app protection policy
  C. an enrollment device platform restriction
  D. an enrollment status page
  D. an enrollment status page

  ---

  Explanation

  https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-status

• Question 317:

  DRAG DROP

  You have an on-premises Active Directory domain that syncs to Azure AD tenant.

  The tenant contains computers that run Windows 10. The computers are hybrid Azure AD joined and enrolled in Microsoft Intune.

  The Microsoft Office settings on the computers are configured by using a Group Policy Object (GPO).

  You need to migrate the GPO to Intune.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create a configuration profile

  Create the template 1) Sign in to the Microsoft Endpoint Manager admin center.

  2) Select Devices > Configuration profiles > Create profile.

  3) Etc.

  Step 2: Configure the Administrative Template settings.

  Find some settings. There are thousands of settings available in these templates.

  Step 3: Assign the profile.

  The template is created, but may not be doing anything yet. Be sure to assign the template (also called a profile) and monitor its status.

  https://docs.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows

• Question 318:

  You have a Hyper-V host that contains the virtual machines shown in the following table.

  

  On which virtual machines can you install Windows 11?

  A. VM1 only
  B. VM3 only
  C. VM1 and VM2 only
  D. VM2 and VM3 only
  E. VM1, VM2, and VM3
  B. VM3 only

  ---

  Explanation

  Windows 11 VM Hyper-V Requirments

  Generation 2 VM.

  UEFI (System Firmware)

  Secure Boot Enabled (Secure Boot can only be enabled with UEFI)

  TPM 2.0 Enabled.

  1 (GHz) or faster CPU with 2 or more cores. 4GM Memory or more. 64GB or more of disk space.

  https://activedirectorypro.com/install-windows-11-vm-hyper-v/

• Question 319:

  HOTSPOT

  You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

  You use Intune to manage devices.

  You need to assess device performance during startup and identify any device models that take longer than average to start.

  What should you use to assess the device performance, and which portal should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 320:

  You have the Windows 10 devices shown in the following table.

  

  You plan to upgrade the devices to Windows 11 Enterprise.

  On which devices can you perform a direct in-place upgrade to Windows 11 Enterprise?

  A. Device3 only
  B. Device3 and Device 4 only
  C. Device2, Device3, and Device4 only
  D. Device1, Device3, and Device4 only
  E. Device1, Device2, Device3, and Device4 only
  B. Device3 and Device 4 only