Microsoft Role-based MS-101 Questions & Answers

• Question 1:

  You need to create the Microsoft Store for Business. Which user can create the store?

  A. User 2

  B. User 3

  C. User 4

  D. User 5

  Correct Answer: C

  References: https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

• Question 2:

  On which server should you use the Defender for identity sensor?

  A. Server1

  B. Server2

  C. Server3

  D. Server4

  E. Servers5

  Correct Answer: A

  However, if the case study had required that the DCs can't have any s/w installed, then the answer would have been a standalone sensor on Server2. In this scenario, the given answer is correct. BTW, ATP now known as Defender for Identity.

• Question 3:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD).

  You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch).

  You configure pilot co-management.

  You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1.

  You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager.

  Solution: Define a Configuration Manager device collection as the pilot collection. Add Device1 to the collection.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Device1 has the Configuration Manager client installed so you can manage Device1 by using Configuration Manager. To manage Device1 by using Microsoft Intune, the device has to be enrolled in Microsoft Intune. In the Co-management Pilot configuration, you configure a Configuration Manager Device Collection that determines which devices are auto-enrolled in Microsoft Intune. You need to add Device1 to the Device Collection so that it auto-enrols in Microsoft Intune. You will then be able to manage Device1 using Microsoft Intune.

  Reference: https://docs.microsoft.com/enus/configmgr/comanage/how-to-enable

• Question 4:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD).

  You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch).

  You configure pilot co-management.

  You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1.

  You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager.

  Solution: You create a device configuration profile from the Device Management admin center.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  It looks like the given answer is correct. There is an on-premises Active Directory synced to Azure Active Directory (Azure AD) So the co-management path 1 - Auto-enroll existing clients 1. Hybrid Azure AD

  2.

  Client agent setting for hybrid Azure ADjoin

  3.

  Configure auto-enrollment of devices to Intune 4. Enable co-management in Configuration Manager https://docs.microsoft.com/enus/mem/configmgr/comanage/tutorial-co-manage-client

• Question 5:

  You need to ensure that the support technicians can meet the technical requirement for the Montreal office mobile devices. What is the minimum of dedicated support technicians required?

  A. 1

  B. 4

  C. 7

  D. 31

  Correct Answer: B

  References: https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

• Question 6:

  You need to ensure that User1 can enroll the devices to meet the technical requirements. What should you do?

  A. From the Azure Active Directory admin center, assign User1 the Cloud device administrator rote.

  B. From the Azure Active Directory admin center, configure the Maximum number of devices per user setting.

  C. From the Intune admin center, add User1 as a device enrollment manager.

  D. From the Intune admin center, configure the Enrollment restrictions.

  Correct Answer: C

  References: https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

• Question 7:

  You need to meet the compliance requirements for the Windows 10 devices. What should you create from the Intune admin center?

  A. a device compliance policy

  B. a device configuration profile

  C. an app protection policy

  D. an app configuration policy

  Correct Answer: D

  References: https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

• Question 8:

  On which server should you install the Azure ATP sensor?

  A. Server 1

  B. Server 2

  C. Server 3

  D. Server 4

  E. Server 5

  Correct Answer: A

  However, if the case study had required that the DCs can't have any s/w installed, then the answer would have been a standalone sensor on Server2. In this scenario, the given answer is correct. BTW, ATP now known as Defender for Identity.

  References: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-capacity-planning

• Question 9:

  You need to protect the U.S. PII data to meet the technical requirements. What should you create?

  A. a data loss prevention (DLP) policy that contains a domain exception

  B. a Security and Compliance retention policy that detects content containing sensitive data

  C. a Security and Compliance alert policy that contains an activity

  D. a data loss prevention (DLP) policy that contains a user override

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/office365/securitycompliance/create-activity-alerts

• Question 10:

  You need to recommend a solution for the security administrator. The solution must meet the technical requirements. What should you include in the recommendation?

  A. Microsoft Azure Active Directory (Azure AD) Privileged Identity Management

  B. Microsoft Azure Active Directory (Azure AD) Identity Protection

  C. Microsoft Azure Active Directory (Azure AD) conditional access policies

  D. Microsoft Azure Active Directory (Azure AD) authentication methods

  Correct Answer: B

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/conceptconditional-access-conditions#sign-in-risk states clearly that Sign-in risk