MD-102 practice questions 91–100

1. Question 91 · 383 in bank

   You have an Azure AD tenant named contoso.com. You need to ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to contoso.com. What should you configure?

   • AWindows Autopilot
   • Bprovisioning packages for Windows
   • CSecurity defaults in Azure AD
   • DDevice settings in Azure AD

   Show answer

   Answer: D

   Explanation

   To ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to Azure AD, you should configure Device settings in Azure AD. Specifically, you need to disable the setting that automatically adds users to the local Administrators group on Azure AD-joined devices. This can be done by setting Local Administrator Group Membership to None in Azure AD's device settings. Entra ID > Devices > Devices Settings > Under Local Administration Settings, Change the state to NONE for "Registering user is added as local administrator on the device during Microsoft Entra join (Preview)"

   Source: Adapted from community discussion — Tr619899

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 92 · 383 in bank

   Your company has devices enrolled in Microsoft Intune as shown in the following table.

   

   In Microsoft Intune admin center, you define the company’s network as a location named Location1. Which devices can use network location-based compliance policies?

   • ADevice1 only
   • BDevice2 only
   • CDevice1 and Device2 only
   • DDevice2 and Device3 only
   • EDevice1, Device2, and Device3

   Show answer

   Answer: E

   Explanation

   Network location-based compliance policies can be used on the following devices: Android devices running Android 6.0 or later iOS devices running iOS 10 or later macOS devices running macOS 10.12 or later Windows devices running Windows 10 or later To use network location-based compliance policies, you must first create a network location. A network location is a defined area, such as a company's office or a home network. Once you have created a network location, you can create a compliance policy that is based on the network location. The compliance policy can be used to enforce security settings or to block access to certain resources.

   Source: Adapted from community discussion — Robin_Cegeka

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 93 · 383 in bank

   You have an Azure subscription. You have an on-premises Windows 11 device named Device1. You plan to monitor Device1 by using Azure Monitor. You create a data collection rule (DCR) named DCR1 in the subscription. To what should you associate DCR1?

   • AAzure Network Watcher
   • BDevice1
   • Ca Log Analytics workspace
   • Da Monitored Object

   Show answer

   Answer: D

   Explanation

   From : https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client "Now we associate the Data Collection Rules (DCR) to the Monitored Object by creating Data Collection Rule Associations"

   Source: Adapted from community discussion — ExamKiller020

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 94 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Intune Suite. You use Microsoft Intune to manage devices. You need to configure an update ring that meets the following requirements: • Fixes and improvements to existing Windows functionality can be deferred for 14 days but will install automatically seven days after that date. • The installation of new Windows features can be deferred for 90 days but will install automatically 10 days after that date. • Devices must restart automatically three days after an update is installed. How should you configure the update ring? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   90 - Days to install a feature update 14 - Days to install a Quality udpate 10 - Force install a Feature update 3 - Days to force a reboot after an update is installed

   Source: Adapted from community discussion — Merrybob

   References

   • Microsoft Learn

   

   Next question

5. Question 95 · 383 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You need to review and implement Microsoft 365 Defender device onboarding. The solution must meet the following requirements: • View onboarded devices that have the Chromium-based version for Microsoft Edge installed. • Download an onboarding package for a Windows 11 device. • Minimize administrative effort. Which two settings should you use in the Microsoft 365 Defender portal? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Inventories and Settings Microsoft states "You can remove the CPE Available filter, to gain further visibility and increase your search scope across all installed software in your organization. This means all software, including software without a CPE, will now display in the software inventory list. [Article updated on Jan 22, 2024!] (Ref: https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) Edge Chromium is available in the CPE list as per the video below (Ref: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=Edge+Chromium) States "Currently, software without CPE are not listed in the Software Inventory page, instead they are listed in the Device specific software inventory section." (Ref: https://youtu.be/X6FVvD5cMZU?t=213) -

   Source: Adapted from community discussion — Merrybob

   References

   • Microsoft Learn
   • Microsoft Learn
   • nist.gov documentation

   

   Next question

6. Question 96 · 383 in bank

   You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune. You plan to manage Microsoft Defender Antivirus on the computers. You need to prevent users from disabling Microsoft Defender Antivirus. What should you do?

   • AFrom the Microsoft Intune admin center, create a security baseline.
   • BFrom the Microsoft 365 Defender portal, enable tamper protection.
   • CFrom the Microsoft Intune admin center, create an account protection policy.
   • DFrom the Microsoft Intune admin center, create an endpoint detection and response (EDR) policy.

   Show answer

   Answer: B

   Explanation

   B: Microsoft 365 Defender portal--> settings-->endpoint-->advanced features--> tamper protection With tamper protection, malicious apps are prevented from turning off security features like virus & threat protection, behavior monitoring, cloud-delivered protection, and more.

   Source: Adapted from community discussion — sergioandreslq

   References

   • Microsoft Learn

   Next question

7. Question 97 · 383 in bank

   HOTSPOT - You have 1,000 computers that run Windows 10 and are members of an Active Directory domain. You need to capture the event logs from the computers to Azure. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Log Analytics Workspaces - This is a table or DB that captures (ingests) logs and stores them so that queries can be run against them. Install the Azure Monitor Agent (previously known as the Log Analytics Agent) - This is the agent that runs on any Windows machine (on-prem or cloud) and reports back. The configuration in between the Azure Monitor Agent and a Log Analytics Workspace is defined in Data Collection Rules (DCRs). DCRs instruct the Azure Monitor Agent to push selected logs and performance counter data to a Log Analytics Workspace.

   Source: Adapted from community discussion — Merrybob

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 98 · 383 in bank

   You have a computer named Computer5 that has Windows 10 installed. You create a Windows PowerShell script named config.ps1. You need to ensure that config.ps1 runs after feature updates are installed on Computer5. Which file should you modify on Computer5?

   • ALiteTouch.wsf
   • BSetupConfig.ini
   • CUnattend.bat
   • DUnattend.xml

   Show answer

   Answer: B

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 99 · 383 in bank

   HOTSPOT - You have a Microsoft 365 tenant and an internal certification authority (CA). You need to use Microsoft Intune to deploy the root CA certificate to managed devices. Which type of Intune policy and profile type template should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

10. Question 100 · 383 in bank

    HOTSPOT - Your company uses Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes the device groups shown in the following table.

    

    You onboard a computer to Microsoft Defender for Endpoint as shown in the following exhibit.

    

    What is the effect of the Microsoft Defender for Endpoint configuration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Group 3 Group 1 When a device is matched to more than one group, it's added only to the highest ranked group. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide#manage-device-groups

    Source: Adapted from community discussion — CaTa_LySt

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MD-102 practice, question 91. 383 questions available.