MD-102 practice questions 101–110

1. Question 101 · 383 in bank

   You have a Microsoft 365 E5 subscription that contains 10 Android Enterprise devices. Each device has a corporate-owned work profile and is enrolled in Microsoft Intune. You need to configure the devices to run a single app in kiosk mode. Which Configuration settings should you modify in the device restrictions profile?

   • AUsers and Accounts
   • BGeneral
   • CSystem security
   • DDevice experience

   Show answer

   Answer: D

   Explanation

   Currently Intune has Home > Android > Configuration Profiles > Device Restrictions > Device Experience": "Enrollment type - Dedicated" and "Kiosk Mode - Single App"

   Source: Adapted from community discussion — letters1234

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 102 · 383 in bank

   You manage 1,000 devices by using Microsoft Intune. You review the Device compliance trends report. For how long will the report display trend data?

   • A30 days
   • B60 days
   • C90 days
   • D365 days

   Show answer

   Answer: B

   Explanation

   Ms Learn says 60 days: https://learn.microsoft.com/en-us/mem/intune/fundamentals/reports. My tenant shows 30 days same as everyone else. i'm guessing exam will want 60

   Source: Adapted from community discussion — Seek12

   References

   • Microsoft Learn

   Next question

3. Question 103 · 383 in bank

   You have a Microsoft 365 E5 subscription that contains 100 iOS devices enrolled in Microsoft Intune. You need to ensure that notifications of iOS updates are deferred for 30 days after the updates are released. What should you create?

   • Aan iOS app provisioning profile
   • Ba device configuration profile based on the Device features templates
   • Can update policy for iOS/iPadOS
   • Da device configuration profile based on the Device restrictions template

   Show answer

   Answer: D

   Explanation

   D: device configuration profiles based on the Device restrictions template Tested in my tenant Devices Configuration Profile > Creat > New Policy Create a new iOS/iPadOS profile in Intune. Choose the "Device restrictions" template. Configuration Settings > General > Defer software updates > Delay default visibility of software updates = 30 Enable "Defer software updates" and set the delay to 30 days. Assign the profile to your 100 iOS devices.

   Source: Adapted from community discussion — Krayzr

   References

   • Microsoft Learn

   Next question

4. Question 104 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Intune and contains 100 Windows 10 devices. You need to create Intune configuration profiles to perform the following actions on the devices: • Deploy a custom Start layout. • Rename the local Administrator account. Which profile type template should you use for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   2nd is wrong. That should be "Endpoint protection". You can achieve the same with LAPS in Account protection or via Settings catalog, Templates/Endpoint protection. Identity protection is for WHfB and Credential guard

   Source: Adapted from community discussion — BJS78

   

   Next question

5. Question 105 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription. You plan to enable Microsoft Intune enrollment for the following types of devices: • Existing Windows 11 devices managed by using Configuration Manager • Personal iOS devices The solution must minimize user disruption. Which enrollment method should you use for each device type? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 106 · 383 in bank

   You have a Windows 10 device named Device1 that is joined to Active Directory and enrolled in Microsoft Intune. Device1 is managed by using Group Policy and Intune. You need to ensure that the Intune settings override the Group Policy settings. What should you configure?

   • Aa device configuration profile
   • Ba device compliance policy
   • Can MDM Security Baseline profile
   • Da Group Policy Object (GPO)

   Show answer

   Answer: A

   Explanation

   Open your Intune tenant or "suit' as Microsoft likes to call it. Go to devices -> Windows -> Windows configuration -> create profile -> fill in the basic and click next -> from the 'Configuration settings' you can click on +Add settings -> Control Policy Conflict. Automatically MDM Wins Over GP will appear.

   Source: Adapted from community discussion — RomanV

   Next question

7. Question 107 · 383 in bank

   HOTSPOT - You have an Azure AD Premium P2 subscription that contains the users shown in the following table.

   

   You purchase the devices shown in the following table.

   

   You configure automatic mobile device management (MDM) and mobile application management (MAM) enrollment by using the following settings: • MDM user scope: Group1 • MAM user scope: Group2 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Great graphic to describe the different situations: https://allthingscloud.blog/wp-content/uploads/2019/02/word-image-12-1140x624.png Yes - Windows device and user 1 is part of the MDM user scope No - Android devices will not auto enroll. This functionality is limited to Windows OS No - MAM will not auto enroll (Ref: https://allthingscloud.blog/configuring-intune-mdm-user-scope-and-mam-user-scope/#:~:text=When%20users%20in%20this%20scope%20add%20a%20Work%20or%20School%20Account%20the%20device%20doesn%E2%80%99t%20get%20enrolled%20in%20Intune%20but%20it%20will%20be%20registered%20in%20Azure%20AD.)

   Source: Adapted from community discussion — Merrybob

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 108 · 383 in bank

   HOTSPOT - You have the MDM Security Baseline profile shown in the MDM exhibit. (Click the MDM tab.)

   

   You have the ASR Endpoint Security profile shown in the ASR exhibit. (Click the ASR tab.)

   

   You plan to deploy both profiles to devices enrolled in Microsoft Intune. You need to identify how the following settings will be configured on the devices: • Block Office applications from creating executable content • Block Win32 API calls from Office macro Currently, the settings are disabled locally on each device. What are the effective settings on the devices? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1: audit Box2: disabled Attack surface reduction rules for managed devices now support behavior for merger of settings from different policies, to create a superset of policy for each device. Only the settings that aren't in conflict are merged, while those that are in conflict aren't added to the superset of rules. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#policy-conflict

   Source: Adapted from community discussion — MR_Eliot

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 109 · 383 in bank

   DRAG DROP - You have an on-premises Active Directory domain that syncs to Azure AD tenant. The tenant contains computers that run Windows 10. The computers are hybrid Azure AD joined and enrolled in Microsoft Intune. The Microsoft Office settings on the computers are configured by using a Group Policy Object (GPO). You need to migrate the GPO to Intune. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To migrate the GPO to Intune, follow these steps and arrange the actions in the correct order: 1. Import an ADMX file: Import the necessary ADMX file into Intune. 2. Create a configuration profile: Use Intune to create a configuration profile based on the imported ADMX file. 3. Assign the profile: Assign the configuration profile to the target devices or users. This ensures the GPO settings are migrated and applied correctly through Intune.

   Source: Adapted from community discussion — Tr619899

   References

   • Microsoft Learn

   

   Next question

10. Question 110 · 383 in bank

    Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 100 client computers that run Windows 10. Currently, your company does NOT have a deployment infrastructure. The company purchases Windows 11 licenses through a volume licensing agreement. You need to recommend how to upgrade the computers to Windows 11. The solution must minimize licensing costs. What should you include in the recommendation?

    • AWindows Autopilot
    • BConfiguration Manager
    • Csubscription activation
    • DMicrosoft Deployment Toolkit (MDT)

    Show answer

    Answer: D

    Explanation

    D. Microsoft Deployment Toolkit (MDT) The other options are not suitable for this scenario. Autopilot requires an Azure AD Premium subscription and a Microsoft Intune subscription, which would increase the licensing costs. In fact, there's no mention of them having anything in Azure, period. Just AD on-prem. Configuration Manager requires a deployment infrastructure, such as a distribution point and a management point, which would also increase the costs and complexity. Subscription activation only updates the edition and not W10 to W11.

    Source: Adapted from community discussion — Merrybob

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MD-102 practice, question 101. 383 questions available.