MD-102 practice questions 121–130

1. Question 121 · 383 in bank

   You have a Microsoft Intune subscription associated to an Azure AD tenant named contoso.com. Users use one of the following three suffixes when they sign in to the tenant: us.contoso.com, eu.contoso.com, or contoso.com. You need to ensure that the users are NOT required to specify the mobile device management (MDM) enrollment URL as part of the enrollment process. The solution must minimize the number of changes. Which DNS records do you need?

   • Aone TXT record only
   • Bthree CNAME records
   • Cthree TXT records
   • Done CNAME record only

   Show answer

   Answer: B

   Explanation

   If your organization uses more than one UPN suffix, create one CNAME for each domain name and point each one to EnterpriseEnrollment-s.manage.microsoft.com. https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-create-cname#step-1-create-cname

   Source: Adapted from community discussion — MR_Eliot

   References

   • Microsoft Learn

   Next question

2. Question 122 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription. You plan to enroll devices in Microsoft Intune that have the platforms and versions shown in the following table.

   

   You need to configure device enrollment to meet the following requirements: • Ensure that only devices that have approved platforms and versions can enroll in Microsoft Intune. • Ensure that devices are added to Azure AD groups based on a selection made by users during the enrollment. Which device enrollment setting should you configure for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Clue: only devices only devices that have approved platforms and versions can enroll in Microsoft Intune: Device enrolment devices are added to Azure AD groups based on a selection made by users during the enrolment :Device category

   Source: Adapted from community discussion — WORKHOLIC

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 123 · 383 in bank

   HOTSPOT - You have a Microsoft 365 tenant that uses Microsoft Intune and contains the devices shown in the following table.

   

   In Microsoft Intune Endpoint security, you need to configure a disk encryption policy for each device. Which encryption type should you use for each device, and which role-based access control (RBAC) role in Intune should you use to manage the encryption keys? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Permissions to manage BitLocker To manage BitLocker in Intune, your account must have the applicable Intune role-based access control (RBAC) permissions. Following are the BitLocker permissions, which are part of the Remote tasks category, and the built-in RBAC roles that grant the permission: Rotate BitLocker Keys Help Desk Operator

   Source: Adapted from community discussion — NoursBear

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 124 · 383 in bank

   Select 2

   You have an Azure AD tenant and 100 Windows 10 devices that are Azure AD joined and managed by using Microsoft Intune. You need to configure Microsoft Defender Firewall and Microsoft Defender Antivirus on the devices. The solution must minimize administrative effort. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ATo configure Microsoft Defender Antivirus, create a Group Policy Object (GPO) and configure the Windows Defender Antivirus settings.
   • BTo configure Microsoft Defender Firewall, create a device configuration profile and configure the Device restrictions settings.
   • CTo configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings.
   • DTo configure Microsoft Defender Antivirus, create a device configuration profile and configure the Device restrictions settings.
   • ETo configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings.
   • FTo configure Microsoft Defender Firewall, create a Group Policy Object (GPO) and configure Windows Defender Firewall with Advanced Security.

   Show answer

   Answer: DE

   Explanation

   DE is the Answer D:Microsoft Defender Antivirus: Device config-Device Restrictions- It has 28-34 settings for Antivrus. E: Microsoft Defender Firewall- Device config- Endpoint Protection (Global settings, netwok settings, Firewall rules) I have cross checked the lab. THe Endpoint Protection does not have the option for MS Defender Antivirus.

   Source: Adapted from community discussion — SalonaSahni

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 125 · 383 in bank

   DRAG DROP - Your company has a Microsoft 365 E5 tenant. All the devices of the company are enrolled in Microsoft Intune. You need to create advanced reports by using custom queries and visualizations from raw Microsoft Intune data. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Purchase an Azure subscription. Complex reporting functionality require an Azure subscription. Step 2: Create a Log Analytics workspace. Each Azure resource requires its own diagnostic setting. The diagnostic setting defines the following for a resource: * One or more destinations to send the logs. Current destinations include Log Analytics workspace, Event Hubs, and Azure Storage. * Categories of logs and metric data sent to the destinations defined in the setting. The available categories will vary for different resource types. * Retention policy for data stored in Azure Storage. Step 3: Add diagnostic settings. You can create and view custom reports using the following steps: 1. Sign in to the Microsoft Endpoint Manager admin center. 2. Select Reports > Diagnostic settings add a diagnostic setting. 3. Etc. Reference: https://docs.microsoft.com/en-us/mem/intune/fundamentals/reports

   Source: Adapted from community discussion — IrinaNakeva

   References

   • Microsoft Learn

   

   Next question

6. Question 126 · 383 in bank

   DRAG DROP - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint. You plan to onboard the following types of devices to Defender for Endpoint: • macOS • Linux Server What should you use to onboard each device? To answer, drag the appropriate tools to the correct device types. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Microsoft Intune is the recommended method for deploying Microsoft Defender for Endpoint on macOS devices. You can create configuration profiles in Intune to deploy the onboarding package and necessary settings. For Linux servers, Ansible is one of the supported deployment options. It allows for automated deployment and configuration of Microsoft Defender for Endpoint on Linux systems. It’s worth noting that while these are the recommended methods, there are other options available for both platforms: • For macOS, you can also use scripting or other MDM solutions if Intune is not available. • For Linux, besides Ansible, you can use Puppet, scripting, or other configuration management tools. The choice between these methods may depend on your organization's existing infrastructure and management tools.

   Source: Adapted from community discussion — Meek_Learner

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 127 · 383 in bank

   You have a Windows 10 device named Computer1 enrolled in Microsoft Intune. You need to configure Computer1 as a public workstation that will run a single customer-facing, full-screen application. Which configuration profile type template should you use in Microsoft Intune admin center?

   • AShared multi-user device
   • BDevice restrictions
   • CKiosk
   • DEndpoint protection

   Show answer

   Answer: C

   Next question

8. Question 128 · 383 in bank

   You have a Microsoft 365 subscription that uses Microsoft Intune Suite. You use Microsoft Intune to manage Windows 11 devices. You create a new policy set named Set and add five device configuration profiles for Windows 10 and later. You create a device compliance policy named Policy1. You need to ensure that when users are assigned the device configuration profiles in Set1, they are always assigned Policy1 also. What should you configure?

   • Athe assignments of Policy1
   • Bthe Policy1 configurations
   • Cthe assignments of Set1
   • Dthe Set1 configurations

   Show answer

   Answer: D

   Explanation

   D. the Set1 configurations You can include the following management objects in a policy set: Apps App configuration policies App protection policies Device configuration profiles Device compliance policies Windows autopilot deployment profiles Enrollment status page Settings catalog policies While creating a Policy Set, you can configure the Device Compliance Policy you need. You would need to include or associate the Policy Set with Policy1 from the question above. [Ref: https://youtu.be/rAkXyx5_6Zg?t=587]

   Source: Adapted from community discussion — Merrybob

   References

   • Microsoft Learn

   Next question

9. Question 129 · 383 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain that contains the locations shown in the following table.

   

   In Microsoft Intune, you enroll the Windows 10 devices shown in the following table.

   

   You have a Delivery Optimization device configuration profile applied to all the devices. The profile is configured as shown in the following exhibit.

   

   From which devices can Device1 and Device2 get updates? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Location 1 subnet includes IPs in the range of 10.10.0.1 to 10.10.255.254 Location 2 subnet includes IPs in the range of 10.20.0.1 to 10.20.255.254 Location 3 subnet includes IPs in the range of 172.16.0.1 to 172.16.255.254 Device 1 is part of Location 1 subnet Device 2 is part of Location 2 subnet Device 3 is part of Location 1 subnet Device 4 is part of Location 3 subnet HTTP blended with peering across a private group (2): "In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices." Ref: https://learn.microsoft.com/en-us/windows/deployment/do/waas-delivery-optimization-reference#download-mode

   Source: Adapted from community discussion — Merrybob

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 130 · 383 in bank

    You have 200 computers that run Windows 10. The computers are joined to Azure AD and enrolled in Microsoft Intune. You need to enable self-service password reset on the sign-in screen. Which settings should you configure from the Microsoft Intune admin center?

    • ADevice configuration
    • BDevice enrollment
    • CConditional access
    • DDevice compliance

    Show answer

    Answer: A

    Explanation

    hah, that's why I was caught, thought it was none of the above because I knew of the method from the Entra portal and now I see a config profile should be used but with a custom setting with OMA-URI

    Source: Adapted from community discussion — NoursBear

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MD-102 practice, question 121. 383 questions available.