MD-102 practice questions 191–200

1. Question 191 · 383 in bank

   Select 2

   You have a Microsoft 365 E5 subscription that includes Microsoft Intune. For macOS devices, you create an update policy named Policy1 that has the following settings: • All other updates (OS, built-in apps): Download and install • Assignments: • Included groups: All Devices Which two types of updates can be downloaded and installed by using Policy1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aconfiguration file
   • BmacOS
   • Cfirmware
   • Dcritical
   • Ebuilt-in app

   Show answer

   Answer: BE

   Explanation

   not quite sure but according to MS Learn shouldn't it be macOS and built-in app? Critical is a separate option https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos#:~:text=Configuration%20file%20update-,All%20other%20updates%20(OS%2C%20built%2Din%20apps),-Specify%20a%20schedule

   Source: Adapted from community discussion — pavic

   References

   • Microsoft Learn

   Next question

2. Question 192 · 383 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that includes Microsoft Intune. The subscription contains a group named Group1. Group1 contains devices enrolled in Intune. You deploy Remote Help in Intune. You need to configure Remote Help to only allow support administrators to join Remote Help sessions from the devices in Group1. Which type of Microsoft Entra object should you create, and which type of policy should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   entra object: service principal Policy: conditional access https://learn.microsoft.com/en-us/mem/intune/fundamentals/remote-help-windows#setup-conditional-access-for-remote-help I had to study that to understand... Remote Help is not a standard app, so you can't find it in Conditional Access without creating a service principal. It's some kind of link to a non-standard app in your AzureAD. I hope I'm not mistaken.

   Source: Adapted from community discussion — AleFCI1908

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 193 · 383 in bank

   You have a Microsoft 365 E5 subscription that includes Microsoft Intune and contains a user named Admin1. Admin1 must use the Microsoft Intune admin center to perform the following tasks: • Create and assign apps and policies to users and devices by using Intune. • Create, assign, and delete Windows 365 Cloud PC provisioning policies. You need to assign the required roles to Admin1. The solution must meet the following requirements: • Follow the principle of least privilege. • Minimize administrative effort. What should you do?

   • AAssign Admin1 the Help Desk Operator role.
   • BAssign Admin1 the Cloud PC Reader role.
   • CAssign Admin1 the Cloud PC Administrator role.
   • DCreate a custom Microsoft Entra role and assign the role to Admin1.
   • ECreate a custom Intune role and assign the role to Admin1.

   Show answer

   Answer: E

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 194 · 383 in bank

   You have a Microsoft 365 subscription that includes Microsoft Intune. The subscription contains Windows 11 devices enrolled in Intune. The subscription contains three groups named Departement1, Department2, and Department3. You need to deploy Microsoft 365 Apps to the Windows 11 devices. The solution must meet the following requirements: • Users in Department1 and Department2 must receive the full Microsoft 365 Apps suite, including Microsoft Project and Visio. • Users in Department3 must receive the full Microsoft 365 Apps suite, including Microsoft Project, but without Visio. • All other users must receive the full Microsoft 365 Apps suite without Microsoft Project or Visio. What is the minimum number of deployments you should create?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: C

   Explanation

   Correct. 1. M365 apps include Dept 1 and Dept 2 2. M365 apps include Dept 3 3. M365 apps include all users exclude Dept 1,2,3

   Source: Adapted from community discussion — jdr002

   Next question

5. Question 195 · 383 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Intune. You configure Intune to send log data to Log Analytics. You need to review events involving devices that fail to enroll in Intune. What should you monitor?

   • Aoperational logs
   • Baudit logs
   • Cthe Intune Device log
   • Ddevice compliance organizational logs

   Show answer

   Answer: A

   Explanation

   A is the correcnt vatiant. Operational Logs show details on users and devices that successfully (or failed) to enroll, and details on noncompliant devices. https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor Correct me if I'm wrong

   Source: Adapted from community discussion — ergacharsk

   References

   • Microsoft Learn

   Next question

6. Question 196 · 383 in bank

   You have a Microsoft 365 subscription that includes Microsoft Intune. The subscription contains corporate-owned, fully managed Android Enterprise devices. You plan to deploy a configuration profile that will have a device restrictions profile type named Profile1. Profile1 will assign maintenance windows for system updates. What should you configure from the Configuration settings for Profile1?

   • ADevice experience
   • BGeneral
   • CConnectivity
   • DPower Settings

   Show answer

   Answer: B

   Explanation

   Wrote above thinking this was on a windows 10 device but it's actually Android enterprise. Checked in tenant and now agree with given answer (General -> system update: Maintenance Window)

   Source: Adapted from community discussion — chafe

   Next question

7. Question 197 · 383 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You use Microsoft Intune to manage Windows 365 Cloud PC devices. You need to deploy a Windows 365 Security Baseline to the Cloud PC devices. The solution must meet the following requirements: • Block data execution prevention. • Enable virtualization-based security (VBS) and Secure Boot. What should you configure for the Windows 365 Security Baseline profile? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Checked in tenant answers are correct: File explorer -> data execution prevention Device Guard -> VBS options are: Not configured, VBS with secureboot, VBS with secureboot and DMA

   Source: Adapted from community discussion — chafe

   References

   • Microsoft Learn

   

   Next question

8. Question 198 · 383 in bank

   You have a Microsoft 365 subscription that includes Microsoft Intune. You create a new Android app protection policy named Policy1 that prevents screen captures in all Microsoft apps. You discover that an unmanaged email client installed on Android devices can still capture screens. You need to ensure that users can only use Microsoft apps to access email. What should you do?

   • ACreate a Conditional Access policy.
   • BCreate a compliance policy.
   • CModify the Data protection settings of Policy1.
   • DModify the assignments of Policy1.

   Show answer

   Answer: A

   Explanation

   Creating a Conditional Access policy, you can enforce the use of Microsoft apps for email access. You can configure the policy to require users to use an Intune-managed app (like Outlook Mobile) to access email services. This will prevent users from using unmanaged email clients and indirectly address the screen capture issue.

   Source: Adapted from community discussion — Frank_2022

   Next question

9. Question 199 · 383 in bank

   You have a Microsoft 365 E5 subscription. All Windows devices are enrolled in Microsoft Intune. You need to create an app protection policy named Policy1 and apply Policy1 to the devices. What can you protect by using Policy1?

   • AMicrosoft Outlook
   • BMicrosoft OneDrive
   • CMicrosoft Teams
   • DMicrosoft Edge

   Show answer

   Answer: D

   Explanation

   An app protection policy can protect all apps shown in the answer choices (Outlook, OneDrive, Teams, Edge). I imagine there is a type mistake, the correct question is: You have a Microsoft 365 E5 subscription. All Windows devices are enrolled in Microsoft Intune. You need to create a device configuration policy named Policy1 and apply Policy1 to the devices. What can you protect by using Policy1? a. Microsoft Outlook b. Microsoft OneDrive c. Microsoft Teams d. Microsoft Edge Then option D is the perfect choice.

   Source: Adapted from community discussion — Meek_Learner

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 200 · 383 in bank

    You have a Microsoft 365 E5 subscription. You use Microsoft Intune to manage all Windows 11 devices. You create an attack surface reduction (ASR) policy named Profile1 based on the Attack Surface Reduction Rules profile and assign Profile1 to all the devices. A user reports that an Adobe Reader plug-in is now blocked. You need to ensure that the plug-in is unblocked. What should you do?

    • ACreate an Endpoint Privilege Management policy and assign the policy to all the devices.
    • BAdd a scope tag to Profile1.
    • CConfigure ASR Only Per Rule Exclusions in Profile1.
    • DCreate a device compliance policy and assign the policy to all the devices.

    Show answer

    Answer: C

    Explanation

    Answer appears correct. Endpoint Privilege Management policy enables users to run tasks requiring elevated privilege without administrator rights. Scope tags determine which objects admins can see. Device Compliance Policy wouldn't impact ASR policy

    Source: Adapted from community discussion — servL

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MD-102 practice, question 191. 383 questions available.