MD-102 practice questions 231–240

1. Question 231 · 383 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two devices named Device1 and Device2. You manage the devices by using Microsoft Intune. You need to use Device query to meet the following requirements: • Identify the Windows build on a device. • Validate whether a folder exists on the C drive of a device. Which table should you target for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Identify the Windows build on a device Table: OSVersion Explanation: This table contains detailed information about the operating system version, including the Windows build number. Validate whether a folder exists on the C drive of a device: Table: FileInfo Explanation: This table provides information about files and directories on a device. You can use it to check the existence of a specific folder on the C drive. https://learn.microsoft.com/en-us/mem/analytics/device-query#table-operators See “Supported Properies” Heading https://learn.microsoft.com/en-us/mem/analytics/data-platform-schema See “OSVersion” and “FileInfo” Descriptions

   Source: Adapted from community discussion — JayHall

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 232 · 383 in bank

   You have a Microsoft 365 E5 subscription and use Microsoft Intune. You plan to implement a Microsoft Cloud PKI solution that will deploy personal user certificates to all Windows devices. What is the minimum number of configuration profiles required to support the solution?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: B

   Explanation

   Answer is correct: 2 To deploy personal user certificates to all Windows devices using Microsoft Cloud PKI in Microsoft Intune, you would need at least two configuration profiles: Root CA Configuration Profile: This profile sets up the root certificate authority (CA) in the cloud. It acts as the trust anchor for your PKI hierarchy2. Issuing CA Configuration Profile: This profile creates the issuing CA, which is responsible for issuing the personal user certificates to the devices. These profiles ensure that the PKI infrastructure is properly configured to issue and manage certificates for your devices. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-configure-ca

   Source: Adapted from community discussion — JayHall

   References

   • Microsoft Learn

   Next question

3. Question 233 · 383 in bank

   DRAG DROP - You have a Microsoft 365 subscription that contains the following devices enrolled in Microsoft Intune: • A corporate-owned Windows device named Device1 • A personally-owned Android device named Device2 You need to use a remote action on each device. The solution must meet the following requirements: • Repurpose Device1 by returning the device to the factory default settings. • Remove only corporate data from Device2 and remove the device from Intune when the device checks in. Which remote action should you use on each device? To answer, drag the appropriate remote actions to the correct devices. Each remote action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Device 1: Wipe The Wipe device action restores a device to its factory default settings. The user data is kept if you choose the Wipe device, but keep enrollment state and associated user account checkbox. Otherwise, all data, apps, and settings are removed. Device 2: Retire The Retire action removes managed app data (where applicable), settings, and email profiles that were assigned by using Intune. The device is removed from Intune management. Removal happens the next time the device checks in and receives the remote Retire action. The device still shows up in Intune until the device checks in. https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe

   Source: Adapted from community discussion — JayHall

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 234 · 383 in bank

   You use Microsoft Intune and Intune Data Warehouse. You need to create a device inventory report that includes the data stored in the data warehouse. What should you use to create the report?

   • Athe Company Portal app
   • BEndpoint analytics
   • Cthe Azure portal app
   • DMicrosoft Power BI

   Show answer

   Answer: D

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 235 · 383 in bank

   You have a Microsoft 365 E5 subscription. You need to enroll Android Enterprise devices in Microsoft Intune by using zero-touch enrollment. What should you do first?

   • AFrom the Microsoft Intune admin center, configure enrollment restrictions.
   • BFrom the Microsoft Intune admin center, create a zero-touch configuration.
   • CFrom the Microsoft Intune admin center, link a Managed Google Play account.
   • DFrom the zero-touch enrollment portal, create a zero-touch configuration.

   Show answer

   Answer: C

   Explanation

   Answer is correct: From the Microsoft Intune admin center, link a Managed Google Play account. The first step to configure Android enterprise in your environment is to connect your Intune tenant account to your Android enterprise account: 1. Create a Google service account (@gmail.com). 2. Sign in to the Microsoft Intune admin center by using your Intune-licensed Global Administrator account. 3. Go to Devices > Android > Android Enrollment > Managed Google Play, select I agree, and then select Launch Google to connect now to open the Managed Google Play website. 4. Sign in to your Google account, and then select Get started. 5. Enter your business name, and then select Next. 6. Accept the terms, and then select Confirm. 7. Select Complete Registration. https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/configure-android-enterprise-devices-intune

   Source: Adapted from community discussion — JayHall

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 236 · 383 in bank

   You have a Microsoft Entra tenant named contoso.com that contains a group named Contoso Help Desk. You need to ensure that Contoso Help Desk is added to the local Administrators group whenever a Windows device is joined to contoso.com. What should you do?

   • AAssign the Cloud Device Administrator role to Contoso Help Desk.
   • BAssign the Microsoft Entra Joined Device Local Administrator role to Contoso Help Desk.
   • CConfigure the Enterprise State Roaming settings.
   • DEnable Microsoft Entra Local Administrator Password Solution (LAPS) for contoso.com.

   Show answer

   Answer: B

   Explanation

   Answer is correct: Assign the Microsoft Entra Joined Device Local Administrator role to Contoso Help Desk. The Microsoft Entra Joined Device Local Administrator role grants users local administrator rights on devices that are joined to Microsoft Entra ID. Users assigned to this role are added to the local administrators group on Azure AD-joined devices1. This allows them to perform tasks requiring administrative privileges, such as installing applications or making system changes https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin

   Source: Adapted from community discussion — JayHall

   References

   • Microsoft Learn

   Next question

7. Question 237 · 383 in bank

   HOTSPOT - You have a Microsoft Entra tenant. You are creating a dynamic device group named Group1. Group1 will include only Windows devices that are Microsoft Entra registered. How should you configure the dynamic membership rule for Group1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   ref# https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership When using deviceTrustType to create dynamic membership groups for devices, you need to set the value equal to AzureAD to represent Microsoft Entra joined devices, ServerAD to represent Microsoft Entra hybrid joined devices or Workplace to represent Microsoft Entra registered devices. So Given answer is correct

   Source: Adapted from community discussion — DiligentSam

   References

   • Microsoft Learn

   

   Next question

8. Question 238 · 383 in bank

   DRAG DROP - You have a Microsoft 365 E5 subscription that is linked to a Microsoft Entra tenant named contoso.com. The subscription contains a user named User1 and a new Windows 11 device named Device1. User1 must enroll Device1 in Microsoft Intune automatically. You need to ensure that all other users cannot use automatic enrollment. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Create a group named Group1 and add User1 to Group1. First, create a group (e.g., Group1) and add User1 to this group. This establishes a group specifically for the user who should have automatic enrolment. This is the foundation for targeting the MDM policy. 2. Configure the mobile device management (MDM) user scope. This step is crucial. You need to configure the MDM user scope to target only Group1. This ensures that only users within this group are subject to automatic MDM enrolment. All other users will be excluded. 3. Instruct User1 to join Device1 to contoso.com. This joins the device to the Azure AD domain. Because User1 is in Group1, and Group1 is targeted by the MDM user scope, joining the domain will trigger the automatic Intune enrolment.

   Source: Adapted from community discussion — Meek_Learner

   References

   • Microsoft Learn

   

   Next question

9. Question 239 · 383 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains three Windows devices named Device1, Device2, and Device3. Each device contains two apps named App1 and App2. You manage the devices by using Microsoft Intune. The subscription contains the groups shown in the following table.

   

   You have an Endpoint Privilege Management (EPM) elevation settings policy named Policy1 that has the following settings: • Endpoint Privilege Management: Enabled • Default elevation response: Require user confirmation • Validation: Windows authentication • Assignments: Group1, Group2 You create an Endpoint Privilege Management elevation rules policy named RulesPolicy1 that has the following settings: • Rule name: Rule1 • Elevation type: Automatic • Child process behavior: Deny all • File name: App1.exe • Assignments: Group1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Looks to be correct https://learn.microsoft.com/en-us/mem/intune/protect/epm-policies#windows-elevation-settings-policy User confirmed: We recommend this option for most rules. When a file is run, the user receives a simple prompt to confirm their intent to run the file. The rule can also include other prompts that are available from the Validation drop down: Business justification: Require the user to enter a justification for running the file. There's no required format for the entry. The user input is saved and can be reviewed through logs if the Reporting scope includes collection of endpoint elevations. Windows authentication: This option requires the user to authenticate using their organization credentials. Automatic: This elevation type automatically runs the file in question with elevated permissions. Automatic elevation is transparent to the user, without prompting for confirmation or requiring justification or authentication by the user.

   Source: Adapted from community discussion — Moot2

   References

   • Microsoft Learn

   

   Next question

10. Question 240 · 383 in bank

    HOTSPOT - You have a Microsoft 365 E5 subscription and use Microsoft Intune. You need to deploy new Android devices as shown in the following table.

    

    Which enrollment profile should you use for each device? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    device 3 is corporate-owned devices with work profile ref: https://learn.microsoft.com/en-us/mem/intune/enrollment/android-dedicated-devices-fully-managed-enroll#:~:text=After%20you%27ve%20set%20up%20your%20Android%20Enterprise%20dedicated%20devices%2C%20fully%20managed%20devices%2C%20or%20corporate%2Downed%20work%20profile%20devices%20in%20Intune%2C%20you%20can%20enroll%20the%20devices Under this, you can see the QR enrollment method for these kinds of devices.

    Source: Adapted from community discussion — AleFCI1908

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MD-102 practice, question 231. 383 questions available.