MD-102AssociateMicrosoftAll questions freePage 26 of 39

MD-102 practice questions 251–260

Endpoint Administrator383 questions across 39 pages are complete and free, with no account or card.

Start practising Review syllabus domains

Questions 251–260 · 383 available

Free practiceExam guide

Official study references

383 questions in this bank

Free access · progress saved on this device

Question 251 · 383 in bank
You have a Microsoft Entra tenant named contoso.com that contains a Windows 11 device named Device1 and a user named User1. User1 registers Device1 in contoso.com. Which capability is available to Device1 after registering in contoso.com?
Show answer
Answer: A
Explanation
Answer is correct: authenticating to cloud resources by using single sign-on (SSO) After Device1 is registered in the Microsoft Entra tenant contoso.com, it gains several capabilities: Single Sign-On (SSO): Device1 can use SSO to access cloud resources seamlessly. Conditional Access: Device1 can be subject to Conditional Access policies, which help secure access to resources based on device compliance. Mobile Device Management (MDM): If enrolled in MDM (e.g., Microsoft Intune), Device1 can have organization-required configurations enforced, such as password complexity and encryption. Access to Organizational Resources: Device1 can access resources in the organization based on the Microsoft Entra account. https://learn.microsoft.com/en-us/entra/identity/devices/concept-device-registration
Source: Adapted from community discussion — JayHall
References
Microsoft Learn
Permanent link to question 251 Report an issue
Question 252 · 383 in bank
HOTSPOT - You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.
You need to create two dynamic device groups named Group1 and Group2. The solution must meet the following requirements: • Group1 must contain Device1 and Device2 only. • Group2 must contain Device1 and Device3 only. Which device membership rule should you configure for each group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Show the answer figure
Answer: See figure below
Explanation
For me, there is no right answer for the second option: •(device . deviceOSType -eq "iPhone") and (device . deviceOSType -eq "Windows"): There is no "iPhone" OS, and an AND means that both conditions must be true. •(device . deviceOSType -eq "iPhone") or (device . deviceOSType -eq "Windows"): There is no "iPhone" OS, and this condition can also add device 2. •(device . deviceTrustType -eq "AzureAD") or (device . deviceOSType -eq "iPhone": There is no "iPhone" OS, but this will be the correct one: AzureAD for Device1 OR iOS for Device3.
Source: Adapted from community discussion — justITtopics
Permanent link to question 252 Report an issue
Question 253 · 383 in bank
You have a Microsoft 365 E5 subscription. You need to create a dynamic device group that will contain any device that has the word Marketing in its name. Which device membership rule should you use?
Show answer
Answer: C
References
Microsoft Learn
Permanent link to question 253 Report an issue
Question 254 · 383 in bank
You have a Microsoft 365 E5 subscription. You need to ensure that when a Windows device is joined to the Microsoft Entra tenant, the device is enrolled automatically in Microsoft Intune. What should you configure?
Show answer
Answer: D
Explanation
Answer is correct: the mobile device management (MDM) user scope To configure Microsoft Intune mobile device management (MDM) enrollment settings so that corporate-owned and personal devices automatically enroll in Microsoft Intune you would use the MDM User scope. MDM user scope enables automatic enrollment for Microsoft Intune device management. https://learn.microsoft.com/en-us/mem/intune/enrollment/quickstart-setup-auto-enrollment
Source: Adapted from community discussion — JayHall
References
Microsoft Learn
Permanent link to question 254 Report an issue
Question 255 · 383 in bank
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Entra tenant named contoso.com. You purchase an Android device named Device1. You need to register Device1 in contoso.com. Solution: You use the Microsoft Intune Company Portal app. Does this meet the goal?
Show answer
Answer: A
Explanation
To register an Android device in Microsoft Entra ID (formerly Azure AD) and Intune, the Microsoft Intune Company Portal app is the correct method. This allows Device1 to be: Registered in Microsoft Entra ID (if it's a personal/BYOD device). Enrolled in Microsoft Intune for management and compliance enforcement.
Source: Adapted from community discussion — RJTW070
Permanent link to question 255 Report an issue
Question 256 · 383 in bank
HOTSPOT - You have 100 computers that run Windows 10. You have no servers. All the computers are joined to Azure AD. The computers have different update settings, and some computers are configured for manual updates. You need to configure Windows Update. The solution must meet the following requirements: The configuration must be managed from a central location. Internet traffic must be minimized. Costs must be minimized. How should you configure Windows Update? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Show the answer figure
Answer: See figure below
Explanation
Windows Update for Business Microsoft Intune Delivery Optimization. Keyword sentence is "you have no servers" and also Microsoft tries to push very hard for full cloud, so it's logical that they will not advertise on-prem solutions in their exams. Cloud services = generating business for MSFT.
Source: Adapted from community discussion — RomanV
References
Microsoft Learn
Permanent link to question 256 Report an issue
Question 257 · 383 in bank
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Entra tenant named contoso.com. You purchase an Android device named Device1. You need to register Device1 in contoso.com. Solution: You use Microsoft Entra Connect. Does this meet the goal?
Show answer
Answer: B
Explanation
Answer is correct: No. Microsoft Entra Connect is an on-premises application that integrates your on-premises directories with Microsoft Entra ID (formerly Azure AD). It allows you to provide a common identity for accessing both cloud and on-premises resources https://www.microsoft.com/en-ie/download/details.aspx?id=47594
Source: Adapted from community discussion — JayHall
Permanent link to question 257 Report an issue
Question 258 · 383 in bank
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Entra tenant named contoso.com. You purchase an Android device named Device1. You need to register Device1 in contoso.com. Solution: You use the Microsoft Authenticator app. Does this meet the goal?
Show answer
Answer: B
Explanation
Using the Microsoft Authenticator app does not meet the goal of registering Device1 in contoso.com. The Microsoft Authenticator app is primarily designed for multi-factor authentication (MFA) and passwordless sign-in, not for device registration in a Microsoft Entra tenant. To register an Android device like Device1 in contoso.com, you would typically use one of the following methods: 1. Microsoft Intune Company Portal app: This is the recommended method for enrolling personal or BYOD Android devices. 2. Android Enterprise enrolment: For corporate-owned devices, you might use methods like QR code scanning or zero-touch enrolment, depending on the specific Android Enterprise deployment scenario.
Source: Adapted from community discussion — Meek_Learner
Permanent link to question 258 Report an issue
Question 259 · 383 in bank
HOTSPOT - You have a Microsoft 365 E5 tenant that contains Windows devices enrolled in Microsoft Intune as shown in the following table.
You create an Endpoint Privilege Management (EPM) elevation settings policy named ElevationSettings1 that has the following settings: • Endpoint Privilege Management: Enabled • Default elevation response: Require user confirmation • Validation: Business justification • Assignments: Group1 Each device contains a file named File1.exe that can be run only by an administrator. You create an EPM elevation rules policy named ElevationRules1 that has the following settings: • Rule name: Rule1 • Elevation type: Automatic • File name: File1.exe • File hash: • Assignments: Group2 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Show the answer figure
Answer: See figure below
Explanation
1:yes Device1 is assigned to both Group1 and Group2. While ElevationRules1 allows automatic elevation for File1.exe for Group2, ElevationSettings1 requires user confirmation and business justification for Group1. Since Device1 is part of Group1, it will still need user confirmation to run File1.exe. 2: YES: Device2 is assigned to Group2, and ElevationRules1, which allows automatic elevation for File1.exe, is also assigned to Group2. Therefore, Device2 can run File1.exe without administrator intervention. 3: NO: Device3 is assigned to both Group1 and Group2. Since ElevationSettings1, which requires business justification, is assigned to Group1, Device3 will require business justification to run File1.exe.
Source: Adapted from community discussion — martinods
References
Microsoft Learn
Microsoft Learn
Microsoft Learn
Microsoft Learn
Permanent link to question 259 Report an issue
Question 260 · 383 in bank
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune. You create a user named User1. You need to ensure that User1 can rotate BitLocker recovery keys by using Intune. Solution: From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1. Does this meet the goal?
Show answer
Answer: B
Explanation
Correct answer: No "Role-based access controls to manage BitLocker To manage BitLocker in Intune, an account must be assigned an Intune role-based access control (RBAC) role that includes the Remote tasks permission with the Rotate BitLockerKeys (preview) right set to Yes. You can add this permission and right to your own custom RBAC roles or use one of the following built-in RBAC roles that include this right: Help Desk Operator Endpoint Security Administrator" Ref: https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices#:~:text=Windows%20security%20documentation.-,Role%2Dbased%20access%20controls%20to%20manage%20BitLocker,Endpoint%20Security%20Administrator,-Create%20and%20deploy
Source: Adapted from community discussion — Knight_Of_Peace
References
Microsoft Learn
Microsoft Learn
Microsoft Learn
Permanent link to question 260 Report an issue

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

About this question bank

Version 1.0.0. How we source questions

Question 259 · 383 in bank

HOTSPOT - You have a Microsoft 365 E5 tenant that contains Windows devices enrolled in Microsoft Intune as shown in the following table.

You create an Endpoint Privilege Management (EPM) elevation settings policy named ElevationSettings1 that has the following settings: • Endpoint Privilege Management: Enabled • Default elevation response: Require user confirmation • Validation: Business justification • Assignments: Group1 Each device contains a file named File1.exe that can be run only by an administrator. You create an EPM elevation rules policy named ElevationRules1 that has the following settings: • Rule name: Rule1 • Elevation type: Automatic • File name: File1.exe • File hash: • Assignments: Group2 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

Show the answer figure

Answer: See figure below

Explanation

1:yes Device1 is assigned to both Group1 and Group2. While ElevationRules1 allows automatic elevation for File1.exe for Group2, ElevationSettings1 requires user confirmation and business justification for Group1. Since Device1 is part of Group1, it will still need user confirmation to run File1.exe. 2: YES: Device2 is assigned to Group2, and ElevationRules1, which allows automatic elevation for File1.exe, is also assigned to Group2. Therefore, Device2 can run File1.exe without administrator intervention. 3: NO: Device3 is assigned to both Group1 and Group2. Since ElevationSettings1, which requires business justification, is assigned to Group1, Device3 will require business justification to run File1.exe.

Source: Adapted from community discussion — martinods

References