MD-102 practice questions 81–90

1. Question 81 · 383 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant. You have a Microsoft 365 subscription. You plan to use Windows Autopilot to deploy new Windows devices. You plan to create a deployment profile. You need to ensure that the deployment meets the following requirements: • Devices must be joined to AD DS regardless of their current working location. • Users in the marketing department must have a line-of-business (LOB) app installed during the deployment. The solution must minimize administrative effort. What should you do for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   because the question says "Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant.", that implies that the intune connector is already setup. Also it says that you PLAN to use autopilot and you PLAN to create a deploy profile suggesting these steps are not yet complete. based on that context, modifying a deployment profile doesnt make sense since you have not yet created one. seems like deploy the always on vpn makes the most sense because that would satisfy the first requirement to ensure the devices could be joined to AD DS. not sure how any other answer of the 4 choices could satisfy this requirement. Creating a deployment profile to skid AD connectivity check would not join it to the AD DS.

   Source: Adapted from community discussion — ckmay

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 82 · 383 in bank

   Select 3

   You have 200 computers that run Windows 10 and are joined to an Active Directory domain. You need to enable Windows Remote Management (WinRM) on all the computers by using Group Policy. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AEnable the Allow Remote Shell access setting.
   • BEnable the Allow remote server management through WinRM setting.
   • CSet the Startup Type of the Windows Remote Management (WS-Management) service to Automatic.
   • DEnable the Windows Defender Firewall: Allow inbound Remote Desktop exceptions setting.
   • ESet the Startup Type of the Remote Registry service to Automatic.
   • FEnable the Windows Defender Firewall: Allow inbound remote administration exception setting.

   Show answer

   Answer: BCF

   Next question

3. Question 83 · 383 in bank

   You have a Microsoft 365 Business Standard subscription and 100 Windows 10 Pro devices. You purchase a Microsoft 365 E5 subscription. You need to upgrade the Windows 10 Pro devices to Windows 10 Enterprise. The solution must minimize administrative effort. Which upgrade method should you use?

   • AWindows Autopilot
   • Ba Microsoft Deployment Toolkit (MDT) lite-touch deployment
   • CSubscription Activation
   • Dan in-place upgrade by using Windows installation media

   Show answer

   Answer: C

   Explanation

   I have two links that proves that the right Answare for this is: C 1 link: https://learn.microsoft.com/en-us/windows/deployment/windows-deployment-scenarios#in-place-upgrade scroll down to Subscription activation, and it says: Windows Subscription Activation is a dynamic deployment method that enables changing the edition of Windows from Pro to Enterprise 2 link: https://learn.microsoft.com/en-us/windows/deployment/windows-subscription-activation?pivots=windows-11 Devices with a current Windows Pro edition license can be seamlessly upgraded to Windows Enterprise.

   Source: Adapted from community discussion — Lunner95

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 84 · 383 in bank

   HOTSPOT - You have devices that are not rooted enrolled in Microsoft Intune as shown in the following table.

   

   The devices are members of a group named Group1. In Intune, you create a device compliance location that has the following configurations: • Name: Network1 • IPv4 range: 192.168.0.0/16 In Intune, you create a device compliance policy for the Android platform. The policy has the following configurations: • Name: Policy1 • Device health: Rooted devices: Block • Locations: Location: Network1 • Mark device noncompliant: Immediately • Assigned: Group1 The Intune device compliance policy has the following configurations: • Mark devices with no compliance policy assigned as: Compliant • Enhanced jailbreak detection: Enabled • Compliance status validity period (days): 20 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   so based on my previous comment I believe the answer is YYY: 1- Y: device1 is a windows device so it's not targeted by policy1 2- Y: Device2 is not in the targeted location so policy1 is not applied 3- Y: Device3 is compliant with Policy1

   Source: Adapted from community discussion — yosry

   References

   • Microsoft Learn

   

   Next question

5. Question 85 · 383 in bank

   You need to implement mobile device management (MDM) for personal devices that run Windows 11. The solution must meet the following requirements: • Ensure that you can manage the personal devices by using Microsoft Intune. • Ensure that users can access company data seamlessly from their personal devices. • Ensure that users can only sign in to their personal devices by using their personal account. What should you use to add the devices to Azure AD?

   • AAzure AD registered
   • Bhybrid Azure AD join
   • CAzure AD joined

   Show answer

   Answer: A

   Explanation

   Azure AD registered devices are personal devices that are associated with Azure AD. This allows users to access company data from their personal devices without having to join the devices to the company's domain. Additionally, Azure AD registered devices can be managed by Microsoft Intune.

   Source: Adapted from community discussion — VirtualJP

   Next question

6. Question 86 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription. All computers are enrolled in Microsoft Intune. You have business requirements for securing your Windows 11 environment as shown in the following table.

   

   What should you implement to meet each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   As far as ik know you can not lock windows 11 devices with compliance policies. You can only block them for non compliance with conditional access policies? How do you lock windows 11 devices with compliance policies?

   Source: Adapted from community discussion — Bart_Hofstede

   References

   • Microsoft Learn

   

   Next question

7. Question 87 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription that contains two security groups named Group1 and Group2. Microsoft 365 uses Microsoft Intune Suite. You use Microsoft Intune to manage devices. You need to assign roles in Intune to meet the following requirements: • The members of Group1 must manage Intune roles and assignments. • The members of Group2 must assign existing apps and policies to users and devices. The solution must follow the principle of least privilege. Which role should you assign to each group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Help Desk Operator: Performs remote tasks on users and devices, and can assign applications or policies to users or devices. https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control Intune Role Administrator: Manages custom Intune roles and adds assignments for built-in Intune roles. It's the only Intune role that can assign permissions to Administrators.

   Source: Adapted from community discussion — 541c48e

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 88 · 383 in bank

   HOTSPOT - You have devices enrolled in Microsoft Intune as shown in the following table.

   

   Intune includes the device compliance policies shown in the following table.

   

   The device compliance policies has the assignments shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is correct: Device 1: Doesn't have secure boot > Non compliant Device 2: Does have secure boot> Compliant Device 3: Policy 3 is only for windows devices and policy 4 is not configured > Compliant

   Source: Adapted from community discussion — Robin_Cegeka

   

   Next question

9. Question 89 · 383 in bank

   HOTSPOT - You have a Microsoft 365 subscription that contains a user named User1. The subscription contains devices enrolled in Microsoft Intune as shown in the following table.

   

   Microsoft Edge is available on all the devices. Intune has the device compliance policies shown in the following table.

   

   The Compliance policy settings are configured as shown in the exhibit. (Click the Exhibit tab.)

   

   You create the following Conditional Access policy: • Name: Policy1 • Assignments o Users and groups: User1 o Cloud apps or actions: Office 365 SharePoint Online • Access controls o Grant: Require device to be marked as compliant • Enable policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is correct: Device 1 has no policy > Compliant Device 2 has encryption > Complaint Device 3 does not have encryption > Non Compliant

   Source: Adapted from community discussion — Robin_Cegeka

   

   Next question

10. Question 90 · 383 in bank

    You have computers that run Windows 10 and connect to an Azure Log Analytics workspace. The workspace is configured to collect all available events from the Windows event logs. The computers have the logged events shown in the following table.

    

    Which events are collected in the Log Analytics workspace?

    • A1 only
    • B2 and 3 only
    • C1 and 3 only
    • D1, 2, and 4 only
    • E1, 2, 3, and 4

    Show answer

    Answer: E

    Explanation

    Just looked it up, D is correct; https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events "You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events."

    Source: Adapted from community discussion — Joe9011

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

MD-102 practice, question 81. 383 questions available.