Microsoft Microsoft Certifications MD-102 Questions & Answers

• Question 91:

  You use a Microsoft Intune subscription to manage iOS devices.

  You configure a device compliance policy that blocks jailbroken iOS devices.

  You need to enable Enhanced jailbreak detection.

  What should you configure?

  A. the Compliance policy settings

  B. the device compliance policy

  C. a network location

  D. a configuration profile

  Correct Answer: B

  Compliance policy settings include the following settings: Enhanced jailbreak detection (applies only to iOS/iPadOS) Etc.

  Reference: https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

• Question 92:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure AD tenant named contoso.com that contains several Windows 10 devices.

  When you join new Windows 10 devices to contoso.com, users are prompted to set up a four-digit pin.

  You need to ensure that the users are prompted to set up a six-digit pin when they join the Windows 10 devices to contoso.com.

  Solution: From the Microsoft Entra admin center, you configure the Authentication methods.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, from the Azure Active Directory admin center, you configure automatic mobile device management (MDM) enrollment. From the Endpoint Management admin center, you configure the Windows Hello for Business enrollment options.

  Reference: https://docs.microsoft.com/en-us/intune/protect/windows-hello

• Question 93:

  You have an Azure AD tenant named contoso.com.

  You have a workgroup computer named Computer1 that runs Windows 11.

  You need to add Computer1 to contoso.com.

  What should you use?

  A. dsregcmd.exe

  B. Computer Management

  C. netdom.exe

  D. the Settings app

  Correct Answer: D

  You join a computer to a domain, including an Azure AD domain in the Settings panel in Windows 10, under System->About

  Reference: https://aadguide.azurewebsites.net/aadjoin/

• Question 94:

  You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

  You use Microsoft Intune to manage Windows 11 devices.

  You need to implement passwordless authentication that requires users to use number matching.

  Which authentication method should you use?

  A. Microsoft Authenticator

  B. voice calls

  C. FIDO2 security keys

  D. text messages

  Correct Answer: A

  How number matching works in multifactor authentication (MFA) push notifications for Authenticator - Authentication methods policy

  This topic covers how number matching in Microsoft Authenticator push notifications improves user sign-in security. Number matching is a key security upgrade to traditional second factor notifications in Authenticator.

  Beginning May 8, 2023, number matching is enabled for all Authenticator push notifications. As relevant services deploy, users worldwide who are enabled for Authenticator push notifications will begin to see number matching in their

  approval requests. Users can be enabled for Authenticator push notifications either in the Authentication methods policy or the legacy multifactor authentication policy if Notifications through mobile app is enabled.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match

• Question 95:

  You use Microsoft Defender for Endpoint to protect computers that run Windows 10.

  You need to assess the differences between the configuration of Microsoft Defender for Endpoint and the Microsoft-recommended configuration baseline.

  Which tool should you use?

  A. Microsoft Defender for Endpoint Power BI app

  B. Microsoft Secure Score

  C. Endpoint Analytics

  D. Microsoft 365 Defender portal

  Correct Answer: B

• Question 96:

  You have a Microsoft 365 E5 subscription that contains 1,000 Windows 11 devices. All the devices are enrolled in Microsoft Intune.

  You plan to integrate Intune with Microsoft Defender for Endpoint.

  You need to establish a service-to-service connection between Intune and Defender for Endpoint.

  Which settings should you configure in the Microsoft Intune admin center?

  A. Premium add-ons

  B. Connectors and tokens

  C. Tenant enrollment

  D. Microsoft Tunnel Gateway

  Correct Answer: C

  https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure

• Question 97:

  Your company uses Microsoft Intune.

  More than 500 Android and iOS devices are enrolled in the Intune tenant.

  You plan to deploy new Intune policies. Different policies will apply depending on the version of Android or iOS installed on the device.

  You need to ensure that the policies can target the devices based on their version of Android or iOS.

  What should you configure first?

  A. groups that have dynamic membership rules in Azure AD

  B. Device categories in Intune

  C. Corporate device identifiers in Intune

  D. Device settings in Azure AD

  Correct Answer: A

  We can create dynamic groups by using the deviceOSVersion or deviceOSType properties, and then apply Intune configuration policies to those groups.

  Reference: https://docs.microsoft.com/en-us/archive/blogs/pauljones/dynamic-group-membership-in-azure-active-directory-part-2 https://docs.microsoft.com/en-ie/mem/intune/enrollment/device-group-mapping

• Question 98:

  You have a Microsoft Intune deployment that contains the resources shown in the following table.

  

  You create a policy set named Set1 and add Comply1 to Set1.

  Which additional resources can you add to Set1?

  A. Conf1 only

  B. Comply2 only

  C. Comply2 and Conf1 only

  D. CA1, Conf1, and Office1 only

  E. Comply2, CA1, Conf1, and Office1

  Correct Answer: C

  You can include the following management objects in a policy set:

  Apps App configuration policies App protection policies Device configuration profiles (Conf1) Device compliance policies (Comply1) Windows autopilot deployment profiles Enrollment status page Settings catalog policies

  Note: Use policy sets to group collections of management objects Policy sets allow you to create a bundle of references to already existing management entities that need to be identified, targeted, and monitored as a single conceptual unit. A policy set is an assignable collection of apps, policies, and other management objects you've created. Creating a policy set enables you to select many different objects at once, and assign them from a single place. As your organization changes, you can revisit a policy set to add or remove its objects and assignments. You can use a policy set to associate and assign existing objects, such as apps, policies, and VPNs in a single package.

  Reference: https://learn.microsoft.com/en-us/mem/intune/fundamentals/policy-sets

• Question 99:

  You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

  You use Microsoft Intune to manage devices.

  You need to ensure that the startup performance of managed Windows 11 devices is captured and available for review in the Intune admin center.

  What should you configure?

  A. the Azure Monitor agent

  B. a device compliance policy

  C. a Conditional Access policy

  D. an Intune data collection policy

  Correct Answer: D

  https://learn.microsoft.com/en-us/mem/analytics/data-collection https://learn.microsoft.com/en-us/mem/analytics/enroll-intune#bkmk_onboard

• Question 100:

  You have a hybrid deployment of Azure AD that contains 50 Windows 10 devices. All the devices are enrolled in Microsoft Intune.

  You discover that Group Policy settings override the settings configured in Microsoft Intune policies.

  You need to ensure that the settings configured in Microsoft Intune override the Group Policy settings.

  What should you do?

  A. From Group Policy Management Editor, configure the Computer Configuration settings in the Default Domain Policy.

  B. From the Microsoft Intune admin center, create a custom device profile.

  C. From the Microsoft Intune admin center, create an Administrative Templates device profile.

  D. From Group Policy Management Editor, configure the User Configuration settings in the Default Domain Policy.

  Correct Answer: B

  Creating the policy Let's create a new policy in Intune to control the GP vs. MDM winner 1) Navigate to portal.azure.com and locate Intune 2) Select “Device configuration à Profiles à Create profile” 3) Under Platform select Windows 10 and later 4) Under Profile type select “custom” and “add” 5) Name the custom setting with something intuitive 6) For OMA-URI add the policy OMA-URI string: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP 7) For Data type select Integer and add the number

  Note: The following describes which policy wins according to Windows 10 version.

  Windows 10 versions 1709 and earlier Group Policy will override MDM policies, even if an identical policy is configured in MDM.

  Windows 10 version 1803 and beyond there is a new Policy CSP (configuration service provider) setting called ControlPolicyConflict that includes the policy of MDMWinsOverGP, where the preference of which policy wins can be controlled,

  i.e. Microsoft Intune MDM policy.

  Note 2: the ControlPolicyConflict policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy (GP) are set on the device.

  Reference: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict https://uem4all.com/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/