Microsoft Microsoft Certifications MD-102 Questions & Answers

• Question 231:

  HOTSPOT

  Your network contains an Active Directory domain. Active Directory is synced with Azure AD.

  There are 500 Active Directory domain-joined computers that run Windows 10 and are enrolled in Microsoft Intune.

  You plan to implement Microsoft Defender Exploit Guard.

  You need to create a custom Microsoft Defender Exploit Guard policy, and then distribute the policy to all the computers.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#manage-or-deploy-a-configuration https://docs.microsoft.com/en-us/intune/endpoint-protection-windows-10 https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection

• Question 232:

  HOTSPOT

  You have a Microsoft 365 subscription.

  You plan to enroll devices in Microsoft Intune that have the platforms and versions shown in the following table.

  

  You need to configure device enrollment to meet the following requirements:

  1.

  Ensure that only devices that have approved platforms and versions can enroll in Microsoft Intune.

  2.

  Ensure that devices are added to Azure AD groups based on a selection made by users during the enrollment.

  Which device enrollment setting should you configure for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Enrollment restrictions

  As an Intune administrator, you can create and manage enrollment restrictions that define what devices can enroll into management with Intune, including the:

  Number of devices.

  Operating systems and versions.

  Box 2: Device categories

  To make managing devices easier, you can use Microsoft Intune device categories to automatically add devices to groups based on categories that you define.

  Device categories use the following workflow:

  Create categories that users can choose from when they enroll their device.

  When users of iOS/iPadOS and Android devices enroll a device, they must choose a category from the list of categories you configured. To assign a category to a Windows device, users must use the Company Portal website.

  You can then deploy policies and apps to these groups.

  You can create any device categories you want. For example:

  -Point-of-sale device

  -Demonstration device

  -Sales

  -Accounting

  -Manager

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set https://docs.microsoft.com/en-us/mem/intune/enrollment/device-group-mapping

• Question 233:

  HOTSPOT

  You have a Microsoft 365 tenant that uses Microsoft Intune and contains the devices shown in the following table.

  

  In Microsoft Intune Endpoint security, you need to configure a disk encryption policy for each device.

  Which encryption type should you use for each device, and which role-based access control (RBAC) role in Intune should you use to manage the encryption keys? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 234:

  HOTSPOT

  Your network contains an on-premises Active Directory domain that contains the locations shown in the following table.

  

  In Microsoft Intune, you enroll the Windows 10 devices shown in the following table.

  

  You have a Delivery Optimization device configuration profile applied to all the devices. The profile is configured as shown in the following exhibit.

  

  From which devices can Device1 and Device2 get updates? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://garvis.ca/2021/06/01/delivery-optimization-know-your-options/

• Question 235:

  HOTSPOT

  You have a Microsoft 365 tenant that uses Microsoft Intune.

  From the Microsoft Intune admin center, you plan to create a baseline to monitor the Startup score and the App reliability score of enrolled Windows 10 devices.

  You need to identify which tool to use to create the baseline and the minimum number of devices required to create the baseline.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Endpoint analytics

  Endpoint analytics has the following three items are central to understanding each of the reports:

  Scores

  Baselines

  Insights and recommendations

  Box 2: 5

  A status of insufficient data means you don't have enough devices reporting to provide a meaningful score. Currently, at least five devices are required.

  Reference:

  https://docs.microsoft.com/en-us/mem/analytics/scores#understanding-scores

• Question 236:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Intune. The subscription contains the users shown in the following table.

  

  Group2 and Group3 are members of Group1.

  All the users use Microsoft Excel.

  From the Microsoft Intune admin center, you create the policies shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  User1 is member of Group 1 and 2. The Priority of policy, Group 1 is upper than Group 2, the result is .ods. =Yes User2 is member of Group 2 but Group 2 is under Group 1. The Priority of policy, Group 1 is upper than Group 2, the result is .ods. =No User3 is memebr of Group 3 but Group 3 is under Group 1. Only Policy 1 can applied. the result is .ods. =No.

• Question 237:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains a computer named Computer1 that runs Windows 11. Computer1 is enrolled in Microsoft Intune.

  You need to deploy an app named App1 to Computer1. The App1 installation will use multiple files.

  What should you use to package App1, and which file format will be used? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Win32 Content Prep Tool Use:

  In Microsoft Intune, there isn't a direct way to deploy .exe files. Instead, you need to package the .exe file using one of the supported formats, such as .intunewin or .msi, before deploying it. Here are two common methods to deploy .exe files via Intune:

  Wrap the .exe file in a .intunewin package:

  *

  Create an application package by using the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe). This tool allows you to convert a .exe file into a .intunewin package.

  *

  Download the IntuneWinAppUtil.exe tool from the Microsoft Download Center.

  Open a command prompt and run the following command to convert the .exe file into a .intunewin package:

  *

  IntuneWinAppUtil.exe -c -s -o

  Replace with the path to the .exe file, with the path to the setup file or installation script, and with the desired output folder for the .intunewin package.

  Box 2: . intunewin

  File format:

  Does Intune support .exe files?

  In Microsoft Intune, there isn't a direct way to deploy .exe files. Instead, you need to package the .exe file using one of the supported formats, such as . intunewin or . msi, before deploying it.

  Reference: https://learn.microsoft.com/en-us/answers/questions/1312151/how-to-deploy-apps-with-exe-file-extension-via-int

• Question 238:

  HOTSPOT

  Your company has an infrastructure that has the following:

  1.

  A Microsoft 365 tenant

  2.

  An Active Directory forest

  3.

  Microsoft Intune

  4.

  A Key Management Service (KMS) server

  5.

  A Windows Deployment Services (WDS) server

  6.

  An Azure AD Premium tenant

  The company purchases 100 new client computers that run Windows.

  You need to ensure that the new computers are joined automatically to Azure AD by using Windows Autopilot.

  What should you use? To answer, select the appropriate options in the answer area,

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft Endpoint Manager admin center Create an Autopilot device group using Intune

  1.

  In the Microsoft Endpoint Manager admin center, select Groups > New group.

  2.

  Etc.

  Box 2: Device serial number and hardware hash

  Ensure that the CSV file meets requirements.

  Device information in the CSV file where you capture hardware hashes should include:

  Serial number

  Windows product ID

  Hardware hash

  Optional group tag

  Optional assigned user

  Reference:

  https://docs.microsoft.com/en-us/intune/enrollment-autopilot

  https://docs.microsoft.com/en-us/mem/autopilot/add-devices

• Question 239:

  HOTSPOT

  You manage a Microsoft Deployment Toolkit (MDT) deployment share named DS1. DS1 contains an Out-of-Box Drivers folder named Windows 11 x64 that has subfolders in the format of {make name}\{model name}.

  You need to modify a deployment task sequence to ensure that all the drivers in the folder that match the make and model of the computers are installed without using PnP detection or selection profiles.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 240:

  HOTSPOT

  You use the Microsoft Deployment Toolkit (MDT) to deploy Windows 11.

  You need to modify the deployment share to meet the following requirements:

  1.

  Ensure that the user who performs the installation is prompted to set the local Administrator password

  2.

  Define a rule for how to name computers during the deployment.

  The solution must NOT replace the existing WinPE image.

  Which file should you modify for each requirement? To answer, select the appropriate options in the answer area,

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: CustomSettings.ini

  You can skip the entire Windows Deployment Wizard by specifying the SkipWizard property in CustomSettings.ini. To skip individual wizard pages, use the following properties:

  SkipAdminPassword

  Etc.

  Note: The CustomSettings.ini file includes for example:

  AdminPassword=pass@word1

  DomainAdmin=CONTOSO\MDT_JD

  DomainAdminPassword=pass@word1

  Some properties to use in the MDT Production rules file are as follows:

  DomainAdmin. The account to use when joining the machine to the domain.

  DomainAdminDomain. The domain for the join domain account.

  DomainAdminPassword. The password for the join domain account.

  Box 2: CustomSettings.ini

  Example of content in the CustomSettings.ini file:

  SkipComputerName=YES

  OSDComputerName=%ComputerName%

  Reference:

  https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt

  https://docs.microsoft.com/en-us/mem/configmgr/mdt/samples-guide