Microsoft Microsoft Certifications MD-102 Questions & Answers

• Question 261:

  HOTSPOT

  To which devices do Policy1 and Policy2 apply? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Device 3 only

  Policy1 applies to Device3 (Android)

  Box 2: Device 4 only

  Policy2 applies to Device4 (iOS)

  Reference:

  https://docs.microsoft.com/en-us/intune/device-profile-assign

• Question 262:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  User1 is a Cloud device administrator.

  Local administrative privileges are required when enrolling an already configured Windows 10 device in Intune.

  Cloud Device Administrator

  Users in this role can enable, disable, and delete devices in Azure AD and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

  Note: The Windows 10 devices are joined to Azure AD and enrolled in Microsoft Intune.

  Box 2: Yes

  User2 is an Azure AD joined device local administrator.

  Azure AD Joined Device Local Administrator

  This role is available for assignment only as an additional local administrator in Device settings. Users with this role become local machine administrators on all Windows 10 devices that are joined to Azure Active Directory. They do not have

  the ability to manage devices objects in Azure Active Directory.

  Box 3: No

  User3 is a Global reader.

  Global Reader

  Users in this role can read settings and administrative information across Microsoft 365 services but can't take management actions.

  Reference:

  https://docs.microsoft.com/en-us/troubleshoot/mem/intune/no-permission-to-enroll-windows-devices

  https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 263:

  HOTSPOT

  You implement the planned changes for Connection1 and Connection2.

  How many VPN connections will there be for User1 when the user signs in to Device1 and Device2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 2

  Device1 has VPN1 and VPN2.

  Box 2: 3

  Device2 has VPN1, VPN2 (group assignment), and VPN3.

• Question 264:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Device1 has BitLocker: Yes, Secure Boot: No.

  Device1 is member of Group1.

  Group1 is assigned Policy1 and Policy2.

  Policy1 is require Bitlocker only. OK.

  Policy2 is require Secure Boot only. Not OK.

  Box 2: No

  Device4 has BitLocker: No, Secure Boot: Yes.

  Device4 is member of Group2.

  Group2 is assigned Policy3.

  Policy3 is require Bitlocker and Secure Boot. Not OK.

  Box 3: Yes

  Device5 has BitLocker: Yes, Secure Boot: No.

  Device5 is member of Group3.

  Group3 is assigned not assigned any policies.

• Question 265:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  User1 is Cloud Device Administrator (and is a member of GroupA).

  Cloud Device Administrator

  Users in this role can enable, disable, and delete devices in Azure AD and read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to manage any other properties on the device.

  Box 2: Yes

  User2 is Azure AD Joined Device Local Administrator.

  Azure AD Joined Device Local Administrator

  This role is available for assignment only as an additional local administrator in Device settings. Users with this role become local machine administrators on all Windows 10 devices that are joined to Azure Active Directory.

  Box 3: No

  User3 is Global Reader.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 266:

  DRAG DROP

  You have a Microsoft 365 E5 subscription and a computer that runs Windows 11.

  You need to create a customized installation of Microsoft 365 Apps for enterprise.

  Which four actions should you perform in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  1.

  Download ODT application

  2.

  Create a configuration file (XML)

  3.

  setup.exe /download to download the installation files

  4.

  setup.exe /configure to deploy the application

  https://learn.microsoft.com/en-us/deployoffice/deploy-microsoft-365-apps-local-source

  1.

  Download ODT application

  2.

  Create a configuration file (XML)

  3.

  setup.exe /download to download the installation files

  4.

  setup.exe /configure to deploy the application https://learn.microsoft.com/en-us/deployoffice/deploy-microsoft-365-apps-local-source https://learn.microsoft.com/en-us/deployoffice/overview-office-deployment-tool#download-the-installation-files-for-microsoft-365-apps upvoted 29 times

• Question 267:

  DRAG DROP

  You have a Microsoft 365 subscription that includes Microsoft Intune.

  You need to implement a Microsoft Defender for Endpoint solution that meets the following requirements:

  1.

  Enforces compliance for Defender for Endpoint by using Conditional Access

  2.

  Prevents suspicious scripts from running on devices

  What should you configure? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: An Intune connection

  Enforces compliance for Defender for Endpoint by using Conditional Access

  Configure Conditional Access in Microsoft Defender for Endpoint

  Take the following steps to enable Conditional Access:

  Step 1: Turn on the Microsoft Intune connection from Microsoft 365 Defender

  Step 2: Turn on the Defender for Endpoint integration in Intune

  Step 3: Create the compliance policy in Intune

  Step 4: Assign the policy

  Step 5: Create an Azure AD Conditional Access policy

  Box 2: An Attack surface reduction (ASR) policy rule

  Prevents suspicious scripts from running on devices

  Attack surface reduction policy for endpoint security in Intune

  When Defender antivirus is in use on your Windows 10/11 devices, you can use Intune endpoint security policies for Attack surface reduction to manage those settings for your devices.

  Attack surface reduction policies help reduce your attack surfaces, by minimizing the places where your organization is vulnerable to cyberthreats and attacks.

  In particular:

  Attack Surface Reduction Rules - Configure settings for attack surface reduction rules that target behaviors that malware and malicious apps typically use to infect computers, including:

  Executable files and scripts used in Office apps or web mail that attempt to download or run files

  Obfuscated or otherwise suspicious scripts

  Behaviors that apps don't usually start during normal day-to-day work Reducing your attack surface means offering attackers fewer ways to perform attacks.

  Reference:

  https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access

  https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-asr-policy

• Question 268:

  DRAG DROP

  You have a Microsoft 365 subscription. The subscription contains computers that run Windows 11 and are enrolled in Microsoft Intune.

  You need to create a compliance policy that meets the following requirements:

  1.

  Requires BitLocker Drive Encryption (BitLocker) on each device

  2.

  Requires a minimum operating system version

  Which setting of the compliance policy should you configure for each requirement? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Device Compliance settings for Windows 10/11 in Intune

  As part of your mobile device management (MDM) solution, use these settings to require BitLocker, set a minimum and maximum operating system, set a risk level using Microsoft Defender for Endpoint, and more.

  Box 1: Device Health

  Device Health

  Windows Health Attestation Service evaluation rules

  Require BitLocker:

  Windows BitLocker Drive Encryption encrypts all data stored on the Windows operating system volume. BitLocker uses the Trusted Platform Module (TPM) to help protect the Windows operating system and user data. It also helps confirm

  that a computer isn't tampered with, even if its left unattended, lost, or stolen. If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys can't be

  accessed until the TPM verifies the state of the computer.

  Not configured (default) - This setting isn't evaluated for compliance or non-compliance.

  Require - The device can protect data that's stored on the drive from unauthorized access when the system is off, or hibernates.

  Box 2: Device Properties

  Requires a minimum operating system version

  Device Properties

  Operating System Version

  To discover build versions for all Windows 10/11 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows release information. Be sure to include the appropriate version prefix before the build numbers,

  like 10.0 for Windows 10 as the following examples illustrate.

  Minimum OS version:

  Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver.

  Etc.

  Reference:

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows

• Question 269:

  DRAG DROP

  You have a Microsoft 365 subscription that contains the devices shown in the following table.

  

  You need to ensure that only devices running trusted firmware or operating system builds can access network resources.

  Which compliance policy setting should you configure for each device? To answer, drag the appropriate settings to the correct devices. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between

  panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Require Secure Boot to be enabled on the device

  Windows 10

  Require Secure Boot to be enabled on the device:

  Not configured (default) - This setting isn't evaluated for compliance or non-compliance.

  Require - The system is forced to boot to a factory trusted state. The core components that are used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI

  firmware verifies the signature before it lets the machine start. If any files are tampered with, which breaks their signature, the system doesn't boot.

  Box 2: Prevent jailbroken devices from having corporate access.

  iOS

  Device Compliance settings for iOS/iPadOS in Intune

  As part of your mobile device management (MDM) solution, use these settings to require an email, mark rooted (jailbroken) devices as not compliant, set an allowed threat level, set passwords to expire, and more.

  This feature applies to:

  iOS

  iPadOS

  Device Health

  Jailbroken devices

  Supported for iOS 8.0 and later

  Not configured (default) - This setting isn't evaluated for compliance or non-compliance.

  Block - Mark rooted (jailbroken) devices as not compliant.

  Box 3: Prevent rooted devices from having corporate access

  Android Enterprise

  Device compliance settings for Android Enterprise in Intune

  As part of your mobile device management (MDM) solution, use these settings to mark rooted devices as not compliant, set an allowed threat level, enable Google Play Protect, and more.

  This feature applies to:

  Android Enterprise

  Device Health

  Jailbroken devices

  Supported for iOS 8.0 and later

  Not configured (default) - This setting isn't evaluated for compliance or non-compliance.

  Block - Mark rooted (jailbroken) devices as not compliant.

  Reference:

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios

• Question 270:

  DRAG DROP

  You have a Microsoft 365 subscription that contains 1,000 Windows 11 devices enrolled in Microsoft Intune.

  You plan to create and monitor the results of a compliance policy used to validate the BIOS version of the devices.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create a PowerShell discovery script and a JSON file

  Discovery script - A PowerShell for Windows or a POSIX-compliant shell script for Linux that you create. The script runs on a device to discover the custom settings defined in your JSON file. The script returns the configuration value of those

  settings to Intune. You need to upload your script to the Microsoft Intune admin center before you create a compliance policy and then select the script you want to use when creating a policy.

  JSON file - The JSON file defines the custom settings and the value that is to be considered as compliant and can contain messages for users on how to restore the device to compliance for the setting.

  Step 2: Upload the PowerShell script to Intune.

  Step 3: Create and assign a custom compliancy policy.

  Use compliance policies to set rules for devices you manage with Intune.

  Create a policy with custom compliance settings

  Before you begin to create a policy that will include custom settings, review the prerequisites.

  You must first upload an applicable discovery script to Intune, and have a ready JSON to add while creating the policy

  Step 4: Review the compliance dashboard for results.

  Monitor results of your Intune Device compliance policies

  Open the compliance dashboard

  Open the Intune Device compliance dashboard:

  Sign in to the Microsoft Intune admin center.

  Select Devices > Overview > Compliance status tab.

  Reference:

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-use-custom-settings

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor