Microsoft Microsoft Certifications MD-102 Questions & Answers

• Question 271:

  DRAG DROP

  You have a computer that runs Windows 10 and contains two local users named User1 and User2.

  You need to ensure that the users can perform the following actions:

  User1 must be able to adjust the date and time.

  User2 must be able to clear Windows logs.

  The solution must use the principle of least privilege.

  To which group should you add each user? To answer, drag the appropriate groups to the correct users. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 272:

  DRAG DROP

  You have a Microsoft Deployment Toolkit (MDT) server named MDT1.

  When computers start from the LiteTouchPE_x64.iso image and connect to MDT1, the welcome screen appears as shown in the following exhibit.

  

  You need to prevent the welcome screen from appearing when the computers connect to MDT1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Modify the CustomSettings.ini file

  CustomSettings.ini (CS) may be edited to include information that you wish to take into account prior to beginning the deployment process-such as data that will exist as variables that can be called upon as needed. This is extremely useful

  when working with multiple sites or when you want certain settings to apply to desktops, while mobile devices receive a different set of settings.

  Example of line included:

  SkipBDDWelcome=NO

  Step 2: Modify the task sequence

  Create the deployment task sequence, example:

  1.

  Using the Deployment Workbench, right-click Task Sequences under the MDT Production node, select New Folder and create a folder with the name: Windows 10.

  2.

  Right-click the Windows 10 folder created in the previous step, and then select New Task Sequence. Use the following settings for the New Task Sequence Wizard:

  Task sequence ID: W10-X64-001

  Task sequence name: Windows 10 Enterprise x64 Custom Image

  Etc.

  Step 3: Update the deployment share

  Configure the MDT production deployment share, example:

  1. On SRV1, open an elevated Windows PowerShell prompt and enter the following commands:

  copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force In the Deployment Workbench console on SRV1, right-click the MDT Production deployment share and then select Properties.

  Select the Rules tab and replace the rules with the following text (don't select OK yet):

  [Settings] Priority=Default

  [Default] _SMSTSORGNAME=Contoso OSInstall=YES UserDataLocation=AUTO *Details omitted*

  Incorrect:

  * Bootstrap.ini

  Bootstrap.ini is the file that controls access to the shared drive that stores the deployment repository.

  Reference: https://learn.microsoft.com/en-us/windows/deployment/windows-10-poc-mdt#create-a-deployment-share-and-reference-image https://www.techrepublic.com/article/mdt-automating-deployments-using-customsettings-ini/

• Question 273:

  DRAG DROP

  You have 100 computers that run Windows 10.

  You plan to deploy Windows 11 to the computers by performing a wipe and load installation.

  You need to recommend a method to retain the user settings and the user data.

  Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Run scanstate.exe

  1.

  Collect files and settings from the source computer.

  2.

  Back up the source computer.

  3.

  Close all applications.

  4.

  Run the ScanState command on the source computer to collect files and settings.

  5.

  Etc.

  Step 2: Deploy Windows 11

  Prepare the destination computer and restore files and settings.

  Install the operating system on the destination computer.

  Install all applications that were on the source computer. Although it is not always required, we recommend installing all applications on the destination computer before you restore the user state. This makes sure that migrated settings are

  preserved.

  Step 3: Run loadstate.exe

  Run the LoadState command on the destination computer. Specify the same set of .xml files that you specified when you used the ScanState command.

  Reference:

  https://docs.microsoft.com/en-us/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool

• Question 274:

  DRAG DROP

  Your company has a computer named Computer1 that runs Windows 10.

  Computer1 was used by a user who left the company.

  You plan to repurpose Computer1 and assign the computer to a new user.

  You need to redeploy Computer1 by using Windows Autopilot.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Generate a CSV file that contains the computer information

  You can perform Windows Autopilot device registration within your organization by manually collecting the hardware identity of devices (hardware hashes) and uploading this information in a comma-separated-values (CSV) file.

  Step 2: Upload the file by using Microsoft Intune

  By default, Intune only applies this profile to Windows Autopilot devices. Yes, to convert all targeted, non-auto pilot devices to Autopilot so that they can receive the profile the next time they perform a factory reset.

  Step 3: Reset the computer

  Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and simply. Specifically, Windows Autopilot Reset:

  Removes personal files, apps, and settings.

  Reapplies a device's original settings.

  Sets the region, language, and keyboard to the original values.

  Maintains the device's identity connection to Azure AD.

  Maintains the device's management connection to Intune.

  Reference:

  https://docs.microsoft.com/en-us/intune/enrollment-autopilot

  https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-reset

• Question 275:

  DRAG DROP

  You have a Microsoft Intune subscription that is configured to use a PFX certificate connector to an on-premises Enterprise certification authority (CA).

  You need to use Intune to configure autoenrollment for Android devices by using public key pair (PKCS) certificates.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Obtain the root certificate.

  Export the root certificate from the Enterprise CA.

  To authenticate a device with VPN, WiFi, or other resources, a device needs a root or intermediate CA certificate.

  Step 2: From the Microsoft Endpoint Manager admin center, create a trusted certificate profile

  Create a trusted certificate profile

  1.Sign in to the Microsoft Endpoint Manager admin center.

  2.Select and go to Devices > Configuration profiles > Create profile.

  3.Enter the following properties:

  Platform:

  Profile: Select Trusted certificate. Or, select Templates > Trusted certificate.

  Select Create.

  4.Etc.

  Step 3: From the Microsoft Endpoint Manager admin center, create a PKCS certificate profile

  Create a PKCS certificate profile

  1.Sign in to the Microsoft Endpoint Manager admin center.

  2.Select and go to Devices > Configuration profiles > Create profile.

  3.Enter the following properties:

  Platform:

  Profile: Select PKCS certificate. Or, select Templates > PKCS certificate.

  Select Create.

  4.Etc.

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/protect/certificates-pfx-configure

• Question 276:

  DRAG DROP

  You have 500 Windows 10 devices enrolled in Microsoft Intune.

  You plan to use Exploit protection in Microsoft Intune to enable the following system settings on the devices:

  1.

  Data Execution Prevention (DEP)

  2.

  Force randomization for images (Mandatory ASLR)

  You need to configure a Windows 10 device that will be used to create a template file.

  Which protection areas on the device should you configure in the Windows Security app before you create the template file? To answer, drag the appropriate protection areas to the correct settings. Each protection area may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://support.microsoft.com/en-us/windows/app-browser-control-in-windows-security-8f68fb65-ebb4-3cfb-4bd7-ef0f376f3dc3

• Question 277:

  DRAG DROP

  You have a Microsoft 365 subscription that contains two users named User1 and User2.

  You need to ensure that the users can perform the following tasks:

  1.

  User1 must be able to create groups and manage users.

  2.

  User2 must be able to reset passwords for nonadministrative users.

  The solution must use the principle of least privilege.

  Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: User Administrator User admin Assign the user admin role to users who you want to access and manage user password resets and manage users and groups. They can also open and manage support requests to Microsoft support.

  Box 2: Helpdesk Administrator Assign the Helpdesk admin role to users who want to reset passwords, force users to sign out for any security issues. They can also open and manage support requests to Microsoft support. The Helpdesk admin can only help non-admin users and users assigned these roles: Directory reader, Guest inviter, Helpdesk admin, Message center reader, and Reports reader.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/admin-roles-page

• Question 278:

  DRAG DROP

  You have a Microsoft Deployment Toolkit (MDT) deployment share named DS1.

  You import a Windows 11 image to DS1.

  You have an executable installer for an application named App1.

  You need to ensure that App1 will be installed for all the task sequences that deploy the image.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Add App1 to DS1

  First add the application in the MDT console.

  Step 2: Identify the GUID of App1.

  Install an application when deploying Windows

  Step 3: Modify CustomSettings.ini

  It is possible in the CustomSettings.ini file, to check the default program to add the following line:

  ApplicationsXXX ={GUID-APPLICATION}

  or to force the installation of the application box checked and grayed out:

  MandatoryApplicationsXXX ={GUID-APPLICATION}

  XXX = numerical value from 000 to 999

  Reference:

  https://rdr-it.com/en/mdt-installation-of-applications-when-deploying-windows/

• Question 279:

  DRAG DROP

  You have a Microsoft 365 subscription that contains devices enrolled in Microsoft Intune.

  You need to create Endpoint security policies to enforce the following requirements:

  1.

  Computers that run macOS must have FileVault enabled.

  2.

  Computers that run Windows 10 must have Microsoft Defender Credential Guard enabled.

  3.

  Computers that run Windows 10 must have Microsoft Defender Application Control enabled.

  Which Endpoint security feature should you use for each requirement? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Disk encryption

  Computers that run macOS must have FileVault enabled.

  Intune supports macOS FileVault disk encryption. FileVault is a whole-disk encryption program that is included with macOS. You can use Intune to configure FileVault on devices that run macOS 10.13 or later.

  Box 2: Attack surface reduction (ASR)

  Computers that run Windows 10 must have Microsoft Defender Application Control enabled.

  Attack surface reduction profiles include:

  * Application control - Application control settings can help mitigate security threats by restricting the applications that users can run and the code that runs in the System Core (kernel). Manage settings that can block unsigned scripts and MSIs, and restrict Windows PowerShell to run in Constrained Language Mode.

  Note: Attack surface reduction rules target certain software behaviors, such as:

  Launching executable files and scripts that attempt to download or run files

  Running obfuscated or otherwise suspicious scripts

  Performing behaviors that apps don't usually initiate during normal day-to-day work

  Box 3: Account protection

  Computers that run Windows 10 must have Microsoft Defender Credential Guard enabled.

  The account protection policy is focused on settings for Windows Hello and Credential Guard, which is part of Windows identity and access management.

  Note: Microsoft Defender Credential Guard protects against credential theft attacks. It isolates secrets so that only privileged system software can access them.

  Reference: https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices-filevault https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-asr-policy

• Question 280:

  DRAG DROP

  You have a Microsoft 365 subscription that uses Microsoft Intune.

  You plan to use Windows Autopilot to provision 25 Windows 11 devices.

  You need to meet the following requirements during device provisioning:

  1.

  Display the progress of app and profile deployments.

  2.

  Join the devices to Azure AD.

  What should you configure to meet each requirement? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or

  scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Enrollment Status Page

  Display the progress of app and profile deployments.

  Enrollment status page

  Set up the Enrollment Status Page

  The enrollment status page (ESP) displays the provisioning status to people enrolling Windows devices and signing in for the first time. You can configure the ESP to block device use until all required policies and applications are installed.

  Device users can look at the ESP to track how far along their device is in the setup process.

  To deploy the ESP to devices, you have to create an ESP profile in Microsoft Intune. Within the profile, you can configure the ESP settings that control:

  Visibility of installation progress indicators

  Device access during provisioning

  Time limits

  Allowed troubleshooting operations

  Create new profile

  1.

  Sign in to the Microsoft Intune admin center and select Devices.

  2.

  Select Windows > Windows enrollment > Enrollment Status Page.

  3.

  Select Create.

  4.

  In Basics, enter the following properties:

  Name: Name your profile so you can easily identify it later.

  Description: Enter a description for the profile. This setting is optional, but recommended.

  5.

  Select Next.

  6.

  In Settings, configure the following settings:

  *-> Show app and profile configuration progress: Your options:

  No: The enrollment status page doesn't appear during device setup. Select this option if you don't want to show the ESP to users.

  Yes: The enrollment status page appears during device setup.

  Etc.

  Note: ESP tracking

  The enrollment status page tracks these phases of provisioning:

  Device preparation

  Device setup

  Account setup

  Apps

  The ESP tracks the installation of apps deployed in a device context, and includes:

  Per machine line-of-business (LoB) MSI apps

  LoB store apps where installation context = device

  Win32 applications for Windows 10, version 1903 and later, and Windows 11.

  Winget application installed during Windows Autopilo

  Box 2: Deployment profiles

  Join the devices to Azure AD.

  Deployment profiles

  After you have created a device group, you can apply a Windows Autopilot deployment profile to each device in the group. Deployment profiles determine the deployment mode, and customize the OOBE for your end users.

  Note: Create and assign user-driven Azure AD join Autopilot profile

  The Autopilot profile specifies how the device is configured during Windows Setup and what is shown during the out of box experience (OOBE).

  To create a user-driven Azure AD join Autopilot profile, follow these steps: (see step 6 below)

  1.

  Sign in to the Microsoft Intune admin center.

  2.

  In the Home screen, select Devices in the left hand pane.

  3.

  In the Devices | Overview screen, under By platform, select Windows.

  4.

  In the Windows | Windows devices screen, select Windows enrollment.

  5.

  Under Windows Autopilot Deployment Program, select Deployment Profiles.

  6.

  In the Windows Autopilot deployment profiles screen, select Create Profile > Windows PC.

  The Create profile screen opens. In the Basics page:

  * Etc. Details omitted *

  Reference:

  https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-status https://learn.microsoft.com/en-us/autopilot/tutorial/user-driven/azure-ad-join-autopilot-profile