Microsoft Microsoft Certifications MD-102 Questions & Answers

• Question 31:

  You manage 1,000 computers that run Windows 10. All the computers are enrolled in Microsoft Intune. You manage the servicing channel settings of the computers by using Intune.

  You need to review the servicing status of a computer.

  What should you do?

  A. From Device configuration - Profiles, view the device status.

  B. From Software updates, view the Per update ring deployment state.

  C. From Software updates, view the audit logs.

  D. From Device compliance, view the device compliance.

  Correct Answer: B

  Reports for Update rings for Windows 10 and later policy.

  Intune offers integrated report views for the Windows update ring policies you deploy. These views display details about the update ring deployment and status:

  1) Sign in to Microsoft Endpoint Manager admin center.

  2) Select Devices > Monitor. Then under Software updates select Per update ring deployment state and choose the deployment ring to review.

  Note: Windows 10 and later update rings - Use a built-in report that's ready by default when you deploy update rings to your devices.

  Reference:

  https://docs.microsoft.com/en-us/intune/windows-update-compliance-reports

• Question 32:

  You have a Windows 10 device named Device1 that is joined to Active Directory and enrolled in Microsoft Intune.

  Device1 is managed by using Group Policy and Intune.

  You need to ensure that the Intune settings override the Group Policy settings.

  What should you configure?

  A. a device configuration profile

  B. a device compliance policy

  C. an MDM Security Baseline profile

  D. a Group Policy Object (GPO)

  Correct Answer: A

  Creating the policy Let's create a new policy in Intune to control the GP vs. MDM winner 1) Navigate to portal.azure.com and locate Intune 2) Select “Device configuration à Profiles à Create profile” 3) Under Platform select Windows 10 and later 4) Under Profile type select “custom” and “add” 5) Name the custom setting with something intuitive 6) For OMA-URI add the policy OMA-URI string: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP 7) For Data type select Integer and add the number

  Note: The following describes which policy wins according to Windows 10 version.

  Windows 10 versions 1709 and earlier Group Policy will override MDM policies, even if an identical policy is configured in MDM.

  Windows 10 version 1803 and beyond there is a new Policy CSP (configuration service provider) setting called ControlPolicyConflict that includes the policy of MDMWinsOverGP, where the preference of which policy wins can be controlled,

  i.e. Microsoft Intune MDM policy.

  Note 2: the ControlPolicyConflict policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy (GP) are set on the device.

  Reference: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict https://uem4all.com/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/

• Question 33:

  Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains 100 client computers that run Windows 10.

  Currently, your company does NOT have a deployment infrastructure.

  The company purchases Windows 11 licenses through a volume licensing agreement.

  You need to recommend how to upgrade the computers to Windows 11. The solution must minimize licensing costs.

  What should you include in the recommendation?

  A. Windows Autopilot

  B. Configuration Manager

  C. subscription activation

  D. Microsoft Deployment Toolkit (MDT)

  Correct Answer: D

  Subscription activation doesn't update a device from Windows 10 to Windows 11. Only the edition is updated.

• Question 34:

  You manage 1,000 devices by using Microsoft Intune.

  You review the Device compliance trends report.

  For how long will the report display trend data?

  A. 30 days

  B. 60 days

  C. 90 days

  D. 365 days

  Correct Answer: B

  https://learn.microsoft.com/en-us/mem/intune/fundamentals/reports#device-compliance-trends-report-historical

• Question 35:

  You have a Microsoft 365 E5 subscription that contains 100 iOS devices enrolled in Microsoft Intune.

  You need to ensure that notifications of iOS updates are deferred for 30 days after the updates are released.

  What should you create?

  A. an iOS app provisioning profile

  B. a device configuration profile based on the Device features templates

  C. an update policy for iOS/iPadOS

  D. a device configuration profile based on the Device restrictions template

  Correct Answer: D

  https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios#delay-visibility-of-software-updates

• Question 36:

  You have a computer named Computer5 that has Windows 10 installed.

  You create a Windows PowerShell script named config.ps1.

  You need to ensure that config.ps1 runs after feature updates are installed on Computer5.

  Which file should you modify on Computer5?

  A. LiteTouch.wsf

  B. SetupConfig.ini

  C. Unattend.bat

  D. Unattend.xml

  Correct Answer: B

  You can run a post script after a Windows 10 feature upgrade with SetupConfig.ini

  Reference: https://www.joseespitia.com/2017/06/01/how-to-run-a-post-script-after-a-windows-10-feature-upgrade/

• Question 37:

  Your company has devices enrolled in Microsoft Intune as shown in the following table.

  

  In Microsoft Intune admin center, you define the company's network as a location named Location1. Which devices can use network location-based compliance policies?

  A. Device1 only

  B. Device2 only

  C. Device1 and Device2 only

  D. Device2 and Device3 only

  E. Device1, Device2, and Device3

  Correct Answer: E

  Intune supported operating systems

  Intune supports devices running the following operating systems (OS):

  1.

  iOS

  2.

  Android

  3.

  Windows

  4.

  macOS

  Note: View the device compliance settings for the different device platforms:

  1.

  Android device administrator

  2.

  Android Enterprise

  3.

  iOS

  4.

  macOS

  5.

  Windows Holographic for Business

  6.

  Windows 8.1 and later

  7.

  Windows 10/11

  Reference: https://docs.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

• Question 38:

  You have an Azure subscription.

  You have an on-premises Windows 11 device named Device1.

  You plan to monitor Device1 by using Azure Monitor.

  You create a data collection rule (DCR) named DCR1 in the subscription.

  To what should you associate DCR1?

  A. Azure Network Watcher

  B. Device1

  C. a Log Analytics workspace

  D. a Monitored Object

  Correct Answer: C

  https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-overview#supported-regions

• Question 39:

  You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune.

  You plan to manage Microsoft Defender Antivirus on the computers.

  You need to prevent users from disabling Microsoft Defender Antivirus.

  What should you do?

  A. From the Microsoft Intune admin center, create a security baseline.

  B. From the Microsoft 365 Defender portal, enable tamper protection.

  C. From the Microsoft Intune admin center, create an account protection policy.

  D. From the Microsoft Intune admin center, create an endpoint detection and response (EDR) policy.

  Correct Answer: B

  Manage tamper protection for your organization using Microsoft 365 Defender portal

  Tamper protection helps protect certain security settings, such as virus and threat protection, from being disabled or changed. If you're part of your organization's security team, you can turn tamper protection on (or off) tenant wide by using the Microsoft 365 Defender portal (https://security.microsoft.com).

  Reference: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-365-defender

• Question 40:

  You need to implement mobile device management (MDM) for personal devices that run Windows 11. The solution must meet the following requirements:

  1.

  Ensure that you can manage the personal devices by using Microsoft Intune.

  2.

  Ensure that users can access company data seamlessly from their personal devices.

  3.

  Ensure that users can only sign in to their personal devices by using their personal account. What should you use to add the devices to Azure AD?

  A. Azure AD registered

  B. hybrid Azure AD join

  C. Azure AD joined

  Correct Answer: A

  Azure AD registered devices are personal devices that are associated with Azure AD. This allows users to access company data from their personal devices without having to join the devices to the company's domain. Additionally, Azure AD registered devices can be managed by Microsoft Intune.