Updated Managing Modern Desktops Exam MD-101 Questions V14.02

1. Topic 1, Litware inc

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question.

General Overview

Litware, Inc. is an international manufacturing company that has 3,000 employees. The company has sales, marketing, research, human resources (HR), development, and IT departments.

Litware has two main offices in New York and Los Angeles. Litware has five branch offices in Asia.

Existing Environment

Current Business Model

The Los Angeles office has 500 developers. The developers work flexible hours ranging from 11 AM to 10 PM.

Litware has a Microsoft System Center 2012 R2 Configuration Manager deployment.

During discovery, the company discovers a process where users are emailing bank account information of its customers to internal and external recipients.

Current Environment

The network contains an Active Directory domain that is synced to Microsoft Azure Active Directory (Azure AD). The functional level of the forest and the domain is Windows Server 2012 R2. All domain controllers run Windows Server 2012 R2.

Litware has the computers shown in the following table.

The development department uses projects in Azure DevOps to build applications.

Most of the employees in the sales department are contractors. Each contractor is assigned a computer that runs Windows 10. At the end of each contract, the computer is assigned to a different contractor. Currently, the computers are re-provisioned manually by the IT department.

Problem Statements

Litware identifies the following issues on the network:

- Employees in the Los Angeles office report slow Internet performance when updates are downloading. The employees also report that the updates frequently consume considerable resources when they are installed. The Update settings are configured as shown in the Updates exhibit. (Click the Updates button.)

- Management suspects that the source code for the proprietary applications in Azure DevOps in being shared externally.

- Re-provisioning the sales department computers is too time consuming.

Requirements

Business Goals

Litware plans to transition to co-management for all the company-owned Windows 10 computers.

Whenever possible, Litware wants to minimize hardware and software costs.

Device Management Requirements

Litware identifies the following device management requirements:

- Prevent the sales department employees from forwarding email that contains bank account information.

- Ensure that Microsoft Edge Favorites are accessible from all computers to which the developers sign in.

- Prevent employees in the research department from copying patented information from trusted applications to untrusted applications.

Technical Requirements

Litware identifies the following technical requirements for the planned deployment:

- Re-provision the sales department computers by using Windows AutoPilot.

- Ensure that the projects in Azure DevOps can be accessed from the corporate network only.

- Ensure that users can sign in to the Azure AD-joined computers by using a PIN. The PIN must expire every 30 days.

- Ensure that the company name and logo appears during the Out of Box Experience (OOBE) when using Windows AutoPilot.

Exhibits

Updates

HOTSPOT

You need to recommend a solution to meet the device management requirements.

What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

2. You need to meet the device management requirements for the developers.

What should you implement?

3. HOTSPOT

You need to meet the OOBE requirements for Windows AutoPilot.

Which two settings should you configure from the Azure Active Directory blade? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

4. HOTSPOT

You need to resolve the performance issues in the Los Angeles office.

How should you configure the update settings? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

5. What should you upgrade before you can configure the environment to support co-management?

6. You need to capture the required information for the sales department computers to meet the technical

requirements.

Which Windows PowerShell command should you run first?

7. What should you use to meet the technical requirements for Azure DevOps?

8. What should you configure to meet the technical requirements for the Azure AD-joined computers?

9. HOTSPOT

You need to meet the technical requirements for Windows AutoPilot.

Which two settings should you configure from the Azure Active Directory blade? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

10. Topic 2, Contoso Ltd

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question.

Overview

Contoso, Ltd, is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.

Contoso has the users and computers shown in the following table.

The company has IT, human resources (HR), legal (LEG), marketing (MKG) and finance (FIN) departments.

Contoso uses Microsoft Store for Business and recently purchased a Microsoft 365 subscription.

The company is opening a new branch office in Phoenix. Most of the users in the Phoenix office will work from home.

Existing Environment

The network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD).

All member servers run Windows Server 2016. All laptops and desktop computers run Windows 10 Enterprise.

The computers are managed by using Microsoft Endpoint Configuration Manager. The mobile devices are managed by using Microsoft Intune.

The naming convention for the computers is the department acronym, followed by a hyphen, and then four numbers, for example, FIN-6785. All the computers are joined to the on-premises Active Directory domain.

Each department has an organizational unit (OU) that contains a child OU named Computers. Each computer account is in the Computers OU of its respective department.

Intune Configuration

The domain has the users shown in the following table.

User2 is a device enrollment manager (DEM) in Intune.

The devices enrolled in Intune are shown in the following table.

The device compliance policies in Intune are configured as shown in the following table.

The device compliance policies have the assignments shown in the following table.

The device limit restrictions in Intune are configured as shown in the following table.

Requirements

Planned Changes

Contoso plans to implement the following changes:

- Provide new computers to the Phoenix office users. The new computers have Windows 10 Pro preinstalled and were purchased already.

- Start using a free Microsoft Store for Business app named App1.

- Implement co-management for the computers.

Technical Requirements :

Contoso must meet the following technical requirements:

- Ensure that the users in a group named Group4 can only access Microsoft Exchange Online from devices that are enrolled in Intune.

- Deploy Windows 10 Enterprise to the computers of the Phoenix office users by using Windows Autopilot.

- Monitor the computers in the LEG department by using Windows Analytics.

- Create a provisioning package for new computers in the HR department.

- Block iOS devices from sending diagnostic and usage telemetry data.

- Use the principle of least privilege whenever possible.

- Enable the users in the MKG department to use App1.

- Pilot co-management for the IT department.

DRAG DROP

You need to meet the technical requirements for the LEG department computers.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

11. You need to meet the requirements for the MKG department users.

What should you do?

12. HOTSPOT

You need to meet the technical requirements for the new HR department computers.

How should you configure the provisioning package? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

13. HOTSPOT

You need a new conditional access policy that has an assignment for Office 365 Exchange Online.

You need to configure the policy to meet the technical requirements for Group4.

Which two settings should you configure in the policy? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

14. You need to meet the technical requirements for the iOS devices.

Which object should you create in Intune?

15. You need to prepare for the deployment of the Phoenix office computers.

What should you do first?

16. HOTSPOT

You are evaluating which devices are compliant.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

17. HOTSPOT

What is the maximum number of devices that User1 and User2 can enroll in Intune? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

18. HOTSPOT

To which devices do Policy1 and Policy2 apply? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

19. You need to meet the technical requirements for the IT department.

What should you do first?

20. You need to prepare for the deployment of the Phoenix office computers.

What should you do first?

21. Topic 3, Misc. Questions

You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

You redirect Windows known folders to Microsoft OneDrive for Business.

Which folder will be included in the redirection?

22. You have computers that run Windows 10 and are managed by using Microsoft Intune.

Users store their files in a folder named D:Folder1.

You need to ensure that only a trusted list of applications is granted write access to D:Folder1.

What should you configure in the device configuration profile?

23. You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

You redirect Windows known folders to Microsoft OneDrive for Business.

Which folder will be included in the redirection?

24. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these

questions will not appear in the review screen.

Your company uses Windows AutoPilot to configure the computer settings of computers issued to users.

A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company.

You plan to transfer the computer to a user named User2.

You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.

Solution: You create a new Windows AutoPilot self-deploying deployment profile.

Does this meet the goal?

25. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these

questions will not appear in the review screen.

Your company uses Windows AutoPilot to configure the computer settings of computers issued to users.

A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company.

You plan to transfer the computer to a user named User2.

You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.

Solution: You perform a remote Windows AutoPilot Reset.

Does this meet the goal?

26. DRAG DROP

Your company uses Microsoft Intune. You have a Microsoft Store for Business account.

You need to ensure that you can deploy Microsoft Store for Business apps by using Intune.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

27. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory domain. The domain contains member computers that run Windows 8.1 and are enrolled in Microsoft Intune.

You need to identify which computers can be upgraded to Windows 10.

Solution: You install the Microsoft Assessment and Planning Toolkit. From the Microsoft Assessment and Planning Toolkit, you collect inventory data and run the Windows 10 Readiness scenario.

Does this meet the goal?

28. HOTSPOT

You have a Microsoft 365 subscription.

Users have iOS devices that are not enrolled in Microsoft 365 Device Management.

You create an app protection policy for the Microsoft Outlook app as shown in the exhibit. (Click the Exhibit tab.)

You need to configure the policy to meet the following requirements:

✑ Prevent the users from using the Outlook app if the operating system version is less than 12.0.0.

✑ Require the users to use an alphanumeric passcode to access the Outlook app.

What should you configure in an app protection policy for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

29. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.

You configure the following device settings for the tenant:

✑ Users may join devices to Azure AD: User1

✑ Additional local administrators on Azure AD joined devices: None

You install Windows 10 on a computer named Computer1.

You need to identify which users can join Computer1 to adatum.com, and which users will be added to the Administrators group after joining adatum.com.

Which users should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

30. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You need to ensure that feature and quality updates install automatically during a maintenance window.

Solution: From the Windows Update settings, you enable Configure Automatic Updates, select 3 C Auto

download and notify for Install, and then enter a time.

Does this meet the goal?

31. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your network contains an Active Directory domain. The domain contains member computers that run Windows 8.1 and are enrolled in Microsoft Intune.

You need to identify which computers can be upgraded to Windows 10.

Solution: From the Microsoft Endpoint Manager admin center, you create a device compliance policy and assign the policy to the computers. After 24 hours, you view the

Device compliance report in Intune.

Does this meet the goal?

32. HOTSPOT

You have a hybrid Microsoft Azure Active Directory (Azure AD) tenant.

You configure a Windows Autopilot deployment profile as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

33. Your network contains an Active Directory domain named contoso.com that syncs to Azure Active Directory (Azure AD).

Existing on-premises computers are managed by using Microsoft System Center Configuration Manager (Current Branch). You configure contoso.com for co-management.

You deploy 100 new devices that run Windows 10. The devices are joined to Azure AD and enrolled in Microsoft Intune.

You need to ensure that the devices are co-managed.

What should you create in Intune first?

34. Your company has several Windows 10 devices that are enrolled in Microsoft Inline.

You deploy a new computer named Computer1 that runs Windows 10 and is in a workgroup.

You need to enroll Computer1 in Intune.

Solution: From Computer1, you sign in to https://portal.azure.com and use the Windows enrollment blade.

Does this meet the goal?

35. DRAG DROP

You have five computers that runs Windows 10.

You need to create a provisioning package to configure the computers to meet the following requirements:

✑ Run an interactive app.

✑ Automatically sign in by using a local user account.

✑ Prevent users from accessing the desktop and running other applications.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

36. HOTSPOT

You have a Microsoft Intune subscription that has the following device compliance policy settings:

Mark devices with no compliance policy assigned as: Compliant Compliance status validity period (days): 14

On January 1, you enroll Windows 10 devices in Intune as shown in the following table.

On January 4, you create the following two device compliance policies:

✑ Name: Policy1

✑ Platform: Windows 10 and later

✑ Require BitLocker: Require

✑ Mark device noncompliant: 5 days after noncompliance

✑ Scope (Tags): Tag1

✑ Name: Policy2

✑ Platform: Windows 10 and later

✑ Firewall: Require

✑ Mark device noncompliant: Immediately

✑ Scope (Tags): Tag2

On January 5, you assign Policy1 and Policy2 to Group1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

37. HOTSPOT

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. All Windows 10 devices are enrolled in Microsoft Intune.

You configure the following settings in Windows Information Protection (WIP):

✑ Protected apps: App1

✑ Exempt apps: App2

✑ Windows Information Protection mode: Silent

App1, App2, and App3 use the same file format.

You create a file named File1 in App1.

You need to identify which apps can open File1.

What apps should you identify? To answer, select the appropriate options in the answer area,

NOTE: Each correct selection is worth one point.

38. Your network contains an Active Directory domain. The domain contains 2,000 computers that run Windows 10.

You implement hybrid Microsoft Azure Active Directory (Azure AD) and Microsoft Intune.

You need to automatically register all the existing computers to Azure AD and enroll the computers in Intune.

The solution must minimize administrative effort.

What should you use?

39. You have 100 devices that run Windows 10 and are joined to Microsoft Azure Active Directory (Azure AD).

You need to prevent users from joining their home computer to Azure AD.

What should you do?

40. HOTSPOT

Your company has computers that run Windows 10. The employees at the company use the computers.

You plan to monitor the computers by using the Update Compliance solution.

You create the required resources in Azure.

You need to configure the computers to send enhanced Update Compliance data.

Which two Group Policy settings should you configure? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

41. HOTSPOT

Your company has a Microsoft Azure Active Directory (Azure AD) tenant and computers that run Windows 10.

The company uses Microsoft Intune to manage the computers.

The Azure AD tenant has the users shown in the following table.

The device type restrictions in Intune are configured as shown in the following table:

User3 is a device enrollment manager (DEM) in Intune.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

42. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your company uses Windows Update for Business.

The research department has several computers that have specialized hardware and software installed.

You need to prevent the video drivers from being updated automatically by using Windows Update.

Solution: From the Device Installation and Restrictions settings in a Group Policy object (GPO), you enable Prevent installation of devices using drivers that match these device setup classes, and then you enter the device GUID.

Does this meet the goal?

43. You manage a Microsoft 365 environment that has co-management enabled.

All computers run Windows 10 and are deployed by using the Microsoft Deployment Toolkit (MDT).

You need to recommend a solution to deploy Microsoft Office 365 ProPlus to new computers. The latest version must always be installed. The solution must minimize administrative effort.

What is the best tool to use for the deployment? More than one answer choice may achieve the goal. Select the BEST answer.

44. Your company purchases new computers that run Windows 10. The computers have cameras that support Windows Hello for Business.

You configure the Windows Hello for Business Group Policy settings as shown in the following exhibit.

What are two valid methods a user can use to sign in? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

45. HOTSPOT

Your company has an infrastructure that has the following:

✑ A Microsoft 365 tenant

✑ An Active Directory forest

✑ Microsoft Store for Business

✑ A Key Management Service (KMS) server

✑ A Windows Deployment Services (WDS) server

✑ A Microsoft Azure Active Directory (Azure AD) Premium tenant The company purchases 100 new computers that run Windows 10.

You need to ensure that the new computers are joined automatically to Azure AD by using Windows AutoPilot.

What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

46. DRAG DROP

Your company has a Microsoft Azure Active Directory (Azure AD) tenant.

The company uses Microsoft Intune to manage iOS, Android, and Windows 10 devices.

The company plans to purchase 1,000 iOS devices. Each device will be assigned to a specific user.

You need to ensure that the new iOS devices are enrolled automatically in Intune when the assigned user signs in for the first time.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

47. HOTSPOT

You have 1,000 computers that run Windows 10 and are members of an Active Directory domain.

You create a workspace in Microsoft Azure Log Analytics.

You need to capture the event logs from the computers to Azure.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

48. You enable controlled folder access in audit mode for several computers that run Windows 10. You need to review the events audited by controlled folder access.

Which Event Viewer log should you view?

49. You have 500 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

You plan to distribute certificates to the computers by using Simple Certificate Enrollment Protocol (SCEP).

You have the servers shown in the following table.

NDES issues certificates from the subordinate CA.

You are configuring a device profile as shown in the exhibit. (Click the Exhibit tab.)

You need to complete the SCEP profile.

50. Your company has a System Center Configuration Manager deployment that uses hybrid mobile device management (MDM). All Windows 10 devices are Active Directory domain-joined.

You plan to migrate from hybrid MDM to Microsoft Intune standalone.

You successfully run the Intune Data Importer tool.

You need to complete the migration.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

51. You have a Microsoft 365 subscription.

You have a conditional access policy that requires multi-factor authentication (MFA) for users in a group name Sales when the users sign in from a trusted location.

The policy is configured as shown in the exhibit. (Click the Exhibit tab.)

You create a compliance policy.

You need to ensure that the users are authenticated only if they are using a compliant device.

What should you configure in the conditional access policy?

52. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a computer that runs Windows 8.1.

Two days ago, you upgraded the computer to Windows 10.

You need to downgrade the computer to Windows 8.1.

Solution: From the Settings app, you use the Recovery options.

Does this meet the goal?

53. HOTSPOT

You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.

You need to configure an Intune device configuration profile to meet the following requirements:

✑ Prevent Microsoft Office applications from launching child processes.

✑ Block users from transferring files over FTP.

Which two settings should you configure in Endpoint protection? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

54. HOTSPOT

You have computers that run Windows 10 as shown in the following table.

Computer2 and Computer3 are enrolled in Microsoft Intune.

In a Group Policy object (GPO) linked to the domain, you enable the Computer Configuration/Administrative Templates/Windows Components/Search/Allow Cortana setting.

In an Intune device configuration profile, you configure the following:

✑ Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP to a value of 1

✑ Experience/AllowCortana to a value of 0.

Each of the following statement, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

55. You have a Microsoft 365 subscription.

You have 10 computers that run Windows 10 and are enrolled in mobile device management (MDM)

You need to deploy the Microsoft Office 365 ProPlus suite to all the computers.

What should you do?

56. You have a Microsoft 365 subscription. All devices run Windows 10.

You need to prevent users from enrolling the devices in the Windows Insider Program.

What two configurations should you perform from Microsoft 365 Device Management? Each correct answer is a complete solution. NOTE: Each correct selection is worth one point.

57. You have a Microsoft 365 subscription.

You need to deploy Microsoft Office 365 ProPlus applications to Windows 10 devices.

What should you do first?

58. Your network contains an Active Directory domain named contoso.com that syncs to Azure Active Directory (Azure AD).

The Active Directory domain contains 200 computers that run Windows 10. The computers are managed by using Microsoft System Center Configuration Manager (Current Branch).

You need to pilot co-management for only five of the computers.

What should you create first?

59. HOTSPOT

Your network contains an Active Directory domain named contoso.com that syncs to Azure Active Directory (Azure AD). The domain contains computers that run Windows 10.

The computers are configured as shown in the following table.

All the computers are enrolled in Microsoft Intune.

You configure the following Maintenance Scheduler settings in the Default Domain Policy:

✑ Turn off auto-restart for updates during active hours: Enabled

✑ Active hours start: 08:00

✑ Active hours end: 22:00

In Intune, you create a device configuration profile named Profile1 that has the following

OMA-URI settings:

✑ ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP set to value 1

✑ ./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursStart set to value 9

✑ ./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursEnd set to value 21

You assign Profile to Group1.

How are the active hours configured on Computer1 and Computer2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

60. HOTSPOT

You have a Microsoft 365 subscription.

You need to configure access to Microsoft Office 365 for unmanaged devices.

The solution must meet the following requirements:

✑ Allow only the Microsoft Intune Managed Browser to access Office 365 web interfaces.

✑ Ensure that when users use the Intune Managed Browser to access Office 365 web interfaces, they can only copy data to applications that are managed by the company.

Which two settings should you configure from the Microsoft Intune blade? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

Which devices can be configured by using Windows Autopilot self-deploying mode?

61. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these

questions will not appear in the review screen.

Your company uses Windows Update for Business.

The research department has several computers that have specialized hardware and software installed.

You need to prevent the video drivers from being updated automatically by using Windows Update.

Solution: From the Settings app, you clear the Give me updates for other Microsoft products when I

update Windows check box.

Does this meet the goal?

62. Your company has a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. All users have computers that run Windows 10. The computers are joined to Azure AD and managed by using Microsoft Intune.

You need to ensure that you can centrally monitor the computers by using the Update Compliance solution.

What should you create in Intune?

63. Your company implements Microsoft Azure Active Directory (Azure AD), Microsoft 365, Microsoft Intune, and Azure Information Protection.

The company’s security policy states the following:

✑ Personal devices do not need to be enrolled in Intune.

✑ Users must authenticate by using a PIN before they can access corporate email data.

✑ Users can use their personal iOS and Android devices to access corporate cloud services.

✑ Users must be prevented from copying corporate email data to a cloud storage service other than Microsoft OneDrive for Business.

You need to configure a solution to enforce the security policy.

What should you create?

64. You have a computer named Computer1 that runs Windows 10. Computer is used by a user named User1.

You need to ensure that when User1 opens websites from untrusted locations by using Microsoft Edge, Microsoft Edge runs in isolated container.

What should you do first?

65. You manage 1,000 computers that run Windows 10. All the computers are enrolled in Microsoft Intune. You manage the servicing channel settings of the computers by using Intune.

You need to review the servicing status of a computer.

What should you do?

66. You have 10 computers that run Windows 7 and have the following configurations:

✑ A single MBR disk

✑ A disabled TPM chip

✑ Disabled hardware virtualization

✑ UEFI firmware running in BIOS mode

✑ Enabled Data Execution Prevention (DEP) You plan to upgrade the computers to Windows 10.

You need to ensure that the computers can use Secure Boot.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

67. HOTSPOT

You have devices enrolled in Microsoft Intune as shown in the following table.

You create device configuration profiles in Intune as shown in the following table.

You assign the device configuration profiles to groups as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

68. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Directory group named Group1 that contains Windows 10 Enterprise devices and Windows 10 Pro devices.

From Microsoft Intune, you create a device configuration profile named Profile1.

You need to ensure that Profile1 applies to only the Windows 10 Enterprise devices in Group1.

Solution: You create an Azure Active Directory group that contains only the Windows 10 Enterprise devices. You assign Profile1 to the new group.

Does this meet the goal?

69. Your company plans to deploy Windows 10 to device that will be configured for Englis use and other devices that will be configured for Korean use.

You need to create a single multivariate provisioning for the planned for the planned devices.

You create the provisioning package.

What should do you next to add the language settings to the package?

70. HOTSPOT

You have a Microsoft Intune subscription.

You create the Windows Autopilot deployment profile-shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.