MD-102 Self-Study Guide for Becoming an Endpoint Administrator Expert
MD-102 Study Guide Realistic Verified MD-102 Dumps
Microsoft MD-102 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 33
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Directory group named Group1 that contains Windows 10 Enterprise devices and Windows 10 Pro devices.
From Microsoft Intune, you create a device configuration profile named Profile1.
You need to ensure that Profile1 applies to only the Windows 10 Enterprise devices in Group1.
Solution: You configure an applicability rule for Profile1. You assign Profile1 to Group1.
Does this meet the goal?
- A. Yes
- B. No
Answer: A
Explanation:
Applicability rules allow administrators to target devices in a group that meet specific criteria. For example, you create a device restrictions profile that applies to the All Windows 10/11 devices group. And, you only want the profile assigned to devices running Windows Enterprise.
To do this task, create an applicability rule.
Reference:
https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-create
NEW QUESTION # 34
Your network contains an Active Directory domain named adatum.com. The domain contains two computers named Computer1 and Computer2 that run Windows 10. Remote Desktop is enabled on Computer2.
The domain contains the user accounts shown in the following table.
Computer2 contains the local groups shown in the following table.
The relevant user rights assignments for Computed are shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
NEW QUESTION # 35
You have 100 computers that run Windows 10. You have no servers. All the computers are joined to Microsoft Azure Active Directory (Azure AD).
The computers have different update settings, and some computers are configured for manual updates.
You need to configure Windows Update. The solution must meet the following requirements:
The configuration must be managed from a central location.
Internet traffic must be minimized.
Costs must be minimized.
How should you configure Windows Update? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/4-configure-group-policy-settings-for-automatic-updates
NEW QUESTION # 36
Hotspot Question
You have a Microsoft 365 tenant that contains the users shown in the following table.
You have Windows 10 devices enrolled in Microsoft Intune as shown in the following table.
You create a Windows 10 update ring that has the following settings:
Basics:
- Name: Ring1
Update ring settings:
- Active hours start: 8 AM
- Active hours end: 8 PM
Assignments:
- Included Groups: All devices
- Excluded Groups: Group1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Yes
Device1 is a personal device, but personal devices enrolled in Intune are included in the policies unless you use a specific FILTER to exclude personal devices.
Box 2: Yes
Box 3: Yes
You cannot mix User and Device Groups while Excluding groups. It is not supported, and the Excluded group will be ignored.
Reference:
https://docs.microsoft.com/en-us/mem/intune/fundamentals/filters
https://docs.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings
NEW QUESTION # 37
You have a Microsoft Intune subscription.
You are creating a Windows Autopilot deployment profile named Profile1 as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 38
Hotspot Question
Your network contains an Active Directory domain named adatum.com. The domain contains two computers named Computer1 and Computer2 that run Windows 10. Remote Desktop is enabled on Computer2.
The domain contains the user accounts shown in the following table.
Computer2 contains the local groups shown in the following table.
The relevant user rights assignments for Computer2 are shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 39
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
A screenshot of a computer Description automatically generated with medium confidence
NEW QUESTION # 40
Your network contains an Active Directory domain named adatum.com, a workgroup, and computers that run Windows 10. The computers are configured as shown in the following table.
The local Administrator accounts on Computed, Computed, and Computed have the same user name and password.
On Computed. Windows Defender Firewall is configured as shown in the following exhibit.
Answer:
Explanation:
NEW QUESTION # 41
You have a Microsoft 365 tenant and an internal certification authority (CA).
You need to use Microsoft Intune to deploy the root CA certificate to managed devices.
Which type of Intune policy and profile should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Box 1: Configuration profile
Create a trusted certificate profile.
Box 2: Trusted certificate
When using Intune to provision devices with certificates to access your corporate resources and network, use a trusted certificate profile to deploy the trusted root certificate to those devices. Trusted root certificates establish a trust from the device to your root or intermediate (issuing) CA from which the other certificates are issued.
Reference: https://docs.microsoft.com/en-us/mem/intune/protect/certificates-trusted-root
NEW QUESTION # 42
You have SOO Windows 10 devices enrolled in Microsoft Intune.
You plan to use Exploit protection in Microsoft Intune to enable the following system settings on the devices:
* Data Execution Prevention (DEP)
* Force randomization for images (Mandatory ASlR)
You need to configure a Windows 10 device that will be used to create a template file.
Which protection areas on the device should you configure in the Windows Security app before you create the template file? To answer, drag the appropriate protection areas to the correct settings. Each protection area may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 43
Which devices are registered by using the Windows Autopilot deployment service?
- A. Device3 only
- B. Device1 and Device3 only
- C. Device1 only
- D. Device1, Device2, and Device3
Answer: B
Explanation:
Scenario: Windows Autopilot Configuration
Assignments
Included groups: Group1
Excluded groups: Group2
Device1 is member of Group1.
Device2 is member of Group1 and member of Group2.
Device3 is member of Group1.
Group1 and Group2 have a Membership type of Assigned.
Exclusion takes precedence over inclusion in the following same group type scenarios.
Reference: https://learn.microsoft.com/en-us/mem/intune/apps/apps-inc-exl-assignments
Topic 3, Contoso Ltd, Case 2
Overview
Contoso, Ltd, is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.
Contoso has the users and computers shown in the following table.
The company has IT, human resources (HR), legal (LEG), marketing (MKG) and finance (FIN) departments.
Contoso uses Microsoft Store for Business and recently purchased a Microsoft 365 subscription.
The company is opening a new branch office in Phoenix. Most of the users in the Phoenix office will work from home.
Existing Environment
The network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD).
All member servers run Windows Server 2016. All laptops and desktop computers run Windows 10 Enterprise.
The computers are managed by using Microsoft System Center Configuration Manager. The mobile devices are managed by using Microsoft Intune.
The naming convention for the computers is the department acronym, followed by a hyphen, and then four numbers, for example, FIN-6785. All the computers are joined to the on-premises Active Directory domain.
Each department has an organization unit (OU) that contains a child OU named Computers. Each computer account is in the Computers OU of its respective department.
Intune Configuration
Requirements
Planned Changes
Contoso plans to implement the following changes:
* Provide new computers to the Phoenix office users. The new computers have Windows 10 Pro preinstalled and were purchased already.
* Start using a free Microsoft Store for Business app named App1.
* Implement co-management for the computers.
Technical Requirements:
Contoso must meet the following technical requirements:
* Ensure that the users in a group named Group4 can only access Microsoft Exchange Online from devices that are enrolled in Intune.
* Deploy Windows 10 Enterprise to the computers of the Phoenix office users by using Windows Autopilot.
* Monitor the computers in the LEG department by using Windows Analytics.
* Create a provisioning package for new computers in the HR department.
* Block iOS devices from sending diagnostic and usage telemetry data.
* Use the principle of least privilege whenever possible.
* Enable the users in the MKG department to use App1.
* Pilot co-management for the IT department.
NEW QUESTION # 44
You have the Microsoft Deployment Toolkit (MDT) installed.
You install and customize Windows 11 on a reference computer.
You need to capture an image of the reference computer and ensure that the image can be deployed to multiple computers.
Which command should you run before you capture the image?
- A. dism
- B. sysprep
- C. bcdedit
- D. wpeinit
Answer: B
Explanation:
Sysprep (System Preparation) prepares a Windows client or Windows Server installation for imaging. Sysprep can remove PC-specific information from a Windows installation (generalizing) so it can be installed on different PCs.
Reference:
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/sysprep--system- preparation--overview
NEW QUESTION # 45
You install a feature update on a computer that runs Windows 10.
How many days do you have to roll back the update?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Microsoft has changed the time period associated with operating system rollbacks with Windows
10 version 1607, decreasing it to 10 days. Previously, Windows 10 had a 30-day rollback period.
https://redmondmag.com/articles/2016/08/04/microsoft-shortens-windows-10-rollback-period.aspx
NEW QUESTION # 46
You have a Microsoft Intune subscription.
You have devices enrolled in intune as shown in the following table.
An app named App1 is installed on each device.
What is the minimum number of app configuration policies required to manage Appl ?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
Answer: E
Explanation:
The correct answer is B because you need to create two app configuration policies for managed devices, one for iOS/iPadOS devices and one for Android devices1. App configuration policies let you customize the settings of apps for iOS/iPadOS or Android devices1. The settings are assigned to user groups and applied when the app runs1. The app developer or supplier provides the configuration settings (keys and values) that are exposed to Intune1. You can't use a single app configuration policy for both iOS/iPadOS and Android devices because they have different configuration settings2. Reference: 1: App configuration policies for Microsoft Intune | Microsoft Learn https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-overview 2: Add app configuration policies for managed iOS/iPadOS devices | Microsoft Learn https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios
NEW QUESTION # 47
You have a Microsoft 365 E5 subscription.
You use Microsoft Intune to manage all devices.
You need to prepare a Win32 app named App1.exe for deployment.
What should you do first?
- A. Change App1.exe to the INTUNEWIN format.
- B. From the Microsoft Intune admin center, create an app configuration policy.
- C. Upload App1.exe to Azure Blob Storage.
- D. From the Microsoft 365 Apps admin center, create a deployment configuration.
Answer: A
NEW QUESTION # 48
You have a Microsoft 365 E5 subscription.
All devices are enrolled in Microsoft Intune.
You need to ensure that devices that have NOT checked in for 30 days are deleted from intune.
What should you configure from the Microsoft Intune admin center?
- A. a device clean-up rule
- B. a configuration profile
- C. a device limit restriction
- D. automatic enrollment
Answer: A
NEW QUESTION # 49
You have the devices shown in the following table.
You need to migrate app data from Device1 to Device2. The data must be encrypted and stored on Seryer1 during the migration.
Which command should you run on each device? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
NEW QUESTION # 50
You need to assign the same deployment profile to all the computers that are configured by using Windows Autopilot.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: each correct selection is worth one point.
- A. Join the computers to Microsoft Azure Active Directory (Azure AD)
- B. Create a Microsoft Azure Active Directory (Azure AD) group that has dynamic membership rules and uses the ZTDID tag
- C. Join the computers to an on-premises Active Directory domain
- D. Assign a Windows AutoPilot deployment profile to a group
- E. Create a Group Policy object (GPO) that is linked to a domain
- F. Create a Microsoft Azure Active Directory (Azure AD) group that has dynamic membership rules and uses the operatingSystem tag
Answer: B,D
Explanation:
B: It is possibly to automatically assign a Windows AutoPilot deployment profile to Windows AutoPilot devices. That makes it a lot easier for administrators, as this prevents the administrators from potentially forgetting to assign the deployment profile to newly imported devices.
F: ZTDId: A unique value assigned to all imported Windows AutoPilot devices.
Reference:
https://www.petervanderwoude.nl/post/automatically-assign-windows-autopilot-deployment- profile-to-windows-autopilot-devices/
NEW QUESTION # 51
You have a Microsoft 365 E5 subscription that contains a group named Group1.
You create a Conditional Access policy named CAPolicy1 and assign CAPolicy1 to Group1.
You need to configure CAPolicy1 to require the members of Group1 to reauthenticate every eight hours when they connect to Microsoft Exchange Online.
What should you configure?
- A. an assignment that uses a Sign-in risk condition
- B. Grant access controls
- C. Session access controls
- D. an assignment that uses a User risk condition
Answer: C
Explanation:
Explanation
User sign-in frequency
Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource.
The Azure Active Directory (Azure AD) default configuration for user sign-in frequency is a rolling window of 90 days.
Sign-in frequency control
Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.
Browse to Azure Active Directory > Security > Conditional Access.
Select New policy.
Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
Choose all required conditions for customer's environment, including the target cloud apps.
Under Access controls > Session.
Select Sign-in frequency.
Choose Periodic reauthentication and enter a value of hours or days or select Every time.
Save your policy.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-life
NEW QUESTION # 52
You have a Microsoft Deployment Toolkit (MDT) solution that is used to manage Windows 11 deployment tasks.
MDT contains the operating system images shown in the following table.
You need to perform a Windows 11 in-place upgrade on several computers that run Windows 10.
From the Deployment Workbench, you open the New Task Sequence Wizard.
You need to identify which task sequence template and which operating system image to use for the task sequence. The solution must minimize administrative effort.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Box 1: Standard Client Upgrade Task Sequence
Use Template: Standard Client Upgrade Task Sequence
In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple.
Box 2: Install.wim
In-place upgrade differs from computer refresh in that you cannot use a custom image to perform the in-place upgrade. I Reference:
https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-m
NEW QUESTION # 53
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Microsoft Intune to manage devices.
You need to configure an update ring that meets the following requirements:
* Fixes and improvements to existing Windows functionality can be deferred for 14 days but will install automatically seven days after that date.
* The installation of new Windows features can be deferred for 90 days but will install automatically 10 days after that date.
* Devices must restart automatically three days after an update is installed.
How should you configure the update ring? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
90
14
10
3
NEW QUESTION # 54
......
Valid MD-102 Exam Dumps Ensure you a HIGH SCORE: https://measureup.preppdf.com/Microsoft/MD-102-prepaway-exam-dumps.html