MD-101 Online Practice Questions and Answers

Correct Answer: A

Re-provision the sales department computers by using Windows AutoPilot. Windows Autopilot Deployment for existing devices, install required modules:

1.

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

2.

Install-Module AzureAD -Force

3.

Install-Module WindowsAutopilotIntune -Force

4.

Install-Module Microsoft.Graph.Intune -Force Reference: https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/existing-devices

Correct Answer: B

Enable co-management in Configuration Manager.

Note: Litware plans to transition to co-management for all the company-owned Windows 10 computers. Whenever possible, Litware wants to minimize hardware and software costs.

Reference:

https://docs.microsoft.com/en-us/sccm/comanage/tutorial-co-manage-clients

Correct Answer: C

ou can configure Windows Hello for Business settings in an Identity protection profile. Identity protection profiles are part of device configuration policy in Microsoft Intune. With an Identity protection profile, you can configure settings on discrete groups of Windows 10/11 devices.

Reference: https://docs.microsoft.com/en-us/intune/protect/identity-protection-windows-settings

Correct Answer: ABD

You can integrate Microsoft Defender for Endpoint with Microsoft Intune as a Mobile Threat Defense solution. Integration can help you prevent security breaches and limit the impact of breaches within an organization. To be successful, you'll use the following configurations in concert:

*

Establish a service-to-service connection between Intune and Microsoft Defender for Endpoint.

*

Use a device configuration profile to onboard devices with Microsoft Defender for Endpoint. You onboard devices to configure them to communicate with Microsoft Defender for Endpoint and to provide data that helps assess their risk level.

*

Use a device compliance policy to set the level of risk you want to allow. Risk levels are reported by Microsoft Defender for Endpoint. Devices that exceed the allowed risk level are identified as noncompliant.

*

Use a conditional access policy to block users from accessing corporate resources from devices that are noncompliant.

Reference: https://docs.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection

Correct Answer: AD

A: Conditional Access allows administrators to control what Office 365 apps users can gain access to based on if they pass/fail certain conditions. These conditions are enforced by building a policy (or multiple policies) to control how users

access your Office 365 resources.

Cloud Apps- What apps do you want to control? Conditional Access does not need to apply to all of Office 365, you can be more granular and just control access to specific apps " E.g. Exchange Online.

Access can be allowed to Office 365 with the following conditions:

*

Require multi-factor authentication " User is allowed in but will need to complete additional security to log in.

*

Etc.

D: The easiest way to block legacy authentication across your entire organization is by configuring a Conditional Access policy that applies specifically to legacy authentication clients and blocks access.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication

Correct Answer: AC

Correct Answer: C

Viewing Windows event logs for Microsoft Defender SmartScreen.

Microsoft Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log, in the Event Viewer.

Reference:

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview#viewing-windows-event-logs-for-microsoft-defender-smartscreen

Correct Answer: A

Before accessing certain cloud apps in your environment, you might want to get consent from users in form of accepting your terms of use (ToU). Azure Active

Directory (Azure AD) Conditional Access provides you with:

A simple method to configure ToU

The option to require accepting your terms of use through a Conditional Access policy.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-tou

Correct Answer: A

Windows 10 supports a Rollback feature that allows you to go back (recover) to the version of Windows (Windows 10, Windows 7 or Windows 8.1) installed on your PC prior to upgrading to the latest version of Windows 10 or Windows 7 / 8.1

1) Click on Start > Settings >

2) In the Windows Setting options click on Update and security

3) In the column of option on the left side of Windows Update click on the 'Recovery' option.

4) Click on 'Get started' to start the Recovery / Rollback process

5) Etc.

Reference:

https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/how-to-recover-restore-your-previous-version-of/94368560-9c64-4387-92b9-82a9234216ad

Correct Answer:

Box 1: No

Device1 belongs to Group2. Group2 has not been assigned a compliance policy. Devices with no compliance policy assigned as Not Compliant. Device1 gets a 3 day grace period, but at August 4 is it marked as Non-compliant.

Box 2: Yes

Device1 belongs to Group2. Group2 has not been assigned a compliance policy. Devices with no compliance policy assigned as Not Compliant. Device1 gets a 3 day grace period, so at August 2 it is compliant.

Box 3: No

Device2 has BitLocker Disabled. The Windows 10 compliance policy applies to Group1 which includes Device1. At August 4 Device is marked noncompliant. 5 days later, at August 9th it is retired.

Note:

*

Retire the noncompliant device: This action removes all company data off the device and removes the device from Intune management.

*

By default, each compliance policy includes the action for noncompliance of Mark device noncompliant with a schedule of zero days (0). The result of this default is when Intune detects a device isn't compliant, Intune immediately marks the

device as noncompliant.

By configuring Actions for noncompliance you gain flexibility to decide what to do about noncompliant devices, and when to do it. For example, you might choose to not block the device immediately, and give the user a grace period to become

compliant.

Compliance status validity period (days):

Specify a period in which devices must successfully report on all their received compliance policies. If a device fails to report its compliance status for a policy before the validity period expires, the device is treated as noncompliant.

Reference: https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started https://docs.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance