MD-102 Online Practice Questions and Answers

Correct Answer: E

Create a Conditional Access policy (see step 7 below).

The following steps will help create a Conditional Access policy to block legacy authentication requests. This policy is put in to Report-only mode to start so administrators can determine the impact they'll have on existing users. When

administrators are comfortable that the policy applies as they intend, they can switch to On or stage the deployment by adding specific groups and excluding others.

Sign in to the Azure portal as a Conditional Access Administrator, Security Administrator, or Global Administrator.

Browse to Azure Active Directory > Security > Conditional Access.

Select New policy.

Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.

Under Assignments, select Users or workload identities.

Under Include, select All users.

Under Exclude, select Users and groups and choose any accounts that must maintain the ability to use legacy authentication. Exclude at least one account to prevent yourself from being locked out. If you don't exclude any account, you won't

be able to create this policy.

6.

Under Cloud apps or actions, select All cloud apps.

7.

Under Conditions > Client apps, set Configure to Yes.

Check only the boxes Exchange ActiveSync clients and Other clients.

Select Done.

8.

Under Access controls > Grant, select Block access.

Select Select.

9.

Confirm your settings and set Enable policy to Report-only.

10.

Select Create to create to enable your policy.

After confirming your settings using report-only mode, an administrator can move the Enable policy toggle from Report-only to On.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy

Correct Answer: D

Android Enterprise device settings list to allow or restrict features on corporate-owned devices using Intune

Device experience Use these settings to configure a kiosk-style experience on your dedicated devices, or to customize the home screen experiences on your fully managed devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available.

Note: You can control and restrict on Android Enterprise devices owned by your organization. As part of your mobile device management (MDM) solution, use these settings to allow or disable features, run apps on dedicated devices, control security, and more.

This feature applies to:

1.

Android Enterprise corporate-owned work profile (COPE)

2.

Android Enterprise corporate owned fully managed (COBO)

3.

Android Enterprise corporate owned dedicated devices (COSU)

Reference: https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android-for-work

Correct Answer: A

Correct Answer: A

Hello for Business is an alternative sign-in method that uses Active Directory or an Azure Active Directory account to replace a password, smart card, or a virtual smart card. It lets you use a user gesture to sign in, instead of a password. A

user gesture might be a PIN, biometric authentication such as Windows Hello, or an external device such as a fingerprint reader.

Intune integrates with Hello for Business in two ways:

An Intune policy can be created under Device enrollment. This policy targets the entire organization (tenant-wide). It supports the Windows AutoPilot out-of-box-experience (OOBE) and is applied when a device enrolls.

An identity protection profile can be created under Device configuration. This profile targets assigned users and devices, and is applied during check-in.

Reference:

https://docs.microsoft.com/en-us/intune/protect/windows-hello

Correct Answer: D

https://learn.microsoft.com/en-us/mem/analytics/data-collection https://learn.microsoft.com/en-us/mem/analytics/enroll-intune#bkmk_onboard

Correct Answer: A

Correct Answer: B

Reports for Update rings for Windows 10 and later policy.

Intune offers integrated report views for the Windows update ring policies you deploy. These views display details about the update ring deployment and status:

1) Sign in to Microsoft Endpoint Manager admin center.

2) Select Devices > Monitor. Then under Software updates select Per update ring deployment state and choose the deployment ring to review.

Note: Windows 10 and later update rings - Use a built-in report that's ready by default when you deploy update rings to your devices.

Reference:

https://docs.microsoft.com/en-us/intune/windows-update-compliance-reports

Correct Answer: B

Mobile Application Management (MAM)

Common Conditional Access policy: Require approved client apps or app protection policy

In Conditional Access policy, you can require that an Intune app protection policy is present on the client app before access is available to the selected applications. These mobile application management (MAM) app protection policies allow

you to manage and protect your organization's data within specific applications.

To apply this grant control, Conditional Access requires that the device is registered in Microsoft Entra ID, which requires using a broker app. The broker app can be either Microsoft Authenticator for iOS or Microsoft Company Portal for

Android devices. If a broker app isn't installed on the device when the user attempts to authenticate, the user is redirected to the app store to install the broker app. App protection policies are generally available for iOS and Android, and in

public preview for Microsoft Edge on Windows

Reference:

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant#require-app-protection-policy

Correct Answer: A

Create the deployment task sequence.

The task sequence used to deploy your production Windows 10 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server.

This includes: Specify Product Key: Do not specify a product key at this time

Reference:

https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt#a-href-idsec08astep-8-deploy-the-windows-10-client-image

Correct Answer: D

Both Personal and Corporate devices can be enrolled to Intune, the network boundary can be assigned to enrolled Windows 10/11 devices. https://learn.microsoft.com/en-us/mem/intune/configuration/network-boundary-windows

The Boundary is assigned to Group 1 and 2, Devices 1,2,3 and 4 have membership to these groups. Device 5 is not part of the membership for Group 1 and 2 so doesnt receive the policy.