HOTSPOT (Drag and Drop is not supported)You have an Azure AD tenant named contoso.com that contains the users shown in the following table.For contoso.com, the Mobility (MDM and MAM) settings have the following configurations:MDM user scope: Group1MAM user scope: Group2You purchase the devices shown in the following table:For each of the following statements, select Yes if the statement is true. Otherwise, select No.Hot Area:
Answer(s): A
Box 1: YesUser1 is member of Group1.For contoso.com MDM user scope is Group1Note: Set up automatic enrollment for Windows devicesApplies to Windows 10, Windows 11Simplify Windows enrollment for you and device users by enabling automatic enrollment in Microsoft Intune. This enrollment method enables devices to enroll automatically when they join or register in your Azure Active Directory.If you enable MDM automatic enrollment, enrollment in Intune will occur when:An Azure AD user adds their work or school account to their personal device.A corporate-owned device joins to your Azure AD.MDM User scope is used to define which USERS will be able to enroll their devices into Intune as part of automatic enrollment (with MEM CM for instance) or using Azure AD join on W10.Box 2: NoIf Device1 is joined, it would not affect Device2.Box 3: NoDevice3 is Android.Note:What is MAM user scope. Mobile Application Management user scope is valid for BYOD (Bring your Own Devices) scenario only. With MAM user scope you can use Windows Information Protection (WIP) policies to apply on devices to restrict the applications. This setting is not meant for enrolling the device.ImportantFor Windows BYOD devices, the MAM user scope takes precedence if both the MAM user scope and the MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will not be MDM enrolled, and Windows Information Protection (WIP) Policies will be applied if you have configured them.If your intent is to enable automatic enrollment for Windows BYOD devices to an MDM: configure the MDM user scope to All (or Some, and specify a group) and configure the MAM user scope to None (or Some, and specify a group ensuring that users are not members of a group targeted by both MDM and MAM user scopes).For corporate devices, the MDM user scope takes precedence if both MDM and MAM user scopes are enabled. The device will get automatically enrolled in the configured MDM.
https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enroll
You have a computer named Computer1 that runs Windows 11.A user named User1 plans to use Remote Desktop to connect to Computer1.You need to ensure that the device of User1 is authenticated before the Remote Desktop connection is established and the sign in page appears.What should you do on Computer1?
Answer(s): B
What is Network Level Authentication?Network level authentication is used for authenticating Remote Desktop services, such as Windows RDP, and Remote Desktop Connection (RDP Client). You might also hear it called front authentication.What is Network Level Authentication (NLA) used for?Before you can start a remote desktop session, the user will need to authenticate themselves ie, prove that they are who they say they are. Using network level authentication means that a false connection can't be made, which would use up CPU and cause a strain on the resources of the network. This offers a level of security against some cyberattacks such as Denial of Service attacks, where multiple requests are made all at once towards a network, overwhelming its ability to cope. To combat this, you can turn on network level authentication to authenticate the user's credentials before starting a remote access session. If the user's credentials aren't authenticated, then the connection is simply denied.
https://www.atera.com/blog/what-is-network-level-authenticatio
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.You use Microsoft Intune to manage devices.You have the devices shown in the following table.Which devices can be changed to Windows 11 Enterprise by using subscription activation?
DRAG DROP (Drag and Drop is not supported) (Drag and Drop is not supported)You have a Microsoft 365 subscription that contains devices enrolled in Microsoft Intune.You need to create Endpoint security policies to enforce the following requirements:Computers that run macOS must have FileVault enabled.Computers that run Windows 10 must have Microsoft Defender Credential Guard enabled.Computers that run Windows 10 must have Microsoft Defender Application Control enabled.Which Endpoint security feature should you use for each requirement? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Select and Place:
Box 1: Disk encryptionComputers that run macOS must have FileVault enabled.Intune supports macOS FileVault disk encryption. FileVault is a whole-disk encryption program that is included with macOS. You can use Intune to configure FileVault on devices that run macOS 10.13 or later.Box 2: Attack surface reduction (ASR)Computers that run Windows 10 must have Microsoft Defender Application Control enabled.Attack surface reduction profiles include:* Application control - Application control settings can help mitigate security threats by restricting the applications that users can run and the code that runs in the System Core (kernel). Manage settings that can block unsigned scripts and MSIs, and restrict Windows PowerShell to run in Constrained Language Mode.Note: Attack surface reduction rules target certain software behaviors, such as:Launching executable files and scripts that attempt to download or run files Running obfuscated or otherwise suspicious scriptsPerforming behaviors that apps don't usually initiate during normal day-to-day workBox 3: Account protectionComputers that run Windows 10 must have Microsoft Defender Credential Guard enabled.The account protection policy is focused on settings for Windows Hello and Credential Guard, which is part of Windows identity and access management.Note: Microsoft Defender Credential Guard protects against credential theft attacks. It isolates secrets so that only privileged system software can access them.
https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices-filevault https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-asr-policy
You have a Microsoft 365 tenant.You have devices enrolled in Microsoft Intune.You assign a conditional access policy named Policy1 to a group named Group1. Policy1 restricts devices marked as noncompliant from accessing Microsoft OneDrive for Business.You need to identify which noncompliant devices attempt to access OneDrive for Business.What should you do?
HOTSPOT (Drag and Drop is not supported)You use Microsoft Intune to manage Windows 10 devices.You are designing a reporting solution that will provide reports on the following:Compliance policy trendsTrends in device and user enrollmentApp and operating system version breakdowns of mobile devicesYou need to recommend a data source and a data visualization tool for the design.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: The Microsoft Intune Data WarehouseUse the Intune Data Warehouse to build reports that provide insight into your enterprise mobile environment.For example, some of the reports include:Trend of users enrolling in Intune so you can optimize your license purchases App and OS versions breakdown so you can review that status of mobile devices Enrollment and device compliance trends so you can smoothly roll out policy updates.Box 2: Microsoft Power BIYou can use the Power BI Compliance app to load interactive, dynamically generated reports for your Intune tenant. Additionally, you can load your tenant data in Power BI using the OData link. Intune provides connection settings to your tenant so that you can view the following sample reports and charts related to:DevicesEnrollmentApp protection policyCompliance policyDevice configuration profilesSoftware updatesDevice inventory logs
https://docs.microsoft.com/en-us/mem/intune/developer/reports-nav-create-intune-reports https://docs.microsoft.com/en-us/mem/intune/developer/reports-proc-get-a-link-powerbi
Your network contains an Active Directory domain. The domain contains 2,000 computers that run Windows 10.You implement hybrid Microsoft Entra ID and Microsoft Intune.You need to automatically register all the existing computers to Microsoft Entra ID and enroll the computers in Intune. The solution must minimize administrative effort.What should you use?
Answer(s): D
Hybrid Azure AD join.Support for Hybrid Azure AD join (on-premises AD) using Windows Autopilot user-driven mode is available with Windows 10, version 1809 (or later).Note: In this mode, you can use Windows Autopilot to join a device to an on-premises Active Directory domain.Configuring this feature is very similar to the Windows Autopilot user-driven mode process today:1)Register the device with Windows Autopilot.2)Create an Autopilot deployment profile specifying Hybrid Azure AD as the method in which you would like to join devices to Azure AD.3)Install the Intune Connector for Active Directory on a computer running Windows Server 2016 (or later).
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Autopilot-Hybrid-Azure-AD-join-and- automatic/ba-p/286126
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription that uses Microsoft Intune and contains the users shown in the following table.You create a policy set named Set1 as shown in the exhibit. (Click the Exhibit tab.)You enroll devices in Intune as shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: NoUser1 is member of Group1.Device1 is enrolled for Windows 10 and for User1.The device policy sets excluded Group1.Box 2: YesUser2 is not a member of Group1.Device2 is using Windows 11.The device policy set will be applied to Device2 and User2.Box 3: NoDevice3 is using Android.The device policy set will not be applied to Device3.Note: Exclude groups from a policy assignmentIntune device configuration policies let you include and exclude groups from policy assignment.As a best practice:Create and assign policies specifically for your user groups. Use filters to include or exclude devices of those users.Create and assign different policies specifically for your device groups.
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-assign
Post your Comments and Discuss Microsoft MD-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MD-102 content, but please register or login to continue.