HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory domain named contoso.com that syncs to a Microsoft Entra tenant.A user named User1 uses the domain-joined devices shown in the following table.In the Microsoft Entra admin center, you assign a Windows 11 Enterprise E5 license to User1.You need to identify what will occur when User1 next signs in to the devices.What should you identify for each device? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Will perform an in-place upgrade to Windows 11 Enterprise Windows 10 ProBox 2: Will activate as Windows 11 EnterpriseWindows 11 ProWindows 10 Pro supports the Subscription Activation feature, enabling users to "step-up" from Windows 10 Pro or Windows 11 Pro to Windows 10 Enterprise or Windows 11 Enterprise, respectively, if they are subscribed to Windows Enterprise E3 or E5.With Windows 10, version 1903 and later, the Subscription Activation feature also supports the ability to step- up from Windows 10 Pro Education or Windows 11 Pro Education to the Enterprise grade editions for educational institutions--Windows 10 Education or Windows 11 Education.
https://docs.microsoft.com/en-us/windows/deployment/windows-10-subscription-activation
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.You have a Microsoft 365 subscription.You plan to use Windows Autopilot to deploy new Windows devices.You plan to create a deployment profile.You need to ensure that the deployment meets the following requirements:Devices must be joined to AD DS regardless of their current working location.Users in the marketing department must have a line-of-business (LOB) app installed during thedeployment.The solution must minimize administrative effort.What should you do for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Deploy Always on VPN.Devices must be joined to AD DS regardless of their current working location.Off-premises/Internet scenarios and VPN connectivityWindows Autopilot user-driven hybrid Azure AD join supports off-premises/Internet scenarios where direct connectivity to Active directory and domain controllers isn't available. However, an off-premises/Internet scenario doesn't eliminate the need for connectivity to Active Directory and a domain controller during the domain join. In an off-premises/Internet scenario, connectivity to Active Directory and a domain controller can be established via a VPN connection during the Autopilot process.For off-premises/Internet scenarios requiring VPN connectivity, the only change in the Autopilot profile would be in the setting Skip AD connectivity check. In the Create and assign user-driven hybrid Azure AD join Autopilot profile section, the Skip AD connectivity check setting should be set to Yes instead of to No. Settingthis option to Yes prevents the deployment from failing since there's no direct connectivity to Active Directory and domain controllers until the VPN connection is established.In addition to changing the Skip AD connectivity check setting to Yes in the Autopilot profile, VPN support also relies on the following prerequisites:The VPN solution can be deployed and installed with Intune.The VPN solution needs to support one of the following options:Let's the user manually establish a VPN connection from the Windows sign-in screen.Automatically establishes a VPN connection as needed.The VPN solution would need to be installed and configured via Intune during the Autopilot process. Configuration would need to include deploying any required device certificates if needed by the VPN solution. Once the VPN solution is installed and configured on the device, the VPN connection can be established, either automatically or manually by the user, at which point the domain join can occur.Box 2: Create a Microsoft Intune app deploymentUsers in the marketing department must have a line-of-business (LOB) app installed during the deployment.Add a Windows line-of-business app to Microsoft Intune A line-of-business (LOB) app is one that you add from an app installation file. This kind of app is typically written in-house. The following steps provide guidance to help you add a Windows LOB app to Microsoft Intune.Step 1 - App informationStep 2 - Select scope tags (optional)Step 3 - AssignmentsStep 4 - Review + createSelect the app typeSign in to the Microsoft Intune admin center.Select Apps > All apps > Add.In the Select app type pane, under the Other app types, select Line-of-business app.Click Select. The Add app steps are displayed.Step 1 - App informationSelect the app package fileEtc.Incorrect:* Modify the Autopilot deployment profile
https://learn.microsoft.com/en-us/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile https://learn.microsoft.com/en-us/mem/intune/apps/lob-apps-windows
HOTSPOT (Drag and Drop is not supported)You have devices that are not rooted enrolled in Microsoft Intune as shown in the following table.The devices are members of a group named Group1.In Intune, you create a device compliance location that has the following configurations:Name: Network1IPv4 range: 192.168.0.0/16In Intune, you create a device compliance policy for the Android platform. The policy has the following configurations:Name: Policy1Device health: Rooted devices: BlockLocations: Location: Network1Mark device noncompliant: ImmediatelyAssigned: Group1The Intune device compliance policy has the following configurations:Mark devices with no compliance policy assigned as: CompliantEnhanced jailbreak detection: EnabledCompliance status validity period (days): 20For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: YesDevice1 is running Windows at IP 192.168.10.35.The device compliance location is named Network1, and has IPv4 range: 192.168.0.0/16.The device compliance policy Policy1 applies to Android.The Intune device compliance policy has the setting: Mark devices with no compliance policy assigned as:CompliantDevice1 will be marked as compliant.Note: Compliance policy settingsCompliance policy settings are tenant-wide settings that determine how Intune's compliance service interacts with your devices. These settings are distinct from the settings you configure in a device compliance policy.Box 2: YesDevice2 is running Android at IP 10.10.10.40.Policy1 location does not match and will not be applied.Device2 will be marked as compliant.Box 3: NoDevice3 is running Android at IP 192.168.10.10.Policy1 location matches and Policy1 is applied.Device3 will be marked as non-compliant.
https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started
You need to implement mobile device management (MDM) for personal devices that run Windows 11. The solution must meet the following requirements:Ensure that you can manage the personal devices by using Microsoft Intune.Ensure that users can access company data seamlessly from their personal devices.Ensure that users can only sign in to their personal devices by using their personal account.What should you use to add the devices to Microsoft Entra?
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription.All computers are enrolled in Microsoft Intune.You have business requirements for securing your Windows 11 environment as shown in the following table.What should you implement to meet each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: A conditional access policyBox 2: A device compliance policyCompliance policies in Intune:Define the rules and settings that users and devices must meet to be compliant. Include actions that apply to devices that are noncompliant. Actions for noncompliance can alert users to the conditions of noncompliance and safeguard data on noncompliant devices. Can be combined with Conditional Access, which can then block users and devices that don't meet the rules.
https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription that contains two security groups named Group1 and Group2. Microsoft 365 uses Microsoft Intune Suite.You use Microsoft Intune to manage devices.You need to assign roles in Intune to meet the following requirements:The members of Group1 must manage Intune roles and assignments.The members of Group2 must assign existing apps and policies to users and devices.The solution must follow the principle of least privilege.Which role should you assign to each group? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Intune Service AdministratorThe members of Group1 must manage Intune roles and assignments.Role-based access control (RBAC) helps you manage who has access to your organization's resources and what they can do with those resources. By assigning roles to your Intune users, you can limit what they can see and change. Each role has a set of permissions that determine what users with that role can access and change within your organization.To create, edit, or assign roles, your account must have one of the following permissions in Azure AD:Global AdministratorIntune Service Administrator (also known as Intune Administrator)Box 2: Help desk operatorThe members of Group2 must assign existing apps and policies to users and devices.Microsoft Intune built-in rolesBuilt-in roles use pre-defined rules based on common Intune scenarios. Alternatively, custom roles are built upon rules that are strictly defined by you.Here are the built-in roles that you can assign:* Help desk operatorAssign the help desk operator role to users who assign apps and policies to users and devices.Incorrect:* Policy and profile managerAssign the policy and profile manager role to users manage compliance policy, configuration profiles and Apple enrollment.* Etc.
https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-intune-admin-roles-in-the-mac
HOTSPOT (Drag and Drop is not supported)You have devices enrolled in Microsoft Intune as shown in the following table.Intune includes the device compliance policies shown in the following table.The device compliance policies has the assignments shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: NoDevice1 is in Group1. Policy1 is assigned to Group1. Policy2 is also assigned to Group1. Device1 is compliant to Policy1, but not compliant to Policy2 (fails on Secure Boot).By default, each device compliance policy includes the action to mark a device as noncompliant if it fails to meet a policy rule.Box 2: YesDevice2 is in Group2. Policy2 is assigned to Group2. Device2 is compliant to Policy2 (Secure boot met).Box 3: YesDevice3 is in Group 3. Policy3 and Policy4 are assigned to Group3. Policy3 is for Windows 10 so it is disregarded. Device3 is compliant to Policy4.
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription that contains a user named User1. The subscription contains devices enrolled in Microsoft Intune as shown in the following table.Microsoft Edge is available on all the devices.Intune has the device compliance policies shown in the following table.The Compliance policy settings are configured as shown in the exhibit. (Click the Exhibit tab.)You create the following Conditional Access policy:Name: Policy1Assignments- Users and groups: User1- Cloud apps or actions: Office 365 SharePoint OnlineAccess controls- Grant: Require device to be marked as compliantEnable policy: OnFor each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: YesDevice1 is member of Group1.No compliance policy applies to Group1.From the Compliance policy settings exhibit we see: Mark devices with no compliance policy assigned as:CompliantDevice1 is marked as compliant.Policy1 is assigned to User1.User1 on Device1 will be granted access to SharePoint online through Policy1.Box 2: YesDevice2 is member of Group2.Compliance1 is applied to Group2.Compliance1 requires encryption of data storage on device.Device2 has disk encryption configured.Compliance1 marks Device2 as compliant.User1 on Device2 will be granted access to SharePoint online through Policy1.Box 3: NoDevice3 is member of Group3.Compliance2 is applied to Group3.Compliance2 requires encryption of data storage on device.Device3 has not disk encryption configured.Compliance1 marks Device3 as non-compliant.Policy1 will not grant User1 access through Device3.
Post your Comments and Discuss Microsoft MD-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MD-102 content, but please register or login to continue.