Free MD-102 Exam Braindumps
Endpoint Administrator Questions 185–192 (page: 25)

Updated On: 7-Apr-2026

You have a Microsoft 365 E5 subscription that contains 500 macOS devices enrolled in Microsoft Intune.

You need to ensure that you can apply Microsoft Defender for Endpoint antivirus policies to the macOS devices. The solution must minimize administrative effort.

What should you do?

  1. Onboard the macOS devices to the Microsoft Purview compliance portal.
  2. From the Microsoft Intune admin center, create a security baseline.
  3. Install Defender for Endpoint on the macOS devices.
  4. From the Microsoft Intune admin center, create a configuration profile.

Answer(s): D



You have a Microsoft Entra tenant and 100 Windows 11 devices that are Microsoft Entra joined and managed by using Microsoft Intune.

You need to configure Microsoft Defender Firewall and Microsoft Defender Antivirus on the devices. The solution must minimize administrative effort.

Which two actions should you perform? Each correct answer presents part of the solution.

Note: Each correct selection is worth one point.

  1. To configure Microsoft Defender Antivirus, create a Group Policy Object (GPO) and configure the Windows Defender Antivirus settings.
  2. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Device restrictions settings.
  3. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings.
  4. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Device restrictions settings.
  5. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings.
  6. To configure Microsoft Defender Firewall, create a Group Policy Object (GPO) and configure Windows Defender Firewall with Advanced Security.

Answer(s): D,E



You have a Microsoft Entra group named Group1. Group1 contains two Windows 11 Enterprise devices named Device1 and Device2.

You create a device configuration profile named Profile1. You assign Profile1 to Group1.

You need to ensure that Profile1 applies to Device1 only.

What should you modify in Profile1?

  1. Assignments
  2. Settings
  3. Scope (Tags)
  4. Applicability Rules

Answer(s): A



HOTSPOT (Drag and Drop is not supported)

You have the device configuration profile shown in the following exhibit.



Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: can access any URL
We see: Public Browsing (InPrivate).

Microsoft Edge kiosk mode type: Select the kiosk mode type. Both options help protect user data.

Public Browsing (InPrivate): Runs a limited multi-tab version of Microsoft Edge. Users can browse publicly, or end their browsing session.

Digital/Interactive Signage (InPrivate): Opens a URL full screen, and only shows the content on that website.

Box 2: a single Microsoft Edge instance that has multiple tabs


Reference:

https://learn.microsoft.com/en-us/mem/intune/configuration/kiosk-settings-windows



HOTSPOT (Drag and Drop is not supported)

You have a Microsoft Entra tenant that contains the users shown in the following table.



You have devices enrolled in Microsoft Intune as shown in the following table.



From Intune, you create and send a custom notification named Notification1 to Group1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: No
Not to a Windows device.

Note: Send custom notifications in Intune
Use Microsoft Intune to send custom notifications to the users of managed iOS/iPadOS and Android devices. These messages appear as standard push notifications from the Company Portal app and from the Microsoft Intune app on a user's device, just as notifications from other applications on the device appear. Intune custom notifications aren't supported by macOS and Windows devices.

Box 2: No
Not to User2, as it is not a member of Group1.

Note: You can send notifications to users in groups.

Box 3: Yes
User1 is member of Group1, and Device3 uses iOS.


Reference:

https://learn.microsoft.com/en-us/mem/intune/remote-actions/custom-notifications



HOTSPOT (Drag and Drop is not supported)

You have 100 computers that run Windows 11. You have no servers. All the computers are joined to a Microsoft Entra tenant.

The computers have different update settings, and some computers are configured for manual updates.

You need to configure Windows Update. The solution must meet the following requirements:

The configuration must be managed from a central location.



Internet traffic must be minimized.



Costs must be minimized.



How should you configure Windows Update? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Windows Update for Business
Costs must be minimized.

Manage Windows 10 and Windows 11 software updates in Intune
Use Intune to manage the install of Windows
software updates from Windows Update for Business.

By using Windows Update for Business, you simplify the update management experience. You don't need to approve individual updates for groups of devices and can manage risk in your environments by configuring an update rollout strategy. With Intune, you can configure update settings on devices and configure deferral of update installation. You can also prevent devices from installing features from new Windows versions to help keep them stable, while allowing those devices to continue installing updates for quality and security.

Box 2: Microsoft Intune
The configuration must be managed from a central location.

Box 3: Delivery Optimization
Internet traffic must be minimized.
With Intune, use Delivery Optimization settings for your Windows devices to reduce bandwidth consumption when those devices download applications and updates. Configure Delivery Optimization as part of your device configuration profiles.


Reference:

https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure https://learn.microsoft.com/en-us/mem/intune/configuration/delivery-optimization-windows



HOTSPOT (Drag and Drop is not supported)

Your network contains an Active Directory domain. The domain contains 1,000 computers that run Windows

11.

You need to configure the Remote Desktop settings of all the computers. The solution must meet the following requirements:

Prevent the sharing of clipboard contents.



Ensure that users authenticate by using Network Level Authentication (NLA).



Which two nodes of the Group Policy Management Editor should you use? To answer, select the appropriate nodes in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Devices and Resource Redirection
Prevent the sharing of clipboard contents.

How to Disable Copy and Paste Remote Desktop Windows 10 (and Windows 11) Method 1. Turn off RDP copy and paste from Group Policy
We tend to enable some policies in Group Policy to prevent copying and pasting via Remote Desktop in Windows 10 in this part.

Step 1. Press Win + R and enter "gpedit", and then press the "Enter" key to open Group Policy Editor.

Step 2. Navigation:

Computer Configuration Administrative Templates Windows Components Remote Desktop services Remote Desktop Host Devices and Resources Redirection



Step 3. Double-click on "Do not allow Clipboard redirection" and then choose "Enabled". Then click on "OK".

Box 2: Connections
Ensure that users authenticate by using Network Level Authentication (NLA).

To configure Network Level Authentication for a connection

1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

2. Under Connections, right-click the name of the connection, and then click Properties.

3. On the General tab, select the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

4. If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is not enabled, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

5. Click OK.


Reference:

https://www.anyviewer.com/how-to/disable-copy-and-paste-remote-desktop-win10-0007.html https://social.technet.microsoft.com/wiki/contents/articles/5490.configure-network-level-authentication-for- remote-desktop-services-connections.aspx



HOTSPOT (Drag and Drop is not supported)

You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

You use Microsoft Intune to manage devices.

Microsoft Entra joined Windows devices enroll automatically in Intune.

You have the devices shown in the following table.



You are preparing to upgrade the devices to Windows11. All the devices are compatible with Windows 11.

You need to evaluate Windows Autopilot and in-place upgrade as deployment methods to implement Windows 11 Pro on the devices, while retaining all user settings and applications.

Which devices can be upgraded by using each method? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Device1 only
Windows Autopilot

Only Device1 is Azure AD joined.

Note: In order for Windows Autopilot to work, users need to be allowed to join devices to Azure AD.

Box 2: Device1 and Device3 only
In-place upgrade

Incorrect:
* Not Device2
You can't directly upgrade from 32-bit Windows 10 to 64-bit Windows 11 since Windows 11 requires a 64-bit

processor. You can perform a clean install of Windows 11 on your PC.

Note: A line-of-business (LOB) app is one that you add from an app installation file. This kind of app is typically written in-house.


Reference:

https://learn.microsoft.com/en-us/mem/autopilot/tutorial/user-driven/azure-ad-join-allow-users-to-join https://www.minitool.com/data-recovery/upgrade-from-32-bit-windows-10-to-windows-11.html



Viewing page 25 of 53
Viewing questions 193 - 200 out of 452 questions


Post your Comments and Discuss Microsoft MD-102 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!