Microsoft MD-102（Endpoint Administrator）予想問題 第2回（問題・正解・解説）

You have a Microsoft Entra tenant. The Device settings in Microsoft Entra ID are configured as follows:

• Users may join devices to Microsoft Entra: Selected (Group1)
• Maximum number of devices per user: 20

The tenant contains the users shown in the following table.

Which users can join a new Windows 11 device to Microsoft Entra ID?

1. A. User1 only
2. B. User1, User2, and User3
3. C. User1 and User2 only
4. D. User1 and User3 only

You need to create a Microsoft Entra dynamic device group that contains all the corporate-owned Windows devices.

Which dynamic membership rule should you use?

1. A. (device.deviceOSType -eq "Windows") -and (device.deviceOwnership -eq "Corporate")
2. B. (device.deviceOSType -eq "Windows") -or (device.deviceOwnership -eq "Company")
3. C. (user.deviceOSType -eq "Windows") -and (user.deviceOwnership -eq "Company")
4. D. (device.deviceOSType -eq "Windows") -and (device.deviceOwnership -eq "Company")

You use a device platform restriction to block personally-owned Windows devices from enrolling in Microsoft Intune.

Your company purchases 50 new Windows 11 devices that are not registered in Windows Autopilot. Users will join the devices to Microsoft Entra ID during Windows setup.

You need to ensure that the devices enroll in Intune as corporate-owned. Personally-owned devices must continue to be blocked.

What should you do?

1. A. Set the device limit restriction to 15.
2. B. Add the IMEI numbers of the devices as corporate device identifiers.
3. C. Add a CSV file that contains the manufacturer, model, and serial number to Intune as corporate device identifiers.
4. D. Remove the device platform restriction.

Users at your company have personally-owned iPhones (iOS 17).

You plan to use account driven user enrollment so that users can enroll the iPhones in Microsoft Intune by signing in to their work account in the Settings app. An Apple MDM push certificate is already configured.

What else is required so that users can start the enrollment?

1. A. Put the devices into supervised mode by using Apple Configurator.
2. B. Publish a service discovery JSON file at /.well-known/com.apple.remotemanagement on the company domain.
3. C. Download an enrollment program token from Apple Business Manager.
4. D. Have users install and sign in to the Company Portal app on the iPhones.

Your company purchases 300 Samsung Galaxy devices from a Samsung Knox authorized reseller. The reseller registers the devices to the company's Samsung Knox account.

You need to ensure that the devices are enrolled automatically in Microsoft Intune as fully managed devices when users turn on the devices for the first time.

The solution must minimize administrative effort.

What should you use?

1. A. manual enrollment by using a QR code
2. B. Samsung Knox Mobile Enrollment (KME)
3. C. Android device administrator enrollment
4. D. Apple Business Manager

Your company has the administrators shown in the following table.

You need to assign an Intune built-in role to each administrator by using the principle of least privilege.

Which role should you assign to each administrator?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Admin1: Policy and Profile Manager / Admin2: Endpoint Security Manager
2. B. Admin1: Application Manager / Admin2: Policy and Profile Manager
3. C. Admin1: Help Desk Operator / Admin2: Intune Administrator
4. D. Admin1: Application Manager / Admin2: Endpoint Security Manager

Your company uses Windows 365 Enterprise.

A user named Admin1 must manage the Cloud PC provisioning policies, Azure network connections, and custom images. Admin1 must NOT be able to manage other Intune objects, such as compliance policies and apps.

You need to assign a role to Admin1 by using the principle of least privilege.

Which role should you assign?

1. A. Cloud PC Reader (Intune built-in role)
2. B. Intune Administrator (Microsoft Entra role)
3. C. Cloud PC Administrator (Intune built-in role)
4. D. Global Administrator (Microsoft Entra role)

You are creating a compliance policy that marks Windows devices as noncompliant if BitLocker is not enabled. A Conditional Access policy that requires devices to be compliant protects access to Microsoft 365.

You need to configure the actions for noncompliance in the policy to meet the following requirements:

• Users must be notified by email immediately after a device is detected as not meeting the requirements.
• Users must have a three-day grace period to fix the issue before access to Microsoft 365 is blocked.

What should you configure?

1. A. Mark device noncompliant: 3 days / Send email to end user: 0 days
2. B. Mark device noncompliant: 3 days / Add device to retire list: 0 days
3. C. Set Compliance status validity period (days) to 3 in the compliance policy settings
4. D. Mark device noncompliant: 0 days / Send email to end user: 3 days

You create a new Conditional Access policy that requires compliant devices.

You need to evaluate which user sign-ins the policy will affect before you enforce the policy. The solution must NOT affect user access.

How should you set Enable policy in the policy?

1. A. On
2. B. Audit
3. C. Report-only
4. D. Off

You are configuring a Windows LAPS policy in Microsoft Intune.

When the help desk signs in to a device by using the password of the local administrator account, the following requirements must be met:

• The password must be changed automatically.
• The session of the local administrator account must be signed out automatically.
• These actions must occur eight hours after the password is used.

What should you configure in the policy?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Post-authentication actions: Reset the password and reboot the device / Password age days: 8
2. B. Post-authentication actions: Reset password and logoff the managed account / Post-authentication reset delay: 8
3. C. Post-authentication actions: Reset password / Post-authentication reset delay: 8
4. D. Password age days: 1 / Password length: 8

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You manage Android devices by using Microsoft Intune. Corporate-owned Android devices are enrolled as fully managed devices.

You need to ensure that users cannot enroll personally-owned Android devices in Intune. The enrollment of corporate-owned devices must NOT be affected.

Solution: You create a device platform restriction, set Personally owned devices for Android Enterprise (work profile) to Block, and assign the restriction to all users.

Does this meet the goal?

1. A. Yes
2. B. No

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You manage Android devices by using Microsoft Intune. Corporate-owned Android devices are enrolled as fully managed devices.

You need to ensure that users cannot enroll personally-owned Android devices in Intune. The enrollment of corporate-owned devices must NOT be affected.

Solution: You create a device limit restriction, set the device limit to 1, and assign the restriction to all users.

Does this meet the goal?

1. A. Yes
2. B. No

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You manage Android devices by using Microsoft Intune. Corporate-owned Android devices are enrolled as fully managed devices.

You need to ensure that users cannot enroll personally-owned Android devices in Intune. The enrollment of corporate-owned devices must NOT be affected.

Solution: You create a Conditional Access policy that requires devices to be compliant.

Does this meet the goal?

1. A. Yes
2. B. No

Your company has 100 existing Windows 11 devices that were not purchased directly from an OEM.

You plan to reset and redeploy the devices by using Windows Autopilot. You need to register the devices in Windows Autopilot.

What should you do?

1. A. Run sysprep /generalize /oobe.
2. B. Add the serial number of each device as a corporate device identifier.
3. C. Register the devices in Microsoft Entra ID.
4. D. Run Get-WindowsAutopilotInfo on each device to export the hardware hash to a CSV file, and then import the file into Windows Autopilot devices in Intune.

You have 200 Windows 11 devices that are Microsoft Entra joined and enrolled in Microsoft Intune. The devices are not registered in Windows Autopilot.

You need to ensure that the devices are registered in Windows Autopilot and receive a Windows Autopilot profile the next time they are reset, without manually collecting the hardware hashes.

What should you do?

1. A. In a Windows Autopilot deployment profile, set Convert all targeted devices to Autopilot to Yes, and assign the profile to a group that contains the devices.
2. B. Perform Fresh Start on the devices.
3. C. Create a Windows Autopilot device preparation policy.
4. D. Create an Enrollment Status Page (ESP) and assign it to the devices.

You plan to deploy Microsoft Entra hybrid joined devices by using Windows Autopilot user-driven mode.

You create a Windows Autopilot deployment profile and a Domain Join configuration profile that specifies an organizational unit (OU).

What should you deploy on-premises so that the devices can join the on-premises Active Directory domain?

1. A. the Intune Connector for Active Directory
2. B. a Microsoft Tunnel gateway
3. C. a Microsoft Entra application proxy connector
4. D. the Certificate Connector for Microsoft Intune

You have 300 Microsoft Entra joined devices that run Windows 11 Pro. Users are assigned Microsoft 365 E3 licenses.

You need to ensure that the devices can use Windows 11 Enterprise features without reinstalling the operating system.

The solution must minimize administrative effort.

What should you use?

1. A. a feature update policy that specifies Windows 11 Enterprise
2. B. Fresh Start
3. C. Windows Autopilot Reset
4. D. Windows subscription activation

You plan to upload custom images for Windows 365 Cloud PCs. You have the managed images in Azure shown in the following table.

Which images can be used as Cloud PC custom images?

1. A. Image1 and Image3 only
2. B. Image1 only
3. C. Image1 and Image2 only
4. D. Image1, Image2, and Image3

Your company's warehouse uses Zebra Android devices that are enrolled in Microsoft Intune as dedicated devices.

You need to configure Zebra-specific features, such as the barcode scanner settings, from Intune.

What should you use?

1. A. an Android Enterprise device restrictions profile
2. B. an app protection policy
3. C. the Zebra OEMConfig app from Managed Google Play and an OEMConfig configuration profile
4. D. a custom OMA-URI profile

You assign a device restrictions profile that configures the home screen layout and blocks installing apps from the App Store to iPhones enrolled in Microsoft Intune.

The profile is applied on some iPhones, but the settings are not applied on other iPhones.

What is the most likely cause for the iPhones on which the settings are not applied?

1. A. App protection policies are not assigned to the iPhones.
2. B. Compliance policies are not assigned to the iPhones.
3. C. The iPhones are not supervised (the users enrolled them by using Company Portal).
4. D. The Apple MDM push certificate was created with a different Apple ID.

You are deploying endpoint security software to macOS devices managed by Microsoft Intune.

You need to ensure that the software can obtain Full Disk Access without prompting users.

What should you configure?

1. A. a macOS compliance policy
2. B. a macOS shell script
3. C. a FileVault disk encryption policy
4. D. a configuration profile that contains Privacy Preferences Policy Control (PPPC) settings

You have Microsoft Intune Suite licenses. You need to deploy 7-Zip to Windows 11 devices and ensure that it is updated automatically when a new version is released.

The solution must minimize the administrative effort required to package the app and create detection rules.

What should you use?

1. A. a Win32 app created by using the Win32 Content Prep Tool
2. B. an Enterprise App Catalog app with auto-update enabled and a required assignment
3. C. a Microsoft Store app (new)
4. D. a Windows line-of-business app (.msi)

Your company plans to use Microsoft Intune Remote Help so that the help desk can remotely control users' Windows 11 devices.

Help desk staff must be able to enter credentials at User Account Control (UAC) prompts.

You need to determine who must be assigned Remote Help licenses and which permission the help desk staff require.

What should you configure?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Licenses: Both help desk staff and the users who receive help / Permission: Remote Help app - Elevation
2. B. Licenses: Users who receive help only / Permission: Remote Help app - Elevation
3. C. Licenses: Help desk staff only / Permission: Remote Help app - View screen
4. D. Licenses: Both help desk staff and the users who receive help / Permission: Remote tasks - Wipe

Users at your company have personally-owned Android devices that are NOT enrolled in Microsoft Intune. You have deployed a Microsoft Tunnel gateway.

You need to ensure that the users can access on-premises web apps from Microsoft Edge by using Microsoft Tunnel for MAM.

What should you install on the users' devices?

1. A. the Microsoft Authenticator app only
2. B. the Microsoft Tunnel VPN client and the Company Portal app (sign-in required)
3. C. Nothing. Edge alone can connect.
4. D. the Microsoft Defender app and the Company Portal app (sign-in not required)

Your company has licenses for Microsoft Intune Advanced Analytics.

Users report that the battery life of some laptops has decreased. You need to identify the devices whose maximum battery capacity has degraded and determine which devices to replace.

What should you use?

1. A. the Startup performance report
2. B. the Battery health report
3. C. the device compliance report
4. D. the Delivery Optimization report

You need to collect diagnostic logs from 60 Windows 11 devices on which Windows Autopilot deployments failed.

You plan to use the Collect diagnostics bulk device action.

What is the minimum number of bulk device actions you must create?

1. A. 1
2. B. 6
3. C. 3
4. D. 2

You have Windows 11 devices managed by Microsoft Intune. The following situations occur:

• Situation 1: Device1 has outdated Microsoft Defender Antivirus definitions. The latest definitions must be applied immediately.
• Situation 2: The help desk signed in to Device2 by using the local administrator password managed by Windows LAPS. The password must be changed immediately.

Which remote action should you use for each situation?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Situation 1: Update Windows Defender security intelligence / Situation 2: Rotate local admin password
2. B. Situation 1: Quick scan / Situation 2: Sync
3. C. Situation 1: Update Windows Defender security intelligence / Situation 2: BitLocker key rotation
4. D. Situation 1: Full scan / Situation 2: Reset passcode

A user named User1 reports that apps are not installed on their devices and that configuration profiles are not applied.

You need to review the policies and apps assigned to User1, the enrollment and compliance state of User1's devices, and the status of app protection policies on a single screen.

What should you use in the Intune admin center?

1. A. Reports > Endpoint analytics
2. B. Devices > Monitor > Device actions
3. C. Tenant administration > Audit logs
4. D. Troubleshooting + support > Troubleshoot, and then select User1

You have Windows 11 devices that are enrolled in Microsoft Intune and onboarded to Microsoft Defender for Endpoint.

You need to ensure that local administrators and malware cannot turn off real-time protection of Microsoft Defender Antivirus.

What should you configure in an endpoint security antivirus policy?

1. A. Add exclusions in the Microsoft Defender Antivirus exclusions profile
2. B. Set Cloud-delivered protection level to High in the Microsoft Defender Antivirus profile
3. C. Enable tamper protection in the Windows Security Experience profile
4. D. Configure scheduled scans in the Microsoft Defender Antivirus profile

You need to allow a line-of-business app named App1 to accept inbound connections on TCP port 8443 on Windows 11 devices managed by Microsoft Intune. The rule must be effective only on the domain network profile.

What should you create in Endpoint security?

1. A. a firewall policy that uses the Windows Firewall Rules profile
2. B. a firewall policy that uses the Windows Firewall profile to turn off the domain network firewall
3. C. an App Control for Business policy
4. D. an attack surface reduction policy

You need to protect the Documents folders of users on Windows 11 devices from ransomware. Untrusted apps must NOT be able to modify files in the protected folders.

What should you configure?

1. A. a BitLocker disk encryption policy
2. B. Enable Controlled folder access in an attack surface reduction policy
3. C. Add exclusions in an antivirus policy
4. D. Windows Backup for Organizations

You have macOS devices that are enrolled in Microsoft Intune by using Automated Device Enrollment (ADE).

You need to ensure that the devices are encrypted by using FileVault and that the help desk can retrieve the personal recovery keys from the Intune admin center.

What should you configure?

1. A. a BitLocker disk encryption policy
2. B. macOS LAPS
3. C. an endpoint security disk encryption policy (FileVault) that configures escrow of the personal recovery key
4. D. a macOS compliance policy that requires encryption

You need to review the BitLocker encryption status, TPM version, and the reasons why devices are not ready for encryption for all the Windows devices enrolled in Microsoft Intune in a single report.

What should you use?

1. A. security baseline monitoring
2. B. the device compliance report
3. C. Endpoint analytics
4. D. the Encryption report

You assign the security baseline for Windows and the Microsoft Defender for Endpoint security baseline to Windows 11 devices.

When you review the setting status of the devices, some settings show Conflict.

You need to resolve the conflicts.

What should you do?

1. A. Identify the conflicting settings and, in one of the baselines, set the value to match the other baseline or set it to Not configured.
2. B. Perform an Autopilot Reset on the devices.
3. C. Sync the devices.
4. D. Change the priority of the baselines.

Your company uses Microsoft Defender for Endpoint and Microsoft Intune.

An incident indicating an active attack is detected on a Windows 11 device named Device1. You need to prevent Device1 from communicating with other devices on the network until the investigation is complete. Device1 must maintain connectivity to the Defender for Endpoint service.

What should you do?

1. A. Retire Device1 from Intune.
2. B. From the Microsoft Defender portal, run Isolate device on Device1.
3. C. Disable Device1 in Microsoft Entra ID.
4. D. Wipe Device1 from Intune.

You are configuring an update rings policy for Windows 11 devices.

For quality updates, the following requirements must be met:

• Updates must be installed automatically within three days after they are offered to the devices.
• After installation, users must have a grace period of up to two days to postpone the restart.

How should you configure the deadline settings?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Deadline for quality updates: 3 / Grace period: 2
2. B. Deadline for quality updates: 5 / Grace period: 0
3. C. Quality update deferral period (days): 3 / Grace period: 2
4. D. Deadline for quality updates: 2 / Grace period: 3

You deploy feature updates to Windows 11 devices by using update rings.

You need to ensure that if an issue is found within 20 days after a feature update is installed, you can roll back to the previous version by using Uninstall in the update ring.

What should you configure in the update ring?

1. A. Set Deadline for feature updates to 20
2. B. Set Feature update deferral period (days) to 20
3. C. Set feature update uninstall period to 20 or more
4. D. Set Windows drivers to Block

You plan to use Windows Autopatch to manage updates for Windows 11 devices.

You attempt to create an Autopatch group for the sales department and specify a Microsoft Entra group that contains the users of the sales department for a deployment ring, but you cannot configure it.

What should you do?

1. A. Use only one deployment ring.
2. B. Use a Microsoft 365 group.
3. C. Use a nested user group.
4. D. Use a device-based Microsoft Entra group that contains the devices of the sales department.

You deploy driver and firmware updates from Windows Update to Windows 11 devices by using Microsoft Intune.

You need to ensure that only drivers that an administrator has reviewed and approved are installed on the devices.

What should you create?

1. A. a quality update policy
2. B. a driver update policy that uses Manually approve and deploy driver updates
3. C. a driver update policy that uses Automatically approve all recommended driver updates
4. D. an update ring that has Windows drivers set to Allow

You have 200 Android devices enrolled in Microsoft Intune as Android Enterprise fully managed devices.

You need to ensure that OS system updates are installed automatically only between 01:00 and 04:00 every day.

What should you configure?

1. A. a compliance policy that requires a minimum OS version
2. B. Set System update to Maintenance window in a device restrictions profile, and specify the start and end times
3. C. Set System update to Postponed in a device restrictions profile
4. D. a Windows update ring

You need to deploy an app named App1 to Windows 11 devices. The installer of App1 is App1.msi, and it requires a transform file (App1.mst) and two external CAB files.

Which app type should you use in Microsoft Intune?

1. A. Windows app (Win32)
2. B. Web link
3. C. Microsoft Store app (new)
4. D. Windows line-of-business (LOB) app

You need to deploy an app that is available in the Microsoft Store to Windows 11 devices by using Microsoft Intune. Microsoft Store for Business has been retired.

Which app type should you use in Intune?

1. A. Web link
2. B. Microsoft Store app (legacy)
3. C. Windows line-of-business (LOB) app
4. D. Microsoft Store app (new)

Users at your company have personally-owned iPhones that are NOT enrolled in Microsoft Intune. App protection policies are configured.

You need to ensure that Microsoft Outlook appears in Company Portal so that users can install it from the App Store.

Which assignment type should you use to assign Outlook to a user group?

1. A. Available for enrolled devices
2. B. Uninstall
3. C. Available with or without enrollment
4. D. Required

You are adding the following Win32 apps to Microsoft Intune:

• App2 requires that the Visual C++ runtime (App1) is installed before App2 is installed.
• App3 v2 must replace App3 v1 that is installed on the devices.

Which Win32 app feature should you use to meet each requirement?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. App2: Dependencies / App3 v2: Supersedence
2. B. App2: Supersedence / App3 v2: Dependencies
3. C. App2: Detection rules / App3 v2: Requirements
4. D. App2: Requirements / App3 v2: Detection rules

You deploy Microsoft 365 Apps by using Microsoft Intune.

The finance department must receive new Office features only twice a year and must fully test each release before deployment. Security updates must be received monthly.

Which update channel should you use for the devices of the finance department?

1. A. Monthly Enterprise Channel
2. B. Current Channel
3. C. Beta Channel
4. D. Semi-Annual Enterprise Channel

You plan to deploy Microsoft 365 Apps as a Win32 app by using the Office Deployment Tool (ODT).

You need to ensure that Access and Publisher are not installed.

What should you add to the <Product ID="O365ProPlusRetail"> element of the configuration file (configuration.xml)?

1. A. <RemoveMSI />
2. B. <Updates Channel="MonthlyEnterprise" />
3. C. <ExcludeApp ID="Access" /> and <ExcludeApp ID="Publisher" />
4. D. <Display Level="None" />

You are creating an app protection policy for Android devices.

The conditional launch in the policy must meet the following requirements:

• On devices that run a version earlier than Android 13, apps must NOT be able to access company data.
• On rooted devices, the company data in the apps must be deleted.

How should you configure conditional launch?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Max OS version 13: Block access / Jailbroken/rooted devices: Wipe data
2. B. Min OS version 13: Block access / Jailbroken/rooted devices: Wipe data
3. C. Min OS version 13: Wipe data / Jailbroken/rooted devices: Warn
4. D. Min OS version 13: Warn / Jailbroken/rooted devices: Block access

You are configuring an app protection policy for iOS devices.

When users save Outlook attachments, the save locations must be restricted to OneDrive for Business and SharePoint only. Users must NOT be able to save attachments to personal cloud storage or local device storage.

What should you configure?

1. A. Set PIN for access to Require
2. B. Set Save copies of org data to Block, and select OneDrive for Business and SharePoint in Allow user to save copies to selected services
3. C. Set Restrict cut, copy, and paste between other apps to Blocked
4. D. Set Send org data to other apps to All apps

Users at your company access Microsoft 365 by using a web browser from personally-owned Windows 11 devices that are NOT enrolled in Microsoft Intune.

You need to restrict downloading, printing, and copying company data to personal apps on the personal devices. The devices must remain unenrolled.

Which app should be targeted by the app protection policy?

1. A. Microsoft Teams (desktop app)
2. B. File Explorer
3. C. Microsoft Edge
4. D. Google Chrome

Users at your company use Microsoft Edge on personally-owned iPhones that are NOT enrolled in Microsoft Intune. An app protection policy is applied to Edge.

You need to ensure that managed bookmarks to the company intranet sites appear when users sign in to Edge with their work account.

What should you create?

1. A. an app configuration policy for managed apps
2. B. a device restrictions configuration profile
3. C. a web link app
4. D. an app configuration policy for managed devices

You are automating Microsoft Intune management by using the Microsoft Graph PowerShell SDK.

You need to retrieve an Intune resource that is available only on the Microsoft Graph beta endpoint. You do not plan to use a dedicated cmdlet.

Which cmdlet should you use?

1. A. Connect-MsolService
2. B. Get-MgDeviceManagementManagedDevice
3. C. Invoke-WebRequest -Uri "https://manage.microsoft.com/..."
4. D. Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/deviceManagement/..."

You are creating a script that automatically downloads the data of the Device compliance report in Microsoft Intune as a CSV file every week.

Which Microsoft Graph method should you use?

1. A. scrape the Intune admin center pages
2. B. POST to deviceManagement/deviceConfigurations
3. C. POST to deviceManagement/reports/exportJobs to create an export job, and then download the file from the URL when the status is completed
4. D. PATCH deviceManagement/managedDevices

Management requests a Power BI dashboard that shows trends in device compliance state and the number of enrolled devices over the past year.

You need to connect Microsoft Intune data to Power BI.

What should you use?

1. A. the Intune audit logs
2. B. the Intune Data Warehouse OData feed
3. C. device query
4. D. Endpoint analytics Startup performance

You attempt to review the Endpoint analytics Startup performance report for Windows 11 devices enrolled in Microsoft Intune. However, the report shows Insufficient data.

You need to ensure that the devices send data to Endpoint analytics.

What should you do?

1. A. Onboard the devices to Microsoft Defender for Endpoint.
2. B. Assign a remediation script to the devices.
3. C. Create a Log Analytics workspace.
4. D. Assign the Intune data collection policy (a Windows health monitoring profile) to the devices.

Your company's security team created a PDF document that describes Windows security requirements based on the CIS benchmarks. Your company uses Microsoft Security Copilot.

You need to identify the Intune settings catalog settings and recommended values that match the requirements in the document, and then create a policy. The solution must minimize administrative effort.

What should you use?

1. A. the Policy Configuration Agent
2. B. Group Policy analytics
3. C. the Change Review Agent
4. D. the Vulnerability Remediation Agent

Multiple users report that app installations from Company Portal in Microsoft Intune are slow.

You need to check whether the Intune service is currently experiencing an outage or degradation, and review announcements from Microsoft about upcoming changes to Intune.

What should you use in the Intune admin center?

1. A. Tenant administration > Audit logs
2. B. Apps > Monitor > App install status
3. C. Reports > Endpoint analytics
4. D. Service health and message center in Tenant administration > Tenant status

You need to meet the technical requirements for the store Android tablets.

What should you configure?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Enrollment type: Android Enterprise dedicated devices / Help desk permission: Remote Help app - Android unattended control
2. B. Enrollment type: Android Enterprise fully managed devices / Help desk permission: Remote Help app - View screen
3. C. Enrollment type: Android Enterprise dedicated devices / Help desk permission: Remote tasks - Wipe
4. D. Enrollment type: Android Enterprise personally-owned work profile / Help desk permission: Remote Help app - Take full control

You need to meet the technical requirements for the cash registers regarding automatic sign-in and running the POS app. The POS app is a Microsoft Store app (UWP).

What should you configure?

1. A. assigning the POS app as required
2. B. an App Control for Business policy
3. C. a kiosk configuration profile that configures single-app kiosk mode and autologon
4. D. an app protection policy

You need to configure an update ring to meet the technical requirements for restarting the cash registers.

What should you configure in the update ring?

1. A. Set Quality update deferral period (days) to 30
2. B. Set Automatic update behavior to Auto install and restart at maintenance time, and set active hours to 09:00 to 21:00
3. C. Pause the updates
4. D. Set Windows drivers to Block

You need to create a Windows 365 provisioning policy for the Cloud PCs of the contractors.

What should you configure in the provisioning policy?

1. A. Join type: Microsoft Entra registered / Network: Microsoft hosted network
2. B. Join type: Microsoft Entra join / Network: Azure network connection (ANC)
3. C. Join type: Microsoft Entra hybrid join / Network: Azure network connection (ANC)
4. D. Join type: Microsoft Entra join / Network: Microsoft hosted network