Microsoft MD-102（Endpoint Administrator）予想問題 第1回（問題・正解・解説）

A company named Contoso, Ltd. uses Microsoft Entra Connect to sync an on-premises Active Directory Domain Services (AD DS) domain to a Microsoft Entra tenant.

Contoso plans to deploy the devices shown in the following table.

You need to recommend the appropriate join type for each device.

What should you recommend?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Device1: Microsoft Entra join / Device2: Microsoft Entra register
2. B. Device1: Microsoft Entra hybrid join / Device2: Microsoft Entra register
3. C. Device1: Microsoft Entra hybrid join / Device2: Microsoft Entra join
4. D. Device1: Microsoft Entra join / Device2: Microsoft Entra hybrid join

You have 300 Windows 11 devices that are registered in Windows Autopilot. The devices in the sales department are assigned a group tag of Sales.

You need to create a Microsoft Entra group that automatically contains only the devices that have a group tag of Sales.

Which dynamic membership rule should you use?

1. A. (device.devicePhysicalIds -any (_ -startsWith "[ZTDid]"))
2. B. (device.deviceCategory -eq "Sales")
3. C. (device.devicePhysicalIds -any (_ -eq "[OrderID]:Sales"))
4. D. (user.department -eq "Sales")

You use Microsoft Intune to manage devices.

You need to ensure that the users in a group named Group1 can enroll a maximum of three devices per user in Intune. All other users must continue to use the default settings.

What should you create?

1. A. a device platform restriction
2. B. a device limit restriction
3. C. a device compliance policy
4. D. a device configuration profile

Your company uses Apple Business Manager to purchase iPhones.

You plan to ensure that new iPhones are enrolled in Microsoft Intune by using Automated Device Enrollment (ADE). Currently, there is no Apple-related configuration in Intune.

What should you do first?

1. A. Upload an enrollment program token to Intune.
2. B. Configure an Apple MDM push certificate.
3. C. Use Apple Configurator to put the devices into supervised mode.
4. D. Create an enrollment profile and assign it to the devices.

Your company's warehouse has 50 Android devices that are used for inventory management.

The devices are shared by multiple employees and are not associated with a specific user. Each device must be locked down to run only the inventory management app.

You need to enroll the devices in Microsoft Intune.

Which enrollment type should you use?

1. A. Android Enterprise personally-owned work profile
2. B. Android Enterprise fully managed devices
3. C. Android Enterprise corporate-owned devices with a work profile
4. D. Android Enterprise dedicated devices

Your company has IT departments in Tokyo and Osaka. All devices are managed by using Microsoft Intune.

A user named Admin1 is a member of the Tokyo IT department. Admin1 will be assigned the Policy and Profile Manager role.

You need to ensure that Admin1 can view and manage only the configuration profiles created for the Tokyo devices in the Intune admin center.

What should you use?

1. A. Microsoft Entra administrative units
2. B. assignment filters
3. C. scope tags
4. D. dynamic device groups

You configure a Multi Admin Approval (MAA) access policy in Microsoft Intune that protects app deployments.

Admin1 submits a request to assign an app named App1 to the All Users group. Admin2, who is a member of the approver group, approves the request.

You need to ensure that the assignment of App1 is applied.

What should occur next?

1. A. Admin2 selects Complete for the request.
2. B. Admin1 selects Complete for the request.
3. C. A Global Administrator approves the request again.
4. D. Nothing. The change is applied automatically upon approval.

You have Windows, iOS, and Android devices that are enrolled in Microsoft Intune.

You plan to create a Microsoft Entra Conditional Access policy that allows only devices marked as compliant to access Exchange Online.

You need to ensure that devices that have no compliance policy assigned are blocked from access.

What should you configure?

1. A. In the compliance policy settings, set Mark devices with no compliance policy assigned as to Not compliant.
2. B. In the compliance policy settings, set Compliance status validity period (days) to 1.
3. C. In each compliance policy, set the schedule for the Mark device noncompliant action to 0 days.
4. D. In the Conditional Access policy, add Require Microsoft Entra hybrid joined device.

You plan to deploy new Windows 11 devices by using Windows Autopilot.

You need to ensure that all the devices provision Windows Hello for Business during enrollment in Microsoft Intune and that the minimum PIN length is eight characters.

The solution must minimize administrative effort.

What should you configure?

1. A. The Windows Hello for Business settings in Devices > Enrollment > Windows in the Intune admin center
2. B. An authentication methods policy in the Microsoft Entra admin center
3. C. An authentication strength in a Conditional Access policy
4. D. A Group Policy Object (GPO)

You have Microsoft Entra joined Windows 11 devices.

You create a Windows LAPS policy in Microsoft Intune, set Backup Directory to Backup the password to Microsoft Entra ID only, and assign the policy to the devices.

After several days, you discover that the local administrator passwords of the devices are not backed up to Microsoft Entra ID.

You need to ensure that the passwords are backed up to Microsoft Entra ID.

What should you do?

1. A. In the Microsoft Entra ID device settings, set Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes.
2. B. Install the legacy Microsoft LAPS MSI on each device.
3. C. Run the Rotate local admin password remote action on the devices.
4. D. Change Password Complexity in the policy to Large letters + small letters + numbers + special characters.

You have 500 Windows 11 devices that are managed by using Microsoft Intune.

You need to add a Microsoft Entra group named HelpDesk to the local Administrators group on all the devices. The existing members of the local Administrators group must NOT be removed.

You create a Local user group membership policy in Endpoint security > Account protection.

Which action should you select in the policy?

1. A. Add (Replace)
2. B. Remove (Update)
3. C. Add (Update)
4. D. Restricted groups

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft Entra tenant named contoso.com and a Microsoft Intune subscription. All users are assigned Microsoft Entra ID P1 and Intune licenses.

Users join new Windows 11 devices to Microsoft Entra ID during the initial setup.

You need to ensure that the devices are enrolled in Intune automatically when they join Microsoft Entra ID.

Solution: You set MDM user scope to All in Windows automatic enrollment.

Does this meet the goal?

1. A. Yes
2. B. No

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft Entra tenant named contoso.com and a Microsoft Intune subscription. All users are assigned Microsoft Entra ID P1 and Intune licenses.

Users join new Windows 11 devices to Microsoft Entra ID during the initial setup.

You need to ensure that the devices are enrolled in Intune automatically when they join Microsoft Entra ID.

Solution: You set MAM user scope to All and leave MDM user scope set to None.

Does this meet the goal?

1. A. Yes
2. B. No

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft Entra tenant named contoso.com and a Microsoft Intune subscription. All users are assigned Microsoft Entra ID P1 and Intune licenses.

Users join new Windows 11 devices to Microsoft Entra ID during the initial setup.

You need to ensure that the devices are enrolled in Intune automatically when they join Microsoft Entra ID.

Solution: You add all the users as device enrollment managers (DEMs).

Does this meet the goal?

1. A. Yes
2. B. No

Your company plans to purchase 500 new Windows 11 devices.

The devices have the following requirements:

• The devices must be joined to both the on-premises Active Directory domain and Microsoft Entra ID.
• IT department technicians must preinstall apps on the devices before the devices are distributed to users.

You need to recommend a method to deploy the devices.

What should you recommend?

1. A. a Windows Autopilot device preparation policy in user-driven mode
2. B. a Windows Autopilot device preparation policy in automatic mode
3. C. a Windows Autopilot deployment profile that allows pre-provisioning and an Enrollment Status Page (ESP)
4. D. a Windows 365 provisioning policy

You plan to deploy new devices that run Windows 11, version 24H2, by using Windows Autopilot device preparation. The hardware hashes of the devices are not registered in Windows Autopilot.

You need to create the device group that will be specified in the Windows Autopilot device preparation policy.

How should you configure the group?

1. A. a security group that has a dynamic membership rule that uses [ZTDid]
2. B. a security group that has assigned membership and has the Intune Provisioning Client service principal as an owner
3. C. a Microsoft 365 group that has assigned membership
4. D. a security group that has a dynamic membership rule that uses user.department

You plan to use Windows Autopilot self-deploying mode to deploy shared devices that will be placed in meeting rooms.

You have the devices shown in the following table.

Which devices can be deployed by using self-deploying mode?

1. A. Device1 only
2. B. Device1 and Device2 only
3. C. Device1 and Device3 only
4. D. Device1, Device2, and Device3

You plan to use Windows Autopilot pre-provisioning so that technicians at a partner company install apps on Windows 11 devices before the devices are shipped to users.

You need to configure the Windows Autopilot deployment profile and provide instructions to the technicians.

What should you configure, and what should the technicians do?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Profile: Set Allow pre-provisioned deployment to Yes / Technicians: Press the Windows key five times on the first OOBE screen
2. B. Profile: Set Deployment mode to Self-Deploying / Technicians: Press the Windows key five times on the first OOBE screen
3. C. Profile: Set Allow pre-provisioned deployment to Yes / Technicians: Press Shift+F10 during OOBE and run sysprep /oobe
4. D. Profile: Set Apply device name template to Yes / Technicians: Press Ctrl+Shift+D

You are creating a Windows Autopilot deployment profile for Microsoft Entra join.

You need to ensure that device names start with TKO- followed by a random five-digit number.

What should you enter as the device name template?

1. A. TKO-%SERIAL:5%
2. B. TKO-#####
3. C. TKO-%RAND:5%
4. D. TKO-%RANDOM%

You deploy Windows 11 devices by using Windows Autopilot user-driven mode. Ten required apps are assigned to the devices.

You need to ensure that users cannot access the desktop until the installation of apps named App1 and App2 is complete. The other apps must be installed after the users access the desktop.

You create an Enrollment Status Page (ESP) profile and set Show app and profile configuration progress and Block device use until all apps and profiles are installed to Yes.

What should you configure next?

1. A. Set Show an error when installation takes longer than specified number of minutes to 30.
2. B. Set Block device use until required apps are installed if they are assigned to the user/device to Selected, and then select App1 and App2.
3. C. Set Only show page to devices provisioned by out-of-box experience (OOBE) to Yes.
4. D. Change the assignment of App1 and App2 to Available for enrolled devices.

You have 1,000 Windows 10 devices that are managed by using Microsoft Intune.

You plan to upgrade the devices to Windows 11 by using a feature update policy.

Before you create the policy, you need to identify which devices do not meet the hardware requirements of Windows 11 and which apps might have compatibility issues after the upgrade.

What should you use?

1. A. the Windows feature update device readiness report and compatibility risks report
2. B. the update ring status report
3. C. a compliance policy that requires a minimum operating system version
4. D. the Delivery Optimization report

You plan to provision Cloud PCs by using Windows 365 Enterprise.

The Cloud PCs must join the on-premises Active Directory domain and access on-premises file servers through an Azure virtual network.

You need to create a provisioning policy.

What should you configure in the provisioning policy?

1. A. Join type: Microsoft Entra join / Network: Microsoft hosted network
2. B. Join type: Microsoft Entra hybrid join / Network: Microsoft hosted network
3. C. Join type: Microsoft Entra hybrid join / Network: Azure network connection (ANC)
4. D. Join type: Microsoft Entra registered / Network: Azure network connection (ANC)

You plan to use Windows Backup for Organizations to restore the Windows settings of users to new devices.

You configure Enable Windows backup in the settings catalog and set Show restore page to On in Windows Backup and Restore under Devices > Enrollment > Windows.

New devices will be deployed as shown in the following table.

On which devices will the restore page be displayed during enrollment?

1. A. Device1 only
2. B. Device1 and Device2 only
3. C. Device1 and Device3 only
4. D. Device1, Device2, and Device3

You plan to configure the settings of a third-party app named App1 by using Microsoft Intune. The vendor of App1 provides App1.admx and App1.adml.

When you attempt to import App1.admx, the import fails because App1.admx references a namespace defined in another ADMX file.

You need to successfully import App1.admx.

What should you do?

1. A. Import App1.admx without App1.adml.
2. B. Import the referenced ADMX file and its corresponding ADML file first, and then import App1.admx.
3. C. Import App1.admx into Group Policy analytics.
4. D. Upload App1.admx as a custom OMA-URI profile.

You manage Windows devices by using on-premises Group Policy Objects (GPOs).

You plan to identify which GPO settings are supported by Microsoft Intune MDM, and then migrate the supported settings to a settings catalog policy.

You use Group Policy analytics in Intune.

What should you do first?

1. A. From the Group Policy Management Console, export the GPOs as XML files, and then import the files into Group Policy analytics.
2. B. Import the ADMX files of the GPOs into Intune.
3. C. Run gpresult /h on a device and upload the HTML file.
4. D. Sync the GPOs by using Microsoft Entra Connect.

You assign a device configuration profile named Profile1 to a user group named Sales. Users in the Sales group have enrolled both corporate-owned and personally-owned devices in Microsoft Intune.

You need to ensure that Profile1 applies only to the corporate-owned devices of the users in the Sales group. The solution must be implemented without creating new groups.

What should you use?

1. A. an assignment filter that has a rule of (device.deviceOwnership -eq "Corporate") in Include filtered devices in profile mode
2. B. an assignment filter that has a rule of (device.deviceOwnership -eq "Corporate") in Exclude filtered devices from profile mode
3. C. a scope tag
4. D. a device category

Your company uses Microsoft Intune Suite. Users sign in to Windows 11 devices as standard users.

You need to use Endpoint Privilege Management (EPM) to allow users to run App1.exe with administrative privileges. App1.exe must be elevated only after a help desk administrator approves each request.

Which elevation type should you use in the elevation rules policy?

1. A. Automatic
2. B. User confirmed
3. C. Support approved
4. D. Elevate as current user

You plan to use Microsoft Cloud PKI to issue certificates for Wi-Fi authentication to Windows devices enrolled in Microsoft Intune. There is no on-premises PKI infrastructure.

You create a root CA and an issuing CA in Cloud PKI.

You need to ensure that a SCEP certificate profile deploys successfully to the devices.

What should you deploy to the devices before you deploy the SCEP certificate profile?

1. A. a PKCS certificate profile
2. B. a trusted certificate profile that contains the root CA certificate
3. C. the Certificate Connector for Microsoft Intune
4. D. an imported PKCS certificate profile

You have the devices shown in the following table that are enrolled in Microsoft Intune.

You need to perform a remote action on each device.

Which action should you use?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Device1: Wipe / Device2: Fresh Start
2. B. Device1: Retire / Device2: Autopilot Reset
3. C. Device1: Retire / Device2: Wipe
4. D. Device1: Delete / Device2: Fresh Start

At the end of the school year, you need to wipe 250 Windows 11 devices that are enrolled in Microsoft Intune.

You plan to use Devices > All devices > Bulk device actions.

What is the minimum number of bulk device actions you must create to complete the wipe?

1. A. 1
2. B. 2
3. C. 3
4. D. 5

Your company has licenses for Microsoft Intune Advanced Analytics. You have a corporate-owned, Microsoft Entra joined Windows 11 device named Device1.

A help desk user named User1 must use KQL to check registry values and running services on Device1 in real time.

You need to allow User1 to run device query by using the principle of least privilege.

What should you do?

1. A. Assign User1 the Microsoft Entra Global Administrator role.
2. B. Assign User1 a custom Intune role that includes the Managed devices/Query and Managed devices/Read permissions.
3. C. Assign User1 the Log Analytics Reader role.
4. D. Assign User1 the Security Copilot Owner role.

You have Microsoft Entra joined Windows 11 devices. Users sign in as standard users.

You need to ensure that the devices are encrypted by BitLocker without user interaction by using an endpoint security disk encryption policy.

How should you configure the following settings in the policy?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Allow Warning For Other Disk Encryption: Enabled / Allow Standard User Encryption: Disabled
2. B. Allow Warning For Other Disk Encryption: Disabled / Allow Standard User Encryption: Enabled
3. C. Allow Warning For Other Disk Encryption: Enabled / Allow Standard User Encryption: Enabled
4. D. Allow Warning For Other Disk Encryption: Disabled / Allow Standard User Encryption: Disabled

You use Microsoft Intune to encrypt Microsoft Entra joined Windows 11 devices by using BitLocker. The recovery keys are backed up to Microsoft Entra ID.

You need to ensure that when users encounter the BitLocker recovery screen, they can retrieve the recovery key of their own device from another device without contacting the help desk.

What should you configure?

1. A. In the Microsoft Entra ID device settings, set Restrict users from recovering the BitLocker key(s) for their owned devices to No.
2. B. Assign the Help Desk Operator role to the users.
3. C. In the disk encryption policy, disable Client-driven recovery password rotation.
4. D. Run the BitLocker key rotation remote action on the devices.

You plan to deploy attack surface reduction (ASR) rules to Windows 11 devices by using Microsoft Intune.

Before you enforce the ASR rules, you need to evaluate how the rules affect the line-of-business apps of the users. The solution must NOT interrupt the work of the users.

To which mode should you set the ASR rules?

1. A. Block
2. B. Audit
3. C. Warn
4. D. Off

You need to apply the Windows security configuration recommended by Microsoft to all the Windows 11 devices enrolled in Microsoft Intune.

The solution must minimize administrative effort.

What should you use?

1. A. a settings catalog policy in which you configure each setting manually
2. B. the security baseline for Windows
3. C. Group Policy analytics
4. D. a custom compliance policy

You configure the integration between Microsoft Defender for Endpoint and Microsoft Intune. Windows 11 devices are onboarded to Defender for Endpoint.

You need to ensure that devices that Defender for Endpoint evaluates as having a machine risk score of Medium or higher cannot access Exchange Online.

You configure Require the device to be at or under the machine risk score in a compliance policy and create a Conditional Access policy that requires devices to be compliant.

To which value should you set Require the device to be at or under the machine risk score?

1. A. Clear
2. B. Low
3. C. Medium
4. D. High

You need to onboard 2,000 Windows 11 devices enrolled in Microsoft Intune to Microsoft Defender for Endpoint. The service-to-service connection between Intune and Defender for Endpoint is already configured.

The solution must minimize administrative effort.

What should you do?

1. A. Download the onboarding package and run the local script on each device.
2. B. Create an endpoint detection and response (EDR) policy and set Microsoft Defender for Endpoint client configuration package type to Auto from connector.
3. C. In an antivirus policy, enable Allow realtime monitoring.
4. D. Deploy Microsoft Defender for Endpoint as a Win32 app.

You plan to deploy an App Control for Business policy to Windows 11 devices by using Microsoft Intune.

You need to ensure that apps deployed by using Intune are automatically allowed to run without creating individual allow rules.

What should you configure?

1. A. Enable the Intune Management Extension as a managed installer, and select Trust apps from managed installers in the policy.
2. B. Select only Trust apps with good reputation in the policy.
3. C. Deploy AppLocker rules by using Group Policy.
4. D. Create an Endpoint Privilege Management (EPM) automatic elevation rule.

You have 800 devices that run Windows 11, version 24H2, and are managed by using Microsoft Intune.

You need to ensure that the devices remain on version 24H2 and that no later feature updates are installed. The devices must continue to receive monthly quality updates.

What should you use?

1. A. an update ring that has the feature update deferral period set to 365 days
2. B. a feature update policy that specifies Windows 11, version 24H2
3. C. pausing feature updates in an update ring
4. D. a quality update policy (expedite)

You set When available, apply without restarting the device ("hotpatch") to Allow in a Windows quality update policy and assign the policy to the x64 devices shown in the following table. All users have Microsoft 365 E3 licenses.

Which devices will receive hotpatch updates?

1. A. Device1 only
2. B. Device1 and Device2 only
3. C. Device1 and Device3 only
4. D. Device1, Device2, and Device3

Microsoft releases a Windows security update that fixes a zero-day vulnerability. The update ring for your Windows 11 devices has the quality update deferral period set to seven days.

You need to ensure that the update is installed on all devices as soon as possible without modifying the update ring settings.

What should you create?

1. A. a quality update policy that expedites the update
2. B. a new update ring
3. C. a feature update policy
4. D. a driver update policy

Your company has a main office that has multiple floors. Each floor is on a different subnet and behind a NAT, but all the devices belong to the same Active Directory site.

You need to ensure that when the devices download Windows updates, the devices share content peer-to-peer with other devices in the same Active Directory site across the NATs.

To which value should you set Download mode in a Delivery Optimization configuration profile?

1. A. HTTP only, no peering (0)
2. B. HTTP blended with peering behind same NAT (1)
3. C. HTTP blended with peering across a private group (2)
4. D. Simple download mode with no peering (99)

You create a Windows feature update policy in Microsoft Intune and assign it to devices.

When you open the feature update report in Reports > Windows updates, no device data is displayed. The diagnostic data level of the devices is configured to Required.

You need to ensure that the report displays data.

What should you do?

1. A. In Tenant administration > Connectors and tokens > Windows data, enable the features that require Windows diagnostic data.
2. B. Assign an Endpoint analytics data collection policy.
3. C. In the Microsoft Entra ID diagnostic settings, send audit logs to Log Analytics.
4. D. Resume updates in the update ring.

You have supervised iPhones that are enrolled in Microsoft Intune by using Automated Device Enrollment (ADE).

You need to ensure that the devices are updated to a specified version of iOS by a specified date and time. The solution must use the current method recommended by Apple.

What should you use?

1. A. the Declarative Device Management (DDM) > Software Update settings in the settings catalog
2. B. Devices > Update policies for iOS/iPadOS (MDM-based update policy)
3. C. a compliance policy that requires a minimum OS version
4. D. an app configuration policy

You plan to deploy an app named App1 to Windows 11 devices by using Microsoft Intune. The installer of App1 consists of setup.exe and multiple support files.

You need to prepare App1 so that it can be uploaded to Intune as a Win32 app.

What should you use?

1. A. the MSIX Packaging Tool
2. B. the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)
3. C. the Intune App Wrapping Tool
4. D. the Office Deployment Tool (ODT)

You assign a Win32 app as required to devices.

In the Intune admin center, the installation status of the app shows Failed with error code 0x87D1041C. However, users report that the app is installed on their devices and starts successfully.

You need to ensure that the installation status is reported correctly.

What should you modify?

1. A. the requirement rules
2. B. the detection rules
3. C. the dependencies
4. D. the assignment type

You deploy Windows 11 devices by using Windows Autopilot and an Enrollment Status Page (ESP). The ESP tracks the installation of Microsoft 365 Apps and five Win32 apps.

On some devices, the ESP stops during app installation, and the deployment fails.

You need to ensure that the deployment does not fail.

What should you do?

1. A. Deploy Microsoft 365 Apps as a Win32 app that uses the Office Deployment Tool (ODT).
2. B. Convert the five Win32 apps to line-of-business (MSI) apps.
3. C. Change the update channel of Microsoft 365 Apps to Semi-Annual Enterprise Channel.
4. D. Reduce the ESP timeout to 30 minutes.

Users at your company use Microsoft 365 Apps on both corporate-owned devices enrolled in Intune and personally-owned Windows devices that are NOT enrolled in Intune.

You need to ensure that a policy that restricts running Office macros is applied on all devices when the users sign in.

What should you use?

1. A. Cloud Policy service in the Microsoft 365 Apps admin center
2. B. a settings catalog policy in Intune
3. C. a configuration profile that uses imported Office ADMX files
4. D. an app protection policy

Users at your company use Microsoft Outlook and Microsoft Teams on iOS and Android devices.

You need to ensure that Outlook email and Teams notifications are muted from 19:00 to 08:00 on weekdays and all day on weekends.

What should you create?

1. A. a Quiet Time policy of the Days of the week type assigned to a user group
2. B. a Quiet Time policy of the Date Range type assigned to a device group
3. C. a device restrictions configuration profile
4. D. conditional launch in an app protection policy

You have a paid app named App1 that you purchased in volume from Apple Business Manager. You have supervised shared iPads that are enrolled by using Automated Device Enrollment (ADE), and users do not sign in with an Apple Account.

You need to ensure that App1 is installed automatically on the iPads without the users entering an Apple Account.

What should you do?

1. A. Upload the location token (.vpptoken) to Intune and assign App1 as required by using device licensing.
2. B. Upload the location token to Intune and assign App1 as available by using user licensing.
3. C. Add App1 as an iOS line-of-business app (.ipa).
4. D. Add App1 as a web link.

At your company, users access company data by using Microsoft Outlook and Microsoft Teams on personally-owned iPhones. The devices are NOT enrolled in Microsoft Intune.

You need to ensure that users cannot copy and paste company data to personal apps. The devices must remain unenrolled.

What should you create?

1. A. a device restrictions configuration profile
2. B. an app protection policy that has Restrict cut, copy, and paste between other apps set to Policy managed apps
3. C. a compliance policy
4. D. an app configuration policy for managed devices

You create app protection policies for iOS and Android devices and assign them to all users.

You need to ensure that users can access Exchange Online and SharePoint Online on mobile devices only from apps that have app protection policies applied.

Which grant control should you use in a Conditional Access policy?

1. A. Require device to be marked as compliant
2. B. Require app protection policy
3. C. Require Microsoft Entra hybrid joined device
4. D. Require password change

You have corporate-owned iOS devices enrolled in Microsoft Intune. Outlook is deployed by Intune as a managed app.

You need to ensure that users can add only their corporate work account to Outlook and cannot add personal email accounts.

What should you create, and which configuration key should you use?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Create: an app configuration policy for managed devices / Key: IntuneMAMAllowedAccountsOnly = Enabled
2. B. Create: a device restrictions configuration profile / Key: IntuneMAMAllowedAccountsOnly = Enabled
3. C. Create: an app configuration policy for managed devices / Key: com.microsoft.outlook.EmailProfile.AccountType = ModernAuth
4. D. Create: a compliance policy / Key: IntuneMAMUPN = {{userprincipalname}}

You are creating a PowerShell script that exports a list of all the managed devices enrolled in Microsoft Intune every night. The script must run on a schedule without user interaction.

You register an app in Microsoft Entra ID and configure certificate authentication.

You need to grant permissions to the app by using the principle of least privilege.

Which Microsoft Graph permission should you grant?

1. A. DeviceManagementManagedDevices.Read.All (delegated permission)
2. B. DeviceManagementManagedDevices.Read.All (application permission)
3. C. DeviceManagementConfiguration.ReadWrite.All (application permission)
4. D. Directory.ReadWrite.All (application permission)

You need to evaluate whether a specific registry value for an app named App1 is configured on Windows devices as a condition for device compliance.

You create a custom compliance discovery script (PowerShell) and upload it to Intune.

When you create a compliance policy that contains custom compliance settings, what else should you upload?

1. A. a JSON file that defines the compliance rules and remediation messages
2. B. an ADMX file
3. C. a remediation script
4. D. a configuration service provider (CSP) file in XML format

You plan to use Remediations in Microsoft Intune to automatically start a Windows service named Service1 when the service is stopped.

You create a detection script and a remediation script and schedule them to run daily.

What should the detection script do when the service is stopped so that the remediation script runs?

1. A. Exit with exit code 0.
2. B. Exit with exit code 1.
3. C. Output Write-Output "Compliant".
4. D. Restart the device.

You enroll Windows 11 devices that are enrolled in Microsoft Intune in Endpoint analytics.

Users report that devices of some models take a long time to start and sign in.

You need to compare the boot time, sign-in time, and restart frequency by device model.

Which Endpoint analytics report should you use?

1. A. Startup performance
2. B. Application reliability
3. C. Work from anywhere
4. D. Resource performance

Your company uses Microsoft Security Copilot and has security compute units (SCUs) provisioned. Multi Admin Approval (MAA) in Microsoft Intune protects the deployment of Windows PowerShell scripts.

You need to recommend Security Copilot agents in Intune that meet the following requirements:

• Requirement 1: Prioritize remediation of CVEs on managed devices based on Microsoft Defender Vulnerability Management data, and provide remediation steps in Intune.
• Requirement 2: Before an approver approves a script deployment request, evaluate the impact of the change and provide a recommendation.

Which agent should you recommend for each requirement?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. Requirement 1: Policy Configuration Agent / Requirement 2: Change Review Agent
2. B. Requirement 1: Vulnerability Remediation Agent / Requirement 2: Change Review Agent
3. C. Requirement 1: Vulnerability Remediation Agent / Requirement 2: Device Offboarding Agent
4. D. Requirement 1: Device Offboarding Agent / Requirement 2: Policy Configuration Agent

You need to ensure that alerts are sent to the operations team when the compliance state of devices changes or configurations are modified in Microsoft Intune. The alerts must be customizable by using Kusto queries.

You create a Log Analytics workspace.

What should you do next?

1. A. In Intune Tenant administration > Diagnostic settings, send the audit logs, operational logs, and device compliance logs to the workspace, and then create Azure Monitor alert rules.
2. B. Connect the Intune Data Warehouse OData feed to Power BI.
3. C. Assign an Endpoint analytics data collection policy.
4. D. Configure email notifications in the message center of the Microsoft 365 admin center.

You need to meet the technical requirements for the iPhones of the sales department.

What should you implement?

1. A. a compliance policy and a Conditional Access policy that requires a compliant device
2. B. an app protection policy and a Conditional Access policy that requires an app protection policy
3. C. Automated Device Enrollment by using Apple Business Manager
4. D. User enrollment (account driven) and a device restrictions configuration profile

You need to meet the technical requirements for the developers.

What should you use?

1. A. a local user group membership policy that adds the developers to the Administrators group
2. B. sharing the Windows LAPS password with the developers
3. C. Endpoint Privilege Management (EPM) policies that include an elevation rule for Tool1.exe
4. D. an App Control for Business policy that allows Tool1.exe

You need to configure an Intune role assignment to meet the technical requirements for the Osaka help desk team.

What should you configure in the role assignment?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

1. A. What they can view: Scope (Groups) / Targets of remote actions: Scope tags
2. B. What they can view: Scope tags / Targets of remote actions: Scope (Groups)
3. C. What they can view: Members / Targets of remote actions: Scope (Groups)
4. D. What they can view: Administrative units / Targets of remote actions: Assignment filters

You need to meet the technical requirements for Service2.

What should you use?

1. A. a Remediations detection script and remediation script scheduled to run daily
2. B. an Intune platform script (PowerShell script)
3. C. a custom compliance policy
4. D. device query