MD-101 : Managing Modern Desktops : Part 03

MD-101 : Managing Modern Desktops : Part 03

1. You company has a Microsoft Azure Active Directory (Azure AD) tenant that includes Microsoft Intune. All of the Windows 10 devices are enrolled in Intune.

   You are preparing to configure a Windows Information Protection (WIP) policy:

   You need to make sure that the policy is configured to allow for the logging of unacceptable data sharing, but not blocking the action.

   Which of the following is the WIP protection mode that you should use?

   • Block
   • Silent
   • Off
   • Allow Overrides

2. Your company has an Active Directory domain, named weylandindustries.com, and a Microsoft Office 365 subscription. The domain is also synced to Microsoft Azure Active Directory (Azure AD).

   All company computers are domain-joined, and are running the most recent Microsoft OneDrive sync client.

   You are currently configuring OneDrive group policy settings.

   Which of the following is the setting that will minimize the disk space consumed by a user profile, when enabled?

   • OneDrive Files On-Demand
   • Silently move known folders to OneDrive
   • Prompt users to move Windows known folders to OneDrive
   • Silently configure OneDrive using the primary Windows account

   Explanation: 
   OneDrive Files On-Demand enables users to view, search for, and interact with files stored in OneDrive from within File Explorer without downloading them and taking up space on the local hard drive.

3. You manage your company’s Microsoft 365 subscription.

   You are tasked with creating an app protection policy for the Microsoft Outlook app on iOS devices that are not enrolled in Microsoft 365 Device Management.

   You have to make sure that the policy is configured to prohibit the users from using the Outlook app if the operating system version is less than 12.0.0. You also have to make sure that an alphanumeric passcode is required for users to access the Outlook app.

   Which of the following is policy settings that you should configure? (Choose two.)

   • Conditional launch
   • Data transfer exemptions
   • Data protection
   • Access requirements

4. You are responsible for your company’s Microsoft 365 environment, with co-management enabled.

   All company computers have been deployed via Microsoft Deployment Toolkit (MDT), and have Windows 10 installed.

   You have been tasked devising a strategy for deploying Microsoft Office 365 ProPlus to new computers. You have to make sure that most recent version is installed at all times, while also reducing the effort required to meet the prerequisites.

   Which of the following actions should you take?

   • You should make use of Windows Deployment Services (WDS).
   • You should make use of the Microsoft Deployment Toolkit
   • You should make use of the Office Deployment Tool (ODT).
   • You should make use of a Windows Configuration Designer provisioning package
5. This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

   To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

   At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

   To start the case study
   To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question.

   General Overview

   Litware, Inc. is an international manufacturing company that has 3,000 employees. The company has sales, marketing, research, human resources (HR), development, and IT departments.

   Litware has two main offices in New York and Los Angeles. Litware has five branch offices in Asia.

   Existing Environment

   Current Business Model

   The Los Angeles office has 500 developers. The developers work flexible hours ranging from 11 AM to 10 PM.

   Litware has a Microsoft Endpoint Configuration Manager deployment.

   During discovery, the company discovers a process where users are emailing bank account information of its customers to internal and external recipients.

   Current Environment

   The network contains an Active Directory domain that is synced to Microsoft Azure Active Directory (Azure AD). The functional level of the forest and the domain is Windows Server 2012 R2. All domain controllers run Windows Server 2012 R2.

   Litware has the computers shown in the following table.

   

   The development department uses projects in Azure DevOps to build applications.

   Most of the employees in the sales department are contractors. Each contractor is assigned a computer that runs Windows 10. At the end of each contract, the computer is assigned to a different contractor. Currently, the computers are re-provisioned manually by the IT department.

   Problem Statements

   Litware identifies the following issues on the network:

   – Employees in the Los Angeles office report slow Internet performance when updates are downloading. The employees also report that the updates frequently consume considerable resources when they are installed. The Update settings are configured as shown in the Updates exhibit. (Click the Updates button.)
   – Management suspects that the source code for the proprietary applications in Azure DevOps in being shared externally.
   – Re-provisioning the sales department computers is too time consuming.

   Requirements

   Business Goals

   Litware plans to transition to co-management for all the company-owned Windows 10 computers.

   Whenever possible, Litware wants to minimize hardware and software costs.

   Device Management Requirements

   Litware identifies the following device management requirements:

   – Prevent the sales department employees from forwarding email that contains bank account information.
   – Ensure that Microsoft Edge Favorites are accessible from all computers to which the developers sign in.
   – Prevent employees in the research department from copying patented information from trusted applications to untrusted applications.

   Technical Requirements

   Litware identifies the following technical requirements for the planned deployment:

   – Re-provision the sales department computers by using Windows AutoPilot.
   – Ensure that the projects in Azure DevOps can be accessed from the corporate network only.
   – Ensure that users can sign in to the Azure AD-joined computers by using a PIN. The PIN must expire every 30 days.
   – Ensure that the company name and logo appears during the Out of Box Experience (OOBE) when using Windows AutoPilot.

   Exhibits

   Updates

   

   1. You need to capture the required information for the sales department computers to meet the technical requirements.

      Which Windows PowerShell command should you run first?

      • Install-Module WindowsAutoPilotIntune

      • Install-Script Get-WindowsAutoPilotInfo

      • Import-AutoPilotCSV

      • Get-WindowsAutoPilotInfo

   2. What should you configure to meet the technical requirements for the Azure AD-joined computers?

      • Windows Hello for Business from the Endpoint Management admin center.
      • The Accounts options in an endpoint protection profile.
      • The Password Policy settings in a Group Policy object (GPO).
      • A password policy from the Microsoft 365 admin center.

   3. HOTSPOT

      You need to meet the OOBE requirements for Windows AutoPilot.

      Which two settings should you configure from the Azure Active Directory blade? To answer, select the appropriate settings in the answer area.

      NOTE: Each correct selection is worth one point.

      

      

      Explanation:​
      Ensure that the company name and logo appears during the Out of Box Experience (OOBE) when using Windows AutoPilot.

   4. HOTSPOT

      You need to meet the technical requirements for Windows AutoPilot.

      Which two settings should you configure from the Azure Active Directory blade? To answer, select the appropriate settings in the answer area.

      NOTE: Each correct selection is worth one point.

      

      

   5. HOTSPOT

      You need to resolve the performance issues in the Los Angeles office.

      How should you configure the update settings? To answer, select the appropriate options in the answer area.

      NOTE: Each correct selection is worth one point.

      

      

      Explanation:

      The Los Angeles office has 500 developers. The developers work flexible hours ranging from 11 AM to 10 PM.

6. This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

   To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

   At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

   To start the case study
   To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question.

   Overview
   Contoso, Ltd, is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.

   Contoso has the users and computers shown in the following table.

   

   The company has IT, human resources (HR), legal (LEG), marketing (MKG) and finance (FIN) departments.

   Contoso uses Microsoft Store for Business and recently purchased a Microsoft 365 subscription.

   The company is opening a new branch office in Phoenix. Most of the users in the Phoenix office will work from home.

   Existing Environment
   The network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD).

   All member servers run Windows Server 2016. All laptops and desktop computers run Windows 10 Enterprise.

   The computers are managed by using Microsoft Endpoint Configuration Manager. The mobile devices are managed by using Microsoft Intune.

   The naming convention for the computers is the department acronym, followed by a hyphen, and then four numbers, for example, FIN-6785. All the computers are joined to the on-premises Active Directory domain.

   Each department has an organizational unit (OU) that contains a child OU named Computers. Each computer account is in the Computers OU of its respective department.

   Intune Configuration

   The domain has the users shown in the following table.

   

   User2 is a device enrollment manager (DEM) in Intune.

   The devices enrolled in Intune are shown in the following table.

   

   The device compliance policies in Intune are configured as shown in the following table.

   

   The device compliance policies have the assignments shown in the following table.

   

   The device limit restrictions in Intune are configured as shown in the following table.

   

   Requirements

   Planned Changes
   Contoso plans to implement the following changes:

   – Provide new computers to the Phoenix office users. The new computers have Windows 10 Pro preinstalled and were purchased already.
   – Start using a free Microsoft Store for Business app named App1.
   – Implement co-management for the computers.

   Technical Requirements
   Contoso must meet the following technical requirements:

   – Ensure that the users in a group named Group4 can only access Microsoft Exchange Online from devices that are enrolled in Intune.
   – Deploy Windows 10 Enterprise to the computers of the Phoenix office users by using Windows Autopilot.
   – Monitor the computers in the LEG department by using Windows Analytics.
   – Create a provisioning package for new computers in the HR department.
   – Block iOS devices from sending diagnostic and usage telemetry data.
   – Use the principle of least privilege whenever possible.
   – Enable the users in the MKG department to use App1.
   – Pilot co-management for the IT department.

   1. HOTSPOT

      You need to meet the technical requirements for the new HR department computers.

      How should you configure the provisioning package? To answer, select the appropriate options in the answer area.

      NOTE: Each correct selection is worth one point.

      

      

   2. You need to prepare for the deployment of the Phoenix office computers.

      What should you do first?

      • Extract the hardware ID information of each computer to a CSV file and upload the file from the Microsoft Endpoint Management admin center.
      • Extract the serial number information of each computer to a XML file and upload the file from the Microsoft Endpoint Management admin center.
      • Extract the serial number information of each computer to a CSV file and upload the file from the Microsoft Endpoint Management admin center.
      • Generalize the computers and configure the Device settings from the Azure Active Directory admin center.
      Explanation: 
      To manage devices through Microsoft Store for Business and Education, you’ll need a .csv file that contains specific information about the devices. You should be able to get this from your Microsoft account contact, or the store where you purchased the devices. Upload the .csv file to Microsoft Store to add the devices.

   3. You need to prepare for the deployment of the Phoenix office computers.

      What should you do first?

      • Generalize the computers and configure the Mobility (MDM and MAM) settings from the Azure Active Directory admin center.
      • Extract the hardware ID information of each computer to a CSV file and upload the file from the Microsoft Intune blade in the Azure portal.
      • Extract the hardware ID information of each computer to an XML file and upload the file from the Devices settings in Microsoft Store for Business.
      • Extract the serial number information of each computer to a CSV file and upload the file from the Microsoft Intune blade in the Azure portal.

7. Case study

   This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

   To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

   At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

   To start the case study

   To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

   Overview

   Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.

   Contoso has a Microsoft 365 E5 subscription.

   Environment

   Network Environment

   The network contains an on-premises Active Directory domain named contoso.com. The domain contains the servers shown in the following table.

   

   Contoso has a hybrid Azure Active Directory (Azure AD) tenant named contoso.com.

   Contoso has a Microsoft Store for Business instance.

   Users and Groups

   The contoso.com tenant contains the users shown in the following table.

   

   All users are assigned a Microsoft Office 365 license and an Enterprise Mobility + Security E3 license.

   Enterprise State Roaming is enabled for Group1 and GroupA.

   Group1 and Group2 have a Membership type of Assigned.

   Devices

   Contoso has the Windows 10 devices shown in the following table.

   

   The Windows 10 devices are joined to Azure AD and enrolled in Microsoft Intune.

   The Windows 10 devices are configured as shown in the following table.

   

   All the Azure AD joined devices have an executable file named C:\AppA.exe and a folder named D:\Folder1.

   Microsoft Endpoint Manager Configuration

   Microsoft Endpoint Manager has the compliance policies shown in the following table.

   

   The Compliance policy settings are shown in the following exhibit.

   

   The Automatic Enrollment settings have the following configurations:

   – MDM user scope: Group A
   – MAM user scope: Group B

   You have an Endpoint protection configuration profile that has the following Controlled folder access settings:

   – Name: Protection1
   – Folder protection: Enable
   – List of apps that have access to protected folders: C:\*\AppA.exe
   – List of additional folders that need to be protected: D:\Folder1
   – Assignments:
   – Included groups: Group2, GroupB

   Windows Autopilot Configuration

   Contoso has a Windows Autopilot deployment profile configured as shown in the following exhibit.

   

   Currently, there are no devices deployed by using Window Autopilot.

   The Intune connector for Active Directory is installed on Server1.

   Requirements

   Planned Changes

   Contoso plans to implement the following changes:

   – Purchase a new Windows 10 device named Device6 and enroll the device in Intune.

   – New computers will be deployed by using Windows Autopilot and will be hybrid Azure AD joined.

   – Deploy a network boundary configuration profile that will have the following settings:
   – Name: Boundary1
   – Network boundary: 192.168.1.0/24
   – Scope tags: Tag1
   – Assignments:
   – – Included groups: Group1, Group2

   – Deploy two VPN configuration profiles named Connection1 and Connection2 that will have the following settings:
   – Name: Connection1
   – Connection name: VPN1
   – Connection type: L2TP
   – Assignments:
   – – Included groups: Group1, Group2, GroupA
   – – Excluded groups: —

   – Name: Connection2
   – Connection name: VPN2
   – Connection type: IKEv2
   – Assignments:
   – – Included groups: GroupA
   – – Excluded groups: GroupB

   – Purchase an app named App1 that is available in Microsoft Store for Business and to assign the app to all the users.

   Technical Requirements

   Contoso must meet the following technical requirements:

   – Users in Group A must be able to deploy new computers.
   – Administrative effort must be minimized.

   1. HOTSPOT

      For each of the following statements, select Yes if the statement is true. Otherwise, select No.

      NOTE: Each correct selection is worth one point.

      

      

8. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

   After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

   Your company uses Windows Autopilot to configure the computer settings of computers issued to users.

   A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company.

   You plan to transfer the computer to a user named User2.

   You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.

   Solution: You perform a remote Windows Autopilot Reset.

   Does this meet the goal?

   • Yes
   • No

9. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

   After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

   Your company uses Windows Autopilot to configure the computer settings of computers issued to users.

   A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company.

   You plan to transfer the computer to a user named User2.

   You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.

   Solution: You create a new Windows Autopilot user-driven deployment profile.

   Does this meet the goal?

   • Yes
   • No

10. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    Your company uses Windows Autopilot to configure the computer settings of computers issued to users.

    A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company.

    You plan to transfer the computer to a user named User2.

    You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.

    Solution: You create a new Windows Autopilot self-deploying deployment profile.

    Does this meet the goal?

    • Yes
    • No

11. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You need to ensure that feature and quality updates install automatically on a Windows 10 computer during a maintenance window.

    Solution: In Group policy, from the Maintenance Scheduler settings, you configure Automatic Maintenance Random Delay.

    Does this meet the goal?

    • Yes
    • No

12. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You need to ensure that feature and quality updates install automatically on a Windows 10 computer during a maintenance window.

    Solution: In Group policy, from the Windows Update settings, you enable Configure Automatic Updates, select 4-Auto download and schedule the install, and then enter a time.

    Does this meet the goal?

    • Yes
    • No

13. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You need to ensure that feature and quality updates install automatically on a Windows 10 computer during a maintenance window.

    Solution: In Group policy, from the Maintenance Scheduler settings, you configure Automatic Maintenance Activation Boundary.

    Does this meet the goal?

    • Yes
    • No

14. DRAG DROP

    Your company has a computer named Computer1 that runs Windows 10.

    Computer1 was used by a user who left the company.

    You plan to repurpose Computer1 and assign the computer to a new user. You need to redeploy Computer1 by using Windows AutoPilot.

    Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

    

    

15. HOTSPOT

    Your company has an infrastructure that has the following:

    – A Microsoft 365 tenant
    – An Active Directory forest
    – Microsoft Intune
    – A Key Management Service (KMS) server
    – A Windows Deployment Services (WDS) server
    – A Microsoft Azure Active Directory (Azure AD) Premium tenant

    The company purchases 100 new computers that run Windows 10.

    You need to ensure that the new computers are joined automatically to Azure AD by using Windows Autopilot.

    What should you use? To answer, select the appropriate options in the answer area.

    NOTE: Each correct selection is worth one point.

    

    

16. Your company purchases new computers that run Windows 10. The computers have cameras that support Windows Hello for Business.

    You configure the Windows Hello for Business Group Policy settings as shown in the following exhibit.

    

    What are two valid methods a user can use to sign in? Each correct answer presents part of the solution.

    NOTE: Each correct selection is worth one point.

    • Facial recognition
    • A smartwatch that is Bluetooth-enabled
    • A PIN
    • A USB key

17. You have 10 computers that run Windows 8.1 and have the following configurations:

    – A single MBR disk
    – A disabled TPM chip
    – Disabled hardware virtualization
    – UEFI firmware running in BIOS mode
    – Enabled Data Execution Prevention (DEP)

    You plan to upgrade the computers to Windows 10.

    You need to ensure that the computers can use Secure Boot.

    Which two actions should you perform? Each correct answer presents part of the solution.

    NOTE: Each correct selection is worth one point.

    • Convert the MBR disk to a GPT disk
    • Enable the TPM chip.
    • Disable DEP
    • Enable hardware virtualization
    • Convert the firmware from BIOS to UEFI.

18. Your network contains an Active Directory domain. The domain contains 2,000 computers that run Windows 10.

    You implement hybrid Microsoft Azure Active Directory (Azure AD) and Microsoft Intune.

    You need to automatically register all the existing computers to Azure AD and enroll the computers in Intune. The solution must minimize administrative effort.

    What should you use?

    • An Autodiscover address record.
    • A Windows AutoPilot deployment profile.
    • An Autodiscover service connection point (SCP).
    • A Group Policy object (GPO).

19. HOTSPOT

    Your network contains an Active Directory domain. The domain contains computers that run Windows 10 and are enrolled in Microsoft Intune. Updates are deployed by using Windows Update for Business.

    Users in a group named Group1 must meet the following requirements:

    – Update installations must occur any day only between 00:00 and 05:00.
    – Updates must be downloaded from Microsoft and from other company computers that already downloaded the updates.

    You need to configure the Windows 10 Update Rings settings in Intune to meet the requirements.

    Which two settings should you modify? To answer, select the appropriate settings in the answer area.

    NOTE: Each correct selection is worth one point.

    

    

20. Your network contains an Active Directory domain named contoso.com.

    You create a provisioning package named Package1 as shown in the following exhibit.

    

    What is the maximum number of devices on which you can run Package1 successfully?

    • 1
    • 10
    • 25
    • unlimited
    Explanation:
    The device name uses a single random number (applied by %RAND:1%). This allows for 10 unique values (0 – 9).