NEW QUESTION 1

Your company has a Microsoft 365 subscription.
The company uses Microsoft Intune to manage all devices.
The company uses conditional access to restrict access to Microsoft 365 services for devices that do not comply with the company’s security policies.
You need to identify which devices will be prevented from accessing Microsoft 365 services.
What should you use?

• A. The Device Health solution in Windows Analytics.
• B. Windows Defender Security Center.
• C. The Device compliance blade in the Intune admin center.
• D. The Conditional access blade in the Azure Active Directory admin center.

Answer: C

NEW QUESTION 2

You have 100 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.
You need to configure the following device restrictions:
Block users from browsing to suspicious websites.
Scan all scripts loaded into Microsoft Edge.
Which two settings should you configure in Device restrictions? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-smartscreen/windows-d

NEW QUESTION 3

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. All Windows 10 devices are enrolled in Microsoft Intune.
You configure the following settings in Windows Information Protection (WIP):
Protected apps: App1
Exempt apps: App2
Windows Information Protection mode: Silent App1, App2, and App3 use the same file format.
You create a file named File1 in App1.
You need to identify which apps can open File1.
What apps should you identify? To answer, select the appropriate options in the answer area, NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/crea https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/crea

NEW QUESTION 4

You are creating a device configuration profile in Microsoft Intune. You need to implement an ADMX-backed policy.
Which profile type should you use?

• A. Identity protection
• B. Custom
• C. Device restrictions
• D. Device restrictions (Windows 10 Team)

Answer: B

Explanation:
Reference:
https://blogs.technet.microsoft.com/senthilkumar/2021/05/21/intune-deploying-admx-backed-policies-usingmicr

NEW QUESTION 5

Your network contains an Active Directory domain named contoso.com. The domain contains 200 computers that run Windows 10.
Folder Redirection for the Desktop folder is configured as shown in the following exhibit.

The target is set to Server1.
You plan to use known folder redirection in Microsoft OneDrive for Business.
You need to ensure that the desktop content of users remains on their desktop when you implement known folder redirection.
Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

• A. Clear the Grant the user exclusive rights to Desktop check box.
• B. Change the Policy Removal setting.
• C. Disable Folder Redirection.
• D. Clear the Move the contents of Desktop to the new location check box.

Answer: AB

Explanation:
References:
https://docs.microsoft.com/en-us/onedrive/redirect-known-folders

NEW QUESTION 6

Your company uses Microsoft Intune to manage devices. You need to ensure that only Android devices that use Android work profiles can enroll in Intune.
Which two configurations should you perform in the device enrollment restrictions? Each correct answer presents part of the solution.
NOTE: each correct selection is worth one point.

• A. From Select platforms, set Android work profile to Allow.
• B. From Configure platforms, set Android Personally Owned to Block.
• C. From Configure platforms, set Android Personally Owned to Allow.
• D. From Select platforms, set Android to Block.

Answer: AD

Explanation:
https://docs.microsoft.com/en-us/InTune/enrollment-restrictions-set

NEW QUESTION 7

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to ensure that feature and quality updates install automatically during a maintenance window. Solution: From the Maintenance Scheduler settings, you configure Automatic Maintenance Activation Boundary.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/sccm/sum/deploy-use/automatically-deploy-software-updates

NEW QUESTION 8

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
Your company uses Windows AutoPilot to configure the computer settings of computers issued to users. A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company. You plan to transfer the computer to a user named User2.
You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.
Solution: You create a new Windows AutoPilot self-deploying deployment profile. Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/self-deploying

NEW QUESTION 9

Your network contains an Active Directory domain that is synced to Microsoft Azure Active Directory (Azure AD).
You have a Microsoft 365 subscription.
You create a conditional access policy for Microsoft Exchange Online.
You need to configure the policy to prevent access to Exchange Online unless is connecting from a device that is hybrid Azure AD-joined.
Which settings should you configure?

• A. Locations
• B. Device platforms
• C. Sign-in risk
• D. Device state

Answer: D

Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/conditions#device-state

NEW QUESTION 10

Note: This question is part of a series of questions that present the same scenario. Each question in the
series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company uses Windows AutoPilot to configure the computer settings of computers issued to users. A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company. You plan to transfer the computer to a user named User2.
You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.
Solution: You create a new Windows AutoPilot user-driven deployment profile. Does this meet the goal?

• A. Yes
• B. No

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/user-driven

NEW QUESTION 11

You have a Microsoft 365 subscription.
All computers are enrolled in Microsoft Intune.
You have business requirements for securing your Windows 10 environment as shown in the following table.

What should you implement to meet each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://github.com/MicrosoftDocs/IntuneDocs/blob/master/intune/advanced-threat-protection.md

NEW QUESTION 12

You need to capture the required information for the sales department computers to meet the technical requirements.
Which Windows PowerShell command should you run first?

• A. Install-Module WindowsAutoPilotIntune
• B. Install-Script Get-WindowsAutoPilotInfo
• C. Import-AutoPilotCSV
• D. Get-WindowsAutoPilotInfo

Answer: A

Explanation:
References:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/existing-devices

NEW QUESTION 13

Your network contains an Active Directory named contoso.com. The domain contains two computers named Computer1 and Computer2 that run Windows 10.
Folder Redirection is configured for a domain user named User1. The AppDataRoaming folder and the Desktop folder are redirected to a network share.
User1 signs in to Computer1 and performs the following tasks:
Configures screen saver to start after five minutes of inactivity
Modifies the default save location for Microsoft Word
Creates a file named File1.docx on the desktop
Modifies the desktop background
You need to identify what will be retained when User1 signs in to Computer2. What should you identify?

• A. File1.docx and the desktop background only
• B. File1.docx, the screen saver settings, the desktop background, and the default save location for Word
• C. File1.docx only
• D. File1.docx, the desktop background, and the default save location for Word only

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview

NEW QUESTION 14

What should you use to meet the technical requirements for Azure DevOps?

• A. An app protection policy
• B. Windows Information Protection (WIP)
• C. Conditional access
• D. A device configuration profile

Answer: C

Explanation:
References:
https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-conditional-access? view=azure-devops

NEW QUESTION 15

Your company uses Microsoft Intune.
More than 500 Android and iOS devices are enrolled in the Intune tenant.
You plan to deploy new Intune policies. Different policies will apply depending on the version of Android or iOS installed on the device.
You need to ensure that the policies can target the devices based on their version of Android or iOS. What should you configure first?

• A. Corporate device identifiers in Intune
• B. Device settings in Microsoft Azure Active Directory (Azure AD)
• C. Device categories in Intune
• D. Groups that have dynamic membership rules in Microsoft Azure Active Directory (Azure AD)

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/compliance-policy-create-android https://docs.microsoft.com/en-us/intune/compliance-policy-create-ios

NEW QUESTION 16

Your network contains an Active Directory domain. The domain contains 2,000 computers that run Windows 10.
You implement hybrid Microsoft Azure Active Directory (Azure AD) and Microsoft Intune.
You need to automatically register all the existing computers to Azure AD and enroll the computers in Intune. The solution must minimize administrative effort.
What should you use?

• A. An Autodiscover address record.
• B. A Windows AutoPilot deployment profile.
• C. An Autodiscover service connection point (SCP).
• D. A Group Policy object (GPO).

Answer: B

Explanation:
Reference:
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Autopilot-Hybrid-Azure-AD-join-and

NEW QUESTION 17

You need to resolve the performance issues in the Los Angeles office.
How should you configure the update settings? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization https://2pintsoftware.com/delivery-optimization-dl-mode/

NEW QUESTION 18

You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (AD) and enrolled in Microsoft Intune.
You need to enable self-service password reset on the sign-in screen. Which settings should you configure from the Microsoft Intune blade?

• A. Device configuration
• B. Device compliance
• C. Device enrollment
• D. Conditional access

Answer: A

Explanation:
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-sspr-windows

NEW QUESTION 19

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company uses Windows AutoPilot to configure the computer settings of computers issued to users. A user named User1 has a computer named Computer1 that runs Windows 10. User1 leaves the company. You plan to transfer the computer to a user named User2.
You need to ensure that when User2 first starts the computer, User2 is prompted to select the language setting and to agree to the license agreement.
Solution: You perform a remote Windows AutoPilot Reset. Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-reset-remote

NEW QUESTION 20

Your network contains an Active Directory domain named contoso.com.
You create a provisioning package named Package1 as shown in the following exhibit.

What is the maximum number of devices on which you can run Package1 successfully?

• A. 1
• B. 10
• C. 25
• D. unlimited

Answer: D

NEW QUESTION 21
......