NEW QUESTION 1

Your company has an infrastructure that has the following:
A Microsoft 365 tenant
An Active Directory forest
Microsoft Store for Business
A Key Management Service (KMS) server
A Windows Deployment Services (WDS) server
A Microsoft Azure Active Directory (Azure AD) Premium tenant The company purchases 100 new computers that run Windows 10.
You need to ensure that the new computers are joined automatically to Azure AD by using Windows AutoPilot.
What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/enrollment-autopilot

NEW QUESTION 2

Your company has a Microsoft 365 subscription.
All the users in the finance department own personal devices that run iOS or Android. All the devices are enrolled in Microsoft Intune.
The finance department adds new users each month.
The company develops a mobile application named App1 for the finance department users. You need to ensure that only the finance department users can download App1.
What should you do first?

• A. Add App1 to Intune.
• B. Add App1 to a Microsoft Deployment Toolkit (MDT) deployment share.
• C. Add App1 to Microsoft Store for Business.
• D. Add App1 to the vendor stores for iOS and Android applications.

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/apps-add

NEW QUESTION 3

Your company has a computer named Computer1 that runs Windows 10 Pro.
The company develops a proprietary Universal Windows Platform (UWP) app named App1. App1 is signed with a certificate from a trusted certification authority (CA).
You need to sideload App1 to Computer1.
What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://www.windowscentral.com/how-enable-windows-10-sideload-apps-outside-store https://docs.microsoft.com/en-us/windows/application-management/sideload-apps-in-windows-10

NEW QUESTION 4

You have computers that run Windows 10 Pro. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.
You need to upgrade the computers to Windows 10 Enterprise. What should you configure in Intune?

• A. A device enrollment policy
• B. A device cleanup rule
• C. A device compliance policy
• D. A device configuration profile

Answer: D

Explanation:
Reference:
https://blogs.technet.microsoft.com/skypehybridguy/2021/09/21/intune-upgrade-windows-from-pro-toenterprise

NEW QUESTION 5

You need to recommend a solution to meet the device management requirements.
What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://github.com/MicrosoftDocs/IntuneDocs/blob/master/intune/app-protection-policy.md https://docs.microsoft.com/en-us/azure/information-protection/configure-usage-rights#do-not-forward-option-fo

NEW QUESTION 6

You have 1,000 computers that run Windows 10 and are members of an Active Directory domain. You create a workspace in Microsoft Azure Log Analytics.
You need to capture the event logs from the computers to Azure.
What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows

NEW QUESTION 7

Your company has a main office and six branch offices. The branch offices connect to the main office by using a WAN link. All offices have a local Internet connection and a Hyper-V host cluster.
The company has a Microsoft System Center Configuration Manager deployment. The main office is the primary site. Each branch has a distribution point. All computers that run Windows 10 are managed by using both Configuration Manager and Microsoft Intune.
You plan to deploy the latest build of Microsoft Office 365 ProPlus to all the computers.
You need to minimize the amount of network traffic on the company’s Internet links for the planned deployment.
What should you include in the deployment plan?

• A. From Intune, configure app assignments for the Office 365 ProPlus suite.In each office, copy the Office 365 distribution files to a Microsoft Deployment Toolkit (MDT) deploymentshare.
• B. From Intune, configure app assignments for the Office 365 ProPlus suite.In each office, copy the Office 365 distribution files to a Configuration Manager distribution point.
• C. From Configuration Manager, create an application deployment.Copy the Office 365 distribution files to a Configuration Manager cloud distribution point.
• D. From Configuration Manager, create an application deployment.In each office, copy the Office 365 distribution files to a Configuration Manager distribution point.

Answer: D

Explanation:
Reference:
https://docs.microsoft.com/en-us/deployoffice/deploy-office-365-proplus-with-system-center-configurationmana

NEW QUESTION 8

What should you configure to meet the technical requirements for the Azure AD-joined computers?

• A. Windows Hello for Business from the Microsoft Intune blade in the Azure portal.
• B. The Accounts options in an endpoint protection profile.
• C. The Password Policy settings in a Group Policy object (GPO).
• D. A password policy from the Microsoft Office 365 portal.

Answer: A

Explanation:
References:
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-manage-inorgani

NEW QUESTION 9

You need to meet the technical requirements for the IT department. What should you do first?

• A. From the Azure Active Directory blade in the Azure portal, enable Seamless single sign-on.
• B. From the Configuration Manager console, add an Intune subscription.
• C. From the Azure Active Directory blade in the Azure portal, configure the Mobility (MDM and MAM) settings.
• D. From the Microsoft Intune blade in the Azure portal, configure the Windows enrollment settings.

Answer: C

Explanation:
Reference:
https://docs.microsoft.com/en-us/sccm/comanage/tutorial-co-manage-clients

NEW QUESTION 10

You need to capture the required information for the sales department computers to meet the technical requirements.
Which Windows PowerShell command should you run first?

• A. Install-Module WindowsAutoPilotIntune
• B. Install-Script Get-WindowsAutoPilotInfo
• C. Import-AutoPilotCSV
• D. Get-WindowsAutoPilotInfo

Answer: A

Explanation:
References:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/existing-devices

NEW QUESTION 11

You need to meet the technical requirements for the iOS devices. Which object should you create in Intune?

• A. A compliance policy
• B. An app protection policy
• C. ADeployment profile
• D. A device profile

Answer: D

Explanation:
References:
https://docs.microsoft.com/en-us/intune/device-restrictions-configure https://docs.microsoft.com/en-us/intune/device-restrictions-ios

NEW QUESTION 12

Your company plans to deploy tablets to 50 meeting rooms.
The tablets run Windows 10 and are managed by using Microsoft Intune. The tablets have an application named App1.
You need to configure the tablets so that any user can use App1 without having to sign in. Users must be prevented from using other applications on the tablets.
Which device configuration profile type should you use?

• A. Kiosk
• B. Endpoint protection
• C. Identity protection
• D. Device restrictions

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/configuration/kiosk-single-app

NEW QUESTION 13

What should you use to meet the technical requirements for Azure DevOps?

• A. An app protection policy
• B. Windows Information Protection (WIP)
• C. Conditional access
• D. A device configuration profile

Answer: C

Explanation:
References:
https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-conditional-access? view=azure-devops

NEW QUESTION 14

You have 200 computers that run Windows 10. The computers are joined to Microsoft Azure Active Directory (Azure AD) and enrolled in Microsoft Intune.
You need to ensure that only applications that you explicitly allow can run on the computers. What should you use?

• A. Windows Defender Credential Guard
• B. Windows Defender Exploit Guard
• C. Windows Defender Application Guard
• D. Windows Defender Antivirus.

Answer: C

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guardv based-security-and-windows-defender-application-control

NEW QUESTION 15

Your network contains an Active Directory domain named constoso.com that is synced to Microsoft Azure Active Directory (Azure AD). All computers are enrolled in Microsoft Intune.
The domain contains the computers shown in the following table.

You are evaluating which Intune actions you can use to reset the computers to run Windows 10 Enterprise with the latest update.
Which computers can you reset by using each action? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/device-fresh-start https://docs.microsoft.com/en-us/intune/devices-wipe

NEW QUESTION 16

Your network contains an Active Directory named contoso.com. The domain contains two computers named Computer1 and Computer2 that run Windows 10.
Folder Redirection is configured for a domain user named User1. The AppDataRoaming folder and the Desktop folder are redirected to a network share.
User1 signs in to Computer1 and performs the following tasks:
Configures screen saver to start after five minutes of inactivity
Modifies the default save location for Microsoft Word
Creates a file named File1.docx on the desktop
Modifies the desktop background
You need to identify what will be retained when User1 signs in to Computer2. What should you identify?

• A. File1.docx and the desktop background only
• B. File1.docx, the screen saver settings, the desktop background, and the default save location for Word
• C. File1.docx only
• D. File1.docx, the desktop background, and the default save location for Word only

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview

NEW QUESTION 17

Your company has a Microsoft 365 subscription.
The company uses Microsoft Intune to manage all devices.
The company uses conditional access to restrict access to Microsoft 365 services for devices that do not comply with the company’s security policies.
You need to identify which devices will be prevented from accessing Microsoft 365 services.
What should you use?

• A. The Device Health solution in Windows Analytics.
• B. Windows Defender Security Center.
• C. The Device compliance blade in the Intune admin center.
• D. The Conditional access blade in the Azure Active Directory admin center.

Answer: C

NEW QUESTION 18

You have a shared computer that runs Windows 10. The computer is infected with a virus.
You discover that a malicious TTF font was used to compromise the computer. You need to prevent this type of threat from affecting the computer in the future. What should you use?

• A. Windows Defender Exploit Guard
• B. Windows Defender Application Guard
• C. Windows Defender Credential Guard
• D. Windows Defender System Guard
• E. Windows Defender SmartScreen

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/windowsd

NEW QUESTION 19

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to ensure that feature and quality updates install automatically during a maintenance window. Solution: From the Maintenance Scheduler settings, you configure Automatic Maintenance Activation Boundary.
Does this meet the goal?

• A. Yes
• B. No

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/sccm/sum/deploy-use/automatically-deploy-software-updates

NEW QUESTION 20

To which devices do Policy1 and Policy2 apply? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/device-profile-assign

NEW QUESTION 21

Your company uses Microsoft Intune.
More than 500 Android and iOS devices are enrolled in the Intune tenant.
You plan to deploy new Intune policies. Different policies will apply depending on the version of Android or iOS installed on the device.
You need to ensure that the policies can target the devices based on their version of Android or iOS. What should you configure first?

• A. Corporate device identifiers in Intune
• B. Device settings in Microsoft Azure Active Directory (Azure AD)
• C. Device categories in Intune
• D. Groups that have dynamic membership rules in Microsoft Azure Active Directory (Azure AD)

Answer: B

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/compliance-policy-create-android https://docs.microsoft.com/en-us/intune/compliance-policy-create-ios

NEW QUESTION 22

You have a Microsoft 365 subscription.
All computers are enrolled in Microsoft Intune.
You have business requirements for securing your Windows 10 environment as shown in the following table.

What should you implement to meet each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://github.com/MicrosoftDocs/IntuneDocs/blob/master/intune/advanced-threat-protection.md

NEW QUESTION 23

Your network contains an Active Directory domain. The domain contains computers that run Windows 10 and are enrolled in Microsoft Intune. Updates are deployed by using Windows Update for Business.
Users in a group named Group1 must meet the following requirements:
Update installations must occur any day only between 00:00 and 05:00.
Updates must be downloaded from Microsoft and from other company computers that already downloaded the updates.
You need to configure the Windows 10 Update Rings in Intune to meet the requirements.
Which two settings should you modify? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference:
https://github.com/MicrosoftDocs/IntuneDocs/blob/master/intune/windows-update-settings.md https://docs.microsoft.com/en-us/intune/delivery-optimization-windows#move-from-existing-update-rings-to-de

NEW QUESTION 24

Your company has a Microsoft Azure Active Directory (Azure AD) tenant. All users in the company are licensed for Microsoft Intune.
You need to ensure that the users enroll their iOS device in Intune. What should you configure first?

• A. ADevice Enrollment Program (DEP) token.
• B. An Intune device configuration profile.
• C. ADevice enrollment manager (DEM) account.
• D. An Apple MDM Push certificate.

Answer: A

Explanation:
Reference:
https://docs.microsoft.com/en-us/intune/device-enrollment-program-enroll-ios

NEW QUESTION 25

You are creating a device configuration profile in Microsoft Intune. You need to implement an ADMX-backed policy.
Which profile type should you use?

• A. Identity protection
• B. Custom
• C. Device restrictions
• D. Device restrictions (Windows 10 Team)

Answer: B

Explanation:
Reference:
https://blogs.technet.microsoft.com/senthilkumar/2021/05/21/intune-deploying-admx-backed-policies-usingmicr

NEW QUESTION 26
......