MS-101: Microsoft 365 Mobility And Security

Approved & Edited by ProProfs Editorial Team

The editorial team at ProProfs Quizzes consists of a select group of subject experts, trivia writers, and quiz masters who have authored over 10,000 quizzes taken by more than 100 million users. This team includes our in-house seasoned quiz moderators and subject matter experts. Our editorial experts, spread across the world, are rigorously trained using our comprehensive guidelines to ensure that you receive the highest quality quizzes.

Learn about Our Editorial Process

| By Blaatlama

Blaatlama

Community Contributor

Quizzes Created: 1 | Total Attempts: 232

Questions: 128 | Attempts: 232 | Updated: Mar 21, 2023

Questions

Settings

Feedback

During the Quiz End of Quiz

Play as

Quiz Flashcard

Create your own Quiz

MS-101: Microsoft 365 Mobility And Security - Quiz

The actual exam questions based on the excellent "Examtopics" website: https://www. Examtopics. Com/exams/microsoft/ms-101/view/1/

Questions and Answers

1.

Of which groups are Computer1 and Computer2 members? To answer, select the appropriate options in the answer area.
2.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the SharePoint admin center, you modify the sharing settings. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
This should be covered with an alert policy from the security & compliance center https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

Rate this question:
3.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the Security & Compliance admin center, you create a threat management policy. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
This should be covered with an alert policy.

Rate this question:
4.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the SharePoint site, you create an alert. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
This should be covered with an alert policy

Rate this question:
5.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You add your user account as a device enrollment manager. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
You need the Apple MDM push certificate.

Rate this question:
6.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You configure the Apple MDM Push certificate. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
A. Yes

Explanation
You need the Apple MDM push certificate.

Rate this question:
7.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create an Apple Configurator enrollment profile. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
You need the Apple MDM push certificate.

Rate this question:
8.

Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You create a device configuration profile from the Intune admin center. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
9.

Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You unjoin Device1 from the Active Directory domain.. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
10.

Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You add Device1 to an Active Directory group. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
The correct answer should be that the new device needs to be added into a pilot collection in configuration manager rather than an AD Security group, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
11.

You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
- A.
  
  Policy 1 applies to Device 3.
- B.
  
  Policy 2 applies to Device 2
- C.
  
  Policy 2 doesn't apply to Device 2.
- D.
  
  Policy 1 applies to Device 1
Correct Answer
A. Policy 1 applies to Device 3.

Explanation
Policy 2 also doesn't apply to Device 2 because that device is in Group 3, which is excluded from the policy. Exclusion takes precedence over inclusion in the following same group type scenarios:
Including user groups and excluding user groups Including device groups and excluding device group https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign

Rate this question:
12.

You have Windows 10 Pro devices that are joined to an Active Directory domain.You plan to create a Microsoft 365 tenant and to upgrade the devices to Windows 10 Enterprise. You are evaluating whether to deploy Windows Hello for Business for SSO to Microsoft 365 services. What are two prerequisites of the deployment? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
- A.
  
  A: Computers that have biometric hardware features
- B.
  
  B. Microsoft Intune enrollment
- C.
  
  C. Microsoft Azure Active Directory (Azure AD)
- D.
  
  D. Smartcards
- E.
  
  E. TPM-enabled device
Correct Answer(s)
B. B. Microsoft Intune enrollment
C. C. Microsoft Azure Active Directory (Azure AD)

Explanation
References:
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base

Rate this question:
13.

You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?
- A.
  
  A. Enrollment restrictions from the Intune admin center
- B.
  
  B. Device enrollment managers from the Intune admin center
- C.
  
  C. MAM User scope from the Azure Active Directory admin center
- D.
  
  D. MDM User scope from the Azure Active Directory admin center
Correct Answer
D. D. MDM User scope from the Azure Active Directory admin center

Explanation
References:
https://docs.microsoft.com/en-us/intune/windows-enroll

Rate this question:
14.

Your network contains an Active Directory domain named contoso.com. All client devices run Windows 10 and are joined to the domain. You update the Windows 10 devices by using Windows Update for Business. What is the maximum amount of time you can defer Windows 10 updates? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- A.
  
  Quality Updates: 14 days
- B.
  
  Quality Updates: 30 days
- C.
  
  Quality Updates: 60 days
- D.
  
  Quality Updates: 120 days
- E.
  
  Feature Updates: 60 days
- F.
  
  Feature Updates: 180 days
- G.
  
  Feature Updates: 365 days
- H.
  
  Feature Updates: 540 days
Correct Answer(s)
B. Quality Updates: 30 days
G. Feature Updates: 365 days

Explanation
https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb

Rate this question:
15.

Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
- A.
  
  A. Deploy applications to Windows 10 devices.
- B.
  
  B. Deploy VPN profiles to iOS devices.
- C.
  
  C. Deploy VPN profiles to Windows 10 devices.
- D.
  
  D. Publish applications to Android devices.
Correct Answer(s)
B. B. Deploy VPN profiles to iOS devices.
D. D. Publish applications to Android devices.

Explanation
References:
https://docs.microsoft.com/en-us/sccm/comanage/overview

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/create-vpn-profiles

Rate this question:
16.

Your network contains an Active Directory domain named contoso.com that uses Microsoft System Center Configuration Manager (Current Branch). You have Windows 10 and Windows 8.1 devices. You need to ensure that you can analyze the upgrade readiness of all the Windows 8.1 devices and analyze the update compliance of all the Windows 10 devices. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- A.
  
  Create a Microsoft Azure Log Analytics workspace
- B.
  
  Configure all the devices to have a commercial ID
Correct Answer(s)
A. Create a Microsoft Azure Log Analytics workspace
B. Configure all the devices to have a commercial ID

Explanation
References:
https://docs.microsoft.com/en-us/windows/deployment/upgrade/upgrade-readiness-get-started
https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-get-started

Rate this question:
17.

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?
- A.
  
  A. the Enrollment restrictions
- B.
  
  B. the mobile device management (MDM) authority
- C.
  
  C. the Exchange on-premises access settings
- D.
  
  D. the Windows enrollment settings
Correct Answer
B. B. the mobile device management (MDM) authority

Explanation
To ensure that users can manage the configuration settings for all the Windows 10 devices in the organization, you need to configure the mobile device management (MDM) authority. This allows users to manage and control the settings of their Windows 10 devices through the MDM solution. By setting the MDM authority to the Microsoft 365 subscription, users will have the necessary permissions and access to manage the configuration settings for all the Windows 10 devices in the organization.

Rate this question:
18.

You configure a conditional access policy. The locations settings are configured as shown in the Locations exhibit. (Click the Locations tab.) The users and groups settings are configured as shown in the Users and Groups exhibit. (Click Users and Groups tab.) Members of the Security reader group report that they cannot sign in to Microsoft Active Directory (Azure AD) on their device while they are in the office. You need to ensure that the members of the Security reader group can sign in in to Azure AD on their device while they are in the office. The solution must use the principle of least privilege. What should you do?
- A.
  
  A. From the conditional access policy, configure the device state.
- B.
  
  B. From the Azure Active Directory admin center, create a custom control.
- C.
  
  C. From the Intune admin center, create a device compliance policy.
- D.
  
  D. From the Azure Active Directory admin center, create a named location.
Correct Answer
D. D. From the Azure Active Directory admin center, create a named location.

Explanation
References:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Rate this question:
19.

You have computers that run Windows 10 Enterprise and are joined to the domain.You plan to delay the installation of new Windows builds so that the IT department can test application compatibility. You need to prevent Windows from being updated for the next 30 days. Which two Group Policy settings should you configure? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
- A.
  
  A. Select when Quality Updates are received
- B.
  
  B. Select when Preview Builds and Feature Updates are received
- C.
  
  C. Turn off auto-restart for updates during active hours
- D.
  
  D. Manage preview builds
- E.
  
  E. Automatic updates detection frequency
Correct Answer(s)
B. B. Select when Preview Builds and Feature Updates are received
D. D. Manage preview builds

Explanation
New build (new feature) come in as a new Preview Build and/or Feature updates. Quality updates are not introducing "new" Windows features but improving existing features (bug fixes / security patches).

https://www.windowscentral.com/whats-difference-between-quality-updates-and-feature-updates-windows-10

Rate this question:
20.

You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, check the box if the statement is true. Otherwise, leave deselected. NOTE: Each correct selection is worth one point.
- A.
  
  Device1 is marked as noncompliant after 10 days
- B.
  
  Device2 is marked as noncompliant after 10 days
- C.
  
  Device3 is marked as noncompliant after 10 days
Correct Answer(s)
A. Device1 is marked as noncompliant after 10 days
B. Device2 is marked as noncompliant after 10 days

Explanation
Device1 is marked as noncompliant after 10 Days: Yes, because Device 1 is member of group 1 and 2, only group 2 is assigned to a policy (policy 2), policy 2 requires Bitlocker, device does not have it so the device will be marked as non compliant after 10 days.

Device2 is marked as noncompliant after 10 Days: Yes, because Device 2 is member of group 2 and 3, only policy 2 requires Bitlocker, therefore Device is marked as non compliant after 10 days.

Device3 is marked as noncompliant after 10 Days: No, because Device 3 is only a member of group 3, group 3 is assigned to Policy 3, policy 3 does not require Bitlocker, so the device will not be marked as non compliant at all, also if it was required it will be after 15 days, not 10 days.

Rate this question:
21.

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?
- A.
  
  A. Cloud application administrator
- B.
  
  B. Application administrator
- C.
  
  C. Global administrator
- D.
  
  D. Service administrator
Correct Answer
C. C. Global administrator

Explanation
References:
https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

Rate this question:
22.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create the Mobility (MDM and MAM) settings. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
You require an Apple MDM push certificate setup
https://www.inthecloud247.com/how-to-start-with-ios-user-enrollment-using-microsoft-intune/

Rate this question:
23.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You add Device1 to a Configuration Manager device collection. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
To Pilot Co-Management, you must provide a Pilot Device Collection, so if this connection was clearly named in the question it would have been yes.

Rate this question:
24.

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?
- A.
  
  A. From the Security & Compliance admin center, create a classification label.
- B.
  
  B. From the Security & Compliance admin center, add the users to the Security Readers role group.
- C.
  
  C. From the Azure Active Directory admin center, configure the trusted IPs for multi-factor authentication.
- D.
  
  D. From the Conditional access blade in the Azure Active Directory admin center, create named locations.
Correct Answer
D. D. From the Conditional access blade in the Azure Active Directory admin center, create named locations.

Explanation
References:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Rate this question:
25.

Your company has a Microsoft 365 E5 subscription. Users in the research department work with sensitive data. You need to prevent the research department users from accessing potentially unsafe websites by using hyperlinks embedded in email messages and documents. Users in other departments must not be restricted. What should you do from the Security & Compliance admin center?
- A.
  
  A. Create a data loss prevention (DLP) policy that has a Content is shared condition.
- B.
  
  B. Modify the default safe links policy.
- C.
  
  C. Create a data loss prevention (DLP) policy that has a Content contains condition.
- D.
  
  D. Create a new safe links policy.
Correct Answer
D. D. Create a new safe links policy.

Explanation
References:
https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-atp-safe-links-policies#policies-that-apply-to-specific-email-recipients

Rate this question:
26.

You have a Microsoft 365 tenant. You have a line-of-business application named App1 that users access by using the My Apps portal. After some recent security breaches, you implement a conditional access policy for App1 that uses Conditional Access App Control. You need to be alerted by email if impossible travel is detected for a user of App1. The solution must ensure that alerts are generated for App1 only. What should you do?
- A.
  
  A. From Microsoft Cloud App Security, create a Cloud Discovery anomaly detection policy.
- B.
  
  B. From Microsoft Cloud App Security, modify the impossible travel alert policy.
- C.
  
  C. From Microsoft Cloud App Security, create an app discovery policy.
- D.
  
  D. From the Azure Active Directory admin center, modify the conditional access policy.
Correct Answer
A. A. From Microsoft Cloud App Security, create a Cloud Discovery anomaly detection policy.

Explanation
References:
https://docs.microsoft.com/en-us/cloud-app-security/cloud-discovery-anomaly-detection-policy

Rate this question:
27.

A user receives the following message when attempting to sign in to https://myapps.microsoft.com: "Your sign-in was blocked. We've detected something unusual about this sign-in. For example, you might be signing in from a new location, device, or app. Before you can continue, we need to verify your identity. Please contact your admin." Which configuration prevents the users from signing in?
- A.
  
  A. Microsoft Azure Active Directory (Azure AD) Identity Protection policies
- B.
  
  B. Microsoft Azure Active Directory (Azure AD) conditional access policies
- C.
  
  C. Security & Compliance supervision policies
- D.
  
  D. Security & Compliance data loss prevention (DLP) policies
Correct Answer
B. B. Microsoft Azure Active Directory (Azure AD) conditional access policies

Explanation
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

Rate this question:
28.

You have the Microsoft Azure Active Directory (Azure AD) users shown in the following table. Your company uses Microsoft Intune. Several devices are enrolled in Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. You create a conditional access policy that has the following settings: ✑ The Assignments settings are configured as follows: 1. Users and groups: Group1 2. Cloud apps: Microsoft Office 365 Exchange Online 3. Conditions: Include All device state, exclude Device marked as compliant ✑ Access controls is set to Block access. For each of the following statements, select if the statement is true. Otherwise leave deselected. NOTE: Each correct selection is worth one point.
- A.
  
  User1 can access Microsoft Exchange Online from Device1
- B.
  
  User1 can access Microsoft Exchange Online from Device2
- C.
  
  User2 can access Microsoft Exchange Online from Device2.
Correct Answer(s)
A. User1 can access Microsoft Exchange Online from Device1
C. User2 can access Microsoft Exchange Online from Device2.

Explanation
User2 is not targeted by conditional access policy.

User1 can access Microsoft Exchange Online from Device1. Yes
User1 can access Microsoft Exchange Online from Device2. No
User2 can access Microsoft Exchange Online from Device2. Yes

Rate this question:
29.

You have several devices enrolled in Microsoft Intune. You have a Microsoft Azure Active Directory (Azure AD) tenant that includes the users shown in the following table. The device limit restrictions in Intune are configured as shown in the following table. You add User3 as a device enrollment manager in Intune. For each of the following statements, select the statement if it's true. Otherwise, leave it deselected. NOTE: Each correct selection is worth one point.
- A.
  
  User1 can enroll a maximum of 10 devices in Intune
- B.
  
  User2 can enroll a maximum of 10 devices in Intune
- C.
  
  User3 can enroll an unlimited number of devices in Intune
Correct Answer
A. User1 can enroll a maximum of 10 devices in Intune

Explanation
User1 can enroll a maximum of 10 devices in Intune - No (User1 is in Group A : Policy1, can enroll 15 devices) User2 can enroll a maximum of 10 devices in Intune - Yes (User2 is in Group B: Policy2, can enroll 10 devices) User3 can enroll an unlimited number of devices in Intune - No (Device Enrolment Managers can enroll 1000 devices)
https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager
https://docs.microsoft.com/en-us/intune/enrollment/device-enrollment-manager-enroll

Rate this question:
30.

You plan to allow users from the engineering department to enroll their mobile device in mobile device management (MDM). The device type restrictions are configured as shown in the following table. The device limit restrictions are configured as shown in the following table. What is the effective configuration for the members of the Engineering group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- A.
  
  Allowed platform: Android only
- B.
  
  Device Limit 5
- C.
  
  IOS only
- D.
  
  10
- E.
  
  All platforms
- F.
  
  15
Correct Answer(s)
A. Allowed platform: Android only
F. 15

Explanation
https://docs.microsoft.com/en-us/intune/enrollment-restrictions-set

https://docs.microsoft.com/en-us/intune/enrollment/enrollment-restrictions-set#change-enrollment-restriction-priority

Rate this question:
31.

Your network contains an Active Directory domain named contoso.com. The domain contains 100 Windows 8.1 devices. You plan to deploy a custom Windows 10 Enterprise image to the Windows 8.1 devices. You need to recommend a Windows 10 deployment method. What should you recommend?
- A.
  
  A. A provisioning package
- B.
  
  B. An in-place upgrade
- C.
  
  C. A Wipe and load refresh
- D.
  
  D. Windows Autopilot
Correct Answer
C. C. A Wipe and load refresh

Explanation
The question specifies a custom image. In place upgrade cannot do custom images. Also, for provisioning packages Win 10 is a prerequisite. Hence, that cannot be the correct answer.

Rate this question:
32.

You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?
- A.
  
  A. Windows 10 and Windows 8.1 only
- B.
  
  B. Windows 10, Android, and iOS only
- C.
  
  C. Windows 10 only
- D.
  
  D. Windows 10, Windows 8.1, Android, and iOS
Correct Answer
C. C. Windows 10 only

Explanation
https://docs.microsoft.com/en-us/configmgr/comanage/overview#prerequisites

Rate this question:
33.

You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, select the statement if it is true. Otherwise don't select. NOTE: Each correct selection is worth one point.
- A.
  
  Device 1 is compliant
- B.
  
  Device 2 is compliant
- C.
  
  Device 3 is compliant
Correct Answer(s)
A. Device 1 is compliant
B. Device 2 is compliant
C. Device 3 is compliant

Explanation
Based on the information provided in the tables, all three devices have a "Compliant" status in the device compliance policies. Therefore, the statement "Device 1 is compliant, Device 2 is compliant, Device 3 is compliant" is true.

Rate this question:
34.

Your company has a Microsoft 365 E3 subscription. All devices run Windows 10 Pro and are joined to Microsoft Azure Active Directory (Azure AD). You need to change the edition of Windows 10 to Enterprise the next time users sign in to their computer. The solution must minimize downtime for the users. What should you use?
- A.
  
  A. Windows Autopilot
- B.
  
  B. Windows Update
- C.
  
  C. Subscription Activation
- D.
  
  D. an in-place upgrade
Correct Answer
C. C. Subscription Activation

Explanation
References:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

Rate this question:
35.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management.You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: Define a Configuration Manager device collection as the pilot collection. Add Device1 to the collection. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
Pilot - Only the Configuration Manager clients that are members of the Intune Auto Enrollment collection are automatically enrolled to Intune.

https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
36.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You configure the Mobility (MDM and MAM) settings. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
Configuring the Mobility (MDM and MAM) settings alone will not resolve the issue of enrolling an iOS device in Intune. The error could be due to various reasons such as incorrect configuration, incompatible device, or network connectivity issues. Therefore, the given solution does not meet the goal of enrolling the iOS device in Intune.

Rate this question:
37.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the Security & Compliance admin center, you create a threat management policy. Does this meet the goal?
- A.
  
  Yes
- B.
  
  No
Correct Answer
B. No

Explanation
From the Security & Compliance admin center, Alerts, you create a new alert policy. https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

Rate this question:
38.

Your company has 5,000 Windows 10 devices. All the devices are protected by using Windows Defender Advanced Threat Protection (ATP). You need to view which Windows Defender ATP alert events have a high severity and occurred during the last seven days. What should you use in Windows Defender ATP?
- A.
  
  A. the threat intelligence API
- B.
  
  B. Automated investigations
- C.
  
  C. Threat analytics
- D.
  
  D. Advanced hunting
Correct Answer
B. B. Automated investigations

Explanation
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/automated-investigations

Rate this question:
39.

Your company uses Windows Defender Advanced Threat Protection (ATP). Windows Defender ATP includes the machine groups shown in the following table. You onboard a computer named computer1 to Windows Defender ATP as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.
- A.
  
  A. Computer1 will be a member of Group3 only. If you add the tag demo to Computer1, the computer will be a member of Group1 only.
- B.
  
  B. Computer1 will be a member of Group4 only. If you add the tag demo to Computer1, the computer will be a member of Group1 only.
- C.
  
  C. Computer1 will be a member of Group3 and Group4 only. If you add the tag demo to Computer1, the computer will be a member of Group1 and Group2 only.
- D.
  
  D. Computer1 will be a member of Group3 and Group4 only. If you add the tag demo to Computer1, the computer will be a member of Group1, Group2, Group3, and Group4.
- E.
  
  E. Computer1 will be a member of Ungrouped machines. If you add the tag demo to Computer1, the computer will be a member of Group1, Group2, Group3, and Group4.
- F.
  
  F. Computer1 will be a member of Ungrouped machines. If you add the tag demo to Computer1, the computer will be a member of Ungrouped machines.
Correct Answer
A. A. Computer1 will be a member of Group3 only. If you add the tag demo to Computer1, the computer will be a member of Group1 only.

Explanation
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/machine-groups#manage-machine-groups

Rate this question:
40.

You have the Microsoft Azure Advanced Threat Protection (ATP) workspace shown in the Workspace exhibit. (Click the Workspace tab.) The sensors settings for the workspace are configured as shown in the Sensors exhibit. (Click the Sensors tab.) You need to ensure that Azure ATP stores data in Asia. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
- A.
  
  1. Delete the workspace
- B.
  
  2. Create a new workspace
- C.
  
  3. Regenerate the acces keys
Correct Answer(s)
A. 1. Delete the workspace
B. 2. Create a new workspace
C. 3. Regenerate the acces keys

Explanation
Your instance is created automatically in the data center that is geographically closest to your Azure Active Directory (Azure AD). Once created, Azure ATP instances aren't movable.
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step1

Rate this question:
41.

Your company has five security information and event management (SIEM) appliances. The traffic logs from each appliance are saved to a file share named Logs. You need to analyze the traffic logs. What should you do from Microsoft Cloud App Security?
- A.
  
  A. Click Investigate, and then click Activity log.
- B.
  
  B. Click Control, and then click Policies. Create a file policy.
- C.
  
  C. Click Discover, and then click Create snapshot report.
- D.
  
  D. Click Investigate, and then click Files.
Correct Answer
C. C. Click Discover, and then click Create snapshot report.

Explanation
https://docs.microsoft.com/en-us/cloud-app-security/create-snapshot-cloud-discovery-reports#log-format

Rate this question:
42.

Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices. You perform a proof of concept (PoC) deployment of Windows Defender Advanced Threat Protection (ATP) for 10 test devices. During the onboarding process, you configure Windows Defender ATP-related data to be stored in the United States. You plan to onboard all the devices to Windows Defender ATP. You need to store the Windows Defender ATP data in Europe. What should you first?
- A.
  
  A. Create a workspace.
- B.
  
  B. Onboard a new device.
- C.
  
  C. Delete the workspace.
- D.
  
  D. Offboard the test devices.
Correct Answer
D. D. Offboard the test devices.
43.

You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?
- A.
  
  A. From the Exchange admin center, create an in-place eDiscovery & hold.
- B.
  
  B. From the Security & Compliance admin center, create a data governance event.
- C.
  
  C. From the Exchange admin center, create an anti-malware policy.
- D.
  
  D. From the Security & Compliance admin center, create a safe attachments policy.
- E.
  
  E. From the Security & Compliance admin center, create a data loss prevention (DLP) policy.
- F.
  
  F. From the Exchange admin center, create a mail flow rule.
Correct Answer
C. C. From the Exchange admin center, create an anti-malware policy.

Explanation
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-atp-safe-attachments-policies

Rate this question:
44.

You have a Microsoft Azure Activity Directory (Azure AD) tenant contains the users shown in the following table. Group3 is a member of Group1. Your company uses Windows Defender Advanced Threat Protection (ATP). Windows Defender ATP contains the roles shown in the following table. Windows Defender ATP contains the device groups shown in the following table. For each of the following statements, select the statement if it is true. Otherwise, don't select. NOTE: Each correct selection is worth one point.
- A.
  
  User1 can view Device1 in Windows Defender Security Center.
- B.
  
  User2 can sign in to Windows Defender Security Center.
- C.
  
  User3 can view Device1 in Windows Defender Security Center.
Correct Answer(s)
A. User1 can view Device1 in Windows Defender Security Center.
B. User2 can sign in to Windows Defender Security Center.
C. User3 can view Device1 in Windows Defender Security Center.

Explanation
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group

Rate this question:
45.

Your company uses Microsoft Cloud App Security. You plan to integrate Cloud App Security and security information and event management (SIEM).You need to deploy a SIEM agent on a server that runs Windows Server 2016. What should you do? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.
- A.
  
  First action to perform (select 1 out of 4) " Install Java8 "
- B.
  
  Second action to perform (select 1 out of 4 ) " Run the java command and specify the – jar parameter "
Correct Answer(s)
A. First action to perform (select 1 out of 4) " Install Java8 "
B. Second action to perform (select 1 out of 4 ) " Run the java command and specify the – jar parameter "

Explanation
https://docs.microsoft.com/nl-nl/cloud-app-security/siem#step-2-download-the-jar-file-and-run-it-on-your-server

Rate this question:
46.

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.
- A.
  
  1.To require multi-factor authentication when signing into an unfamiliar location, you must create a (sign-in risky policy)
- B.
  
  2.To avoid generating alerts when signing in to the Montreal location, create (a named location in Azure AD)
Correct Answer(s)
A. 1.To require multi-factor authentication when signing into an unfamiliar location, you must create a (sign-in risky policy)
B. 2.To avoid generating alerts when signing in to the Montreal location, create (a named location in Azure AD)

Explanation
To require multi-factor authentication when signing into an unfamiliar location, you must create a sign-in risky policy. This policy would identify and flag sign-in attempts from unfamiliar locations as risky, triggering the requirement for multi-factor authentication to provide an additional layer of security.

To avoid generating alerts when signing in to the Montreal location, you would create a named location in Azure AD. By defining Montreal as a named location, sign-ins from this location would be recognized as legitimate and not trigger any alerts or risk events.

Rate this question:
47.

Your company uses Microsoft Azure Advanced Threat Protection (ATP) and Windows Defender ATP. You need to integrate Windows Defender ATP and Azure ATP. What should you do?
- A.
  
  A. From Azure ATP, configure the notifications and reports.
- B.
  
  B. From Azure ATP, configure the data sources.
- C.
  
  C. From Windows Defender Security Center, configure the Machine management settings.
- D.
  
  D. From Windows Defender Security Center, configure the General settings.
Correct Answer
B. B. From Azure ATP, configure the data sources.

Explanation
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/integrate-wd-atp

Rate this question:
48.

You have a Microsoft Azure Activity Directory (Azure AD) tenant contains the users shown in the following table. Group3 is a member of Group1. Your company uses Windows Defender Advanced Threat Protection (ATP). Windows Defender ATP contains the roles shown in the following table. Windows Defender ATP contains the device groups shown in the following table. For each of the following statements, select the statement if it is true. NOTE: Each correct selection is worth one point.
- A.
  
  User1 can view Device1 in Windows Defender Security Center
- B.
  
  User2 can sign in to Windows Defender Security Center
- C.
  
  User3 can view Device1 in WIndows Defender Center
- D.
  
  User1 can run an antivirus scan on Device2
- E.
  
  User2 can collect an investigation package from Device2
- F.
  
  User3 can isolate Device1
Correct Answer(s)
A. User1 can view Device1 in Windows Defender Security Center
B. User2 can sign in to Windows Defender Security Center
C. User3 can view Device1 in WIndows Defender Center

Explanation
User1 can view Device1 in Windows Defender Security Center because User1 is a member of Group1, which has access to view Device1 in Windows Defender ATP. User2 can sign in to Windows Defender Security Center because User2 is a member of Group2, which has the necessary role to sign in to Windows Defender ATP. User3 can view Device1 in Windows Defender Security Center because User3 is a member of Group3, which is a member of Group1 and therefore has access to view Device1.

Rate this question:
49.

You have a Microsoft 365 subscription. You need to implement Windows Defender Advanced Threat Protection (ATP) for all the supported devices enrolled in mobile device management (MDM). What should you include in the device configuration profile? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- A.
  
  Create a new profile with type: "Microsoft Defender ATP (Windows 10 Desktop)"
- B.
  
  Onboard devices to configure them to communicate with Microsoft Defender ATP
Correct Answer
A. Create a new profile with type: "Microsoft Defender ATP (Windows 10 Desktop)"

Explanation
http://https://docs.microsoft.com/nl-nl/intune/protect/advanced-threat-protection#create-the-device-configuration-profile

Rate this question:
50.

You have a Microsoft 365 subscription. Your company purchases a new financial application named App1. From Cloud Discovery in Microsoft Cloud App Security, you view the Discovered apps page and discover that many applications have a low score because they are missing information about domain registration and consumer popularity. You need to prevent the missing information from affecting the score. What should you configure from the Cloud Discover settings?
- A.
  
  A. Organization details
- B.
  
  B. Default behavior
- C.
  
  C. Score metrics
- D.
  
  D. App tags
Correct Answer
C. C. Score metrics

Explanation
https://docs.microsoft.com/en-us/cloud-app-security/risk-score#customizing-the-risk-score

Rate this question:

Quiz Review Timeline +

Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.

Current Version
Mar 21, 2023

Quiz Edited by
ProProfs Editorial Team
Feb 29, 2020

Quiz Created by
Blaatlama

MS-101: Microsoft 365 Mobility And Security

Of which groups are Computer1 and Computer2 members? To answer, select the appropriate options in the answer area.

You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?

Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?

Your network contains an Active Directory domain named contoso.com. The domain contains 100 Windows 8.1 devices. You plan to deploy a custom Windows 10 Enterprise image to the Windows 8.1 devices. You need to recommend a Windows 10 deployment method. What should you recommend?

You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?

Your company has 5,000 Windows 10 devices. All the devices are protected by using Windows Defender Advanced Threat Protection (ATP). You need to view which Windows Defender ATP alert events have a high severity and occurred during the last seven days. What should you use in Windows Defender ATP?

Your company has five security information and event management (SIEM) appliances. The traffic logs from each appliance are saved to a file share named Logs. You need to analyze the traffic logs. What should you do from Microsoft Cloud App Security?

You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

Your company uses Microsoft Azure Advanced Threat Protection (ATP) and Windows Defender ATP. You need to integrate Windows Defender ATP and Azure ATP. What should you do?