MS-101: Microsoft 365 Mobility And Security

Reviewed by Editorial Team

The ProProfs editorial team is comprised of experienced subject matter experts. They've collectively created over 10,000 quizzes and lessons, serving over 100 million users. Our team includes in-house content moderators and subject matter experts, as well as a global network of rigorously trained contributors. All adhere to our comprehensive editorial guidelines, ensuring the delivery of high-quality content.

Learn about Our Editorial Process

| By Blaatlama

Blaatlama

Community Contributor

Quizzes Created: 1 | Total Attempts: 234

| Attempts: 235

Questions

Feedback

During the Quiz End of Quiz

Difficulty

Easy First Hard First Sequential

1/128 Questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the SharePoint admin center, you modify the sharing settings. Does this meet the goal?
- Yes
- No

About This Quiz

The actual exam questions based on the excellent "Examtopics" website: https://www. Examtopics. Com/exams/microsoft/ms-101/view/1/

MS-101: Microsoft 365 Mobility And Security - Quiz

Quiz Preview

2.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the Security & Compliance admin center, you create a threat management policy. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

This should be covered with an alert policy.

Rate this question:
3.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You add your user account as a device enrollment manager. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

You need the Apple MDM push certificate.

Rate this question:
4.

Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You create a device configuration profile from the Intune admin center. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
5.

Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You unjoin Device1 from the Active Directory domain.. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
6.

You have Windows 10 Pro devices that are joined to an Active Directory domain.You plan to create a Microsoft 365 tenant and to upgrade the devices to Windows 10 Enterprise. You are evaluating whether to deploy Windows Hello for Business for SSO to Microsoft 365 services. What are two prerequisites of the deployment? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
- A: Computers that have biometric hardware features
- B. Microsoft Intune enrollment
- C. Microsoft Azure Active Directory (Azure AD)
- D. Smartcards
- E. TPM-enabled device
Correct Answer(s)

A. B. Microsoft Intune enrollment
A. C. Microsoft Azure Active Directory (Azure AD)

Explanation

References:
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base

Rate this question:
7.

Your network contains an Active Directory domain named contoso.com. All client devices run Windows 10 and are joined to the domain. You update the Windows 10 devices by using Windows Update for Business. What is the maximum amount of time you can defer Windows 10 updates? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- Quality Updates: 14 days
- Quality Updates: 30 days
- Quality Updates: 60 days
- Quality Updates: 120 days
- Feature Updates: 60 days
- Feature Updates: 180 days
- Feature Updates: 365 days
- Feature Updates: 540 days
Correct Answer(s)

A. Quality Updates: 30 days
A. Feature Updates: 365 days

Explanation

https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb

Rate this question:
8.

Your network contains an Active Directory domain named contoso.com that uses Microsoft System Center Configuration Manager (Current Branch). You have Windows 10 and Windows 8.1 devices. You need to ensure that you can analyze the upgrade readiness of all the Windows 8.1 devices and analyze the update compliance of all the Windows 10 devices. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- Create a Microsoft Azure Log Analytics workspace
- Configure all the devices to have a commercial ID
Correct Answer(s)

A. Create a Microsoft Azure Log Analytics workspace
A. Configure all the devices to have a commercial ID

Explanation

References:
https://docs.microsoft.com/en-us/windows/deployment/upgrade/upgrade-readiness-get-started
https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-get-started

Rate this question:
9.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create the Mobility (MDM and MAM) settings. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

You require an Apple MDM push certificate setup
https://www.inthecloud247.com/how-to-start-with-ios-user-enrollment-using-microsoft-intune/

Rate this question:
10.

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?
- A. From the Security & Compliance admin center, create a classification label.
- B. From the Security & Compliance admin center, add the users to the Security Readers role group.
- C. From the Azure Active Directory admin center, configure the trusted IPs for multi-factor authentication.
- D. From the Conditional access blade in the Azure Active Directory admin center, create named locations.
Correct Answer

A. D. From the Conditional access blade in the Azure Active Directory admin center, create named locations.

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Rate this question:
11.

You plan to allow users from the engineering department to enroll their mobile device in mobile device management (MDM). The device type restrictions are configured as shown in the following table. The device limit restrictions are configured as shown in the following table. What is the effective configuration for the members of the Engineering group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- Allowed platform: Android only
- Device Limit 5
- IOS only
- 10
- All platforms
- 15
Correct Answer(s)

A. Allowed platform: Android only
A. 15

Explanation

https://docs.microsoft.com/en-us/intune/enrollment-restrictions-set

https://docs.microsoft.com/en-us/intune/enrollment/enrollment-restrictions-set#change-enrollment-restriction-priority

Rate this question:
12.

You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?
- A. Windows 10 and Windows 8.1 only
- B. Windows 10, Android, and iOS only
- C. Windows 10 only
- D. Windows 10, Windows 8.1, Android, and iOS
Correct Answer

A. C. Windows 10 only

Explanation

https://docs.microsoft.com/en-us/configmgr/comanage/overview#prerequisites

Rate this question:
13.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You configure the Mobility (MDM and MAM) settings. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

Configuring the Mobility (MDM and MAM) settings alone will not resolve the issue of enrolling an iOS device in Intune. The error could be due to various reasons such as incorrect configuration, incompatible device, or network connectivity issues. Therefore, the given solution does not meet the goal of enrolling the iOS device in Intune.

Rate this question:
14.

Your company has 5,000 Windows 10 devices. All the devices are protected by using Windows Defender Advanced Threat Protection (ATP). You need to view which Windows Defender ATP alert events have a high severity and occurred during the last seven days. What should you use in Windows Defender ATP?
- A. the threat intelligence API
- B. Automated investigations
- C. Threat analytics
- D. Advanced hunting
Correct Answer

A. B. Automated investigations

Explanation

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/automated-investigations

Rate this question:
15.

Your company uses Microsoft Cloud App Security. You plan to integrate Cloud App Security and security information and event management (SIEM).You need to deploy a SIEM agent on a server that runs Windows Server 2016. What should you do? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.
- First action to perform (select 1 out of 4) " Install Java8 "
- Second action to perform (select 1 out of 4 ) " Run the java command and specify the – jar parameter "
Correct Answer(s)

A. First action to perform (select 1 out of 4) " Install Java8 "
A. Second action to perform (select 1 out of 4 ) " Run the java command and specify the – jar parameter "

Explanation

https://docs.microsoft.com/nl-nl/cloud-app-security/siem#step-2-download-the-jar-file-and-run-it-on-your-server

Rate this question:
16.

Which of the following is a key feature of Microsoft 365 Mobility that helps ensure secure access to corporate resources from mobile devices?
- Conditional Access
- Power Automate
- SharePoint Online
- Microsoft Teams
Correct Answer

A. Conditional Access

Explanation

Conditional Access in Microsoft 365 is a security feature that helps organizations control how and when users access corporate resources. It allows administrators to enforce access policies based on conditions like user location, device compliance, and risk levels. This is particularly important in a mobile environment where employees access company data from various devices and locations, ensuring that only compliant and trusted devices can access sensitive information.

Rate this question:

0
17.

From the Security & Compliance admin center, you create a retention policy named Policy1. You need to prevent all users from disabling the policy or reducing the retention period. Which command should you run? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- Set-RetentionCompliancePolicy -Identity “policy1” –RestrictiveRetention $true https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies Under locking retention policy
- Set-RetentionCompliancePolicy -Identity “policy1” –RestrictiveRetention $false
Correct Answer

A. Set-RetentionCompliancePolicy -Identity “policy1” –RestrictiveRetention $true https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies Under locking retention policy

Explanation

locking retention policy
https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies#locking-a-retention-policy

Rate this question:
18.

You have a Microsoft 365 subscription. You have a user named User 1. You need to ensure that User 1 can place a hold on all mailbox content. Which role should you assign to User1?
- A. eDiscovery Manager from the Security & Compliance admin center
- B. compliance management from the Exchange admin center
- C. User management administrator from the Microsoft 365 admin center
- D. Information Protection administrator from the Azure Active Directory admin center
Correct Answer

A. A. eDiscovery Manager from the Security & Compliance admin center

Explanation

https://docs.microsoft.com/en-us/Exchange/permissions/feature-permissions/policy-and-compliance-permissions?view=exchserver-2019

Rate this question:
19.

You have a Microsoft 365 subscription. All users are assigned a Microsoft 365 E3 license. You enable auditing for your organization. What is the maximum amount of time data will be retained in the Microsoft 365 audit log?
- A. 2 years
- B. 1 year
- C. 30 days
- D. 90 days
Correct Answer

A. D. 90 days

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

Rate this question:
20.

You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of all the mailboxes that contain the work ProjectX. You need to export the results of the content search. What do you need to download the report?
- A. a certification authority (CA) certificate
- B. an export key
- C. a password
- D. a user certificate
Correct Answer

A. B. an export key

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/export-search-results

Rate this question:
21.

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You have three applications named App1, App2, and App3 that have the same file format. Your company uses Windows Information Protection (WIP). WIP has the following configurations: ✑ Windows Information Protection mode: Silent ✑ Protected apps: App1 ✑ Exempt apps: App2 From App1, you create a file named File1. What is the effect of the configurations? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
- App1, 2, 3
- App 3 only
Correct Answer(s)

A. App1, 2, 3
A. App 3 only

Explanation

The given configurations in Windows Information Protection (WIP) mode will have the following effects:
- App1, App2, and App3 will be protected by WIP.
- App3 will be the only app exempted from WIP protection.
Therefore, the correct answer is that App1, App2, and App3 will be affected by the configurations, and App3 will be the only app that is exempted from WIP protection.

Rate this question:
22.
Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes:
- Implement Microsoft 365.
- Manage devices by using Microsoft Intune.
- Implement Azure Advanced Threat Protection (ATP).
- Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only.
Technical Requirements - Contoso identifies the following technical requirements:
- When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically.
- Dedicated support technicians must enroll all the Montreal office mobile devices in Intune.
- User1 must be able to enroll all the New York office mobile devices in Intune.
- Azure ATP sensors must be installed and must NOT use port mirroring.
- Whenever possible, the principle of least privilege must be used.
- A Microsoft Store for Business must be created.
Compliance Requirements -
- Contoso identifies the following compliance requirements:
- Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy.
- Configure Windows Information Protection (WIP) for the Windows 10 devices.
Question: On which server should you install the Azure ATP sensor?
- A. Server1
- B. Server2
- C. Server3
- D. Server4
- E. Server5
Correct Answer

A. A. Server1

Explanation

The Azure ATP sensor is installed directly on a domain controller to monitor the network traffic.
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-capacity-planning

Rate this question:
23.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You need to prevent users from accessing your Microsoft SharePoint Online sites unless the users are connected to your on-premises network. Solution: From the Microsoft 365 admin center, you configure the Organization profile settings. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

Conditional Access in SharePoint Online can be configured to use an IP Address white list to allow access.

References:
https://techcommunity.microsoft.com/t5/Microsoft-SharePoint-Blog/Conditional-Access-in-SharePoint-Online-and-OneDrive-for/ba-p/46678

Rate this question:
24.

You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?
- A. Global administrator
- B. Cloud application administrator
- C. Application administrator
- D. Service administrator
Correct Answer

A. A. Global administrator

Explanation

https://docs.microsoft.com/en-us/microsoft-store/sign-up-microsoft-store-for-business

Rate this question:
25.

You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable Windows Defender Credential Guard on all the computers. What should you do?
- A. From the Security & Compliance admin center, configure the DKIM signatures for the domain.
- B. From a domain controller, create a Group Policy object (GPO) that enables the Restrict delegation of credentials to remote servers setting.
- C. From the Security & Compliance admin center, create a device security policy.
- D. From a domain controller, create a Group Policy object (GPO) that enabled the Turn On Virtualization Based Security setting.
Correct Answer

A. D. From a domain controller, create a Group Policy object (GPO) that enabled the Turn On Virtualization Based Security setting.

Explanation

https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Rate this question:
26.

You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?
- A. A conditional access policy.
- B. A compliance policy.
- C. An app protection policy.
- D. An app configuration policy.
Correct Answer

A. C. An app protection policy.

Explanation

https://docs.microsoft.com/en-us/intune/app-protection-policy

Rate this question:
27.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You configure the Apple MDM Push certificate. Does this meet the goal?
- Yes
- No
Correct Answer

A. Yes

Explanation

You need the Apple MDM push certificate.

Rate this question:
28.

Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
- A. Deploy applications to Windows 10 devices.
- B. Deploy VPN profiles to iOS devices.
- C. Deploy VPN profiles to Windows 10 devices.
- D. Publish applications to Android devices.
Correct Answer(s)

A. B. Deploy VPN profiles to iOS devices.
A. D. Publish applications to Android devices.

Explanation

References:
https://docs.microsoft.com/en-us/sccm/comanage/overview

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/create-vpn-profiles

Rate this question:
29.

You configure a conditional access policy. The locations settings are configured as shown in the Locations exhibit. (Click the Locations tab.) The users and groups settings are configured as shown in the Users and Groups exhibit. (Click Users and Groups tab.) Members of the Security reader group report that they cannot sign in to Microsoft Active Directory (Azure AD) on their device while they are in the office. You need to ensure that the members of the Security reader group can sign in in to Azure AD on their device while they are in the office. The solution must use the principle of least privilege. What should you do?
- A. From the conditional access policy, configure the device state.
- B. From the Azure Active Directory admin center, create a custom control.
- C. From the Intune admin center, create a device compliance policy.
- D. From the Azure Active Directory admin center, create a named location.
Correct Answer

A. D. From the Azure Active Directory admin center, create a named location.

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Rate this question:
30.

You have computers that run Windows 10 Enterprise and are joined to the domain.You plan to delay the installation of new Windows builds so that the IT department can test application compatibility. You need to prevent Windows from being updated for the next 30 days. Which two Group Policy settings should you configure? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
- A. Select when Quality Updates are received
- B. Select when Preview Builds and Feature Updates are received
- C. Turn off auto-restart for updates during active hours
- D. Manage preview builds
- E. Automatic updates detection frequency
Correct Answer(s)

A. B. Select when Preview Builds and Feature Updates are received
A. D. Manage preview builds

Explanation

New build (new feature) come in as a new Preview Build and/or Feature updates. Quality updates are not introducing "new" Windows features but improving existing features (bug fixes / security patches).

https://www.windowscentral.com/whats-difference-between-quality-updates-and-feature-updates-windows-10

Rate this question:
31.

You have a Microsoft 365 tenant. You have a line-of-business application named App1 that users access by using the My Apps portal. After some recent security breaches, you implement a conditional access policy for App1 that uses Conditional Access App Control. You need to be alerted by email if impossible travel is detected for a user of App1. The solution must ensure that alerts are generated for App1 only. What should you do?
- A. From Microsoft Cloud App Security, create a Cloud Discovery anomaly detection policy.
- B. From Microsoft Cloud App Security, modify the impossible travel alert policy.
- C. From Microsoft Cloud App Security, create an app discovery policy.
- D. From the Azure Active Directory admin center, modify the conditional access policy.
Correct Answer

A. A. From Microsoft Cloud App Security, create a Cloud Discovery anomaly detection policy.

Explanation

References:
https://docs.microsoft.com/en-us/cloud-app-security/cloud-discovery-anomaly-detection-policy

Rate this question:
32.

Your company has a Microsoft 365 E3 subscription. All devices run Windows 10 Pro and are joined to Microsoft Azure Active Directory (Azure AD). You need to change the edition of Windows 10 to Enterprise the next time users sign in to their computer. The solution must minimize downtime for the users. What should you use?
- A. Windows Autopilot
- B. Windows Update
- C. Subscription Activation
- D. an in-place upgrade
Correct Answer

A. C. Subscription Activation

Explanation

References:
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

Rate this question:
33.

Your company has a Microsoft 365 subscription.You implement Microsoft Azure Information Protection. You need to automatically protect email messages that contain the word Confidential in the subject line. What should you create?
- A. a mail flow rule from the Exchange admin center
- B. a message trace from the Security & Compliance admin center
- C. a supervision policy from the Security & Compliance admin center
- D. a sharing policy from the Exchange admin center
Correct Answer

A. A. a mail flow rule from the Exchange admin center

Explanation

https://docs.microsoft.com/en-us/azure/information-protection/configure-exo-rules

Rate this question:
34.

You have a Microsoft 365 tenant. You create a retention label as shown in the Retention Label exhibit. (Click the Retention Label tab.) You create a label policy as shown in the Label Policy Exhibit. (Click the Label Policy tab.) The label policy is configured as shown in the following table. For each of the following statements, select the statement if it is true. NOTE: Each correct selection is worth one point.
- Any sent email message that contains the word ProjectX will be deleted immediately
- Any sent email message that contains the workd ProjectX will be retained for six months
- Users are required to manually apply a label to email messages that contain the work ProjectX
Correct Answer

A. Any sent email message that contains the workd ProjectX will be retained for six months

Explanation

The label policy shown in the exhibit indicates that any sent email message containing the word "ProjectX" will be retained for six months. This means that the statement "Any sent email message that contains the word ProjectX will be retained for six months" is true.

Rate this question:
35.

Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes - Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements - Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements - Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices.QuestionYou need to create the Microsoft Store for Business. Which user can create the store?
- User2
- User3
- User4
- User5
Correct Answer

A. User4

Explanation

https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

Rate this question:
36.

You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?
- A. From the Exchange admin center, create an in-place eDiscovery & hold.
- B. From the Security & Compliance admin center, create a data governance event.
- C. From the Exchange admin center, create an anti-malware policy.
- D. From the Exchange admin center, create a spam filter policy.
Correct Answer

A. C. From the Exchange admin center, create an anti-malware policy.

Explanation

https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/anti-spam-and-anti-malware-protection

Rate this question:
37.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a new Microsoft 365 subscription. You need to prevent users from sending email messages that contain Personally Identifiable Information (PII). Solution: From the Cloud App Security admin center, you create an access policy. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

The solution mentioned in the scenario does not meet the goal of preventing users from sending email messages that contain Personally Identifiable Information (PII). The Cloud App Security admin center is not specifically designed to create an access policy for preventing PII in email messages. Other solutions, such as implementing data loss prevention (DLP) policies in Exchange Online or using Microsoft Information Protection (MIP) labels and sensitivity labels, would be more suitable for this purpose.

Rate this question:
38.

Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure Active Directory (Azure AD). You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch). You configure pilot co-management. You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1. You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager. Solution: You add Device1 to an Active Directory group. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

The correct answer should be that the new device needs to be added into a pilot collection in configuration manager rather than an AD Security group, since the question clearly states that this scenario is a pilot co-management scenario. Reference: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

Specifically, please have a look at the section called "enable co-management in configuration manager" in the article above.

Reference: https://docs.microsoft.com/en-us/configmgr/comanage/how-to-enable

Rate this question:
39.

You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?
- A. Enrollment restrictions from the Intune admin center
- B. Device enrollment managers from the Intune admin center
- C. MAM User scope from the Azure Active Directory admin center
- D. MDM User scope from the Azure Active Directory admin center
Correct Answer

A. D. MDM User scope from the Azure Active Directory admin center

Explanation

References:
https://docs.microsoft.com/en-us/intune/windows-enroll

Rate this question:
40.

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?
- A. the Enrollment restrictions
- B. the mobile device management (MDM) authority
- C. the Exchange on-premises access settings
- D. the Windows enrollment settings
Correct Answer

A. B. the mobile device management (MDM) authority

Explanation

To ensure that users can manage the configuration settings for all the Windows 10 devices in the organization, you need to configure the mobile device management (MDM) authority. This allows users to manage and control the settings of their Windows 10 devices through the MDM solution. By setting the MDM authority to the Microsoft 365 subscription, users will have the necessary permissions and access to manage the configuration settings for all the Windows 10 devices in the organization.

Rate this question:
41.

You have three devices enrolled in Microsoft Intune as shown in the following table. The device compliance policies in Intune are configured as shown in the following table. The device compliance policies have the assignments shown in the following table. For each of the following statements, check the box if the statement is true. Otherwise, leave deselected. NOTE: Each correct selection is worth one point.
- Device1 is marked as noncompliant after 10 days
- Device2 is marked as noncompliant after 10 days
- Device3 is marked as noncompliant after 10 days
Correct Answer(s)

A. Device1 is marked as noncompliant after 10 days
A. Device2 is marked as noncompliant after 10 days

Explanation

Device1 is marked as noncompliant after 10 Days: Yes, because Device 1 is member of group 1 and 2, only group 2 is assigned to a policy (policy 2), policy 2 requires Bitlocker, device does not have it so the device will be marked as non compliant after 10 days.

Device2 is marked as noncompliant after 10 Days: Yes, because Device 2 is member of group 2 and 3, only policy 2 requires Bitlocker, therefore Device is marked as non compliant after 10 days.

Device3 is marked as noncompliant after 10 Days: No, because Device 3 is only a member of group 3, group 3 is assigned to Policy 3, policy 3 does not require Bitlocker, so the device will not be marked as non compliant at all, also if it was required it will be after 15 days, not 10 days.

Rate this question:
42.

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?
- A. Cloud application administrator
- B. Application administrator
- C. Global administrator
- D. Service administrator
Correct Answer

A. C. Global administrator

Explanation

References:
https://docs.microsoft.com/en-us/microsoft-store/roles-and-permissions-microsoft-store-for-business

Rate this question:
43.

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.
- 1.To require multi-factor authentication when signing into an unfamiliar location, you must create a (sign-in risky policy)
- 2.To avoid generating alerts when signing in to the Montreal location, create (a named location in Azure AD)
Correct Answer(s)

A. 1.To require multi-factor authentication when signing into an unfamiliar location, you must create a (sign-in risky policy)
A. 2.To avoid generating alerts when signing in to the Montreal location, create (a named location in Azure AD)

Explanation

To require multi-factor authentication when signing into an unfamiliar location, you must create a sign-in risky policy. This policy would identify and flag sign-in attempts from unfamiliar locations as risky, triggering the requirement for multi-factor authentication to provide an additional layer of security.

To avoid generating alerts when signing in to the Montreal location, you would create a named location in Azure AD. By defining Montreal as a named location, sign-ins from this location would be recognized as legitimate and not trigger any alerts or risk events.

Rate this question:
44.
Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company has the employees and devices shown in the following table. Contoso recently purchased a Microsoft 365 E5 subscription. Existing Environment - The network contains an on-premises Active Directory forest named contoso.com. The forest contains the servers shown in the following table. All servers run Windows Server 2016. All desktops and laptops run Windows 10 Enterprise and are joined to the domain. The mobile devices of the users in the Montreal and Seattle offices run Android. The mobile devices of the users in the New York office run iOS. The domain is synced to Azure Active Directory (Azure AD) and includes the users shown in the following table. The domain also includes a group named Group1. Requirements - Planned Changes: Contoso plans to implement the following changes: Implement Microsoft 365. Manage devices by using Microsoft Intune. Implement Azure Advanced Threat Protection (ATP). Every September, apply the latest feature updates to all Windows computers. Every March, apply the latest feature updates to the computers in the New York office only. Technical Requirements: Contoso identifies the following technical requirements: When a Windows 10 device is joined to Azure AD, the device must enroll in Intune automatically. Dedicated support technicians must enroll all the Montreal office mobile devices in Intune. User1 must be able to enroll all the New York office mobile devices in Intune. Azure ATP sensors must be installed and must NOT use port mirroring. Whenever possible, the principle of least privilege must be used. A Microsoft Store for Business must be created. Compliance Requirements: Contoso identifies the following compliance requirements: Ensure that the users in Group1 can only access Microsoft Exchange Online from devices that are enrolled in Intune and configured in accordance with the corporate policy. Configure Windows Information Protection (WIP) for the Windows 10 devices. Question:- You need to meet the technical requirements and planned changes for Intune. What should you do? To answer, select the appropriate options is the answer area. NOTE: Each correct selection is worth one point.
- Settings to configure in Azure AD:
- Settings to configure in Intune:
- Device Settings
- Device compliance
- Mobility (MDM & MAM)
- Device configuration
- Organizational relationships
- Device enrollment
- User settings
- Mobile Device Management Authority
Correct Answer(s)

A. Mobility (MDM & MAM)
A. Device enrollment

Explanation

https://docs.microsoft.com/en-us/intune/windows-enroll

Rate this question:
45.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. You are deploying Microsoft Intune. You successfully enroll Windows 10 devices in Intune. When you try to enroll an iOS device in Intune, you get an error. You need to ensure that you can enroll the iOS device in Intune. Solution: You create an Apple Configurator enrollment profile. Does this meet the goal?
- Yes
- No
Correct Answer

A. No

Explanation

You need the Apple MDM push certificate.

Rate this question:
46.

You have a Microsoft 365 subscription. Your company purchases a new financial application named App1. From Cloud Discovery in Microsoft Cloud App Security, you view the Discovered apps page and discover that many applications have a low score because they are missing information about domain registration and consumer popularity. You need to prevent the missing information from affecting the score. What should you configure from the Cloud Discover settings?
- A. Organization details
- B. Default behavior
- C. Score metrics
- D. App tags
Correct Answer

A. C. Score metrics

Explanation

https://docs.microsoft.com/en-us/cloud-app-security/risk-score#customizing-the-risk-score

Rate this question:
47.

You have a Microsoft 365 subscription. You need to investigate user activity in Microsoft 365, including from where users signed in, which applications were used, and increases in activity during the past month. The solution must minimize administrative effort. Which admin center should you use?
- A. Azure ATP
- B. Security & Compliance
- C. Cloud App Security
- D. Flow
Correct Answer

A. C. Cloud App Security

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

If it shouln't contain application info, the answer should be B

Rate this question:
48.

You are testing a data loss prevention (DLP) policy to protect the sharing of credit card information with external users. During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint Online. You need to prevent the user from sharing the credit card information by using email and SharePoint. What should you configure?
- A. the locations of the DLP policy
- B. the user overrides of the DLP policy rule
- C. the status of the DLP policy
- D. the conditions of the DLP policy rule
Correct Answer

A. A. the locations of the DLP policy

Explanation

https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

Rate this question:
49.

You have a Microsoft Office 365 subscription. You need to delegate eDiscovery tasks as shown in the following table. The solution must follow the principle of the least privilege. To which role group should you assign each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
- User1 - eDiscovery Manager
- User2 - eDiscovery Administrator
Correct Answer(s)

A. User1 - eDiscovery Manager
A. User2 - eDiscovery Administrator

Explanation

RBAC Roles related to eDiscovery:
https://docs.microsoft.com/en-us/microsoft-365/compliance/assign-ediscovery-permissions?view=o365-worldwide#rbac-roles-related-to-ediscovery

Role
Compliance Administrator
eDiscovery Manager & Administrator
Organization Management
Reviewer

Case Management

Compliance Search

Export

Hold

Preview

Review

RMS Decrypt

Search And Purge

Rate this question:

Quiz Review Timeline (Updated): Aug 10, 2024 +

Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.

Current Version
Aug 10, 2024

Quiz Edited by
ProProfs Editorial Team
Feb 29, 2020

Quiz Created by
Blaatlama

Recent Quizzes

FREE Sample Quiz for CyberArk's CAU302: Defender + Sentry FREE Sample Quiz for CyberArk's CAU302: Defender + Sentry

Lactation Consultant Exam: Quiz! Lactation Consultant Exam: Quiz!

Six Sigma Black Belt Exam Prep Six Sigma Black Belt Exam Prep

ACF Cooking Professional Exam Prep ACF Cooking Professional Exam Prep

MCDST Desktop Technician Exam Prep MCDST Desktop Technician Exam Prep

PgMP Program Manager Exam Prep PgMP Program Manager Exam Prep

CPCT/A Patient Care Exam Test Prep CPCT/A Patient Care Exam Test Prep

OCJP Mock JGI - III OCJP Mock JGI - III

How well do you know PRINCE2 Test? How well do you know PRINCE2 Test?

Back to top

MS-101: Microsoft 365 Mobility And Security

Quiz Preview

From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.) You need to reduce the likelihood that the sign-ins are identified at risky. What should you do?

You use Microsoft System Center Configuration Manager (Current Branch) to manage devices. Your company uses the following types of devices: ✑ Windows 10 ✑ Windows 8.1 ✑ Android ✑ iOS Which devices can be managed by using co-management?

Your company has 5,000 Windows 10 devices. All the devices are protected by using Windows Defender Advanced Threat Protection (ATP). You need to view which Windows Defender ATP alert events have a high severity and occurred during the last seven days. What should you use in Windows Defender ATP?

Which of the following is a key feature of Microsoft 365 Mobility that helps ensure secure access to corporate resources from mobile devices?

You have a Microsoft 365 subscription. You have a user named User 1. You need to ensure that User 1 can place a hold on all mailbox content. Which role should you assign to User1?

You have a Microsoft 365 subscription. All users are assigned a Microsoft 365 E3 license. You enable auditing for your organization. What is the maximum amount of time data will be retained in the Microsoft 365 audit log?

You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a content search of all the mailboxes that contain the work ProjectX. You need to export the results of the content search. What do you need to download the report?

You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?​​​​​​

You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable Windows Defender Credential Guard on all the computers. What should you do?

You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?​​​​​

Your company uses Microsoft System Center Configuration Manager (Current Branch) and Microsoft Intune to co-manage devices. Which two actions can be performed only from Intune? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Your company has a Microsoft 365 subscription.You implement Microsoft Azure Information Protection. You need to automatically protect email messages that contain the word Confidential in the subject line. What should you create?

You have a Microsoft 365 subscription. You need to be notified if users receive email containing a file that has a virus. What should you do?

You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You have a Microsoft 365 subscription. You need to ensure that users can manage the configuration settings for all the Windows 10 devices in your organization. What should you configure?

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com. You need to provide a user with the ability to sign up for Microsoft Store for Business for contoso.com. The solution must use the principle of least privilege. Which role should you assign to the user?

You have a Microsoft 365 subscription. You need to investigate user activity in Microsoft 365, including from where users signed in, which applications were used, and increases in activity during the past month. The solution must minimize administrative effort. Which admin center should you use?

You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role should you assign to the user?

You have a Microsoft 365 subscription. Some users have iPads that are managed by your company. You plan to prevent the iPad users from copying corporate data in Microsoft Word and pasting the data into other applications. What should you create?