HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains the security groups shown in the following table.
The subscription contains devices that run Windows 11, version 21H2 as shown in the following table.
You have a feature update deployment profile named Deployment1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Device1: No
Device2: Yes
Device3: No
Explanation: Deployment1 includes Group2 and excludes Group1 and Group3. All devices are Windows, so they qualify for Group2. Device1 has extensionAttribute1 = Test, making it a member of Group3, which is excluded. Device3 is a member of Group1, which is also excluded. Device2 is only in Group2 and not excluded, so it receives the update.
Question 146
DRAG DROP
-
You have a Microsoft 365 E5 subscription that includes Microsoft Intune.
The subscription contains Android Enterprise devices that are enrolled in Intune and have personally-owned work profiles. All the Android devices are members of a group named Group1.
You need to ensure that end users and Intune administrators receive an email message when an Android device does NOT have an up-to-date security provider.
Which actions should you perform from the Microsoft Intune admin center in sequence? To answer, drag the appropriate actions to the correct order. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Step 1: From Compliance policies, create a notification message template.
Step 2: Create a compliance policy.
Step 3: Assign policy to Group1.
Explanation: Email alerts for noncompliant Android devices are triggered by compliance policies. The notification message template must exist first so it can be selected as an action for noncompliance. After creating the compliance policy (including the outdated security provider condition and notification action), the policy is assigned to Group1.
Question 147
You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune.
You plan to manage Microsoft Defender Antivirus on the computers.
You need to prevent users from disabling Microsoft Defender for Endpoint.
What should you do?
A. From the Microsoft Intune admin center, create an attack surface reduction (ASR) policy.
B. From the Microsoft 365 Defender portal, enable tamper protection.
C. From the Microsoft Intune admin center, create an account protection policy.
D. From the Microsoft Entra admin center, create a Conditional Access policy.
Show Answer
Correct Answer: B
Explanation: Tamper protection is specifically designed to prevent users or malware from disabling or modifying Microsoft Defender Antivirus and Microsoft Defender for Endpoint security settings. Enabling tamper protection from the Microsoft 365 Defender portal ensures these protections cannot be turned off locally, even by administrators. The other options do not control the ability to disable Defender.
Question 148
HOTSPOT
-
Your company has computers that run Windows 10 and are Microsoft Entra joined.
The company purchases an Azure subscription.
You need to collect Windows events from the Windows 10 computers in Azure. The solution must enable you to create alerts based on the collected events.
What should you create in Azure and what should you configure on the computers? To answer, select the appropriate options in the answer area.
Show Answer
Correct Answer: An Azure Log Analytics workspace
Install the Azure Monitor Agent
Explanation: Windows event collection with alerting in Azure is done through Azure Monitor. Events are stored and queried in a Log Analytics workspace, which supports alert rules. Windows 10 devices must have the Azure Monitor Agent installed to send event data to the workspace.
Question 149
HOTSPOT
-
Your network contains an Active Directory domain.
The domain contains four computers named Computer1, Computer2, Computer3, and Computer4 that run Windows 10.
You perform the following actions:
• On Computer1, you install Windows Admin Center and configure Windows Defender Firewall to allow incoming communication over TCP ports 80,443, and 6516.
• On Computer2, you run the Enable-PSRemoting cmdlet.
• On Computer3, you configure Windows Defender Firewall to allow Windows Remote Management (WinRM) traffic.
• On Computer4, you run the winrm quickconfig command.
You need to manage the computers remotely by using Windows Admin Center.
From which computers can you connect to Windows Admin Center, and which computers can you manage by using Windows Admin Center? To answer, select the appropriate options in the answer are.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Connect from:
Computer1 only
Manage:
Computer1, Computer2, and Computer4 only
Explanation: Windows Admin Center is installed on Computer1 (Windows 10 client), so it can only be accessed locally from that computer. To be managed by Windows Admin Center, a machine must have WinRM enabled and running with firewall access. Computer2 (Enable-PSRemoting) and Computer4 (winrm quickconfig) both start WinRM and configure the firewall. Computer3 only opens the firewall but does not start the WinRM service, so it cannot be managed. Computer1 can manage itself.
Question 150
You have a Hyper-V host. The host contains virtual machines that run Windows 10 as shown in following table.
Which virtual machines can be upgraded to Windows 11?
A. VM1 only
B. VM2 only
C. VM2 and VM3 only
D. VM1, VM2, and VM3
Show Answer
Correct Answer: B
Explanation: Windows 11 on Hyper-V requires a Generation 2 VM with Secure Boot, TPM 2.0 (vTPM), and supported CPU configuration. VM1 is Generation 1 and lacks TPM support, so it cannot be upgraded. VM3 does not meet the minimum processor requirements (insufficient CPU cores). VM2 is Generation 2 and meets all Windows 11 hardware requirements, so only VM2 can be upgraded.
Question 151
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Intune to manage all devise.
Users have iOS devices with Microsoft apps installed.
You need to prevent users from cutting, copying, and pasting data between Microsoft Excel and other apps installed on the devices.
What should you configure?
A. an app protection policy
B. an app configuration policy
C. an iOS app provisioning profile
D. policies for Microsoft Office apps
Show Answer
Correct Answer: A
Explanation: Intune app protection policies (MAM) control data transfer behaviors within managed apps on iOS, including restricting cut, copy, and paste between Microsoft Excel and other apps. App configuration policies and provisioning profiles do not enforce cross-app data protection, and Office app policies are implemented through app protection policies.
Question 152
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Intune to manage devices.
You need to review details about device wipes initiated through Intune.
Which report should you review?
A. Noncompliant devices
B. Assignment status
C. Windows health attestation report
D. Device actions
Show Answer
Correct Answer: D
Explanation: Intune records remote actions such as wipe, retire, reset, and delete in the **Device actions** report. This report allows you to review when a wipe was initiated, by whom, and its status. The other reports focus on compliance, assignment results, or device health and do not track wipe actions.
Question 153
You have a Microsoft 365 subscription. The subscription contains 500 computers that run Windows 11 and are enrolled in Microsoft Intune.
You need to manage the deployment of monthly security updates. The solution must meet the following requirements:
• Updates must be deployed to a group of test computers for quality assurance.
• Updates must be deployed automatically 15 days after the quality assurance testing.
What should you create in the Microsoft Intune admin center?
A. a device configuration profile
B. a feature update policy
C. a security baseline
D. an update ring
Show Answer
Correct Answer: D
Explanation: Windows Update rings in Intune are designed to manage monthly quality (security) updates. They let you deploy updates to a pilot/test group first and configure a quality update deferral period (e.g., 15 days) so updates are automatically released to broader groups after testing. Other options do not control monthly security update deployment timing.
Question 154
DRAG DROP
-
Your on-premises network contains an Active Directory Domain Services (AD DS) domain.
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains five virtual machines and is NOT connected to the on-premises network.
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You purchase Windows 365 Enterprise licenses.
You need to deploy Cloud PC. The solution must meet the following requirements:
• All users must be able to access their Cloud PC at any time without any restrictions.
• The users must be able to connect to the virtual machines on VNet1.
How should you configure the provisioning policy for Windows 365? To answer, drag the appropriate options to the correct settings. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Hybrid join requires line-of-sight to on‑prem AD DS, which isn’t available because VNet1 isn’t connected to the on‑prem network. To allow Cloud PCs to access resources in VNet1, an Azure network connection is required. Windows 365 Enterprise licenses provide unrestricted access, unlike Frontline.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.