You have devices enrolled in Microsoft Intune as shown in the following table.
For which devices can you manage updates by using Intune?
A. Device1 only
B. Device1 and Device2 only
C. Device1 and Device3 only
D. Device1, Device3, and Device4 only
E. Device1, Device2, Device3, and Device4
Show Answer
Correct Answer: E
Explanation: Microsoft Intune can manage OS updates for all the listed device platforms: Windows (Windows Update for Business), iOS/iPadOS and macOS (software update policies), and Android (Android Enterprise system update controls such as deferrals and maintenance windows). Therefore, updates can be managed for Device1, Device2, Device3, and Device4.
Question 167
Your company has a Microsoft 365 subscription.
All the users in the finance department own personal devices that run iOS or Android. All the devices are enrolled in Microsoft Intune.
The finance department adds new users each month.
The company develops a mobile application named App1 for the finance department users.
You need to ensure that only the finance department users can download App1.
What should you do first?
A. Register App1 in Azure AD.
B. Add App1 to the vendor stores for iOS and Android applications.
C. Add App1 to a Microsoft Deployment Toolkit (MDT) deployment share.
D. Add App1 to Intune.
Show Answer
Correct Answer: D
Explanation: To control who can download and access a mobile app using Intune, the app must first be added to Microsoft Intune. Only after adding the app can you assign it to specific Azure AD user groups, such as the finance department, and restrict access accordingly. Other options do not enable Intune-based assignment or access control.
Question 168
HOTSPOT
-
Your network contains an Active Directory domain. Active Directory is synced with Azure AD.
There are 500 Active Directory domain-joined computers that run Windows 10 and are enrolled in Microsoft Intune.
You plan to implement Microsoft Defender Exploit Guard.
You need to create a custom Microsoft Defender Exploit Guard policy, and then distribute the policy to all the computers.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Microsoft Intune admin center
An Endpoint Protection configuration profile
Explanation: Microsoft Defender Exploit Guard custom settings are configured in the Microsoft Intune admin center and deployed to Windows 10 devices using an Endpoint Protection configuration profile, which supports Exploit Guard policies.
Question 169
HOTSPOT
-
You have an Azure AD tenant that contains the following:
• Windows 11 devices that are joined to Azure AD
• A user that has a display name of User1 and a UPN of
You enable Remote Desktop on the Windows 11 devices.
You need to ensure that User1 can use Remote Desktop to connect to the devices.
How should you complete the command that must be run on each device? To answer, select the appropriate options in the answer area
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: net localgroup "Remote Desktop Users" /add "AzureAD\[email protected]"
Explanation: On Azure AD–joined Windows devices, users must be added to the local **Remote Desktop Users** group using the **AzureAD\<UPN>** format to allow Remote Desktop sign-in.
Question 172
You have a Microsoft 365 subscription that contains a user named User1 and uses Microsoft Intune Suite.
You use Microsoft Intune to manage devices that run Windows 11.
You need to remove User1 from the local Administrators group on all enrolled devices.
What should you configure?
A. a device compliance policy
B. an account protection policy
C. an app configuration policy
Show Answer
Correct Answer: B
Explanation: To remove a user from the local Administrators group on Windows 11 devices managed by Intune, you must use an Endpoint security **account protection policy**. Account protection policies allow you to manage local user and group memberships (including the local Administrators group) across enrolled devices. Device compliance and app configuration policies cannot modify local group membership.
Question 173
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains a computer named Computer1 that runs Windows 11. Computer1 is enrolled in Microsoft Intune.
You need to deploy an app named App1 to Computer1. The App1 installation will use multiple files.
What should you use to package App1, and which file format will be used? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Intune deploys Windows desktop apps with multiple installation files as Win32 apps. These must be packaged using the Win32 Content Prep Tool, which converts the source files into an .intunewin package for deployment to Windows 11 devices.
Question 174
HOTSPOT
-
You have a Microsoft 365 subscription that contains the devices shown in the following table.
All the devices will be reimaged and licensed by using subscription activation.
The devices are assigned to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Device1 can be upgraded to Windows 11 and activated: No
Device2 requires additional hardware before it can be upgraded to Windows 11: No
User3 requires an additional license to activate Windows 11 on Device3: Yes
Explanation: Windows 11 requires TPM 2.0; Device1 has only TPM 1.2, so it cannot be upgraded/activated. Device2 meets minimum hardware requirements (TPM 2.0, 4 GB RAM, 64 GB storage). Subscription activation requires a Windows license (Microsoft 365 E3/E5); User3 has Office 365 E5 + EMS E5, which does not include Windows licensing.
Question 175
You have a Microsoft Intune subscription associated to an Azure AD tenant named contoso.com.
Users use one of the following three suffixes when they sign in to the tenant: us.contoso.com, eu.contoso.com, or contoso.com.
You need to ensure that the users are NOT required to specify the mobile device management (MDM) enrollment URL as part of the enrollment process. The solution must minimize the number of changes.
Which DNS records do you need?
A. one TXT record only
B. three CNAME records
C. three TXT records
D. one CNAME record only
Show Answer
Correct Answer: B
Explanation: To allow automatic Intune MDM discovery without users entering the enrollment URL, Azure AD relies on DNS CNAME records for each UPN suffix. Because users sign in with three different suffixes (contoso.com, us.contoso.com, and eu.contoso.com), a separate CNAME record is required for each domain, all pointing to EnterpriseEnrollment-s.manage.microsoft.com. This meets the requirement with minimal changes.
Question 176
DRAG DROP
-
You have a Microsoft 365 subscription that contains the devices shown in the following table.
You need to configure the Microsoft Edge settings for each device.
What should you use? To answer, drag the appropriate Intune features to the correct devices. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Windows 10 Edge settings are managed via Intune device configuration profiles (Settings catalog). On Android Enterprise and iOS/iPadOS, Microsoft Edge is configured using app configuration policies (managed app configurations).
Question 177
HOTSPOT
-
Your network contains an on-premises Active Directory domain that contains the locations shown in the following table.
In Microsoft Intune, you enroll the Windows 10 devices shown in the following table.
You have a Delivery Optimization device configuration profile applied to all the devices. The profile is configured as shown in the following exhibit.
From which devices can Device1 and Device2 get updates? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Device1:
Can get updates from Device3 only.
Device2:
Cannot get updates from any device.
Explanation: Restrict Peer Selection is set to Subnet mask, so peering is limited to devices in the same subnet. Device1 (10.10.0.50) and Device3 (10.10.1.155) are both in 10.10.0.0/16, so they can peer. Device2 (10.20.1.150) is the only device in its 10.20.0.0/16 subnet, so it has no eligible peers.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.