HOTSPOT -
You manage a Microsoft Deployment Toolkit (MDT) deployment share named DS1. DS1 contains an Out-of-Box Drivers folder named Windows 11 x64 that has subfolders in the format of {make name}\{model name}.
You need to modify a deployment task sequence to ensure that all the drivers in the folder that match the make and model of the computers are installed without using PnP detection or selection profiles.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Preinstall
Set Task Sequence Variable
Explanation: Modify the Preinstall phase so drivers are handled before OS installation. Use a Set Task Sequence Variable step (e.g., DriverGroup001) to point to the {make}\{model} folder, allowing Inject Drivers to install all matching drivers without PnP detection or selection profiles.
Question 191
You plan to deploy Windows 11 Pro to 200 new computers by using the Microsoft Deployment Toolkit (MDT) and Windows Deployment Services (WDS).
The company has a Volume Licensing Agreement and uses a product key to activate Windows 11.
You need to ensure that the new computers will be configured to have the correct product key during the installation.
What should you configure?
A. an MDT task sequence
B. the Device settings in Azure AD
C. a WDS boot image
D. a Windows Autopilot deployment profile
Show Answer
Correct Answer: A
Explanation: In an MDT + WDS deployment, the Windows product key is configured as part of the MDT deployment process. MDT allows you to specify a Volume License (MAK/KMS) product key directly in the task sequence or via CustomSettings.ini, ensuring Windows 11 is installed and activated with the correct key. WDS boot images only start the deployment, Azure AD device settings and Autopilot profiles are not used in MDT/WDS-based deployments.
Question 192
HOTSPOT
-
Your company has an infrastructure that has the following:
• A Microsoft 365 tenant
• An Active Directory forest
• Microsoft Intune
• A Key Management Service (KMS) server
• A Windows Deployment Services (WDS) server
• An Azure AD Premium tenant
The company purchases 100 new client computers that run Windows.
You need to ensure that the new computers are joined automatically to Azure AD by using Windows Autopilot.
What should you use? To answer, select the appropriate options in the answer area,
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Management tool:
Microsoft Intune admin center
Required information from each computer:
Device serial number and hardware hash
Explanation: Windows Autopilot is configured and managed through Microsoft Intune. Each device must be registered with Autopilot using its unique hardware identity (hardware hash) and serial number so it can automatically join Azure AD during first boot.
Question 193
Your network contains an Active Directory domain named contoso.com. The domain contains 25 computers that run Windows 11.
You have a Microsoft 365 subscription
You have an Azure AD tenant that syncs with contoso.com.
You configure hybrid Azure AD join and discover that some of the computers have a registered state of Pending.
You need to ensure that the computers complete the join successfully.
What should you ensure?
A. that Windows is activated on all the computers
B. that the users of the computers are assigned Microsoft 365 licenses
C. that each computer has a line of sight to a domain controller
D. that the computers contain the latest quality updates
Show Answer
Correct Answer: C
Explanation: For a hybrid Azure AD (Microsoft Entra ID) join to complete, Windows devices must be able to contact an on‑premises Active Directory domain controller. During the join process, the device authenticates with AD and writes required attributes that are then synced to Entra ID. If a device lacks network line of sight to a domain controller, it remains in a Pending registered state and cannot complete the hybrid join. Licensing, Windows activation, and latest quality updates are not prerequisites for hybrid Azure AD join.
Question 194
You have a Microsoft 365 tenant that contains the devices shown in the following table.
The devices are managed by using Microsoft Intune.
You create a compliance policy named Policy1 and assign Policy1 to Group1. Policy1 is configured to mark a device as Compliant only if the device security settings match the settings specified in the policy.
You discover that devices that are not members of Group1 are shown as Compliant.
You need to ensure that only devices that are assigned a compliance policy can be shown as Compliant. All other devices must be shown as Not compliant.
What should you do from the Microsoft Intune admin center?
A. From Device compliance, configure the Compliance policy settings.
B. From Endpoint security, configure the Conditional access settings.
C. From Tenant administration, modify the Diagnostic settings.
D. From Policy1, modify the actions for noncompliance.
Show Answer
Correct Answer: A
Explanation: Intune has a tenant-wide compliance setting under Device compliance > Compliance policy settings called "Mark devices with no compliance policy assigned as." By default, devices without an assigned compliance policy are marked Compliant. Changing this setting to Not compliant ensures that only devices targeted by a compliance policy (such as Policy1 assigned to Group1) can be shown as Compliant, while all other devices are shown as Not compliant.
Question 195
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Microsoft Intune to manage Windows 11 devices.
You create a new policy set named Set and add five device configuration profiles for Windows 10 and later.
You create a device compliance policy named Policy1.
You need to ensure that when users are assigned the device configuration profiles in Set1, they are always assigned Policy1 also.
What should you configure?
A. the assignments of Policy1
B. the Policy1 configurations
C. the assignments of Set1
D. the Set1 configurations
Show Answer
Correct Answer: D
Explanation: To ensure that users who receive the device configuration profiles in Set1 are always also assigned the compliance policy Policy1, you must include Policy1 within the same policy set. Policy sets deploy all included objects together as a single unit. This is done by configuring the Set1 configurations to add the device compliance policy to the set. Assignments are then handled at the policy set level, guaranteeing Policy1 is applied whenever Set1 is assigned.
Question 196
You have a Windows 10 device named Device1 that is joined to Active Directory and enrolled in Microsoft Intune.
Device1 is managed by using Group Policy and Intune.
You need to ensure that the Intune settings override the Group Policy settings.
What should you configure?
A. a device configuration profile
B. a device compliance policy
C. an MDM Security Baseline profile
D. a Group Policy Object (GPO)
Show Answer
Correct Answer: A
Explanation: To ensure Intune settings override Group Policy on a Windows 10 device that is both AD-joined and Intune-enrolled, you must configure the Intune setting **MDMWinsOverGP**. This setting is available within an **Intune device configuration profile** (Settings catalog → Control policy conflict → MDM wins over GP). Compliance policies and security baselines do not control policy precedence, and configuring a GPO would not make Intune take priority over Group Policy.
Question 197
HOTSPOT -
You have a Microsoft 365 subscription that uses Microsoft Intune and contains 100 Windows 10 devices.
You need to create Intune configuration profiles to perform the following actions on the devices:
• Deploy a custom Start layout.
• Rename the local Administrator account.
Which profile type template should you use for each action? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Deploy a custom Start layout: Device restriction
Rename the local Administrator account: Endpoint protection
Explanation: Custom Start menu layouts are configured using the Device restrictions template in Intune. Renaming the built-in local Administrator account is done through Endpoint protection under Local device security options (Accounts).
Question 198
You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune.
You plan to manage Microsoft Defender Antivirus on the computers.
You need to prevent users from disabling Microsoft Defender Antivirus.
What should you do?
A. From the Microsoft Intune admin center, create a security baseline.
B. From the Microsoft 365 Defender portal, enable tamper protection.
C. From the Microsoft Intune admin center, create an account protection policy.
D. From the Microsoft Intune admin center, create an endpoint detection and response (EDR) policy.
Show Answer
Correct Answer: B
Explanation: Enabling Tamper Protection prevents users and malicious apps from disabling or altering Microsoft Defender Antivirus settings. It is managed from the Microsoft 365 Defender portal (and can also be configured via Intune security settings), making it the correct way to stop users from turning off Defender.
Question 199
You have 200 computers that run Windows 10. The computers are joined to Azure AD and enrolled in Microsoft Intune.
You need to enable self-service password reset on the sign-in screen.
Which settings should you configure from the Microsoft Intune admin center?
A. Device configuration
B. Device enrollment
C. Conditional access
D. Device compliance
Show Answer
Correct Answer: A
Explanation: Enabling self-service password reset on the Windows 10 sign-in screen for Azure AD–joined, Intune-enrolled devices is done by deploying a device configuration profile from the Microsoft Intune admin center. This uses a Windows configuration (including a custom OMA-URI setting) to enable SSPR at the sign-in screen. The other options—device enrollment, conditional access, and device compliance—do not configure Windows sign-in behavior.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.