Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant named contoso.com.
You need to deploy 100 Windows 11 devices to contoso.com. The solution must meet the following requirements:
• Ensure that from the devices, users can access shares on an on-premises file server without being prompted for credentials.
• Minimize reliance on the on-premises infrastructure for device identity management.
Which join type should you use?
A. Active Directory domain-joined
B. Microsoft Entra hybrid joined
C. Microsoft Entra joined
D. Microsoft Entra registered
Show Answer
Correct Answer: C
Explanation: Microsoft Entra joined devices best meet both requirements. They minimize reliance on on‑premises infrastructure for device identity management because the device identity is cloud‑only, managed in Microsoft Entra ID rather than AD DS. At the same time, Microsoft Entra joined Windows 11 devices can access on‑premises file shares without credential prompts using single sign‑on when Microsoft Entra Kerberos / Windows Hello for Business cloud trust (or equivalent supported configuration) is in place, which is now an established and documented capability. Hybrid join would still depend on on‑prem AD for device identity, and domain join relies entirely on it.
Question 64
HOTSPOT
-
You have a Microsoft Entra tenant that contains the devices shown in the following table.
Which devices can be Microsoft Entra joined, and which devices can be Microsoft Entra registered? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Microsoft Entra joined:
Device1 and Device2 only
Microsoft Entra registered:
Device1, Device2, Device3, and Device4
Explanation: Microsoft Entra join is supported for Windows and Android devices. iOS and iPadOS do not support Entra join.
Microsoft Entra registration is supported for Windows, Android, iOS, and iPadOS devices.
Question 65
You have a Microsoft Entra tenant that contains a device named Device1. Device1 is Microsoft Entra joined.
You need to validate the Microsoft Entra ID primary refresh token (PRT) for Device1.
Which command should you run?
A. klist tgt
B. dsregcmd /status
C. query session
D. sc.exe query state=all
Show Answer
Correct Answer: B
Explanation: To validate the Microsoft Entra ID Primary Refresh Token (PRT) on a Microsoft Entra joined device, you use the dsregcmd /status command. This command displays the device registration and SSO state, including fields such as AzureAdPrt, AzureAdPrtUpdateTime, and AzureAdPrtExpiryTime, which indicate whether the PRT is present and valid.
Question 66
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.
You create a user named User1.
You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.
Solution: From the Microsoft Intune admin center, you assign the Endpoint Security Manager role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. Assigning the Endpoint Security Manager role meets the goal because this built-in Intune RBAC role includes the Remote tasks permission with the Rotate BitLockerKeys right. That permission allows a user to rotate BitLocker recovery keys for managed devices via Intune, which is exactly the required capability.
Question 67
You have a Microsoft 365 E5 subscription that contains a device named Device1.
Device1 is Microsoft Entra joined.
You manage Device1 by using Microsoft Intune.
You need to use a remote action to reset the device as quickly as possible, if the device is turned off, the action must resume after the device is powered on.
Which remote action should you use?
A. Autopilot reset
B. Wipe
C. Retire
D. Delete
Show Answer
Correct Answer: B
Explanation: The **Wipe** remote action resets the device to factory settings and is designed to continue automatically if the device is powered off when the action is initiated, resuming once the device is turned back on and connects to the service. It is also the fastest way to fully reset a managed device. Autopilot Reset requires the device to be online and does not resume from a powered-off state, Retire only removes management, and Delete only removes the device record without resetting the device.
Question 68
You have a Microsoft 365 subscription.
You plan to enroll 25 new devices in Microsoft Intune.
You need to configure an enrollment notification for the new devices.
Which two types of notifications can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. SMS
B. Microsoft Teams message
C. phone call
D. push
E. email
Show Answer
Correct Answer: D, E
Explanation: Microsoft Intune enrollment notifications support only two delivery methods: email notifications and push notifications to the enrolled device/user. SMS, Microsoft Teams messages, and phone calls are not supported for enrollment notifications.
Question 69
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.
You create a user named User1.
You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.
Solution: From the Microsoft Intune admin center, you assign the Help Desk Operator role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: In Microsoft Intune RBAC, the built-in Help Desk Operator role includes the **Remote tasks – Rotate BitLockerKeys (preview)** permission. Assigning this role from the Intune admin center allows a user to rotate BitLocker recovery keys on Intune-managed Windows devices, which meets the stated goal.
Question 70
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.
You create a user named User1.
You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.
Solution: From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Rotating BitLocker recovery keys in Intune requires an Intune RBAC role that includes the Remote tasks permission with Rotate BitLocker keys enabled, such as Help Desk Operator or Endpoint Security Administrator. Assigning the Microsoft Entra Helpdesk Administrator role does not grant Intune device management or BitLocker rotation permissions, so it does not meet the goal.
Question 71
Your on-premises network contains an Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.
You need to enable users to connect to Microsoft 365 services from their personal Windows devices by using single sign-on (SSO). The solution must minimize organizational control of the devices.
Which join type should you use?
A. Microsoft Entra registered
B. Microsoft Entra joined
C. Active Directory domain-joined
D. Microsoft Entra hybrid joined
Show Answer
Correct Answer: A
Explanation: Personal (BYOD) Windows devices that need SSO to Microsoft 365 with minimal organizational control should be Microsoft Entra registered. Entra registration supports SSO to cloud apps without enforcing device management or full organizational control, unlike Entra joined or hybrid joined devices. Domain-joined devices are not suitable for personal devices.
Question 72
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Entra tenant named contoso.com.
You purchase an Android device named Device1.
You need to register Device1 in contoso.com.
Solution: You use the Microsoft Authenticator app.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: On Android, adding a work or school account through the Microsoft Authenticator app performs Microsoft Entra device registration (workplace join). Microsoft documentation explicitly lists Microsoft Authenticator as a supported method to register iOS/Android devices in Entra ID. Therefore, using the Microsoft Authenticator app meets the goal of registering Device1 in contoso.com.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
