You have a Microsoft Entra tenant that contains a device named Device1. Device1 is Microsoft Entra joined.
You need to validate the Microsoft Entra ID primary refresh token (PRT) for Device1.
Which command should you run?
A. klist tgt
B. dsregcmd /status
C. query session
D. sc.exe query state=all
Show Answer
Correct Answer: B
Explanation: The correct command is `dsregcmd /status`. On a Microsoft Entra joined Windows device, this command displays device registration and SSO state information, including the Primary Refresh Token (PRT) status (for example, AzureAdPrt = YES/NO, update time, and expiry). The other commands are unrelated to validating the Microsoft Entra PRT: `klist tgt` shows Kerberos tickets, `query session` lists user sessions, and `sc.exe query state=all` queries Windows services.
Question 67
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.
You create a user named User1.
You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.
Solution: From the Microsoft Intune admin center, you assign the Endpoint Security Manager role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. To rotate BitLocker recovery keys from Intune, the assigned Intune RBAC role must include the Remote tasks permission with the Rotate BitLockerKeys right. The built-in Endpoint Security Manager role includes this permission, so assigning it to User1 enables BitLocker recovery key rotation.
Question 68
You have a Microsoft 365 E5 subscription that contains a device named Device1.
Device1 is Microsoft Entra joined.
You manage Device1 by using Microsoft Intune.
You need to use a remote action to reset the device as quickly as possible, if the device is turned off, the action must resume after the device is powered on.
Which remote action should you use?
A. Autopilot reset
B. Wipe
C. Retire
D. Delete
Show Answer
Correct Answer: B
Explanation: Use the Intune Wipe remote action. A wipe resets the device to factory settings and, if the device is offline or powered off when the command is issued, the command remains pending and is executed when the device next powers on and checks in. Autopilot Reset is intended to reprovision an enrolled device while preserving enrollment but is not the best fit for the requirement emphasizing a reset that resumes after power-on. Retire only removes management and company data where applicable, and Delete only removes the device record from Intune.
Question 69
You have a Microsoft 365 subscription.
You plan to enroll 25 new devices in Microsoft Intune.
You need to configure an enrollment notification for the new devices.
Which two types of notifications can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. SMS
B. Microsoft Teams message
C. phone call
D. push
E. email
Show Answer
Correct Answer: D, E
Explanation: Microsoft Intune enrollment notifications support notifying assigned users about newly enrolled devices via push notifications or email. SMS, Microsoft Teams messages, and phone calls are not supported enrollment notification methods.
Question 70
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.
You create a user named User1.
You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.
Solution: From the Microsoft Intune admin center, you assign the Help Desk Operator role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. In Microsoft Intune, the built-in Help Desk Operator RBAC role includes the Remote tasks permission to rotate BitLocker recovery keys. Assigning this Intune role to User1 enables the BitLocker recovery key rotation remote task on managed Windows devices.
Question 71
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune.
You create a user named User1.
You need to ensure that User1 can rotate BitLocker recovery keys by using Intune.
Solution: From the Microsoft Entra admin center, you assign the Helpdesk Administrator role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Assigning the Microsoft Entra Helpdesk Administrator role does not grant the Intune RBAC permission required to perform the remote task of rotating BitLocker recovery keys. Rotating BitLocker keys in Intune requires an Intune RBAC role that includes the 'Rotate BitLockerKeys' remote task permission, such as the built-in Help Desk Operator or Endpoint Security Administrator role.
Question 72
Your on-premises network contains an Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.
You need to enable users to connect to Microsoft 365 services from their personal Windows devices by using single sign-on (SSO). The solution must minimize organizational control of the devices.
Which join type should you use?
A. Microsoft Entra registered
B. Microsoft Entra joined
C. Active Directory domain-joined
D. Microsoft Entra hybrid joined
Show Answer
Correct Answer: A
Explanation: Microsoft Entra registered is designed for personally owned (BYOD) devices. It allows users to sign in to Microsoft 365 with single sign-on while keeping organizational management and control to a minimum. Microsoft Entra joined is intended for organization-owned or fully cloud-managed devices, Active Directory domain-joined is on-premises, and Microsoft Entra hybrid joined implies greater organizational control through domain and Entra integration.
Question 73
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Entra tenant named contoso.com.
You purchase an Android device named Device1.
You need to register Device1 in contoso.com.
Solution: You use the Microsoft Authenticator app.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Microsoft Entra device registration for Android can be performed using the Microsoft Authenticator app by adding a work or school account, which acts as a broker and registers the device with Microsoft Entra ID. The question asks only about registering the device in the Entra tenant, not enrolling it into Intune.
Question 74
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Entra tenant named contoso.com.
You purchase an Android device named Device1.
You need to register Device1 in contoso.com.
Solution: You use Microsoft Entra Connect.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Microsoft Entra Connect is used to synchronize identities from on-premises Active Directory to Microsoft Entra ID. It is not used to register Android devices in Microsoft Entra. Android device registration is performed from the device (for example, through Android enrollment or the Microsoft Authenticator/Company Portal process), not through Entra Connect.
Question 75
You have a Microsoft 365 E5 subscription.
You need to ensure that when a Windows device is joined to the Microsoft Entra tenant, the device is enrolled automatically in Microsoft Intune.
What should you configure?
A. the Windows Information Protection (WIP) user scope
B. the Enterprise State Roaming settings
C. the Microsoft Entra join and registration settings
D. the mobile device management (MDM) user scope
Show Answer
Correct Answer: D
Explanation: Automatic enrollment of Windows devices into Microsoft Intune during Microsoft Entra join is controlled by the Mobile Device Management (MDM) user scope. Assigning users to the MDM user scope enables automatic Intune enrollment when their Windows devices are Microsoft Entra joined. WIP user scope configures Windows Information Protection, Enterprise State Roaming syncs user settings, and Entra join/registration settings alone do not enable Intune auto-enrollment.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.