Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Entra tenant named contoso.com.
You purchase an Android device named Device1.
You need to register Device1 in contoso.com.
Solution: You use the Microsoft Intune Company Portal app.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. On Android, the Microsoft Intune Company Portal app is the standard method to enroll/register a device for management. During enrollment, the device is registered with the Microsoft Entra tenant, satisfying the goal of registering the Android device in contoso.com.
Question 77
You have a Microsoft 365 E5 subscription.
You need to create a dynamic device group that will contain any device that has the word Marketing in its name.
Which device membership rule should you use?
A. (device.displayName -in "Marketing")
B. (device.displayName -in "*Marketing*")
C. (device.displayName -contains "Marketing")
D. (device.displayName -contains "*Marketing*")
Show Answer
Correct Answer: C
Explanation: Use the -contains operator to match devices whose displayName contains the substring "Marketing". The -in operator checks membership in a collection rather than substring matching, and wildcards are not used with -contains for this purpose.
Question 78
You have a Microsoft Entra tenant named contoso.com that contains a Windows 11 device named Device1 and a user named User1.
User1 registers Device1 in contoso.com.
Which capability is available to Device1 after registering in contoso.com?
A. authenticating to cloud resources by using single sign-on (SSO)
B. enforcing compliance policies
C. enforcing software updates
D. enforcing hard drive encryption
Show Answer
Correct Answer: A
Explanation: Microsoft Entra registered (workplace joined) devices gain the ability to authenticate to Microsoft Entra-protected cloud resources with single sign-on. Merely registering a device does not by itself enforce compliance policies, software updates, or BitLocker/hard drive encryption; those require MDM enrollment and management such as Microsoft Intune.
Question 79
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.
You need to create two dynamic device groups named Group1 and Group2. The solution must meet the following requirements:
• Group1 must contain Device1 and Device2 only.
• Group2 must contain Device1 and Device3 only.
Which device membership rule should you configure for each group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Group1:
(device.displayName -startsWith "Device") and (device.deviceOSType -eq "Windows")
Group2:
(device.deviceTrustType -eq "AzureAD") or (device.deviceOSType -eq "iPhone")
Explanation: Group1 should include only the two Windows devices. Group2 should include the Microsoft Entra joined device and the iOS device. The screenshot appears to use "iPhone" where Microsoft documentation typically uses "iOS" for the OS type, making this a likely typo in the exam choices.
Question 80
You have a Microsoft 365 E5 subscription that contains a group named Group1.
You need to ensure that only the members of Group1 can join devices to the Microsoft Entra tenant.
What should you configure in the Microsoft Entra admin center?
A. Device settings
B. Mobility
C. Enterprise State Roaming
D. User settings
Show Answer
Correct Answer: A
Explanation: Configure Microsoft Entra admin center > Devices > Device settings. The setting 'Users may join devices to Microsoft Entra' can be set to 'Selected' and assigned to Group1, restricting Microsoft Entra device join to only members of that group.
Question 81
HOTSPOT
-
You have a Microsoft 365 ES subscription and use Microsoft Intune Suite.
You manage the following types of devices:
• Windows 11
• Android
• iOS
You need to implement Microsoft Tunnel for Mobile Application Management (MAM) to provide the devices with access to on-premises company apps.
What should you deploy first, and which device types can use Tunnel for MAM? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Deploy: Microsoft Tunnel Gateway
Device types: Android and iOS only
Explanation: Microsoft Tunnel for MAM requires deployment of the Microsoft Tunnel Gateway. Tunnel for MAM supports unenrolled/mobile application management scenarios on Android and iOS/iPadOS, not Windows 11.
Question 82
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains three Windows devices named Device1, Device2, and Device3.
Each device contains two apps named App1 and App2.
You manage the devices by using Microsoft Intune.
The subscription contains the groups shown in the following table.
You have an Endpoint Privilege Management (EPM) elevation settings policy named Policy1 that has the following settings:
• Endpoint Privilege Management: Enabled
• Default elevation response: Require user confirmation
• Validation: Windows authentication
• Assignments: Group1, Group2
You create an Endpoint Privilege Management elevation rules policy named RulesPolicy1 that has the following settings:
• Rule name: Rule1
• Elevation type: Automatic
• Child process behavior: Deny all
• File name: App1.exe
• Assignments: Group1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
No
Explanation: Policy1 applies to all three devices and requires Windows authentication for default elevations. Rule1 (automatic elevation for App1.exe) applies only to Group1 (Device1 and Device3), overriding the default for App1 there. Thus App2 on Device1 uses the default (credentials required), App1 on Device2 uses the default (not automatic), and App1 on Device3 is elevated automatically without credentials.
Question 83
DRAG DROP
-
You have a Microsoft 365 E5 subscription that is linked to a Microsoft Entra tenant named contoso.com. The subscription contains a user named User1 and a new Windows 11 device named Device1.
User1 must enroll Device1 in Microsoft Intune automatically.
You need to ensure that all other users cannot use automatic enrollment.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. Create a group named Group1 and add User1 to Group1.
2. Configure the mobile device management (MDM) user scope.
3. Instruct User1 to join Device1 to contoso.com.
Explanation: Target the MDM user scope to Group1 so only User1 receives automatic Intune enrollment. Automatic enrollment is triggered when the Windows device is Microsoft Entra joined. Restricting who can join devices to Entra is not required by the stated requirement.
Question 84
HOTSPOT
-
You have a Microsoft Entra tenant.
You are creating a dynamic device group named Group1.
Group1 will include only Windows devices that are Microsoft Entra registered.
How should you configure the dynamic membership rule for Group1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Microsoft Entra registered devices have deviceTrustType = "Workplace". Combined with device.deviceOSType -eq "Windows", this includes only Windows devices that are Microsoft Entra registered.
Question 85
You have a Microsoft Entra tenant named contoso.com that contains a group named Contoso Help Desk.
You need to ensure that Contoso Help Desk is added to the local Administrators group whenever a Windows device is joined to contoso.com.
What should you do?
A. Assign the Cloud Device Administrator role to Contoso Help Desk.
B. Assign the Microsoft Entra Joined Device Local Administrator role to Contoso Help Desk.
C. Configure the Enterprise State Roaming settings.
D. Enable Microsoft Entra Local Administrator Password Solution (LAPS) for contoso.com.
Show Answer
Correct Answer: B
Explanation: The Microsoft Entra Joined Device Local Administrator role grants its assigned users or groups local administrator rights on Microsoft Entra joined Windows devices. Members of this role are added to the local Administrators group during Microsoft Entra join. The Cloud Device Administrator role manages device objects but does not grant local admin rights. Enterprise State Roaming is unrelated, and Microsoft Entra LAPS manages local administrator passwords rather than assigning local administrators.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.