Practice Free MD-102 Exam Online Questions

Question #146

How do you define an interface that performs path parameter substitution for a dynamic path?

A . See the Explanation.

Reveal Solution Hide Solution

Question #146

How do you define an interface that performs path parameter substitution for a dynamic path?

A . See the Explanation.

Reveal Solution Hide Solution

Question #3

You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune.

You plan to manage Microsoft Defender Antivirus on the computers.

You need to prevent users from disabling Microsoft Defender for Endpoint.

What should you do?

A . From the Microsoft Intune admin center, create an attack surface reduction (ASR) policy.
B . From the Microsoft 365 Defender portal, enable tamper protection.
C . From the Microsoft Intune admin center, create an account protection policy.
D . From the Microsoft Entra admin center, create a Conditional Access policy.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Correct:

* From the Microsoft 365 Defender portal, enable tamper protection. [Preferred]

* From the Microsoft Intune admin center, create a device compliance policy. [Worse option]

Incorrect:

* From the Microsoft Entra admin center, create a Conditional Access policy.

* From the Microsoft Intune admin center, create an account protection policy.

* From the Microsoft Intune admin center, create an attack surface reduction (ASR) policy.

Note:

From the Microsoft Intune admin center, create an account protection policy.

How do I configure or manage tamper protection?

You can use Microsoft Intune and other methods to configure or manage tamper protection, as listed in the following table:

* Use the Microsoft Defender portal.

Turn tamper protection on (or off), tenant wide.

* Etc.

What is tamper protection?

Tamper protection is a capability in Microsoft Defender for Endpoint that helps protect certain security settings, such as virus and threat protection, from being disabled or changed. During some kinds of cyber attacks, bad actors try to disable security features on devices. Disabling security features provides bad actors with easier access to your data, the ability to install malware, and the ability to exploit your data, identity, and devices. Tamper protection helps guard against these types of activities.

Tamper protection is part of anti-tampering capabilities that include standard protection attack surface reduction rules. Tamper protection is an important part of built-in protection.

What happens when tamper protection is turned on?

When tamper protection is turned on, these tamper-protected settings can’t be changed:

Virus and threat protection remains enabled.

Real-time protection remains turned on.

Behavior monitoring remains turned on.

Antivirus protection, including IOfficeAntivirus (IOAV) remains enabled.

Cloud protection remains enabled.

Security intelligence updates occur.

Automatic actions are taken on detected threats.

Notifications are visible in the Windows Security app on Windows devices.

Archived files are scanned.

* From the Microsoft Intune admin center, create a device compliance policy.

Manage endpoint security policies on devices onboarded to Microsoft Defender for Endpoint

When you use Microsoft Defender for Endpoint, you can deploy endpoint security policies from Microsoft Intune to manage the Defender security settings on the devices you’ve onboarded to Defender without enrolling those devices with Intune. This capability is known as Defender for Endpoint security settings management.

When you manage devices through security settings management:

* You can use the Microsoft Intune admin center or the Microsoft 365 Defender portal to configure policies for endpoint security for Defender for Endpoint and assign those policies to Microsoft Entra ID groups. The Defender portal includes the user interface for device views, policy management, and reports for security settings management.

* Etc.

Configure Intune

In the Microsoft Intune admin center, your account need permissions equal to Endpoint Security Manager built-in Role based access control (RBAC) role.

Question #4

You have an Azure AD tenant named contoso.com.

You have a workgroup computer named Computer1 that runs Windows 11.

You need to add Computer1 to contoso.com.

What should you use?

A . dsregcmd.exe
B . Computer Management
C . netdom.exe
D . the Settings app

Reveal Solution Hide Solution

Question #5

You have 100 computers that run Windows 10 and connect to an Azure Log Analytics workspace.

Which three types of data can you collect from the computers by using Log Analytics? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A . failure events from the Security log
B . the list of processes and their execution times
C . the average processor utilization
D . error events from the System log
E . third-party application logs stored as text files

Reveal Solution Hide Solution

Correct Answer: CDE
CDE

Explanation:

E: The Custom Logs data source for the Log Analytics agent in Azure Monitor allows you to collect events from text files on both Windows and Linux computers. Many applications log information to text files instead of standard logging services, such as Windows Event log or Syslog. After the data is collected, you can either parse it into individual fields in your queries or extract it during collection to individual fields.

D: Collect Windows event log data sources with Log Analytics agent

Windows event logs are one of the most common data sources for Log Analytics agents on Windows virtual machines because many applications write to the Windows event log. You can collect events from standard logs, such as System and Application, and any custom logs created by applications you need to monitor.

C: Summary of data sources

The following table lists the agent data sources that are currently available with the Log Analytics agent. Each agent data source links to an article that provides information for that data source. It also provides information on their method and frequency of collection.

* Performance counters

Performance counters in Windows and Linux provide insight into the performance of hardware components, operating systems, and applications. Azure Monitor can collect performance counters from Log Analytics agents at frequent intervals for near real time analysis. Azure Monitor can also aggregate performance data for longer-term analysis and reporting.

* Etc.

Log queries with performance records

The following table provides different examples of log queries that retrieve performance records. Example, CPU utilization across all computers

Query: Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total" | summarize AVGCPU = avg(CounterValue) by Computer Average

B: The following table lists the objects and counters that you can specify in the configuration file. More counters are available for certain applications.

* Processor, % Processor Time

* Processor, % User Time

* Etc.

Incorrect:

Not A: Not from the Security log.

Important

You can’t configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events.

Reference:

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-custom-logs

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-performance-counters

Question #5

A . failure events from the Security log
B . the list of processes and their execution times
C . the average processor utilization
D . error events from the System log
E . third-party application logs stored as text files

Reveal Solution Hide Solution

Question #5

A . failure events from the Security log
B . the list of processes and their execution times
C . the average processor utilization
D . error events from the System log
E . third-party application logs stored as text files

Reveal Solution Hide Solution

Question #8

DRAG DROP

Your on-premises network contains an Active Directory Domain Services (AD DS) domain.

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains five virtual machines and is NOT connected to the on-premises network.

You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

You purchase Windows 365 Enterprise licenses.

You need to deploy Cloud PC. The solution must meet the following requirements:

• All users must be able to access their Cloud PC at any time without any restrictions.

• The users must be able to connect to the virtual machines on VNet1.

How should you configure the provisioning policy for Windows 365? To answer, drag the appropriate options to the correct settings. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Question #9

HOTSPOT

You have a Microsoft 365 E5 subscription that contains two devices named Device1 and Device2.

You manage the devices by using Microsoft Intune.

You need to use Device query to meet the following requirements:

• Identify the Windows build on a device.

• Validate whether a folder exists on the C drive of a device.

Which table should you target for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Question #10

HOTSPOT

You have a Microsoft 365 subscription.

Users have iOS devices that are not enrolled in Microsoft Intune.

You create an app protection policy for the Microsoft Outlook app as shown in the exhibit. (Click the Exhibit tab.)

You need to configure the policy to meet the following requirements:

Prevent the users from using the Outlook app if the operating system version is less than 12.0.0.

Require the users to use an alphanumeric passcode to access the Outlook app.

What should you configure in an app protection policy for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Exams