Practice Free MD-102 Exam Online Questions

Explanation:

Box 1: Microsoft Defender Firewall

Block users from transferring files over FTP.

Microsoft Defender Firewall settings include MdmStore/Global/DisableStatefulFtp, which could be used to disable stateful FTP.

Box 2: Microsoft Defender Exploit Guard

Prevent Microsoft Office applications from launching child processes.

Attack surface reduction rules in the Microsoft Defender.

These rules include: Block all Office applications from creating child processes

Note: Attack surface reduction rule merge behavior is as follows:

Attack surface reduction rules from the following profiles are evaluated for each device the rules apply to: Devices > Configuration policy > Endpoint protection profile > *Microsoft Defender Exploit Guard* > Attack Surface Reduction

Endpoint security > Attack surface reduction policy > Attack surface reduction rules

Endpoint security > Security baselines > Microsoft Defender for Endpoint Baseline > Attack Surface Reduction Rules.

Reference: https://docs.microsoft.com/en-us/intune/endpoint-protection-windows-10

Explanation:

Step 1: Create a compliance policy.

Configure actions for noncompliant devices in Intune

As part of a compliance policy that protects your organizations resources from devices that don’t meet your security requirements, compliance policies also include Actions for noncompliance. Actions for noncompliance are one or more time- ordered actions that are taken by a policy to help protect devices and your organization. As an example, an action for noncompliance can remotely lock a device to ensure it’s protected, or send a notification to devices or users to help them understand and resolve the noncompliant status.

Available actions for noncompliance

Following are the available actions for noncompliance:

* Mark device non-compliant

*-> Send email to end user: This action sends an email notification to the user. When you enable this action:

– Select a Notification message template that this action sends. You Create a notification message template before you can assign one to this action. When you create the custom notification, you customize the message locale, subject, message body, and can include the company logo, company name, and other contact information.

– Choose to send the message to more recipients by selecting one or more of your Microsoft Entra groups. * Etc.

Step 2: From Compliance policies, create a notification message template.

Reference: https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance

Explanation:

Box 1: Configuration profile

Create a trusted certificate profile.

Box 2: Trusted certificate

When using Intune to provision devices with certificates to access your corporate resources and network, use a trusted certificate profile to deploy the trusted root certificate to those devices. Trusted root certificates establish a trust from the device to your root or intermediate (issuing) CA from which the other certificates are issued.

Reference: https://docs.microsoft.com/en-us/mem/intune/protect/certificates-trusted-root

Explanation:

Box 1: Image1, Image2, Image3, Image4, and Image5.

All images.

Standard Client Task Sequence

Standard Client task sequence. The most frequently used task sequence. Used for creating reference images and for deploying clients in production.

Box 2: Image1, Image2, Image3, and Image4 only.

Exclude image5 with applications.

Standard Client Upgrade Task Sequence

Standard Client Upgrade task sequence. A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers.

Reference: https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit

Explanation:

Deploy: Microsoft Tunnel Gateway

Device types: Android and iOS only

To implement Microsoft Tunnel for Mobile Application Management (MAM) and provide access to on-premises company apps, here’s what you need to do:

What to deploy first: The correct answer is Microsoft Tunnel Gateway. This is the core component that enables secure connections from mobile devices to your on-premises network. Microsoft Tunnel Gateway is deployed on-premises and provides a VPN-like experience for MAM-enabled devices.

Device types that can use Tunnel for MAM: The correct answer is Android and iOS only. Microsoft Tunnel for MAM is specifically designed for mobile platforms (Android and iOS) and does not apply to Windows devices.

Explanation:

Deploy: Microsoft Tunnel Gateway

Device types: Android and iOS only

To implement Microsoft Tunnel for Mobile Application Management (MAM) and provide access to on-premises company apps, here’s what you need to do:

What to deploy first: The correct answer is Microsoft Tunnel Gateway. This is the core component that enables secure connections from mobile devices to your on-premises network. Microsoft Tunnel Gateway is deployed on-premises and provides a VPN-like experience for MAM-enabled devices.

Device types that can use Tunnel for MAM: The correct answer is Android and iOS only. Microsoft Tunnel for MAM is specifically designed for mobile platforms (Android and iOS) and does not apply to Windows devices.

Explanation:

First dropdown: device.deviceTrustType

Second dropdown: "Workplace"

To configure the dynamic membership rule for Group1 to include only Windows devices that are Microsoft Entra registered, you would use the following logic:

The OS type should be "Windows."

The deviceTrustType should be set to "Workplace," which indicates that the device is Microsoft Entra registered (as opposed to "AzureAd," which would indicate Microsoft Entra joined).