You have a Microsoft 365 tenant that contains the objects shown in the following table.

You are creating a compliance policy named Compliance1.

Which objects can you specify in Compliance1 as additional recipients of noncompliance notifications?

Lösung einblenden Lösung ausblenden

HOTSPOT

You have devices enrolled in Microsoft Intune as shown in the following table.

Intune includes the device compliance policies shown in the following table.

The device compliance policies has the assignments shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Hot Area:

Lösung einblenden Lösung ausblenden

Richtige Antwort:

Explanation:

Box 1: No

Device1 is in Group1. Policy1 is assigned to Group1. Policy2 is also assigned to Group1. Device1 is compliant to Policy1, but not compliant to Policy2 (fails on Secure Boot).

By default, each device compliance policy includes the action to mark a device as noncompliant if it fails to meet a policy rule.

Box 2: Yes

Device2 is in Group2.  Policy2 is assigned to Group2.  Device2 is compliant to Policy2 (Secure boot met).

Box 3: Yes

Device3 is in Group 3. Policy3 and Policy4 are assigned to Group3. Policy3 is for Windows 10 so it is disregarded. Device3 is compliant to Policy4.

Reference: https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

Device1, Device2, and Device3

Lösung einblenden Lösung ausblenden

HOTSPOT

You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.

The subscription contains the dynamic device groups shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Hot Area:

Lösung einblenden Lösung ausblenden

Richtige Antwort:

Explanation:

Device1 is a member of Group1 only:

No. Device1 is Microsoft Entra hybrid joined, not AzureAD joined (which is required for Group1 membership). Therefore, Device1 is not a member of Group1.

Device2 is a member of Group1 and Group2:

Yes. Device2 is Microsoft Entra joined, so it meets the AzureAD trust type condition for Group1. It does not meet the conditions for Group2 because it is not Workplace (Microsoft Entra registered), so it’s a member of Group1 only.

Device3 is a member of Group2 only:

Yes. Device3 is Microsoft Entra registered, which aligns with the Workplace trust type condition required for Group2 membership.

You need to assign the same deployment profile to all the computers that are configured by using Windows Autopilot.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Lösung einblenden Lösung ausblenden

You have a Microsoft Entra tenant named contoso.com.

You need to ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to contoso.com.

What should you configure?

Lösung einblenden Lösung ausblenden

You have a Microsoft Entra tenant named contoso.com.

You need to ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to contoso.com.

What should you configure?

Lösung einblenden Lösung ausblenden

You have a Microsoft Entra tenant named contoso.com.

You need to ensure that users are not added automatically to the local Administrators group when they join their Windows 11 device to contoso.com.

What should you configure?

Lösung einblenden Lösung ausblenden

You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Azure AD joined and are enrolled in Microsoft Intune.

You plan to manage Microsoft Defender Antivirus on the computers. You need to prevent users from disabling Microsoft Defender Antivirus.

What should you do?

* From the Microsoft Intune admin center, create a security baseline.

* From the Microsoft 365 Defender portal, enable tamper protection.

* From the Microsoft Intune admin center, create an account protection policy.

* From the Microsoft Intune admin center, create an endpoint detection and response (EDR) policy.

Lösung einblenden Lösung ausblenden

Your network contains an on-premises Active Directory domain and an Azure AD tenant.

The Default Domain Policy Group Policy Object (GPO) contains the settings shown in the following table.

You need to migrate the existing Default Domain Policy GPO settings to a device configuration profile.

Which device configuration profile type template should you use?

Lösung einblenden Lösung ausblenden