You have a Microsot Entra tenant named contoso.com.

You have a workgroup computer named Computer1 that runs Windows 11.

You need to add Computer1 to contoso.com.

What should you use?

Lösung einblenden Lösung ausblenden

You have computers that run Windows 11 Pro. The computers are joined to Microsoft Entra and enrolled in Microsoft Intune.

You need to upgrade the computers to Windows 11 Enterprise.

What should you configure in Intune?

Lösung einblenden Lösung ausblenden

HOTSPOT

You have the MDM Security Baseline profile shown in the MDM exhibit. (Click the MDM tab.)

You have the ASR Endpoint Security profile shown in the ASR exhibit. (Click the ASR tab.)

You plan to deploy both profiles to devices enrolled in Microsoft Intune.

You need to identify how the following settings will be configured on the devices:

Block Office applications from creating executable content Block Win32 API calls from Office macro

Currently, the settings are disabled locally on each device.

What are the effective settings on the devices? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Hot Area:

Lösung einblenden Lösung ausblenden

Richtige Antwort:

Explanation:

Box 1: Audit mode

According to the ASR Endpoint Security profile and to the MDM Security Baseline profile, Block Office applications from creating executable content is set to Audit mode.

Box 2: Disable

Block Win32 API calls from Office macro: According to MDM Security Baseline profile it is set to disable.

According to the ASR Endpoint Security profile it is set to Audit mode.

The profiles are merged. The Baseline profile overrides the Endpoint Security profile.

Note:

When two or more policies have conflicting settings, the conflicting settings are not added to the combined policy, while settings that don’t conflict are added to the superset policy that applies to a device.

Attack surface reduction rule merge behavior is as follows:

Endpoint security > Security baselines > Microsoft Defender for Endpoint Baseline > Attack Surface Reduction Rules.

MDM Security Baseline profile ASR Endpoint Security profile.

Reference: https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-asr-policy

HOTSPOT

All users have Microsoft 365 apps deployed.

You need to configure Microsoft 365 apps to meet the following requirements:

E. Enable the automatic installation of WebView2 Runtime.

F. Prevent users from submitting feedback.

Which two settings should you configure in the Microsoft 365 Apps admin center? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

Hot Area:

Lösung einblenden Lösung ausblenden

Richtige Antwort:

Explanation:

Box 1: Device Configuration

Enable the automatic installation of WebView2 Runtime.

To prevent (or enable) the automatic installation of WebView2 Runtime, sign in to the Microsoft 365 Apps admin center (https://config.office.com) with an admin account. Then, go to Customization > Device Configuration > Modern Apps Settings. Select Microsoft Edge WebView2 and then clear the Enable automatic installation of WebView2 Runtime check box.

Box 2: Policy Management

Prevent users from submitting feedback.

New policy settings available to control the feedback users can send to Microsoft

When creating a new policy configuration, search for ‘feedback’ to see four of the five new policies.

Reference: https://learn.microsoft.com/en-us/deployoffice/webview2-install

https://m365admin.handsontek.net/new-policy-settings-available-to-control-the-feedback-users-can-send-

to-microsoft/

a device configuration profile based on the Device restrictions template

Lösung einblenden Lösung ausblenden

a device configuration profile based on the Device restrictions template

Lösung einblenden Lösung ausblenden

You have a Microsoft 365 subscription and use Microsoft Intune Suite.

The subscription contains devices enrolled in Intune as shown in the following table.

Which devices support Device query?

E. Device1 only

F. Device2 only

G. Device1 and Device2 only

H. Device1, Device2, Device3, and Device4

Lösung einblenden Lösung ausblenden

You have a Microsoft 365 subscription and use Microsoft Intune Suite.

The subscription contains devices enrolled in Intune as shown in the following table.

Which devices support Device query?

E. Device1 only

F. Device2 only

G. Device1 and Device2 only

H. Device1, Device2, Device3, and Device4

Lösung einblenden Lösung ausblenden

You have a Microsoft 365 subscription and use Microsoft Intune Suite.

The subscription contains devices enrolled in Intune as shown in the following table.

Which devices support Device query?

E. Device1 only

F. Device2 only

G. Device1 and Device2 only

H. Device1, Device2, Device3, and Device4

Lösung einblenden Lösung ausblenden

HOTSPOT

You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

You use Microsoft Intune to manage devices.

You need to configure an update ring that meets the following requirements:

Fixes and improvements to existing Windows functionality can be deferred for 14 days but will install automatically seven days after that date.

The installation of new Windows features can be deferred for 90 days but will install automatically 10 days after that date.

Devices must restart automatically three days after an update is installed.

How should you configure the update ring? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Hot Area:

Lösung einblenden Lösung ausblenden

Richtige Antwort:

Explanation:

Box 1: 90

Feature update deferral period

The installation of new Windows features can be deferred for *90 days* but will install automatically 10 days after that date.

Box 2: 14

Quality update deferral period

Fixes and improvements to existing Windows functionality can be deferred for *14 days* but will install automatically seven days after that date.

Box 3: 10

Deadline for feature updates

The installation of new Windows features can be deferred for 90 days but will install automatically *10 days* after that date.

Note: Use deadline settings

Deadline for quality updates

Default: Not configured

Windows Update CSP: Update/ConfigureDeadlineForQualityUpdates

Specifies the number of days a user has before quality updates are installed on their devices automatically (2-30).

Box 4: 7

Grace period

Fixes and improvements to existing Windows functionality can be deferred for 14 days but will install automatically *seven days* after that date.

Note: Grace period

Default: Not configured Windows Update CSP: Update/ConfigureDeadlineGracePeriod

Specifies a minimum number of days after deadline until restarts occur automatically (0-7).

Reference: https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-settings