MD-102 Managing Identity and Access 3

Question 1

Which Azure AD role has the least privilege to manage Intune device compliance policies?

Accepted Answer

Intune Administrator

Answer

The Intune Administrator role provides the necessary permissions to manage device compliance policies without granting full Global Administrator access.

Question 2

A company needs to allow users to join devices to Azure AD without granting them the ability to manage other users. Which setting controls the maximum number of devices a user can Azure AD join?

Accepted Answer

Device quota per user in Azure AD

Answer

The device quota per user setting in Azure AD > Devices > Device settings controls how many devices each user can Azure AD join.

Question 3

Which authentication strength setting in Azure AD Conditional Access enforces phishing-resistant MFA methods only?

Accepted Answer

Phishing-resistant MFA strength

Answer

The Phishing-resistant MFA strength in Conditional Access restricts authentication to methods immune to phishing, such as FIDO2 keys and Windows Hello for Business.

Question 4

An admin wants to ensure that when a user's risk level is detected as high, their session is blocked. Which Azure AD feature supports this?

Accepted Answer

Conditional Access – User risk policy

Answer

A Conditional Access user risk policy can be configured to block access when Azure AD Identity Protection detects that a user's risk level is high.

Question 5

Which protocol does Windows Hello for Business use for authentication in a key trust deployment?

Accepted Answer

Kerberos

Answer

Windows Hello for Business key trust uses Kerberos for on-premises authentication by leveraging the user's key credential registered in AD.

MD-102 - Endpoint Administrator Exam Practice Test

MD-102 - Endpoint Administrator Exam Practice Test

MD-102 Managing Identity and Access 3