Correct Answer: B

To enable security defaults (or confirm they're already enabled)

Important

You must be a Security Administrator, Conditional Access administrator, or Global Administrator to perform this task.

Note: Turn on multi-factor authentication

Multi-factor authentication (MFA) is a very important first step in securing your organization. Microsoft 365 Business Premium includes the option to use security defaults or Conditional Access policies to turn on MFA for your admins and user

accounts. For most organizations, security defaults offer a good level of sign-in security. But if your organization must meet more stringent requirements, you can use Conditional Access policies instead.

This article provides information about:

Security defaults (suitable for most businesses)

Conditional Access (for businesses with more stringent security requirements)

Reference:

https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-turn-on-mfa?

Correct Answer: D

https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policies-monitor#view-the-app-protection-status-report

Correct Answer: E

References: https://docs.microsoft.com/en-us/microsoft-store/distribute-apps-from-your-private-store

Enable the users in the MKG department to use App1.

The private store is a feature in Microsoft Store for Business and Education that organizations receive during the signup process. When admins add apps to the private store, all employees in the organization can view and download the apps.

Your private store is available as a tab in Microsoft Store app, and is usually named for your company or organization. Only apps with online licenses can be added to the private store.

Reference:

https://docs.microsoft.com/en-us/microsoft-store/distribute-apps-from-your-private-store

Correct Answer:

Box 1: Co-management

Existing Windows 11 devices managed by using Configuration Manager

Co-management enrollment

If you use Configuration Manager, and want to continue to use Configuration Manager, then co-management enrollment is for you. Co-management manages Windows 10/11 devices using Configuration Manager and Microsoft Intune

together. You cloud-attach your existing Configuration Manager environment to Intune. This enrollment option runs some workloads in Configuration Manager, and other workloads in Intune.

Box 2: User enrollment

Personal iOS devices

BYOD: User and Device enrollment

These iOS/iPadOS devices are personal or BYOD (bring your own device) devices that can access organization email, apps, and other data. Starting with iOS 13 and newer, this enrollment option targets users or targets devices. It doesn't

require resetting the devices.

Note: Enroll iOS and iPadOS devices in Microsoft Intune

Personal and organization-owned devices can be enrolled in Intune. Once they're enrolled, they receive the policies and profiles you create. You have the following options when enrolling iOS/iPadOS devices:

Automated device enrollment (ADE)

Apple Configurator

BYOD: User and Device enrollment

Incorrect:

*

Automated Device Enrollment Automated Device Enrollment (ADE) (supervised) Previously called Apple Device Enrollment Program (DEP). Use on devices owned by your organization. This option configures settings using Apple Business Manager (ABM) or Apple School Manager (ASM). It enrolls a large number of devices, without you ever touching the devices. These devices are purchased from Apple, have your preconfigured settings, and can be shipped directly to users or schools. You create an enrollment profile in the Intune admin center, and push this profile to the devices.

*

Apple Configurator Apple Configurator enrollment Use on devices owned by your organization, and includes Direct Enrollment. This option requires you to physically connect iOS/iPadOS devices to a Mac computer using the USB port.

Reference: https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-windows https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-ios-ipados

Correct Answer:

Box 1: No

Policy3, which requires encryption, applies to Device1.

Box 2: Yes

Policy1, which has no encryption requirement, applies to Device3.

Box 3: Yes

Policy2, which has no encryption requirement, applies to Device4.