Exam MS-101 All Questions

View all questions & answers for the MS-101 exam

Exam MS-101 topic 3 question 145 discussion

Actual exam question from Microsoft's MS-101

Question #: 145
Topic #: 3

HOTSPOT
-

You have a Microsoft 365 E5 tenant that uses Microsoft Endpoint Manager.

You have Windows 10 devices enrolled in Microsoft Endpoint Manager.

You need to perform the following actions on the devices:

• Configure Windows Hello for Business.
• Deploy a root certification authority (CA) certificate.

Which type of Microsoft Endpoint Manager configuration profile should you use for each action? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by StudyBM at Jan. 4, 2023, 3:56 p.m.

Comments

Submit Cancel

StudyBM

Highly Voted 2 years, 5 months ago

Correct answers are: Azure ad identity protection and Trusted certificate

upvoted 12 times

DutchChaos

2 years, 5 months ago

I agree, just checked it in my test tenant

upvoted 4 times

emanresu

2 years, 5 months ago

Not sure what you guys are talking about Correct answer is Administrative Templates for the first question https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-manage-in-organization Second is correct answer Trusted certificate https://learn.microsoft.com/en-us/mem/intune/protect/certificates-configure

upvoted 7 times

Ludosan

2 years, 5 months ago

I agree with StudyBM and DutchChaos. Device configuration profile template in Endepoint Manager to activate Windows Hello is Identity Protection.

upvoted 2 times

Fala_Fel

2 years, 5 months ago

Agree with Ludosan - Windows Hello is set in Configuration Profiles > Templates > Identity Protection The wording in the question makes it debatable which answer is 100% - Administrative 'Templates' - Azure AD 'Identity Protection' Both are a bit wrong and a bit right. I'm going for whatever says 'Identity Protection'

upvoted 2 times

AdcomMolde

2 years, 4 months ago

Please disregard my comment below. I mixed up Endpoint Protection and Endpoint Manager.

upvoted 1 times

...

Load full discussion...

...

Amir1909

Most Recent 1 year, 4 months ago

- Identity Protection - Trusted certificate

upvoted 1 times

...

NitishKarmakar

1 year, 9 months ago

1. The questions states "You have Windows 10 devices enrolled in Microsoft Endpoint Manager." No OnPrem based GPO management is mentioned in the question so no point assuming that. So Intune would be our best bet. Windows Hello can be set from Intune> Configuration Profiles > Templates > Identity Protection 2. Trusted certificate can be set from Intune> Configuration Profiles > Templates > Trusted Certificate "The trusted root certificate establishes a trust from the device to your root or intermediate (issuing) CA from which the other certificates are issued. To deploy this certificate, you use the trusted certificate profile, and deploy it to the same devices and users that receive the certificate profiles for SCEP, PKCS, and imported PKCS." https://learn.microsoft.com/en-us/mem/intune/protect/certificates-configure

upvoted 1 times

...

Ayham_J

2 years, 3 months ago

Azure AD identity protection

upvoted 1 times

...

Kees1990

2 years, 3 months ago

when you go into ENDPOINT manager and select DEVICES, configuration profiles, you have the option to create one from a "template" or from scratch, if you choose template then you have the option "identity protection" -> hello for business. so the answer is Template.

upvoted 2 times

Kees1990

2 years, 3 months ago

template is called "identity protection"

upvoted 2 times

...

shaden2000

2 years, 5 months ago

Scratch PKCS Certifacte it should be trusted certificate: https://learn.microsoft.com/en-us/mem/intune/protect/certificates-configure "Trusted certificate Use to deploy the public key (certificate) from a root CA or intermediary CA to users and devices to establish a trust back to the source CA. Other certificate profiles require the trusted certificate profile and its root certificate."

upvoted 2 times

...

shaden2000

2 years, 5 months ago

Its a bit vague. But I use the Windows Configuration Profile > TEMPLATES (for windows 10 and later) > Identity protection. So: Administrative Teamplates PKCS Certificate

upvoted 2 times

Fala_Fel

2 years, 5 months ago

BUT after selecting Templates you can then choose either: Administrative Templates OR Identity Protection. Windows Hello settings are only in Templates > Identity Protection. Therefore I will go for Azure AD Identity Protection (hoping that 'Azure AD' is not in the actual exam wording' If just 'Templates' is a choice, I'll go for that.

upvoted 2 times

...

KennethYY

2 years, 5 months ago

in the intune, you could create configuration profile, For WIndows hello, you can set in the Identity protection

upvoted 2 times

...