MD-102 Prepare infrastructure for devices — 10 Questions

Question 1

Users have iOS/iPadOS devices enrolled in Intune. You need to ensure that corporate data in managed apps is encrypted at rest. What should you configure?

Accepted Answer

App protection policy for iOS/iPadOS. App protection policies (APP) in Intune provide the ability to encrypt corporate data at rest within managed apps on iOS/iPadOS devices, regardless of whether the device itself is managed or enrolled. This encryption is enforced at the application layer using AES-256, ensuring that data stored by the app is protected even if the device is compromised or unenrolled. Option C is correct because APP policies are the specific mechanism for data-level encryption in managed apps, not device-level settings.

Answer

iOS native encryption feature

Answer

Compliance policy for iOS/iPadOS

Answer

Device configuration profile with encryption settings

Question 2

Refer to the exhibit. You are configuring a device compliance policy in Microsoft Intune for Windows devices. Based on the JSON configuration, what will happen if a device does not have a password set?

Accepted Answer

The device will be marked non-compliant and after 24 hours access will be blocked, then retired after 72 hours. The JSON configuration defines a grace period of 24 hours for non-compliance due to missing password, after which access is blocked, and a 72-hour period after which the device is retired. The device is marked non-compliant immediately when no password is set, but the actions (block access, retire) are scheduled based on these grace periods, not executed instantly.

Answer

The device will be marked non-compliant but no action is taken until the grace period expires

Answer

The device will be retired immediately because password is not set

Answer

The device will be immediately blocked from accessing corporate resources

Question 3

Refer to the exhibit. A PowerShell command is used to create a device category in Microsoft Intune. After running the command, you want to automatically assign devices to this category based on their Azure AD group membership. How should you configure this?

Accepted Answer

Map an Azure AD group to the Intune device category in the Intune console.. Intune provides a built-in capability to map an Azure AD group to a device category. Once a device category is created (e.g., via PowerShell), you can configure automatic assignment by navigating to Devices > Categories in the Intune console, selecting 'Map Azure AD groups' or similar, and specifying the group. Devices in that group are automatically assigned to the category. This is the direct configuration step, while Option A (creating a dynamic group) is a prerequisite but not the assignment step itself.

Answer

Create a dynamic device group in Azure AD that includes devices based on rules, then use that group to assign category via Intune.

Answer

Use a device configuration profile to set the device category.

Answer

Create a PowerShell script that runs daily to assign devices to the category based on group membership.

Question 4

You are planning the enrollment of 500 Android Enterprise personally-owned work profile devices. Management requires that users must not be able to remove the work profile from their device. Which enrollment method should you use?

Accepted Answer

Android Enterprise corporate-owned work profile. To prevent users from removing the work profile, the device must be corporate-owned. Android Enterprise corporate-owned work profile allows IT to manage a work profile on a corporate-owned device while still allowing personal use, and IT can enforce policies that prevent removal of the work profile. Dedicated devices (option A) are for corporate-owned kiosk devices and do not have a work profile; fully managed devices (option C) take over the entire device, not just a work profile; personally-owned work profile (option D) allows the user to remove the work profile.

Answer

Android Enterprise dedicated devices

Answer

Android Enterprise fully managed

Answer

Android Enterprise personally-owned work profile

Question 5

You are troubleshooting a Windows 10 device that fails to install a required application from Microsoft Intune. The device shows the application as 'Enforced' but never installs. The application is a line-of-business (LOB) app. What should you check first?

Accepted Answer

Check if the application package has a valid code signing certificate.. For a line-of-business (LOB) app in Intune, a valid code signing certificate is required to ensure the app can be trusted and deployed. The most common reason an LOB app fails to install despite being enforced is a missing or invalid code signing certificate. Option A is incorrect because 'Required' intent is for user groups, not device groups; LOB apps can be assigned to device groups with 'Required' intent, so this is not the first check. Option B is incorrect because the Intune Management Extension is used for Win32 apps, not for LOB apps; LOB apps use a different deployment mechanism. Option D is incorrect because LOB apps are uploaded directly to Intune, not from the Microsoft Store for Business.

Answer

Ensure the app is assigned to a device group using 'Required' intent.

Answer

Verify that the Intune Management Extension is installed on the device.

Answer

Check if the app is available in the Microsoft Store for Business.

Question 6

You are troubleshooting an issue where users report that they cannot install required line-of-business (LOB) apps from Microsoft Intune Company Portal on their Windows 10 devices. The apps are assigned as 'Required' to a dynamic device group. You verify that the devices are enrolled and compliant. What is the most likely cause of the failure?

Accepted Answer

The dynamic device group is not updating membership correctly.. For required LOB apps assigned to a dynamic device group, the device must be a member of the group to receive the app assignment. If the dynamic group membership is not updating correctly, the device may be excluded, and the app will not be pushed or become available in Company Portal. Despite enrollment and compliance, without correct group membership, the app cannot be installed. Option C is incorrect because Intune installs required apps using the system account, so local administrator privileges are not necessary for the installation itself.

Answer

The apps are not published in the Company Portal.

Answer

The user is not a local administrator on the device.

Answer

The enrollment restrictions block installation of LOB apps.

Question 7

You need to configure device compliance policies in Microsoft Intune for Windows 10 devices. Which THREE settings can you include in a compliance policy? (Choose three.)

Accepted Answer

Require BitLocker.. In Microsoft Intune, compliance policies for Windows 10 devices include settings for device health, system security, and OS version. Specifically, 'Require BitLocker' (A) ensures OS drive encryption, 'Maximum OS version' (B) prevents devices from exceeding a specified version, and 'Minimum OS version' (E) ensures devices meet a baseline version. 'Allow camera' (C) is a device configuration profile setting, not a compliance policy. 'Require a password to unlock the device' (D) applies to mobile platforms like iOS/Android, not Windows 10.

Answer

Allow camera.

Answer

Require a password to unlock the device.

Question 8

You have deployed the above compliance policy in Microsoft Intune. A Windows 10 device running version 10.0.19042.0 is marked as noncompliant. You verify that the device meets all password, encryption, firewall, and Defender requirements. What is the most likely reason for noncompliance?

Accepted Answer

The device is running a version higher than the maximum OS version.. The compliance policy includes a maximum OS version rule set to a value lower than 10.0.19042.0. Since the device is running version 10.0.19042.0, which exceeds that maximum, it is marked as noncompliant even though it meets all other requirements. In Intune, OS version rules are evaluated as strict comparisons, so exceeding the maximum triggers noncompliance regardless of other settings.

Answer

The device is running a version lower than the minimum OS version.

Answer

The device's antivirus software is not Microsoft Defender.

Answer

The device does not have a TPM 2.0 chip.

Question 9

Your organization is planning to use Microsoft Intune for Windows device management. Which TWO components are required for a successful Windows Autopilot deployment?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is required for Windows Autopilot because it provides the identity and device registration infrastructure. Autopilot uses Entra ID to associate a device with its hardware hash (via the OEM or partner portal) and to authenticate the user during the out-of-box experience (OOBE). Without Entra ID, the device cannot be recognized as an Autopilot device and cannot join the cloud domain.

Answer

Microsoft Endpoint Manager (MDM authority)

Answer

Windows Server Active Directory

Answer

Microsoft Configuration Manager

Question 10

You need to enroll macOS devices into Microsoft Intune. What is the required enrollment method?

Accepted Answer

Company Portal app. The Company Portal app is the required enrollment method for macOS devices when using user-driven enrollment with Intune. It allows users to authenticate, download management profiles, and register their device via the Intune Company Portal, which is the standard approach for bring-your-own-device (BYOD) scenarios or when automated enrollment is not configured.

Answer

Device Enrollment Manager (DEM)

Answer

Apple Automated Device Enrollment (ADE)

Answer

Apple Configurator