MD-102 Prepare infrastructure for devices — 20 Questions

Question 1

Users have iOS/iPadOS devices enrolled in Intune. You need to ensure that corporate data in managed apps is encrypted at rest. What should you configure?

Accepted Answer

App protection policy for iOS/iPadOS. App protection policies (APP) in Intune provide the ability to encrypt corporate data at rest within managed apps on iOS/iPadOS devices, regardless of whether the device itself is managed or enrolled. This encryption is enforced at the application layer using AES-256, ensuring that data stored by the app is protected even if the device is compromised or unenrolled. Option C is correct because APP policies are the specific mechanism for data-level encryption in managed apps, not device-level settings.

Answer

iOS native encryption feature

Answer

Compliance policy for iOS/iPadOS

Answer

Device configuration profile with encryption settings

Question 2

Refer to the exhibit. You are configuring a device compliance policy in Microsoft Intune for Windows devices. Based on the JSON configuration, what will happen if a device does not have a password set?

Accepted Answer

The device will be marked non-compliant and after 24 hours access will be blocked, then retired after 72 hours. The JSON configuration defines a grace period of 24 hours for non-compliance due to missing password, after which access is blocked, and a 72-hour period after which the device is retired. The device is marked non-compliant immediately when no password is set, but the actions (block access, retire) are scheduled based on these grace periods, not executed instantly.

Answer

The device will be marked non-compliant but no action is taken until the grace period expires

Answer

The device will be retired immediately because password is not set

Answer

The device will be immediately blocked from accessing corporate resources

Question 3

Refer to the exhibit. A PowerShell command is used to create a device category in Microsoft Intune. After running the command, you want to automatically assign devices to this category based on their Azure AD group membership. How should you configure this?

Accepted Answer

Map an Azure AD group to the Intune device category in the Intune console.. Intune provides a built-in capability to map an Azure AD group to a device category. Once a device category is created (e.g., via PowerShell), you can configure automatic assignment by navigating to Devices > Categories in the Intune console, selecting 'Map Azure AD groups' or similar, and specifying the group. Devices in that group are automatically assigned to the category. This is the direct configuration step, while Option A (creating a dynamic group) is a prerequisite but not the assignment step itself.

Answer

Create a dynamic device group in Azure AD that includes devices based on rules, then use that group to assign category via Intune.

Answer

Use a device configuration profile to set the device category.

Answer

Create a PowerShell script that runs daily to assign devices to the category based on group membership.

Question 4

You are planning the enrollment of 500 Android Enterprise personally-owned work profile devices. Management requires that users must not be able to remove the work profile from their device. Which enrollment method should you use?

Accepted Answer

Android Enterprise corporate-owned work profile. To prevent users from removing the work profile, the device must be corporate-owned. Android Enterprise corporate-owned work profile allows IT to manage a work profile on a corporate-owned device while still allowing personal use, and IT can enforce policies that prevent removal of the work profile. Dedicated devices (option A) are for corporate-owned kiosk devices and do not have a work profile; fully managed devices (option C) take over the entire device, not just a work profile; personally-owned work profile (option D) allows the user to remove the work profile.

Answer

Android Enterprise dedicated devices

Answer

Android Enterprise fully managed

Answer

Android Enterprise personally-owned work profile

Question 5

You are troubleshooting a Windows 10 device that fails to install a required application from Microsoft Intune. The device shows the application as 'Enforced' but never installs. The application is a line-of-business (LOB) app. What should you check first?

Accepted Answer

Check if the application package has a valid code signing certificate.. For a line-of-business (LOB) app in Intune, a valid code signing certificate is required to ensure the app can be trusted and deployed. The most common reason an LOB app fails to install despite being enforced is a missing or invalid code signing certificate. Option A is incorrect because 'Required' intent is for user groups, not device groups; LOB apps can be assigned to device groups with 'Required' intent, so this is not the first check. Option B is incorrect because the Intune Management Extension is used for Win32 apps, not for LOB apps; LOB apps use a different deployment mechanism. Option D is incorrect because LOB apps are uploaded directly to Intune, not from the Microsoft Store for Business.

Answer

Ensure the app is assigned to a device group using 'Required' intent.

Answer

Verify that the Intune Management Extension is installed on the device.

Answer

Check if the app is available in the Microsoft Store for Business.

Question 6

You are troubleshooting an issue where users report that they cannot install required line-of-business (LOB) apps from Microsoft Intune Company Portal on their Windows 10 devices. The apps are assigned as 'Required' to a dynamic device group. You verify that the devices are enrolled and compliant. What is the most likely cause of the failure?

Accepted Answer

The dynamic device group is not updating membership correctly.. For required LOB apps assigned to a dynamic device group, the device must be a member of the group to receive the app assignment. If the dynamic group membership is not updating correctly, the device may be excluded, and the app will not be pushed or become available in Company Portal. Despite enrollment and compliance, without correct group membership, the app cannot be installed. Option C is incorrect because Intune installs required apps using the system account, so local administrator privileges are not necessary for the installation itself.

Answer

The apps are not published in the Company Portal.

Answer

The user is not a local administrator on the device.

Answer

The enrollment restrictions block installation of LOB apps.

Question 7

You need to configure device compliance policies in Microsoft Intune for Windows 10 devices. Which THREE settings can you include in a compliance policy? (Choose three.)

Accepted Answer

Require BitLocker.. In Microsoft Intune, compliance policies for Windows 10 devices include settings for device health, system security, and OS version. Specifically, 'Require BitLocker' (A) ensures OS drive encryption, 'Maximum OS version' (B) prevents devices from exceeding a specified version, and 'Minimum OS version' (E) ensures devices meet a baseline version. 'Allow camera' (C) is a device configuration profile setting, not a compliance policy. 'Require a password to unlock the device' (D) applies to mobile platforms like iOS/Android, not Windows 10.

Answer

Allow camera.

Answer

Require a password to unlock the device.

Question 8

You have deployed the above compliance policy in Microsoft Intune. A Windows 10 device running version 10.0.19042.0 is marked as noncompliant. You verify that the device meets all password, encryption, firewall, and Defender requirements. What is the most likely reason for noncompliance?

Accepted Answer

The device is running a version higher than the maximum OS version.. The compliance policy includes a maximum OS version rule set to a value lower than 10.0.19042.0. Since the device is running version 10.0.19042.0, which exceeds that maximum, it is marked as noncompliant even though it meets all other requirements. In Intune, OS version rules are evaluated as strict comparisons, so exceeding the maximum triggers noncompliance regardless of other settings.

Answer

The device is running a version lower than the minimum OS version.

Answer

The device's antivirus software is not Microsoft Defender.

Answer

The device does not have a TPM 2.0 chip.

Question 9

Your organization is planning to use Microsoft Intune for Windows device management. Which TWO components are required for a successful Windows Autopilot deployment?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is required for Windows Autopilot because it provides the identity and device registration infrastructure. Autopilot uses Entra ID to associate a device with its hardware hash (via the OEM or partner portal) and to authenticate the user during the out-of-box experience (OOBE). Without Entra ID, the device cannot be recognized as an Autopilot device and cannot join the cloud domain.

Answer

Microsoft Endpoint Manager (MDM authority)

Answer

Windows Server Active Directory

Answer

Microsoft Configuration Manager

Question 10

You need to enroll macOS devices into Microsoft Intune. What is the required enrollment method?

Accepted Answer

Company Portal app. The Company Portal app is the required enrollment method for macOS devices when using user-driven enrollment with Intune. It allows users to authenticate, download management profiles, and register their device via the Intune Company Portal, which is the standard approach for bring-your-own-device (BYOD) scenarios or when automated enrollment is not configured.

Answer

Device Enrollment Manager (DEM)

Answer

Apple Automated Device Enrollment (ADE)

Answer

Apple Configurator

Question 11

You are the endpoint administrator for Contoso Ltd., a multinational company with 10,000 Windows 10 and 11 devices managed by Microsoft Intune. The company recently acquired a subsidiary that uses on-premises Active Directory and Configuration Manager. The subsidiary's devices are not joined to Microsoft Entra ID. Your goal is to migrate these devices to cloud management with Intune within six months. The subsidiary has 2,000 devices, all running Windows 10. The devices are currently domain-joined and managed by ConfigMgr. You need to choose the most efficient migration strategy that minimizes user disruption and leverages existing investments. The subsidiary has a high-speed WAN link to the corporate network. You have the following options: A) Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune. B) Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join. C) Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps. D) Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning. Which option should you choose?

Accepted Answer

Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join.. Co-management allows you to gradually transition Configuration Manager workloads to Intune without disrupting existing management, leveraging the existing ConfigMgr infrastructure and high-speed WAN link. This minimizes user disruption by keeping devices domain-joined initially, then switching to Entra ID join after workloads are migrated, which is the most efficient path for 2,000 existing domain-joined devices.

Answer

Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune.

Answer

Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps.

Answer

Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning.

Question 12

You are the endpoint administrator for a healthcare organization that uses Intune to manage 500 iOS devices used by clinicians. The devices are enrolled as corporate-owned, user-approved devices via Apple Business Manager (ABM). You need to deploy a new custom electronic health record (EHR) app that is not in the App Store. The app is distributed as an .ipa file signed with an enterprise certificate. The app must be installed silently without user interaction. The devices are supervised and managed with iOS MDM. You have the following options: A) Deploy the app as an iOS LOB app in Intune and assign to device groups. B) Deploy the app as a Volume Purchase Program (VPP) app. C) Use Apple Configurator to sideload the app via USB. D) Distribute the app via a web link to the .ipa hosted on a public CDN. Which option should you choose?

Accepted Answer

Deploy the app as an iOS LOB app in Intune and assign to device groups.. Intune LOB app deployment on supervised devices allows silent installation of enterprise-signed .ipa files by automatically trusting the enterprise certificate via MDM. No user interaction is required. Option C (Apple Configurator) requires physical USB connection and manual trust acceptance, making it non-silent. Option B (VPP) only applies to App Store apps. Option D relies on user-initiated download and installation, also not silent.

Answer

Deploy the app as a Volume Purchase Program (VPP) app.

Answer

Use Apple Configurator to sideload the app via USB.

Answer

Distribute the app via a web link to the .ipa hosted on a public CDN.

Question 13

You need to prepare on-premises Windows devices for a migration to Microsoft Intune. Which tool should you use to generate a configuration package that can be deployed via Group Policy or manual installation?

Accepted Answer

Windows Autopilot. Windows Autopilot for existing devices allows you to generate a configuration package (a .ppkg file) that can be deployed via Group Policy or manual installation to enroll on-premises Windows devices into Microsoft Intune. This package includes provisioning settings that configure MDM enrollment targetting the Intune server, enabling a seamless migration.

Answer

Configuration Manager

Answer

Microsoft Intune Management Extension

Answer

Microsoft Intune Troubleshooting Tool

Question 14

Your organization plans to deploy Windows 11 devices using Windows Autopilot. You need to ensure that each device is automatically enrolled in Intune and receives a custom configuration profile during the out-of-box experience (OOBE). Which two components are required?

Accepted Answer

A device configuration profile assigned to the device. To meet the requirements of automatic Intune enrollment and receiving a custom configuration profile during OOBE, two components are needed. An Autopilot deployment profile (option C) is required because it specifies the enrollment settings and OOBE experience, such as joining Azure AD and enrolling in Intune automatically. Additionally, a device configuration profile assigned to the device (option A) is required because it defines the custom settings (e.g., security baselines, app restrictions, or network configurations) that must be applied during OOBE. Without the Autopilot deployment profile, the device would not enroll automatically; without the device configuration profile, it would enroll but not receive the custom configuration. Both are essential for the stated goal.

Answer

A Microsoft Defender for Endpoint policy

Answer

A compliance policy

Answer

Windows Autopilot hardware hash

Question 15

Which THREE are valid methods to prepare an existing Windows 10 device for Intune management? (Select THREE.)

Accepted Answer

Install and sign in to the Company Portal app. Options A, C, and E are all valid methods for preparing an existing Windows 10 device for Intune management. Option A is correct because the Company Portal app, when signed in with a work or school account, triggers MDM enrollment via the Windows Management Framework, registering the device with Intune. Option C is correct because a provisioning package created with Windows Configuration Designer can be used to configure and enroll devices into Intune, even for existing devices. Option E is correct because users can manually enroll a device by navigating to Settings > Accounts > Access work or school and selecting 'Enroll only in device management', which initiates Intune enrollment. Option B is incorrect because Group Policy alone cannot trigger Intune enrollment; it can only configure settings or trigger auto-enrollment if combined with Azure AD join. Option D is incorrect because joining Azure AD without MDM auto-enrollment configured does not enroll the device in Intune; additional configuration is required.

Answer

Deploy a Group Policy to trigger enrollment

Answer

Join the device to Azure AD without MDM auto-enrollment

Question 16

Which TWO actions should you take to prepare a Windows 10 device for a deployment using Windows Autopilot?

Accepted Answer

Ensure the device has an internet connection during the out-of-box experience.. Windows Autopilot requires an internet connection during the Out-of-Box Experience (OOBE) to download the Autopilot profile from the Microsoft Intune service and to authenticate with Microsoft Entra ID. Without connectivity, the device cannot complete the enrollment or apply the deployment profile. Option E is also correct because collecting the hardware hash (e.g., using the Get-WindowsAutoPilotInfo.ps1 script) is necessary to generate a unique device identifier that must be uploaded to the Autopilot service to register the device before deployment. Joining manually (A), enabling BitLocker (C), or upgrading (D) are not prerequisites for Autopilot; these can be configured via the deployment profile or are handled automatically.

Answer

Join the device to Microsoft Entra ID manually.

Answer

Enable BitLocker encryption on the device.

Answer

Upgrade the device to the latest Windows 10 version.

Question 17

Refer to the exhibit. A Microsoft Intune security baseline is configured for Windows 10 devices. What is the effect of this setting?

Accepted Answer

It reduces the CPU priority of scheduled scans to minimize performance impact.. This setting in the Microsoft Intune security baseline for Windows 10 configures the 'Low CPU priority for scheduled scans' policy for Microsoft Defender Antivirus. When enabled, it reduces the CPU priority of scheduled scans to minimize performance impact on the user's active workload, ensuring that background scanning does not interfere with foreground tasks.

Answer

It requires a reboot for the setting to take effect.

Answer

It enables real-time protection for scheduled scans.

Answer

It disables scheduled scans when the device is in use.

Question 18

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.. Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.

Answer

Set up a device compliance policy in Microsoft Purview to block non-compliant devices.

Answer

Configure a device filter in Exchange Online to block devices that are not managed by Intune.

Answer

Deploy an email security policy via Intune to block access from non-compliant devices.

Question 19

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

Accepted Answer

Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.. Using a 'Provision Microsoft Entra ID' step with a bulk token in a Configuration Manager task sequence directly enables automatic Microsoft Entra ID join and Intune enrollment during OSD. The bulk token, generated from Microsoft Entra ID, allows devices to be joined without user interaction, which is essential for unattended, large-scale deployments.

Answer

Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

Answer

Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

Answer

Configure Windows Autopilot for existing devices and redeploy them.

Question 20

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.