MD-102 Prepare infrastructure for devices Practice Test 10 — 15 Questions

Question 1

A multinational organization uses Microsoft Entra ID joined devices with Intune. The security team wants to block enrollment of devices from non-corporate networks unless they have a compliant certificate. Which enrollment restriction should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enrollment device restrictions with certificate requirement. Enrollment device restrictions in Intune allow you to block enrollment from non-corporate networks unless a compliant certificate is present. This is configured under 'Enrollment device restrictions' where you can set a 'Block' action for devices not on trusted networks and require a certificate for compliance, ensuring only authenticated devices can enroll from untrusted locations.

Answer

Device platform restrictions

Answer

Conditional Access policy requiring hybrid Azure AD join

Answer

Compliance policy for device health

Question 2

Your organization plans to deploy Windows 11 devices using Windows Autopilot. You need to ensure that each device is automatically enrolled in Intune and receives a custom configuration profile during the out-of-box experience (OOBE). Which two components are required?

Accepted Answer

A device configuration profile assigned to the device. To meet the requirements of automatic Intune enrollment and receiving a custom configuration profile during OOBE, two components are needed. An Autopilot deployment profile (option C) is required because it specifies the enrollment settings and OOBE experience, such as joining Microsoft Entra ID and enrolling in Intune automatically. Additionally, a device configuration profile assigned to the device (option A) is required because it defines the custom settings (e.g., security baselines, app restrictions, or network configurations) that must be applied during OOBE. Without the Autopilot deployment profile, the device would not enroll automatically; without the device configuration profile, it would enroll but not receive the custom configuration. Both are essential for the stated goal.

Answer

A Microsoft Defender for Endpoint policy

Answer

A compliance policy

Answer

Windows Autopilot hardware hash

Question 3

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work profile apps are encrypted and that the device owner cannot uninstall the Company Portal app. Which configuration profile should you deploy?

Accepted Answer

Device restrictions for Android Enterprise work profile. The 'Device restrictions for Android Enterprise work profile' profile includes settings to enforce encryption of work profile apps and to prevent the uninstallation of the Company Portal app. Specifically, the 'Require work profile encryption' setting ensures that work profile data is encrypted, and the 'Block uninstall of Company Portal' setting prevents the device owner from removing the Company Portal app. These settings are only available within the work profile restrictions profile, not in other profile types.

Answer

Device configuration profile with custom OMA-URI

Answer

Device restrictions for Android Enterprise fully managed

Answer

Compliance policy for Android Enterprise

Question 4

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

Accepted Answer

Automated device enrollment (with user affinity). Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Answer

User enrollment

Answer

Device enrollment (without user affinity)

Answer

Bring your own device (BYOD) enrollment

Question 5

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Accepted Answer

Ensure the device has a Windows 10/11 Pro or Education license. Option A is correct because subscription activation requires the device to already have a valid qualifying Windows 10/11 Pro or Education license as the underlying OS license, onto which the Windows E3/E5 subscription license is stacked to upgrade to Enterprise. Option D is correct because the device must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined so that the user's subscription-based license can be authenticated and applied to the device. Option B is incorrect because a MAK key is a volume-licensing activation method, not part of the subscription activation process. Option C is incorrect because a KMS host key is used for Key Management Service volume activation, which is unrelated to subscription activation. Option E is incorrect because Microsoft Entra Connect is a synchronization tool for hybrid identity and is not a per-device requirement for subscription activation.

Answer

Enter a MAK key

Answer

Configure a KMS host key

Answer

Install the Azure AD Connect tool

Question 6

Which THREE permissions are required for a service account to register devices in Windows Autopilot? (Select THREE.)

Accepted Answer

Intune Administrator role. Option A (Intune Administrator role) is correct because the Intune Administrator role includes the Device Enrollment Manager and device configuration permissions needed to import and register Autopilot devices in the Intune portal. Option D (Windows Autopilot device enrollment manager (DEM) permissions) is correct because DEM permissions allow the service account to enroll and register devices on behalf of the organization, which is essential for bulk Autopilot registration. Option E (Microsoft Entra ID join permission) is correct because Autopilot registration requires the ability to create/join device objects in Microsoft Entra ID, which the service account must be granted. Option B (Security Reader role) is not correct because it only provides read-only access to security features and cannot register devices. Option C (Global Administrator role) is not required and is excessive; while it technically has permissions, it is not one of the three specific permissions needed for Autopilot device registration.

Answer

Security Reader role

Answer

Global Administrator role

Question 7

Which THREE are valid methods to prepare an existing Windows 10 device for Intune management? (Select THREE.)

Accepted Answer

Install and sign in to the Company Portal app. Option A is correct because installing and signing in to the Company Portal app on an existing Windows 10 device lets the user manually enroll it into Intune, which is a supported enrollment method for personal or existing devices. Option C is correct because a provisioning package created with Windows Configuration Designer can be applied to an existing device to enroll it in Microsoft Entra ID and Intune, commonly used for bulk or kiosk-style enrollment. Option E is correct because navigating to Settings > Accounts > Access work or school and connecting the work account triggers MDM auto-enrollment into Intune when the user is licensed and auto-enrollment is configured. Option B is not valid because Group Policy cannot trigger Intune MDM enrollment; it is used for on-premises domain management, not cloud MDM enrollment. Option D is not valid because joining a device to Microsoft Entra ID without MDM auto-enrollment does not enroll it into Intune, so the device would not be managed by Intune.

Answer

Deploy a Group Policy to trigger enrollment

Answer

Join the device to Azure AD without MDM auto-enrollment

Question 8

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Accepted Answer

Microsoft Entra ID Connect. Microsoft Entra ID Connect (option B) is required because hybrid Windows Hello for Business depends on synchronizing on-premises Active Directory user accounts to Microsoft Entra ID, which the Connect tool provides. Public Key Infrastructure (option C) is required because hybrid deployments use certificate-based authentication, where a domain-issued certificate (from an enterprise CA) is used as the user's authentication credential for Windows Hello for Business. Configuration Manager (option A) is not required, as it is a management tool rather than a prerequisite for enabling the feature. Multifactor authentication (option D) is not a strict requirement for the hybrid deployment itself, since Windows Hello for Business is designed to replace password plus MFA with a strong two-factor credential. Microsoft Intune (option E) is not required, because hybrid Windows Hello for Business can be deployed using Group Policy and certificate enrollment without Intune.

Answer

Configuration Manager

Answer

Multifactor authentication (MFA)

Answer

Microsoft Intune

Question 9

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

Accepted Answer

Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.. It leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Answer

Deploy Windows Autopilot for all new devices and ignore existing devices.

Answer

Purchase a third-party MDM tool to manage non-compliant devices.

Answer

Ask all users to manually enroll their devices using the Company Portal app.

Question 10

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

Accepted Answer

Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.. Configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Microsoft Entra ID-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Answer

Distribute a script to each user to run manually.

Answer

Deploy Windows Autopilot to reset and re-enroll each device.

Answer

Use the Intune Enrollment Status Page to force enrollment.

Question 11

You manage a fleet of 2,000 iOS devices for a healthcare organization. The devices are used by clinicians and must be enrolled in Intune. Due to security requirements, you must ensure that devices are supervised and that the Company Portal app is installed automatically. You have Apple Business Manager (ABM) set up with Intune. You need to configure the enrollment process so that when a new device is unboxed and turned on, it automatically enrolls and receives the required configuration. Which enrollment method should you use?

Accepted Answer

Automated Device Enrollment (ADE) with user affinity. Automated Device Enrollment (ADE) with user affinity is the correct method because it leverages Apple Business Manager (ABM) to supervise devices automatically during the initial setup, enforces the required supervision state, and installs the Company Portal app via a mandatory VPP app assignment. User affinity ensures that each device is associated with a specific clinician, enabling user-based policies and conditional access. This meets the healthcare organization's security requirements for supervised devices and automatic app deployment.

Answer

Device enrollment (without user affinity)

Answer

Company Portal enrollment

Answer

User enrollment (BYOD)

Question 12

Your organization recently deployed Windows 11 devices managed by Microsoft Intune. You need to ensure that only approved third-party drivers are installed on these devices. What is the best approach?

Accepted Answer

Configure a Windows Defender Application Control policy to block unsigned drivers.. Windows Defender Application Control (WDAC) allows you to configure code integrity policies that restrict driver installation to only those that are signed by approved publishers or have known-good hashes. This ensures that only approved third-party drivers, as defined by your organization's policy, can be installed, regardless of the installation source (Windows Update, manual, or otherwise). Option C is insufficient because blocking driver updates from Windows Update does not prevent manual installation of unapproved drivers. Options A and B do not provide a comprehensive enforcement mechanism for driver approval.

Answer

Deploy a Windows Driver Frameworks (WDF) Coinstaller to enforce driver signing.

Answer

Use Device Installation Restrictions to allow only approved hardware IDs.

Answer

Configure Windows Update for Business group policy settings to block driver updates from Windows Update.

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a custom security baseline that includes blocking PowerShell scripts from running unless they are signed by a trusted publisher. Which configuration should be applied?

Accepted Answer

Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.. Setting the PowerShell Execution Policy to 'AllSigned' via Administrative Templates in Intune ensures that PowerShell scripts can only run if they are signed by a trusted publisher. This policy is enforced through Group Policy or Intune's Settings Catalog, directly controlling the PowerShell execution policy at the machine level, which meets the requirement for a custom security baseline.

Answer

Create a Windows Defender Application Control (WDAC) policy that blocks unsigned scripts.

Answer

Enable BitLocker with Secure Boot to validate script integrity.

Answer

Configure AppLocker rules to deny execution of PowerShell scripts.

Question 14

You are troubleshooting an Intune enrollment issue on a Windows 10 device. The device is Microsoft Entra joined, but the enrollment status shows 'Pending'. What is the most likely cause?

Accepted Answer

The Enrollment Status Page (ESP) profile is not assigned to the device.. The Enrollment Status Page (ESP) tracks the installation of profiles, policies, and apps during enrollment. If the ESP profile is not assigned to the device, the enrollment process may hang in a 'Pending' state waiting for the ESP configuration. Option A is incorrect because conditional access policies are evaluated after enrollment, not during. Option B is incorrect because BitLocker is a disk encryption feature unrelated to enrollment status. Option D is incorrect because the MDM authority is set at the tenant level; if it were not set to Intune, enrollment would fail entirely, not just show 'Pending'.

Answer

The device is not compliant with a conditional access policy.

Answer

The device does not have BitLocker enabled.

Answer

The MDM authority is not set to Intune.

Question 15

You need to deploy Microsoft 365 Apps to 500 Windows 10 devices managed by Intune. The deployment must be automatic and should not require user interaction. What is the best method?

Accepted Answer

Create a Win32 app in Intune with the installation command for Microsoft 365 Apps.. Creating a Win32 app in Intune allows you to use the Office Deployment Tool (ODT) with a custom configuration.xml to install Microsoft 365 Apps silently. This method supports automatic, unattended deployment to 500 Windows 10 devices managed by Intune, as Win32 apps can be assigned with required intent and run in system context without user interaction.

Answer

Create a Configuration Manager application and deploy to the devices.

Answer

Use the Office Deployment Tool (ODT) to create a package and deploy via Intune as a line-of-business (LOB) app.

Answer

Assign the Microsoft 365 Apps from the Microsoft Store for Business.