MD-102 Prepare infrastructure for devices Practice Test 10 — 15 Questions

Question 1

Your organization is deploying Windows Autopilot self-deploying mode for kiosk devices. The devices will be used in a public area and must not require user interaction during the initial setup. What is the prerequisite for this deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device must have a TPM 2.0 chip.. Windows Autopilot self-deploying mode relies on the device's TPM 2.0 chip to cryptographically attest its identity to Microsoft Entra ID without any user interaction. The TPM 2.0 provides hardware-bound keys that enable the device to authenticate itself and automatically enroll, which is essential for kiosk devices in public areas where no user credentials can be supplied during initial setup.

Answer

A user must be assigned to the device in Microsoft Entra ID.

Answer

An enrollment profile must be assigned to the user.

Answer

The device must be added to Microsoft Entra ID manually.

Question 2

A user reports that their Windows device is not appearing in the Intune console after enrollment. The device is joined to Microsoft Entra ID and the user has an Intune license. What should you check first?

Accepted Answer

Ensure that the MDM user scope in Microsoft Entra ID is set to 'All' or 'Some'.. The most common reason a device fails to appear in the Intune console after enrollment is that the MDM user scope in Microsoft Entra ID is not configured to include the user. The MDM user scope determines which users can automatically enroll their devices into Intune; if it is set to 'None', enrollment is blocked entirely. Since the device is already joined to Microsoft Entra ID and the user has an Intune license, the first step is to verify this scope setting.

Answer

Assign an Intune license to the device.

Answer

Verify that enrollment restrictions are not blocking the device.

Answer

Check if the device is compliant.

Question 3

Your organization plans to use Microsoft Intune to manage macOS devices. Which TWO prerequisites are required for macOS enrollment?

Accepted Answer

An Apple Push Notification service (APNs) certificate.. An Apple Push Notification service (APNs) certificate is required for macOS enrollment because it establishes a persistent, secure connection between Microsoft Intune and Apple's servers. This certificate enables Intune to send management commands, policies, and app installations to macOS devices. Without a valid APNs certificate, Intune cannot communicate with enrolled devices, making enrollment impossible.

Answer

A user enrollment certificate from a public CA.

Answer

A Volume Purchase Program (VPP) token.

Answer

A Microsoft Configuration Manager connector.

Question 4

Your organization uses Microsoft Intune and you need to configure Windows Autopilot for hybrid Microsoft Entra ID join. Which THREE components are required?

Accepted Answer

A domain join profile (configured in Intune).. A domain join profile is required for hybrid Microsoft Entra ID join because it provides the on-premises Active Directory domain information that the device needs during Autopilot provisioning. Without this profile, the device cannot complete the domain join step, which is essential for establishing the hybrid identity state.

Answer

A device compliance policy.

Answer

An MDM push certificate.

Question 5

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Microsoft Entra ID join with automatic MDM enrollment.. The correct answers are B (Microsoft Entra ID join with automatic MDM enrollment) and D (Windows Autopilot). Both are valid methods to enroll Windows devices into Microsoft Intune. Option A (Android Zero Touch) is for Android devices, not Windows. Option C (Apple Business Manager) is for Apple devices. Option E (Samsung Knox Mobile Enrollment) is for Samsung Android devices.

Answer

Android Zero Touch.

Answer

Apple Business Manager.

Answer

Samsung Knox Mobile Enrollment.

Question 6

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

Accepted Answer

The device does not have a TPM 2.0 chip.. Windows Autopilot self-deploying mode requires a TPM 2.0 chip to perform hardware-based attestation and automatically enroll the device without user interaction. If the device lacks TPM 2.0, the provisioning process will fail because the required cryptographic keys for attestation cannot be generated, preventing the device from completing the self-deploying profile.

Answer

The device name template is invalid.

Answer

The profile requires a user to sign in during deployment.

Answer

The language settings are not configured.

Question 7

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

Accepted Answer

One of the required apps failed to install.. The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Answer

The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

Answer

The user attempted to retry the setup and it was blocked.

Answer

The device reset on failure is enabled, causing a reset loop.

Question 8

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant are blocked from accessing corporate resources. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that requires compliant devices.. Conditional Access policies in Azure AD are the correct mechanism to enforce access controls based on device compliance status. By creating a policy that requires devices to be marked as compliant, you ensure that only compliant devices can access corporate resources, while non-compliant devices are blocked at the authentication level. This integrates with Intune compliance policies to evaluate device health before granting access.

Answer

Create a device compliance policy and assign it to users.

Answer

Create a device configuration profile that restricts access.

Answer

Configure enrollment restrictions to block non-compliant devices.

Question 9

Your organization is planning to deploy Windows 11 to 5000 devices using Microsoft Intune. The devices are currently a mix of Windows 10 and Windows 11 eligible hardware. You need to ensure that only devices meeting the Windows 11 hardware requirements can be upgraded. What is the most efficient way to achieve this using Intune?

Accepted Answer

Create a Windows feature update profile targeting Windows 11 and assign it to all devices; Intune will automatically skip ineligible devices.. A Windows feature update profile in Intune automatically checks device hardware eligibility before applying the Windows 11 upgrade. Intune queries the Windows Update for Business service, which evaluates TPM 2.0, Secure Boot, CPU generation, and RAM requirements; devices that do not meet the minimum hardware requirements are skipped without any manual intervention or additional configuration.

Answer

Use Windows Autopilot to reset each device and manually verify hardware compatibility.

Answer

Create a dynamic device group based on TPM version and assign a Windows 10 update ring to non-compliant devices.

Answer

Create a compliance policy requiring TPM 2.0 and Secure Boot, then assign a Windows 11 update ring to compliant devices.

Question 10

You manage devices with Microsoft Intune. Some Windows devices are not receiving required security updates despite being assigned to an update ring for Windows 10. You verify that the devices are active and connected to the internet. What is the most likely cause?

Accepted Answer

The update ring has a deferral period configured that delays updates for 30 days.. The most likely cause is that the update ring has a deferral period configured that delays updates for 30 days. In Microsoft Intune, update rings for Windows 10 allow administrators to set deferral periods for quality and feature updates. A deferral period of 30 days means that even if the device is active and connected, it will not install the update until the specified number of days after Microsoft releases it. This explains why the devices are not receiving the updates despite being compliant and online.

Answer

The devices have a compliance policy requiring a specific version that is not yet met.

Answer

The devices are not connected to a corporate VPN.

Answer

Delivery Optimization is disabled on the devices.

Question 11

You are configuring Windows Autopilot for new devices. The devices need to be automatically enrolled in Intune and assigned to a specific group based on their serial number. What is the required step before the devices can be recognized by Autopilot?

Accepted Answer

Register the devices using their hardware hash in the Microsoft Intune admin center.. Before Windows Autopilot can recognize and automatically enroll devices, they must be registered as Autopilot devices. This is done by uploading their hardware hash (a unique identifier derived from the device's TPM and other hardware) into the Microsoft Intune admin center. Once registered, the device is associated with an Autopilot profile and can be automatically enrolled in Intune and assigned to a group based on its serial number during the out-of-box experience.

Answer

Configure Intune enrollment for all users using device enrollment managers.

Answer

Join the devices to Microsoft Entra ID manually before shipping.

Answer

Upload a CSV file with device serial numbers to Microsoft Entra ID.

Question 12

Your organization uses Microsoft Defender for Endpoint. You need to ensure that devices onboarding to Microsoft Defender for Endpoint are automatically assigned to a specific device group based on their operating system version. What should you use?

Accepted Answer

Configure device group rules in Microsoft Defender for Endpoint using OS version condition.. Device group rules in Microsoft Defender for Endpoint allow you to automatically assign devices to groups based on conditions such as operating system version. This is the correct approach because it uses the built-in grouping engine that evaluates device attributes during onboarding, ensuring consistent and automated assignment without manual intervention.

Answer

Manually tag each device in the Microsoft 365 Defender portal.

Answer

Use Microsoft Entra ID dynamic groups based on device OS.

Answer

Create a Microsoft Intune compliance policy that tags devices by OS version.

Question 13

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

Accepted Answer

The devices have TPM version 1.2 instead of 2.0.. The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Answer

The devices are not joined to Microsoft Entra ID.

Answer

The BitLocker policy is configured only for Windows 11 Enterprise devices.

Answer

The devices are running Windows 10 instead of Windows 11.

Question 14

You need to deploy Microsoft 365 Apps to 1000 devices using Microsoft Intune. The devices are a mix of Windows 10 and Windows 11. Which app deployment method should you use to ensure the latest version is always installed?

Accepted Answer

Deploy Microsoft 365 Apps for enterprise as a built-in app type in Intune.. The Microsoft 365 Apps for enterprise built-in app type in Intune is specifically designed to deploy and manage Office with automatic updates from the Office Content Delivery Network (CDN). This method ensures that devices always receive the latest version of Microsoft 365 Apps without requiring manual intervention or custom configuration, as Intune handles the deployment policy and update channel settings natively.

Answer

Deploy a line-of-business app from the installation file.

Answer

Deploy a Win32 app with the Office Deployment Tool.

Answer

Deploy a custom script that installs Office from a network share.

Question 15

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Accepted Answer

The device has not checked in with the Intune service recently.. When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Answer

The device is marked as non-compliant.

Answer

The device does not have a valid device certificate.

Answer

The device enrollment profile has expired.