MD-102 Prepare infrastructure for devices Practice Test 10 — 15 Questions

Question 1

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

Accepted Answer

The devices have TPM version 1.2 instead of 2.0.. The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Answer

The devices are not joined to Microsoft Entra ID.

Answer

The BitLocker policy is configured only for Windows 11 Enterprise devices.

Answer

The devices are running Windows 10 instead of Windows 11.

Question 2

You need to deploy Microsoft 365 Apps to 1000 devices using Microsoft Intune. The devices are a mix of Windows 10 and Windows 11. Which app deployment method should you use to ensure the latest version is always installed?

Accepted Answer

Deploy Microsoft 365 Apps for enterprise as a built-in app type in Intune.. Option C is correct because the Microsoft 365 Apps for enterprise built-in app type in Intune is specifically designed to deploy and manage Office with automatic updates from the Office Content Delivery Network (CDN). This method ensures that devices always receive the latest version of Microsoft 365 Apps without requiring manual intervention or custom configuration, as Intune handles the deployment policy and update channel settings natively.

Answer

Deploy a line-of-business app from the installation file.

Answer

Deploy a Win32 app with the Office Deployment Tool.

Answer

Deploy a custom script that installs Office from a network share.

Question 3

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Accepted Answer

The device has not checked in with the Intune service recently.. When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Answer

The device is marked as non-compliant.

Answer

The device does not have a valid device certificate.

Answer

The device enrollment profile has expired.

Question 4

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

Accepted Answer

The Conditional Access policy does not include the email application as a target.. Option C is correct because Conditional Access policies require a cloud app to be targeted. Option A is incorrect because the policy would block access if applied. Option B is incorrect because compliance policy is separate from Conditional Access. Option D is incorrect because the policy would apply to all users if included.

Answer

The Conditional Access policy is set to 'Block' instead of 'Grant'.

Answer

The Conditional Access policy applies only to users in a specific group.

Answer

The compliance policy is not assigned to the users' devices.

Question 5

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

Accepted Answer

Configuration profiles. Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Answer

Update rings

Answer

Device enrollment profiles

Answer

Compliance policies

Question 6

Which TWO actions should you take to prepare infrastructure for devices running macOS in your organization? (Select two.)

Accepted Answer

Deploy the Company Portal app to macOS devices.. Option A is correct because the Company Portal app is the primary interface for users to enroll macOS devices in Microsoft Intune, access corporate resources, and manage compliance. Deploying it ensures users can initiate enrollment and receive policies. Option B is correct because enrolling macOS devices in Intune is the foundational step to apply management policies, deploy apps, and enforce compliance settings via MDM.

Answer

Configure Windows Autopilot for macOS devices.

Answer

Join macOS devices to Microsoft Entra ID.

Answer

Use Group Policy to manage macOS settings.

Question 7

Which THREE components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select three.)

Accepted Answer

Enrollment Status Page (ESP) configuration.. The Enrollment Status Page (ESP) configuration is required because it provides visibility into the provisioning process and enforces device compliance before the user can access the desktop. In a user-driven Microsoft Entra ID join Autopilot deployment, the ESP ensures that required policies, apps, and certificates are installed, preventing users from bypassing critical setup steps. Without ESP, users might gain early access to an incompletely configured device, leading to support issues.

Answer

On-premises Active Directory domain join.

Answer

Microsoft Configuration Manager co-management.

Question 8

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Accepted Answer

Allows IT to provision devices remotely without physical access.. Windows Autopilot leverages cloud-based services to provision new devices, eliminating the need for IT staff to be physically present. Option C is correct because Autopilot allows IT to deploy a device by simply providing the user with the hardware; the device automatically joins Azure AD, enrolls in Intune, and applies policies over the internet. This remote provisioning capability is a core benefit, as it enables zero-touch deployment for remote workers or distributed offices.

Answer

Works offline without internet connectivity.

Answer

Enables deployment of custom operating system images.

Answer

Eliminates the need for any user interaction during setup.

Question 9

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

Accepted Answer

The OS build is greater than the maximum version specified.. Option C is correct because the policy specifies osMinimumVersion as 10.0.19041.0 (Windows 10 2004) and osMaximumVersion as 10.0.22621.0 (Windows 10 22H2). Since 22621 is equal to the maximum, it should be compliant. However, if the devices have a newer build (e.g., 22631 from an Insider preview), they would exceed the maximum. Option A is incorrect because 22621 is not less than 19041. Option B is incorrect because the maximum is inclusive. Option D is incorrect because the policy does not specify validOperatingSystemBuildRanges.

Answer

The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.

Answer

The OS build is less than the minimum version.

Answer

The policy requires a password but the devices have no password.

Question 10

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

Accepted Answer

Quality updates are paused until March 15, 2025.. Option C is correct because the JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Answer

The quality update deferral of 7 days has not yet elapsed since the last update.

Answer

The quality update pause has expired, but quality updates are still blocked.

Answer

Feature updates are deferred for 30 days, preventing all updates.

Question 11

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

Accepted Answer

User-driven deployment with Microsoft Entra ID join.. Option B is correct because the enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Answer

Self-deploying mode where no user interaction is required.

Answer

Hybrid Microsoft Entra ID join with on-premises domain controller.

Answer

On-premises Active Directory domain join only.

Question 12

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

Accepted Answer

Create a Windows feature update profile targeting Windows 11.. A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Answer

Deploy a configuration profile with the Windows 11 installation script.

Answer

Create a Windows update ring profile targeting Windows 11.

Answer

Configure a device compliance policy requiring Windows 11.

Question 13

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can access company resources, while allowing users to enroll personal devices for limited access. You plan to use enrollment restrictions and compliance policies. What should you configure?

Accepted Answer

Set enrollment device platform restrictions to block personally owned devices, and create a compliance policy to mark personal devices as noncompliant.. Option A is correct because enrollment device platform restrictions can block personally owned devices from enrolling, while a compliance policy can mark personal devices that do enroll as noncompliant. This combination ensures corporate-owned devices get full access, and personal devices are either blocked or flagged for limited access via conditional access policies.

Answer

Configure enrollment restrictions to block all devices from enrolling.

Answer

Configure a compliance policy that requires devices to be corporate-owned.

Answer

Create a conditional access policy that requires devices to be marked as compliant.

Question 14

You are troubleshooting an issue where users report that they cannot install required line-of-business (LOB) apps from Microsoft Intune Company Portal on their Windows 10 devices. The apps are assigned as 'Required' to a dynamic device group. You verify that the devices are enrolled and compliant. What is the most likely cause of the failure?

Accepted Answer

The user is not a local administrator on the device.. For Windows 10 devices managed by Microsoft Intune, the installation of line-of-business (LOB) apps that are assigned as 'Required' requires the user to be a local administrator on the device. This is because the Intune Management Extension (IME) runs in the context of the local system account, but the actual app installation process for LOB apps (typically .msi or .exe files) often requires elevated privileges that only a local administrator can provide. Without local admin rights, the installation fails silently or with an access denied error, even though the device is enrolled and compliant.

Answer

The dynamic device group is not updating membership correctly.

Answer

The apps are not published in the Company Portal.

Answer

The enrollment restrictions block installation of LOB apps.

Question 15

You are designing a Windows Autopilot deployment for a new fleet of devices. The devices will be shipped directly to users from the vendor. You need to ensure that the devices automatically enroll in Microsoft Intune and receive a standard set of applications during the out-of-box experience (OOBE). Which Autopilot deployment profile should you assign?

Accepted Answer

User-Driven mode (Azure AD joined) with user-assigned apps.. User-Driven mode with Azure AD joined and user-assigned apps is correct because the devices are shipped directly to users, who will perform the OOBE themselves. This mode requires a user to sign in with Azure AD credentials, which triggers automatic enrollment in Microsoft Intune and applies the assigned user-targeted apps during the enrollment process.

Answer

Pre-provisioning (White Glove) mode with device-assigned apps.

Answer

Self-Deploying mode (Azure AD registered) with device-assigned apps.

Answer

Self-Deploying mode (Azure AD joined) with user-assigned apps.