MD-102 Prepare infrastructure for devices Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not connected to the cloud service.. The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Answer

The device is not compliant with Intune compliance policies.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device does not have Microsoft Defender Antivirus enabled.

Question 2

You need to deploy a custom Windows 10 image to 100 new devices using Microsoft Intune. The devices are not yet enrolled. Which method should you use to deploy the image and enroll the devices?

Accepted Answer

Use Windows Autopilot to deploy a custom image and automatically enroll the devices.. Option B is correct because Windows Autopilot can deploy a custom image and automatically enroll devices. Option A is wrong because PXE boot is not supported by Intune directly. Option C is wrong because USB deployment is manual. Option D is wrong because Configuration Manager is a separate tool.

Answer

Use PXE boot to deploy the image and then enroll via a provisioning package.

Answer

Create a bootable USB with the image and manually enroll each device.

Answer

Use Microsoft Configuration Manager to deploy the image and enroll via co-management.

Question 3

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

Accepted Answer

The enrollment restrictions are set to block personally owned devices.. Option D is correct because enrollment restrictions must allow personal devices if users are using personal iOS devices. Option A is wrong because Apple MDM push certificate is required for enrollment, but the error message is different. Option B is wrong because terms of use appear after enrollment attempt. Option C is wrong because conditional access policies do not block enrollment but access after enrollment.

Answer

A conditional access policy requires compliant devices.

Answer

The Apple MDM push certificate is not configured.

Answer

The users have not accepted the terms of use.

Question 4

You need to configure Windows 10 devices to automatically encrypt their drives using BitLocker when they enroll in Microsoft Intune. You have created a BitLocker policy in Endpoint Security. However, after enrollment, some devices are not encrypted. You verify that the devices have a TPM 2.0 and meet hardware requirements. What is the most likely reason for the failure?

Accepted Answer

The BitLocker policy does not require a recovery password to be saved to Azure AD.. BitLocker requires a recovery key to be escrowed to Azure AD before encryption can proceed when managed via Intune. If the policy does not mandate saving the recovery password to Azure AD, the encryption process will fail silently on devices that meet all hardware prerequisites, including TPM 2.0. This is a common configuration oversight in Endpoint Security BitLocker policies.

Answer

The devices do not have Secure Boot enabled.

Answer

The TPM is not enabled in the BIOS.

Answer

The devices are not compliant with the BitLocker compliance policy.

Question 5

You need to manage updates for Windows 10 devices using Microsoft Intune. You want to ensure that critical security updates are installed within 7 days of release, while feature updates are deferred for 60 days. Which approach should you use?

Accepted Answer

Create a Windows update ring policy with quality update deferral set to 7 days and feature update deferral set to 60 days.. Option A is correct because Windows update ring policies in Microsoft Intune allow granular control over both quality (security) and feature update deferral periods. Setting quality update deferral to 7 days ensures critical security patches are installed within a week, while feature update deferral of 60 days delays non-security feature updates. This directly meets the requirement without additional profiles or compliance policies.

Answer

Create a Windows feature update profile to deploy the latest feature update after 60 days.

Answer

Create a device compliance policy requiring devices to install updates within 7 days.

Answer

Configure Windows Update for Business settings via a configuration profile.

Question 6

You are planning to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. Which TWO methods can you use to deploy Microsoft 365 Apps? (Choose two.)

Accepted Answer

Windows Installer (Win32) app type using the Office Deployment Tool.. Option B is correct because the Windows Installer (Win32) app type in Intune allows you to deploy Microsoft 365 Apps using the Office Deployment Tool (ODT), which provides granular control over installation settings, languages, and update channels. Option E is correct because Intune includes a dedicated 'Microsoft 365 Apps for Windows' app type that simplifies deployment by automatically configuring the ODT XML and handling the installation process without manual scripting.

Answer

Android store app type.

Answer

Web link app type pointing to the Office website.

Answer

iOS store app type.

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Accepted Answer

Windows Defender Application Control (WDAC).. Windows Defender Application Control (WDAC) is a code integrity feature that restricts which executables, scripts, and installers can run on Windows 10 devices. It uses a trust-based model where only binaries signed by approved publishers or with specific hash values are allowed, making it a core component for application control in an Intune-managed environment.

Answer

Windows Information Protection (WIP).

Answer

BitLocker drive encryption.

Question 8

You need to configure device compliance policies in Microsoft Intune for Windows 10 devices. Which THREE settings can you include in a compliance policy? (Choose three.)

Accepted Answer

Require BitLocker.. Option A is correct because BitLocker is a built-in Windows 10 encryption feature that can be required via a device compliance policy in Microsoft Intune. When you configure a compliance policy for Windows 10, you can set the 'Require BitLocker' setting to 'Require' to ensure the device's operating system drive is encrypted, which is a common security baseline for corporate devices.

Answer

Maximum OS version.

Answer

Allow camera.

Question 9

You have deployed the above compliance policy in Microsoft Intune. A Windows 10 device running version 10.0.19042.0 is marked as noncompliant. You verify that the device meets all password, encryption, firewall, and Defender requirements. What is the most likely reason for noncompliance?

Accepted Answer

The device is running a version higher than the maximum OS version.. The compliance policy includes a maximum OS version rule, and the device is running version 10.0.19042.0. Since this version is higher than the configured maximum, the device is marked as noncompliant even though it meets all other requirements. In Intune, OS version rules are evaluated as strict comparisons, so exceeding the maximum triggers noncompliance regardless of other settings.

Answer

The device is running a version lower than the minimum OS version.

Answer

The device's antivirus software is not Microsoft Defender.

Answer

The device does not have a TPM 2.0 chip.

Question 10

You run the above PowerShell script to change the Windows Autopilot group tag for devices currently tagged as 'Sales' to 'Marketing'. You have assigned different deployment profiles to the 'Sales' and 'Marketing' group tags. After running the script, you check the Autopilot devices in Intune and see that the group tag for the devices has changed. However, the devices still apply the 'Sales' deployment profile during OOBE. What is the most likely reason?

Accepted Answer

The deployment profile assignment is based on the group tag at the time of enrollment; existing devices retain the original profile.. The group tag is evaluated at the time of enrollment to determine which deployment profile to assign. Changing the group tag on an already-enrolled device does not retroactively change the profile assignment; the device retains the profile that was applied during its original OOBE. This is by design in Windows Autopilot, as the profile is bound to the device record at enrollment.

Answer

The deployment profile is assigned to the device by device ID, not group tag.

Answer

The script needs to include a step to remove the device from Autopilot and re-import it.

Answer

The script did not sync the device details to Intune after changing the group tag.

Question 11

You have deployed the above Endpoint Protection configuration profile to Windows 10 devices. Some users report that their devices are not encrypted. You verify that the devices have TPM 2.0 and meet hardware requirements. What is the most likely cause?

Accepted Answer

The policy does not configure recovery key escrow to Azure AD.. The correct answer is A because when BitLocker encryption is enabled via an Endpoint Protection configuration profile in Microsoft Intune, the policy must include recovery key escrow to Azure AD for encryption to proceed. Without this setting, BitLocker will not encrypt the drive, even if the device meets TPM and hardware requirements. The policy in question likely has the 'Require BitLocker recovery key to be stored in Azure AD' option set to 'Not configured' or 'No', which prevents encryption from starting.

Answer

The policy disables encryption for the OS drive.

Answer

The devices do not have a TPM chip.

Answer

The encryption method is not supported by the devices.

Question 12

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

Accepted Answer

Create a custom device preparation profile with delegated admin privileges.. Option D is correct because a custom device preparation profile with delegated admin privileges allows a hardware vendor to register devices in your tenant via Autopilot without granting them full user privileges. This profile grants the vendor scoped permissions to upload device hashes and associate them with your tenant, using delegated administration in Microsoft Entra ID to limit access to only the necessary actions for device enrollment.

Answer

Export the device list from the vendor and import it via CSV in Microsoft Intune.

Answer

Add the vendor as a global administrator in Microsoft Entra ID.

Answer

Provide the vendor with a bulk enrollment token and URL.

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

Accepted Answer

Set feature update deferral to 120 days and quality update deferral to 30 days.. Option C is correct because the Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Answer

Set feature update deferral to 180 days and quality update deferral to 0 days.

Answer

Set feature update deferral to 30 days and quality update deferral to 120 days.

Answer

Set both feature and quality update deferrals to 60 days.

Question 14

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

Accepted Answer

Include the 'Language' and 'RegionalSettings' settings in the PPKG.. Windows Configuration Designer (WCD) directly supports configuring language and regional settings within a provisioning package (PPKG) through built-in settings. Including the 'Language' and 'RegionalSettings' settings in the PPKG ensures these configurations are applied during the out-of-box experience (OOBE) or provisioning process, without requiring additional scripts or policies. This is the most efficient and supported method for offline or Autopilot pre-provisioning scenarios.

Answer

Add a PowerShell script that runs during Autopilot to set language and region.

Answer

Assign an Intune Language Pack policy to the device group.

Answer

Create a Group Policy Object that sets language and region, and link it to the device OU.

Question 15

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

Accepted Answer

The update ring is not assigned to the device's group.. Option D is correct because the device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Answer

The update ring is configured with an incorrect deferral period.

Answer

The device is not compliant with the security baseline.

Answer

Windows Update is blocked by the corporate firewall.