MD-102 Prepare infrastructure for devices Practice Test 11 — 15 Questions

Question 1

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Conditional Access policy does not include the email application as a target.. A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it. Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.

Answer

The Conditional Access policy is set to 'Block' instead of 'Grant'.

Answer

The Conditional Access policy applies only to users in a specific group.

Answer

The compliance policy is not assigned to the users' devices.

Question 2

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

Accepted Answer

Configuration profiles. Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Answer

Update rings

Answer

Device enrollment profiles

Answer

Compliance policies

Question 3

Which TWO actions should you take to prepare infrastructure for devices running macOS in your organization? (Select two.)

Accepted Answer

Deploy the Company Portal app to macOS devices.. The Company Portal app is the primary interface for users to enroll macOS devices in Microsoft Intune, access corporate resources, and manage compliance. Deploying it ensures users can initiate enrollment and receive policies. Option B is correct because enrolling macOS devices in Intune is the foundational step to apply management policies, deploy apps, and enforce compliance settings via MDM.

Answer

Configure Windows Autopilot for macOS devices.

Answer

Join macOS devices to Microsoft Entra ID.

Answer

Use Group Policy to manage macOS settings.

Question 4

Which TWO components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select two.)

Accepted Answer

Device registration in the Autopilot service using hardware hash.. For a user-driven Windows Autopilot deployment with Microsoft Entra ID join, the required components are device registration in the Autopilot service using hardware hash and a Windows Autopilot deployment profile in Intune. The Enrollment Status Page (ESP) is optional and not required for a successful deployment. On-premises Active Directory domain join is not needed because the device joins Microsoft Entra ID, and Configuration Manager co-management is optional.

Answer

Enrollment Status Page (ESP) configuration.

Answer

On-premises Active Directory domain join.

Answer

Microsoft Configuration Manager co-management.

Question 5

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Accepted Answer

Allows IT to provision devices remotely without physical access.. Windows Autopilot leverages cloud-based services to provision new devices, eliminating the need for IT staff to be physically present. Option C is correct because Autopilot allows IT to deploy a device by simply providing the user with the hardware; the device automatically joins Azure AD, enrolls in Intune, and applies policies over the internet. This remote provisioning capability is a core benefit, as it enables zero-touch deployment for remote workers or distributed offices.

Answer

Works offline without internet connectivity.

Answer

Enables deployment of custom operating system images.

Answer

Eliminates the need for any user interaction during setup.

Question 6

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

Accepted Answer

The OS build is greater than the maximum version specified.. The policy defines the maximum OS version as 10.0.22621.0 (Windows 10 22H2), but the device is running a build that exceeds this maximum. Although the device build is 22621, the policy may interpret the build range as exclusive, or the device has a newer build (e.g., 22631) that is greater than the maximum. In either case, the OS build is greater than the allowed maximum, causing non-compliance. Option A is incorrect because the validOperatingSystemBuildRanges property is not the issue. Option C is incorrect because the build is not less than the minimum version. Option D is incorrect because the policy does not require a password.

Answer

The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.

Answer

The OS build is less than the minimum version.

Answer

The policy requires a password but the devices have no password.

Question 7

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

Accepted Answer

Quality updates are paused until March 15, 2025.. The JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Answer

The quality update deferral of 7 days has not yet elapsed since the last update.

Answer

The quality update pause has expired, but quality updates are still blocked.

Answer

Feature updates are deferred for 30 days, preventing all updates.

Question 8

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

Accepted Answer

User-driven deployment with Microsoft Entra ID join.. The enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Answer

Self-deploying mode where no user interaction is required.

Answer

Hybrid Microsoft Entra ID join with on-premises domain controller.

Answer

On-premises Active Directory domain join only.

Question 9

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

Accepted Answer

Create a Windows feature update profile targeting Windows 11.. A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Answer

Deploy a configuration profile with the Windows 11 installation script.

Answer

Create a Windows update ring profile targeting Windows 11.

Answer

Configure a device compliance policy requiring Windows 11.

Question 10

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can access company resources, while allowing users to enroll personal devices for limited access. You plan to use enrollment restrictions and compliance policies. What should you configure?

Accepted Answer

Set enrollment device platform restrictions to block personally owned devices, and create a compliance policy to mark personal devices as noncompliant.. Enrollment device platform restrictions can block personally owned devices from enrolling, while a compliance policy can mark personal devices that do enroll as noncompliant. This combination ensures corporate-owned devices get full access, and personal devices are either blocked or flagged for limited access via conditional access policies.

Answer

Configure enrollment restrictions to block all devices from enrolling.

Answer

Configure a compliance policy that requires devices to be corporate-owned.

Answer

Create a conditional access policy that requires devices to be marked as compliant.

Question 11

You are designing a Windows Autopilot deployment for a new fleet of devices. The devices will be shipped directly to users from the vendor. You need to ensure that the devices automatically enroll in Microsoft Intune and receive a standard set of applications during the out-of-box experience (OOBE). Which Autopilot deployment profile should you assign?

Accepted Answer

User-Driven mode (Azure AD joined) with user-assigned apps.. User-Driven mode with Azure AD joined and user-assigned apps is correct because the devices are shipped directly to users, who will perform the OOBE themselves. This mode requires a user to sign in with Azure AD credentials, which triggers automatic enrollment in Microsoft Intune and applies the assigned user-targeted apps during the enrollment process.

Answer

Pre-provisioning (White Glove) mode with device-assigned apps.

Answer

Self-Deploying mode (Azure AD registered) with device-assigned apps.

Answer

Self-Deploying mode (Azure AD joined) with user-assigned apps.

Question 12

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not connected to the cloud service.. The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Answer

The device is not compliant with Intune compliance policies.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device does not have Microsoft Defender Antivirus enabled.

Question 13

You need to deploy a custom Windows 10 image to 100 new devices using Microsoft Intune. The devices are not yet enrolled. Which method should you use to deploy the image and enroll the devices?

Accepted Answer

Use Windows Autopilot to deploy a custom image and automatically enroll the devices.. Windows Autopilot is the correct method because it can deploy a custom Windows 10 image and automatically enroll devices into Intune, providing a zero-touch deployment experience. Option A is incorrect because PXE boot is not natively supported by Intune and a provisioning package alone cannot deploy an image. Option B is incorrect because creating a bootable USB and manually enrolling each device is not scalable for 100 devices and does not leverage Intune's automated enrollment. Option C is incorrect because while Configuration Manager can deploy images, co-management is an additional configuration and not the simplest approach for this scenario; Windows Autopilot is the recommended method for modern deployment with Intune.

Answer

Use PXE boot to deploy the image and then enroll via a provisioning package.

Answer

Create a bootable USB with the image and manually enroll each device.

Answer

Use Microsoft Configuration Manager to deploy the image and enroll via co-management.

Question 14

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

Accepted Answer

The enrollment restrictions are set to block personally owned devices.. The error 'This device is not allowed to enroll' typically occurs when enrollment restrictions block the device type or ownership. In this scenario, although iOS enrollment is allowed, the restriction likely blocks personally owned devices. If users are trying to enroll personal iOS devices, the restriction preventing personally owned devices would cause this error. Option A is incorrect because a conditional access policy requiring compliant devices blocks access to resources after enrollment, not the enrollment itself. Option B is incorrect because the Apple MDM push certificate is required for Intune to communicate with iOS devices, but a missing certificate would cause a different error related to certificate setup. Option D is incorrect because terms of use appear after the enrollment attempt and would not prevent the initial enrollment.

Answer

A conditional access policy requires compliant devices.

Answer

The Apple MDM push certificate is not configured.

Answer

The users have not accepted the terms of use.

Question 15

You need to configure Windows 10 devices to automatically encrypt their drives using BitLocker when they enroll in Microsoft Intune. You have created a BitLocker policy in Endpoint Security. However, after enrollment, some devices are not encrypted. You verify that the devices have a TPM 2.0 and meet hardware requirements. What is the most likely reason for the failure?

Accepted Answer

The BitLocker policy does not require a recovery password to be saved to Azure AD.. BitLocker requires a recovery key to be escrowed to Azure AD before encryption can proceed when managed via Intune. If the policy does not mandate saving the recovery password to Azure AD, the encryption process will fail silently on devices that meet all hardware prerequisites, including TPM 2.0. This is a common configuration oversight in Endpoint Security BitLocker policies.

Answer

The devices do not have Secure Boot enabled.

Answer

The TPM is not enabled in the BIOS.

Answer

The devices are not compliant with the BitLocker compliance policy.