MD-102 Prepare infrastructure for devices Practice Test 11 — 15 Questions

Question 1

Which THREE components are required for a successful Windows Autopilot self-deploying mode deployment?

Accepted Answer

Windows Autopilot device registration using the hardware hash.. Option B is correct because self-deploying mode requires the device to be registered in Windows Autopilot by uploading its hardware hash (a 4K hardware hash collected via Get-WindowsAutopilotInfo or by the OEM), which ties the physical device to the tenant so it can be targeted. Option D is correct because self-deploying mode relies on Entra ID device-based authentication using the device's TPM-attested identity, and the automatic MDM enrollment and device join scenarios require Microsoft Entra ID Premium P1 or P2 licensing. Option E is correct because a Windows Autopilot deployment profile (with the deployment mode set to Self-Deploying) must be assigned to the device or its group so the device knows to run the zero-touch, user-less OOBE flow. Option A is not required because self-deploying mode is designed to be user-less and creates no local admin account by default; the device is managed via Intune and Entra ID, not a local admin. Option C is not required because self-deploying mode performs device-based authentication and does not need a user account or a Microsoft 365 E3 user license assigned.

Answer

A local administrator account created on the device.

Answer

A Microsoft 365 E3 license assigned to the user.

Question 2

Which TWO Intune policies can be used to enforce encryption on macOS devices?

Accepted Answer

Device Configuration policy (Endpoint Protection) for FileVault.. Option E is correct because a macOS Device Compliance policy in Intune can include the FileVault requirement, which marks a device as noncompliant until FileVault full-disk encryption is enabled, allowing Conditional Access to enforce encryption. Option D is correct because an Intune Device Configuration policy using the Endpoint Protection template for macOS exposes FileVault settings, letting you configure and enforce FileVault disk encryption directly on the device. Options A and B are incorrect because BitLocker and the generic 'Disk Encryption' requirement apply to Windows, not macOS, and macOS compliance uses the FileVault-specific setting. Option C is incorrect because the Device Restrictions configuration template does not provide a Disk Encryption setting for enforcing FileVault on macOS.

Answer

Device Compliance policy that requires BitLocker.

Answer

Device Compliance policy that requires Disk Encryption.

Answer

Device Configuration policy (Device Restrictions) for Disk Encryption.

Question 3

You are the Microsoft 365 administrator for Contoso, Ltd. The company has an on-premises Active Directory Domain Services (AD DS) forest and uses Microsoft Entra ID. You need to implement Windows Autopilot for existing Windows 11 devices that are currently joined to AD DS and managed by Configuration Manager. The devices must become Microsoft Entra joined and enrolled in Microsoft Intune. What should you configure first?

Accepted Answer

The Windows Autopilot device registration using the hardware hash and a JSON file.. Windows Autopilot for existing devices requires the device to be registered in the Autopilot service. This is done by collecting the hardware hash and uploading it manually or via a script. Once registered, the device can be reset and then go through the Autopilot OOBE, joining Microsoft Entra ID and enrolling in Intune. Other options do not enable the initial registration.

Answer

A configuration profile in Microsoft Intune that applies the Autopilot deployment profile.

Answer

Microsoft Entra Connect with device writeback enabled.

Answer

A Group Policy object that redirects the device to Microsoft Entra join.

Question 4

You are setting up Microsoft Intune for a new company. The company wants to manage Windows 10 devices and iOS devices. You need to ensure that devices can enroll automatically when users sign in with their Microsoft Entra ID credentials. What should you configure first?

Accepted Answer

Set the MDM authority to Microsoft Intune.. The MDM authority must be set to Microsoft Intune before any enrollment can occur. This designates Intune as the management service. After that, you can configure automatic enrollment, assign licenses, and create groups. The other options are important but not the initial requirement.

Answer

Create device groups for Windows and iOS devices.

Answer

Configure automatic enrollment in Microsoft Entra ID.

Answer

Assign Intune licenses to all users.

Question 5

You are preparing infrastructure for deploying Windows 11 devices using Windows Autopilot. The devices are currently running Windows 10 and are joined to an on-premises Active Directory domain. You plan to use Autopilot in hybrid Microsoft Entra join mode. You need to ensure that the devices can complete the Autopilot process without requiring local administrator credentials. What should you configure?

Accepted Answer

Create an Intune connector for Active Directory and assign it to the domain.. The Intune connector for Active Directory is required for Autopilot hybrid Microsoft Entra join. It performs an offline domain join during OOBE, eliminating the need for local administrator credentials. Without this connector, the device cannot join the domain automatically, and the Autopilot process would fail or require manual intervention.

Answer

Enable the 'Skip AD connectivity check' setting in the Autopilot deployment profile.

Answer

Configure a Group Policy object to allow automatic domain join for unknown computers.

Answer

Deploy a PowerShell script via Intune that runs the Add-Computer cmdlet with stored credentials.

Question 6

You are an endpoint administrator for a company that uses Microsoft Intune. The company has a requirement that all Windows 10 devices must have the Windows Firewall enabled for all profiles (Domain, Private, Public). You create a compliance policy to enforce this. However, you notice that some devices are still reporting as compliant even though the firewall is disabled for the Public profile. What is the most likely cause?

Accepted Answer

The compliance policy is configured to check only the Private and Domain profiles, not the Public profile.. The Windows Firewall compliance setting in Intune can be scoped to specific profiles. If the Public profile is not selected, the policy will not evaluate it, and devices with the Public firewall disabled will still be compliant. To enforce all profiles, you must ensure that Domain, Private, and Public are all selected in the compliance policy settings.

Answer

The compliance policy only checks the Domain profile by default.

Answer

The device is not enrolled in Microsoft Defender for Endpoint, so the firewall status is not reported.

Answer

The compliance policy setting for Windows Firewall is configured to require the firewall for all profiles, but the device is not applying the policy due to a configuration conflict with a Group Policy object.

Question 7

You are configuring Microsoft Intune to manage Windows 10 devices. You need to ensure that devices can receive policies and applications. Which two actions must you perform? (Choose two.)

Accepted Answer

Set the MDM authority to Microsoft Intune.. To manage devices with Intune, you must set the MDM authority to Intune and assign Intune licenses to users. These are the foundational steps that enable enrollment and policy delivery. Other actions like automatic enrollment, groups, and compliance policies are important but not strictly required for devices to receive policies and applications.

Answer

Configure a compliance policy.

Answer

Create device groups in Intune.

Answer

Configure automatic enrollment in Microsoft Entra ID.

Question 8

You are the endpoint administrator for a company that uses Microsoft Intune. All Windows 11 devices are enrolled in Intune and are Microsoft Entra joined. You need to ensure that when a device is lost or stolen, you can remotely wipe it, and that the wipe removes all user data and settings but preserves the device's Microsoft Entra registration so it can be re-enrolled without reimaging. Which wipe action should you use?

Accepted Answer

Wipe device, but keep enrollment state and associated user account.. The requirement is to remotely wipe a lost device, remove all user data and settings, and preserve the Microsoft Entra registration so the device can be re-enrolled without reimaging. The wipe action that keeps enrollment state and the associated user account achieves this by resetting the device while maintaining its identity in Microsoft Entra ID and Intune. This allows the device to be re-enrolled seamlessly, which is ideal for a device that will be recovered and reused.

Answer

Retire device.

Answer

Fresh Start device.

Answer

Wipe device, and continue to wipe even if device loses power.

Question 9

You are an administrator for a company that uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices meet specific encryption requirements before they can access corporate email. You create a compliance policy that requires BitLocker to be enabled. After deployment, you notice that some devices show as compliant even though BitLocker is not enabled. What should you do to ensure that only devices with BitLocker enabled are marked compliant?

Accepted Answer

Configure the compliance policy to require BitLocker and enable 'Require BitLocker' under Device Health.. To ensure that only devices with BitLocker enabled are marked compliant, you must configure the compliance policy to require BitLocker under the Device Health section. This setting directly checks the BitLocker status. Other options do not affect the compliance evaluation for BitLocker.

Answer

Enable conditional access policy to require compliant devices.

Answer

Create a device configuration profile that enforces BitLocker and assign it to all devices.

Answer

Deploy a PowerShell script that checks for BitLocker and reports status to Intune.

Question 10

You are deploying Windows 11 devices using Windows Autopilot. The devices will be used by multiple users in a shared environment. You need to configure the Autopilot deployment profile to allow any user to sign in and use the device, and to ensure that the device is not tied to a single user. Which setting should you configure in the deployment profile?

Accepted Answer

Set 'Deployment mode' to 'User-driven' and assign the device to a group, then configure 'Shared PC' mode via a device configuration profile.. For a shared device where multiple users need to sign in with their own credentials, you should use User-driven mode in the Autopilot deployment profile. Additionally, you must configure a Shared PC device configuration profile to enable the shared device settings. This allows the device to be used by multiple users without being tied to a single user.

Answer

Set 'Deployment mode' to 'User-driven' and enable 'Allow pre-provisioned deployment'.

Answer

Set 'User-driven' mode to 'Pre-provisioned'.

Answer

Set 'Deployment mode' to 'Self-deploying'.

Question 11

You are planning the deployment of Windows 11 devices using Windows Autopilot. The devices will be joined to Microsoft Entra ID and managed by Microsoft Intune. You need to prepare the infrastructure so that the devices can be identified and assigned the correct deployment profile. Which two components must you configure? (Choose two.)

Accepted Answer

Register the device hardware hash in the Windows Autopilot Devices blade.. Autopilot requires devices to be known to the service through their hardware hash, and it requires a deployment profile assigned to a group containing those devices. Registering the hash enables identification, while the assigned profile controls the OOBE experience. Together these two components form the minimum infrastructure needed for a Microsoft Entra join Autopilot deployment.

Answer

Deploy the Microsoft Intune Management Extension to the devices.

Answer

Create a configuration profile that enables the Autopilot OOBE experience.

Answer

Configure a Microsoft Entra dynamic device group with a membership rule based on the enrollmentProfileName attribute.

Question 12

You are configuring Microsoft Intune to manage Windows 11 devices for a company named Fabrikam, Inc. The company uses a proxy server for all internet access. You need to ensure that devices can enroll in Intune and receive policies even when users are working remotely and connected through the proxy. You configure a device configuration profile with a custom OMA-URI setting to specify the proxy settings. Which OMA-URI path should you use to configure the proxy server for all users?

Accepted Answer

./Vendor/MSFT/Policy/Config/NetworkProxy/ProxyServer. To configure a system-wide proxy for all users on Windows devices, the correct OMA-URI is ./Vendor/MSFT/Policy/Config/NetworkProxy/ProxyServer. This policy CSP setting applies to the device and ensures that all applications, including the Intune Management Extension and Windows Push Notification Service, can communicate through the proxy. Other proxy-related OMA-URIs target specific applications and would not satisfy the requirement.

Answer

./Vendor/MSFT/Policy/Config/NetworkIsolation/EnterpriseProxyServers

Answer

./Vendor/MSFT/Policy/Config/Connectivity/Proxies

Answer

./Vendor/MSFT/Policy/Config/InternetExplorer/ProxySettings

Question 13

You are the Microsoft 365 Endpoint Administrator for Contoso, Ltd. Contoso has an on-premises Active Directory Domain Services (AD DS) forest and uses Microsoft Entra Connect to synchronize user accounts to Microsoft Entra ID. You must enroll 500 existing Windows 11 domain-joined computers into Microsoft Intune without reimaging them, while preserving the existing domain sign-in experience. You need to configure the devices to be managed by both AD DS and Microsoft Entra ID. What should you do?

Accepted Answer

Configure a Group Policy object that enables automatic MDM enrollment using user credentials, and assign the Intune license to each user.. To enroll existing domain-joined Windows 11 devices into Intune while keeping them joined to AD DS, you configure automatic MDM enrollment through Group Policy. This requires the devices to be running Windows 10/11 and the users to have Intune licenses. The Group Policy setting enables the device to automatically enroll into Intune when a user signs in, creating a hybrid Microsoft Entra join that maintains the on-premises domain sign-in.

Answer

Run the Windows Autopilot deployment for existing devices and upload the hardware hash to Intune.

Answer

Create a device enrollment manager account and use it to bulk enroll the devices via a provisioning package.

Answer

Deploy the Intune Company Portal app to each device and instruct users to sign in and enroll manually.

Question 14

You are the Intune administrator for a company that uses Apple devices. The company wants to enroll corporate-owned iPhones and iPads in Intune without requiring users to sign in with their Apple IDs. You need to configure a method that allows automatic enrollment and streamline the setup process. What should you do?

Accepted Answer

Configure Apple Automated Device Enrollment (ADE) with the Intune Company Portal.. Apple Automated Device Enrollment (ADE) integrated with Intune is the correct method for automatic enrollment of corporate-owned iOS devices without user Apple IDs. It provides a zero-touch experience during setup. Manual enrollment, Apple Configurator, and Entra ID automatic enrollment do not meet the requirements.

Answer

Configure Apple Configurator with a provisioning profile to enroll devices.

Answer

Set up Apple Business Manager (ABM) and enable automatic enrollment in Microsoft Entra ID.

Answer

Use the Intune Company Portal app for iOS and instruct users to enroll manually.

Question 15

You are configuring a Windows Autopilot deployment for a company that uses Microsoft Intune. The company wants to deploy devices to users who work remotely and do not have access to the corporate network. You need to ensure that the devices are joined to Microsoft Entra ID and enrolled in Intune without requiring the user to manually enter any enrollment information. Which Autopilot deployment mode should you use?

Accepted Answer

Self-deploying mode.. Self-deploying mode is the correct choice because it automatically joins the device to Microsoft Entra ID and enrolls it in Intune without any user interaction. It uses the device's TPM to authenticate, so no user credentials are needed. This is ideal for remote deployment scenarios where users are not present to enter information. User-driven mode requires sign-in, pre-provisioning requires a technician and user sign-in, and hybrid join requires domain connectivity.

Answer

User-driven mode with Microsoft Entra join.

Answer

Microsoft Entra hybrid join mode.

Answer

Pre-provisioning (white glove) mode.