MD-102 Prepare infrastructure for devices Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

Accepted Answer

Use the remote lock action in Intune and provide a custom message.. The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Answer

Enable lost mode on the device via Apple Business Manager.

Answer

Configure a device compliance policy to wipe the device on non-compliance.

Answer

Initiate a remote assistance session to lock the device.

Question 2

You are responsible for deploying Microsoft 365 Apps for enterprise to Windows 10 devices using Microsoft Intune. You want to ensure that users receive the Current Channel with updates delivered directly from the Office Content Delivery Network (CDN). You also want to minimize bandwidth usage on your network. What should you configure?

Accepted Answer

Enable delivery optimization and set the Office update channel to Current Channel.. To minimize bandwidth, you can enable peer-to-peer distribution and configure delivery optimization. Option C is correct because enabling delivery optimization with peer-to-peer reduces network load. Option A is wrong because CDN is the default but does not minimize bandwidth. Option B is wrong because BranchCache is not used for Office updates. Option D is wrong because peer-to-peer is the recommended approach.

Answer

Configure a local update server using BranchCache.

Answer

Set the update path to the Office CDN and enable Office automatic updates.

Answer

Use a configuration profile to disable peer-to-peer distribution.

Question 3

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

Accepted Answer

Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.. The device is hybrid Azure AD joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Answer

Re-enroll the device in Intune.

Answer

Ensure the device has internet connectivity.

Answer

Assign a compliance policy to the device.

Question 4

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

Accepted Answer

Use a provisioning package (PPKG) to reset the device and register it for Autopilot.. Option C is correct because using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Answer

Assign an Autopilot deployment profile to the device group in Intune.

Answer

Export the hardware hash from each device and upload it manually to Intune.

Answer

Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

Question 5

You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?

Accepted Answer

Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.. Option D is correct because enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.

Answer

Configure a device compliance policy to mark the device as non-compliant.

Answer

Enable 'Manual investigation' in the endpoint security policy.

Answer

Create an alert rule in Microsoft Defender XDR to notify administrators.

Question 6

You are planning to deploy Microsoft Intune for device management. Which TWO of the following are prerequisites for enrolling Windows 10 devices in Intune?

Accepted Answer

Microsoft Entra ID (Azure AD) Premium P1 or P2.. Microsoft Entra ID (Azure AD) Premium P1 or P2 is a prerequisite because Intune relies on Azure AD for identity and conditional access policies. Without a Premium license, you cannot configure device compliance policies, deploy Windows Hello for Business, or use advanced features like Autopilot. This requirement ensures the tenant has the necessary identity management capabilities to support Intune enrollment and management.

Answer

A Microsoft account (MSA) for each user.

Answer

Microsoft 365 E3 subscription.

Answer

Azure Information Protection license.

Question 7

You are configuring Windows Hello for Business in Microsoft Intune. Which THREE settings are required to enable Windows Hello for Business on Windows 10 devices?

Accepted Answer

Set minimum PIN length to at least 4 digits.. Option B is correct because Windows Hello for Business requires a minimum PIN length of at least 4 digits when configured via Intune's identity protection policy. This setting is mandatory to enforce a baseline level of security for the PIN-based authentication method, and Intune will not enable Windows Hello for Business without a defined minimum PIN length.

Answer

Configure a certificate enrollment policy for smart cards.

Answer

Enable biometric authentication.

Question 8

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Accepted Answer

Assign to a device group.. Option D is correct because Microsoft Intune supports assigning Microsoft 365 Apps for enterprise directly to device groups, which ensures the application is installed on the specified devices regardless of which user signs in. This method is useful for shared or kiosk devices where user-based assignment would not apply. Option E is correct because assigning to a Microsoft Entra ID user group is the standard method for user-based deployment, allowing the apps to be provisioned based on user identity.

Answer

Assign to individual users directly.

Answer

Assign to a distribution group.

Answer

Assign to a dynamic group using device attributes.

Question 9

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

Accepted Answer

A device with OS version 10.0.17134.2 (build 1803).. The compliance policy targets Windows 10 version 1803 (build 17134.1). A device with OS version 10.0.17134.2 (build 1803) is non-compliant because its build number (17134.2) is higher than the policy's specified minimum version (17134.1), and compliance policies typically enforce a minimum OS version, not an exact match. Any device with a build number greater than the policy's defined version is marked non-compliant unless the policy explicitly allows higher versions.

Answer

A device with OS version 10.0.16299.0 (build 1709).

Answer

A device with OS version 10.0.17134.1 (build 1803).

Answer

A device with OS version 10.0.15063.0 (build 1703).

Question 10

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

Accepted Answer

Upload the hardware hash to Microsoft Intune to register the device.. The device is not yet registered in Autopilot. You need to upload the hardware hash to Intune. Option A is correct. Option B is wrong because even if the device is already registered, the 'Unknown' state indicates it is not. Option C is wrong because using a provisioning package is not needed if Autopilot is desired. Option D is wrong because the script already works; re-running won't help.

Answer

Assign an Autopilot deployment profile to the device group.

Answer

Run the script again with the -Online parameter.

Answer

Use a provisioning package to set up the device manually.

Question 11

Refer to the exhibit. You create a new update ring policy for Windows 10 devices. You assign the policy to a test group. After a week, you notice that no devices have installed any quality updates. Devices are online and enrolled. What is the most likely reason?

Accepted Answer

Devices are assigned a different update ring policy that defers quality updates.. The policy sets QualityUpdateDeferralInDays to 0, which means no deferral, but if the pause start date is null, updates should install. However, if the devices are not receiving updates, it could be that the policy is not applied. But the exhibit shows that quality update deferral is 0, so quality updates should be installed immediately. Option C is correct because if the quality update pause start date is not set, it does not pause updates. Actually, the issue might be that the policy is not assigned correctly. But given the options, Option B is plausible: If the devices have a conflicting update ring policy that defers quality updates, they might not install. Option A is wrong because feature update deferral does not affect quality updates. Option D is wrong because the policy does not pause quality updates.

Answer

The feature update deferral period is too long.

Answer

The quality update pause start date is set to a future date.

Answer

The policy requires a restart to take effect.

Question 12

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

Accepted Answer

Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.. Option A is correct because a Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Answer

Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

Answer

Set a device compliance policy that requires device name prefix 'CORP-'.

Answer

Modify the Enrollment Status Page (ESP) policy to require device naming.

Question 13

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the system context during automatic enrollment. The script must run before the user logs on. Which approach should you use?

Accepted Answer

Add the script as a device management extension (PowerShell script) in Intune, assigned to 'All Devices'.. Option A is correct because device management extension (PowerShell scripts) in Microsoft Intune run in the system context and execute during automatic enrollment before the user logs on. This is the only Intune method that supports system-context script execution at enrollment time without requiring a user session.

Answer

Assign the script as a compliance policy remediation.

Answer

Deploy the script as a proactive remediation in Microsoft Intune.

Answer

Embed the script in a device configuration profile using a custom OMA-URI.

Question 14

You are troubleshooting an Autopilot deployment where devices are not receiving the expected configuration policies after enrollment. The devices show as enrolled in Intune but are stuck in a 'pending' state for policy application. What is the most likely cause?

Accepted Answer

The user does not have an assigned Intune license.. When a device is enrolled in Intune but stuck in a 'pending' state for policy application, the most common cause is that the user account lacks an assigned Intune license. Without a license, the user cannot synchronize policies from the Intune service, even though the device itself appears in the console. This is a prerequisite for policy delivery and is often overlooked during troubleshooting.

Answer

The device is not registered in Autopilot.

Answer

The device has a slow internet connection.

Answer

The Autopilot profile is set to 'offline' mode.

Question 15

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

Accepted Answer

Create a Conditional Access policy requiring device to be marked as compliant.. Option D is correct because a Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Answer

Create an app protection policy for Windows 365 app.

Answer

Configure the Cloud PC provisioning policy to allow only compliant devices.

Answer

Assign a device compliance policy to all users.