MD-102 Prepare infrastructure for devices Practice Test 12 — 15 Questions

Question 1

You are planning to deploy Windows 11 devices using Windows Autopilot in a hybrid Microsoft Entra ID join configuration. You need to ensure that the devices can authenticate to the on-premises Active Directory domain during OOBE. Which two components are required to support this configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An Intune Connector for Active Directory.. Hybrid Microsoft Entra ID join during Autopilot requires the Intune Connector for Active Directory to create the computer account, and the device must have network connectivity to a domain controller to complete the domain join during OOBE. Both are essential for successful hybrid join.

Answer

A Windows Autopilot deployment profile with hybrid join settings.

Answer

A VPN connection configured on the device.

Answer

Microsoft Entra Connect synchronization configured for device writeback.

Question 2

You are configuring Windows Autopilot for pre-provisioned deployment (white glove) for a batch of Windows 11 devices. You need to ensure that the device is pre-provisioned and then shipped to the user for final setup. Which Autopilot profile setting must be configured to allow pre-provisioning?

Accepted Answer

Enable the Autopilot pre-provisioning (white glove) setting in the deployment profile.. To use Windows Autopilot pre-provisioned deployment, you must enable the pre-provisioning (white glove) setting in the Autopilot deployment profile. This allows the device to be pre-provisioned by IT or the OEM, then shipped to the user for final setup. The other options do not enable pre-provisioning; they are either unrelated settings or incorrect assignment methods.

Answer

Assign the Autopilot profile to a user group.

Answer

Set Convert all targeted devices to Autopilot to Yes.

Answer

Configure the Enrollment Status Page (ESP) to block device use until all apps are installed.

Question 3

You are configuring Microsoft Intune to manage Windows 11 devices. You need to ensure that devices meet specific compliance requirements before users can access corporate email. The compliance policy must check for BitLocker encryption and require a minimum OS version. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a compliance policy in the Microsoft Intune admin center with rules for BitLocker and OS version.. To enforce compliance for email access, you need a compliance policy that defines the requirements and a Conditional Access policy that blocks access for non-compliant devices. The compliance policy evaluates device state, while Conditional Access enforces the access decision. Together, they ensure only compliant devices can access corporate email.

Answer

Create a device configuration profile to set the minimum OS version.

Answer

Deploy a PowerShell script to enable BitLocker on all devices.

Answer

Assign the compliance policy to a group containing all users.

Question 4

You are an endpoint administrator for a company that uses Microsoft Intune. The company has a set of Windows 10 devices that are managed by Configuration Manager. You need to configure co-management so that the devices can be managed by both Configuration Manager and Intune. You want to enable the workload for device configuration to be managed by Intune. Which prerequisite must be met before you can move the device configuration workload to Intune?

Accepted Answer

The devices must be running Windows 10 version 1709 or later and be enrolled in Intune.. To enable co-management and move the device configuration workload to Intune, devices must meet the minimum OS requirement of Windows 10 version 1709 or later and be enrolled in Intune. These prerequisites ensure that the devices can receive and apply policies from Intune. Other requirements, such as Configuration Manager version and cloud management gateway, are important but not strictly necessary for this specific workload transition.

Answer

The Configuration Manager site must be upgraded to version 1806 or later and have a cloud management gateway configured.

Answer

The devices must be enrolled in Microsoft Entra ID and have the Configuration Manager client installed.

Answer

The devices must be domain-joined and have a direct connection to the Configuration Manager site server.

Question 5

You are deploying Windows 11 devices using Windows Autopilot. The devices are Microsoft Entra joined and managed by Microsoft Intune. You need to ensure that during the out-of-box experience (OOBE), the device automatically configures the region, keyboard, and language based on the user's Microsoft Entra ID profile. What should you configure?

Accepted Answer

In the Autopilot deployment profile, set 'User-driven' mode and enable 'Automatically configure keyboard'.. The 'Automatically configure keyboard' setting in a user-driven Autopilot profile uses the user's Microsoft Entra ID profile to set the region, keyboard, and language during OOBE. This streamlines the setup experience by eliminating manual selection. It requires the deployment mode to be user-driven so that the user signs in with their Microsoft Entra ID credentials.

Answer

In the Autopilot deployment profile, set 'Self-deploying' mode.

Answer

In the Autopilot deployment profile, set 'Pre-provisioned' mode.

Answer

In the Autopilot deployment profile, set 'User-driven' mode and enable 'Hide EULA'.

Question 6

You are configuring a Windows Autopilot deployment for a group of remote users. The users will receive new devices directly from the manufacturer. You need to ensure that the devices are automatically enrolled in Microsoft Intune and that the users are not prompted to select a language, keyboard, or region during OOBE. You also want to prevent users from accessing the desktop until all device-targeted applications are installed. Which Autopilot profile setting should you configure?

Accepted Answer

Configure 'Enrollment Status Page (ESP)' to block device use until all apps are installed. The Enrollment Status Page (ESP) is designed to block device use until all required applications and policies are applied. Configuring ESP to block device use until all apps are installed meets the requirement to prevent desktop access. Other settings like user account type, pre-provisioning, and hiding EULA do not provide this blocking behavior.

Answer

Enable 'Pre-provisioning' (white glove)

Answer

Set 'User account type' to 'Standard User'

Answer

Set 'Out-of-box experience (OOBE)' to 'Hide EULA' and 'Hide privacy settings'

Question 7

You are deploying Windows 11 devices using Windows Autopilot in a Microsoft Intune environment. You need to ensure that the devices are joined to Microsoft Entra ID and automatically enrolled in Intune. You have created a deployment profile and assigned it to a device group. However, during testing, you find that devices are not joining Microsoft Entra ID. What is the most likely cause?

Accepted Answer

The deployment profile is configured for Microsoft Entra hybrid join instead of Microsoft Entra join.. The most likely cause is that the Autopilot deployment profile is configured for Microsoft Entra hybrid join instead of Microsoft Entra join. Hybrid join requires additional on-premises configuration (such as a domain controller and connector), and if not properly set up, the join fails. Since the requirement is Microsoft Entra join, the profile must be set to Microsoft Entra join, not hybrid.

Answer

The devices are not registered with the Windows Autopilot service.

Answer

Automatic enrollment is not enabled in Microsoft Entra ID.

Answer

The deployment profile is assigned to a user group instead of a device group.

Question 8

You are the endpoint administrator for a company that uses Microsoft Intune. The company has a requirement that all Windows 10 devices must use a specific set of DNS servers for name resolution. You create a device configuration profile using the custom OMA-URI setting ./Vendor/MSFT/Policy/Config/Connectivity/NameResolutionServers. After assigning the profile to a group of devices, you notice that the DNS settings are not applied. What is the most likely reason?

Accepted Answer

The OMA-URI value must be formatted as a comma-separated list of IP addresses without spaces, and the profile must be assigned to a device group, not a user group.. The NameResolutionServers OMA-URI requires a specific value format: a comma-separated list of IP addresses with no spaces, and it must be assigned to device groups because it is a device-level policy. If the value is incorrectly formatted or the profile is assigned to user groups, the DNS settings will not be applied. Ensuring the correct format and assignment scope resolves the issue.

Answer

The custom OMA-URI setting requires a reboot, and the devices have not been restarted since the profile was assigned.

Answer

The devices are not enrolled in Microsoft Entra ID, which is required for custom OMA-URI settings to apply.

Answer

The OMA-URI path is incorrect; the correct path is ./Vendor/MSFT/Policy/Config/Network/DNS.

Question 9

You are the Microsoft 365 Endpoint Administrator for a company that uses Microsoft Intune. The company has a requirement that all Windows 11 devices must be encrypted with BitLocker and that the recovery keys are escrowed to Microsoft Entra ID. You have configured a BitLocker disk encryption policy in Intune. However, you notice that some devices are not encrypting automatically. You need to ensure that BitLocker encryption is enforced on all devices. What should you do?

Accepted Answer

Configure the 'Silent enablement of BitLocker' setting to 'Enable' in the BitLocker disk encryption policy.. To enforce BitLocker encryption automatically, you must enable the 'Silent enablement of BitLocker' setting in the BitLocker disk encryption policy. This setting allows the device to encrypt without user interaction, provided the device meets the prerequisites such as TPM and a valid recovery key escrow configuration. Other settings like compliance policies only report status, and 'Require Device Encryption' alone does not force encryption if prerequisites are not met.

Answer

Configure the 'Allow Standard Users to Enable Encryption During Azure AD Join' setting to 'Allow'.

Answer

Configure a compliance policy that requires BitLocker and set the action for noncompliance to 'Mark device noncompliant'.

Answer

Enable the 'Require Device Encryption' setting in the BitLocker disk encryption policy.

Question 10

You are planning to deploy Windows 11 devices using Windows Autopilot in a hybrid Microsoft Entra ID join configuration. You need to ensure that the devices can authenticate to the on-premises Active Directory domain during OOBE. Which two components are required to support this configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an Autopilot deployment profile to the devices. To enable automatic enrollment in Intune via Windows Autopilot, you must first register the devices as Autopilot devices so they are recognized, and then assign an Autopilot deployment profile to define the enrollment settings. Other actions like Wi-Fi configuration, conditional access, and licensing are important but not directly required for the enrollment mechanism itself.

Answer

Configure a conditional access policy to require compliant devices

Answer

Assign Intune licenses to the users

Answer

Create a device configuration profile for Wi-Fi settings

Question 11

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.

Question 12

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

Accepted Answer

Add a compliance policy setting: 'Require the device to be at or under the machine risk score' with a low score.. Microsoft Defender for Endpoint integrates with Intune compliance policies via the 'Require the device to be at or under the machine risk score' setting. When a device stops reporting to Defender, its risk score escalates above the 'Low' threshold, causing Intune to mark it as non-compliant. This directly meets the requirement to flag non-reporting devices without additional scripting or conditional access complexity.

Answer

Create a Conditional Access policy requiring device compliance and blocking access if not compliant.

Answer

Enable 'Require BitLocker' compliance setting.

Answer

Deploy a PowerShell script via Intune that checks the Defender service status and reports to Intune custom compliance.

Question 13

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

Accepted Answer

Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.. It leverages Configuration Manager's 'Windows 10/11 feature update' servicing plan, which is specifically designed for in-place upgrades while preserving user data and settings. Enabling Delivery Optimization for peer-to-peer download reduces bandwidth consumption in remote offices by allowing devices to share upgrade content locally, addressing the limited bandwidth constraint.

Answer

Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.

Answer

Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.

Answer

Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.

Question 14

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

Accepted Answer

Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.. Update rings are the primary policy in Microsoft Intune for controlling how and when Windows 10 and later devices receive updates from Windows Update. Setting 'Automatic update behavior' to 'Auto install and reboot' ensures that critical and security updates are automatically downloaded and installed without user intervention, meeting the requirement for all Windows 11 devices.

Answer

Configure a device configuration profile with 'Windows Update for Business' settings.

Answer

Deploy a feature update policy to install the latest quality updates.

Answer

Create a device compliance policy that requires devices to have the latest updates.

Question 15

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices to authenticate to a corporate Wi-Fi network. Which TWO methods can you use to deploy the certificate?

Accepted Answer

Create a SCEP certificate profile in Intune.. A SCEP certificate profile in Intune allows iOS/iPadOS devices to request a certificate from a Simple Certificate Enrollment Protocol (SCEP) server, which can then be used for Wi-Fi authentication. This method supports automated enrollment and renewal of certificates without manual intervention, making it suitable for large-scale deployments.

Answer

Create a device compliance policy that includes the certificate.

Answer

Create a Wi-Fi profile and embed the certificate in the profile.

Answer

Create a VPN profile that includes the certificate.