MD-102 Prepare infrastructure for devices Practice Test 12 — 15 Questions

Question 1

You need to manage updates for Windows 10 devices using Microsoft Intune. You want to ensure that critical security updates are installed within 7 days of release, while feature updates are deferred for 60 days. Which approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Windows update ring policy with quality update deferral set to 7 days and feature update deferral set to 60 days.. Windows update ring policies in Microsoft Intune allow granular control over both quality (security) and feature update deferral periods. Setting quality update deferral to 7 days ensures critical security patches are installed within a week, while feature update deferral of 60 days delays non-security feature updates. This directly meets the requirement without additional profiles or compliance policies.

Answer

Create a Windows feature update profile to deploy the latest feature update after 60 days.

Answer

Create a device compliance policy requiring devices to install updates within 7 days.

Answer

Configure Windows Update for Business settings via a configuration profile.

Question 2

You are planning to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. Which TWO methods can you use to deploy Microsoft 365 Apps? (Choose two.)

Accepted Answer

Windows Installer (Win32) app type using the Office Deployment Tool.. The Windows Installer (Win32) app type in Intune allows you to deploy Microsoft 365 Apps using the Office Deployment Tool (ODT), which provides granular control over installation settings, languages, and update channels. Option E is correct because Intune includes a dedicated 'Microsoft 365 Apps for Windows' app type that simplifies deployment by automatically configuring the ODT XML and handling the installation process without manual scripting.

Answer

Android store app type.

Answer

Web link app type pointing to the Office website.

Answer

iOS store app type.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Accepted Answer

Windows Defender Application Control (WDAC).. Windows Defender Application Control (WDAC) is a code integrity feature that restricts which executables, scripts, and installers can run on Windows 10 devices. It uses a trust-based model where only binaries signed by approved publishers or with specific hash values are allowed, making it a core component for application control in an Intune-managed environment.

Answer

Windows Information Protection (WIP).

Answer

BitLocker drive encryption.

Question 4

You run the above PowerShell script to change the Windows Autopilot group tag for devices currently tagged as 'Sales' to 'Marketing'. You have assigned different deployment profiles to the 'Sales' and 'Marketing' group tags. After running the script, you check the Autopilot devices in Intune and see that the group tag for the devices has changed. However, the devices still apply the 'Sales' deployment profile during OOBE. What is the most likely reason?

Accepted Answer

The deployment profile assignment is based on the group tag at the time of enrollment; existing devices retain the original profile.. The group tag is evaluated at the time of enrollment to determine which deployment profile to assign. Changing the group tag on an already-enrolled device does not retroactively change the profile assignment; the device retains the profile that was applied during its original OOBE. This is by design in Windows Autopilot, as the profile is bound to the device record at enrollment.

Answer

The deployment profile is assigned to the device by device ID, not group tag.

Answer

The script needs to include a step to remove the device from Autopilot and re-import it.

Answer

The script did not sync the device details to Intune after changing the group tag.

Question 5

You have deployed the above Endpoint Protection configuration profile to Windows 10 devices. Some users report that their devices are not encrypted. You verify that the devices have TPM 2.0 and meet hardware requirements. What is the most likely cause?

Accepted Answer

The policy does not configure recovery key escrow to Azure AD.. When BitLocker encryption is enabled via an Endpoint Protection configuration profile in Microsoft Intune, the policy must include recovery key escrow to Azure AD for encryption to proceed. Without this setting, BitLocker will not encrypt the drive, even if the device meets TPM and hardware requirements. The policy in question likely has the 'Require BitLocker recovery key to be stored in Azure AD' option set to 'Not configured' or 'No', which prevents encryption from starting.

Answer

The policy disables encryption for the OS drive.

Answer

The devices do not have a TPM chip.

Answer

The encryption method is not supported by the devices.

Question 6

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

Accepted Answer

Provide the vendor with a bulk enrollment token and URL.. Providing the vendor with a bulk enrollment token (also known as an Autopilot registration token) and the associated URL allows the vendor to register devices in your tenant via Autopilot without granting full user privileges. This token is specifically designed for OEMs or resellers to upload device hashes and associate them with your tenant, scoping their permissions to only that action. Option D is incorrect because a 'custom device preparation profile with delegated admin privileges' is not a standard or recognized method for Autopilot device registration by vendors; the correct approach is to use an Autopilot registration token or delegate via Microsoft Partner Center.

Answer

Export the device list from the vendor and import it via CSV in Microsoft Intune.

Answer

Add the vendor as a global administrator in Microsoft Entra ID.

Answer

Create a custom device preparation profile with delegated admin privileges.

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

Accepted Answer

Set feature update deferral to 120 days and quality update deferral to 30 days.. The Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Answer

Set feature update deferral to 180 days and quality update deferral to 0 days.

Answer

Set feature update deferral to 30 days and quality update deferral to 120 days.

Answer

Set both feature and quality update deferrals to 60 days.

Question 8

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

Accepted Answer

Include the 'Language' and 'RegionalSettings' settings in the PPKG.. Windows Configuration Designer (WCD) directly supports configuring language and regional settings within a provisioning package (PPKG) through built-in settings. Including the 'Language' and 'RegionalSettings' settings in the PPKG ensures these configurations are applied during the out-of-box experience (OOBE) or provisioning process, without requiring additional scripts or policies. This is the most efficient and supported method for offline or Autopilot pre-provisioning scenarios.

Answer

Add a PowerShell script that runs during Autopilot to set language and region.

Answer

Assign an Intune Language Pack policy to the device group.

Answer

Create a Group Policy Object that sets language and region, and link it to the device OU.

Question 9

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

Accepted Answer

The update ring is not assigned to the device's group.. The device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Answer

The update ring is configured with an incorrect deferral period.

Answer

The device is not compliant with the security baseline.

Answer

Windows Update is blocked by the corporate firewall.

Question 10

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

Accepted Answer

Use the remote lock action in Intune and provide a custom message.. The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Answer

Enable lost mode on the device via Apple Business Manager.

Answer

Configure a device compliance policy to wipe the device on non-compliance.

Answer

Initiate a remote assistance session to lock the device.

Question 11

You are responsible for deploying Microsoft 365 Apps for enterprise to Windows 10 devices using Microsoft Intune. You want to ensure that users receive the Current Channel with updates delivered directly from the Office Content Delivery Network (CDN). You also want to minimize bandwidth usage on your network. What should you configure?

Accepted Answer

Enable delivery optimization and set the Office update channel to Current Channel.. To minimize bandwidth when deploying Office updates from the CDN, you need to enable delivery optimization with peer-to-peer distribution. This allows devices to share update content locally, reducing downloads from the internet. Setting the update channel to Current Channel ensures users receive the latest features. Therefore, option D is correct because it combines delivery optimization and the appropriate update channel. Option A is incorrect because BranchCache is not used for Office updates. Option B is incorrect because while the CDN is the default update source, it alone does not minimize bandwidth. Option C is incorrect because disabling peer-to-peer (as in disabling delivery optimization) would increase bandwidth usage.

Answer

Configure a local update server using BranchCache.

Answer

Set the update path to the Office CDN and enable Office automatic updates.

Answer

Use a configuration profile to disable peer-to-peer distribution.

Question 12

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

Accepted Answer

Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.. The device is hybrid Azure AD joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Answer

Re-enroll the device in Intune.

Answer

Ensure the device has internet connectivity.

Answer

Assign a compliance policy to the device.

Question 13

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

Accepted Answer

Use a provisioning package (PPKG) to reset the device and register it for Autopilot.. Using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Answer

Assign an Autopilot deployment profile to the device group in Intune.

Answer

Export the hardware hash from each device and upload it manually to Intune.

Answer

Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

Question 14

You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?

Accepted Answer

Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.. Enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.

Answer

Configure a device compliance policy to mark the device as non-compliant.

Answer

Enable 'Manual investigation' in the endpoint security policy.

Answer

Create an alert rule in Microsoft Defender XDR to notify administrators.

Question 15

You are planning to deploy Microsoft Intune for device management. Which ONE of the following is a prerequisite for enrolling Windows 10 devices in Intune?

Accepted Answer

Microsoft Intune license assigned to the user.. Option B is the correct prerequisite: a Microsoft Intune license must be assigned to the user enrolling the device. Option A (Microsoft Entra ID Premium P1/P2) is not required; Microsoft Entra ID Free is sufficient for Intune enrollment. Option C (Microsoft account) is not needed for corporate devices. Option D (Microsoft 365 E3) is a bundled subscription but not a standalone prerequisite. Option E (Azure Information Protection) is unrelated to device enrollment. Therefore, only one option is correct.

Answer

Microsoft Entra ID (Azure AD) Premium P1 or P2.

Answer

A Microsoft account (MSA) for each user.

Answer

Microsoft 365 E3 subscription.

Answer

Azure Information Protection license.