MD-102 Prepare infrastructure for devices Practice Test 13 — 15 Questions

Question 1

You manage devices with Microsoft Intune. A user reports that their Windows 11 device is not receiving updates from Windows Update for Business. The device shows as compliant in Intune. You verify that update rings are assigned to the device. What should you check next?

Accepted Answer

Check the device's delivery optimization settings.. Option C is correct because delivery optimization settings control how Windows Update for Business downloads updates, and misconfigured settings (e.g., peer caching or bandwidth throttling) can prevent updates from being received even when update rings are properly assigned. Since the device is compliant and update rings are assigned, the next logical step is to verify that delivery optimization is not blocking or delaying the download. This aligns with Intune's troubleshooting workflow for Windows Update for Business issues.

Answer

Check if the device has a compliance policy that blocks updates.

Answer

Ensure that the device is not configured for dual scan.

Answer

Verify that the update ring is assigned to the correct Azure AD group.

Question 2

You need to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. The deployment must be available to users in the company portal. Which app type should you select?

Accepted Answer

Windows 10/11 (Microsoft 365 Apps). Option A is correct because Windows 10/11 (Microsoft 365 Apps) is the correct app type for deploying Office. Option B is wrong because it is for line-of-business apps. Option C is wrong because it is for web links. Option D is wrong because it is for store apps.

Answer

Microsoft 365 (Web link)

Answer

Microsoft Store app (new)

Answer

Windows app (Win32)

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that corporate data in managed apps is encrypted at rest. Which setting should you configure?

Accepted Answer

App protection policy – Data protection – Encrypt app data.. Option B is correct because App Protection Policies (APP) in Microsoft Intune include a 'Data Protection' setting called 'Encrypt app data' that enforces encryption of corporate data at rest on iOS/iPadOS devices. This setting uses hardware-backed file-level encryption (Data Protection class) to protect data in managed apps, ensuring that even if the device is lost or stolen, the data remains inaccessible without the user's passcode.

Answer

Device compliance policy – Require data encryption.

Answer

Enrollment restrictions – Require encrypted backup.

Answer

Device configuration profile – Encryption settings.

Question 4

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

Accepted Answer

Devices must have line-of-sight to an on-premises domain controller.. For hybrid Azure AD join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Answer

Devices must have VPN connectivity to Azure.

Answer

An Intune connector for Active Directory must be installed.

Answer

Azure AD Connect must be configured with password hash sync.

Question 5

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

Accepted Answer

Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.. Option A is correct because setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Answer

Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

Answer

Set 'Update deferral period (days)' to 7.

Answer

Set 'Update deferral period (days)' to 30.

Question 6

Your organization is planning to use Microsoft Intune for Windows device management. Which TWO components are required for a successful Windows Autopilot deployment?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is required for Windows Autopilot because it provides the identity and device registration infrastructure. Autopilot uses Entra ID to associate a device with its hardware hash (via the OEM or partner portal) and to authenticate the user during the out-of-box experience (OOBE). Without Entra ID, the device cannot be recognized as an Autopilot device and cannot join the cloud domain.

Answer

Microsoft Endpoint Manager (MDM authority)

Answer

Windows Server Active Directory

Answer

Microsoft Configuration Manager

Question 7

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Accepted Answer

Users must have an Intune license assigned.. Option A is correct because Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Answer

Devices must be connected via VPN.

Answer

Tenant must have Azure AD Premium P2.

Question 8

Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Bulk enrollment using provisioning package. Option D is correct because Windows provisioning packages (PPKG) created with Windows Configuration Designer allow bulk enrollment of Windows devices into Intune without user interaction. This method is ideal for large-scale deployments where devices are not yet Azure AD joined or Autopilot-registered, as the PPKG contains the enrollment credentials and settings to automatically join the device to Azure AD and enroll it in Intune during the out-of-box experience (OOBE).

Answer

VPN connection

Answer

Cloud Management Gateway

Answer

Azure AD join

Question 9

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

Accepted Answer

The device's group membership is still being processed, so policies are not yet applied.. Option C is correct because when a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet. The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Answer

The OMA-URI setting is invalid.

Answer

The device is not enrolled.

Answer

The device is not compliant.

Question 10

You are reviewing an ARM template for Intune device configuration. The exhibit shows a snippet. What will be the effect on Windows 10 devices?

Accepted Answer

Automatic updates will be disabled.. The ARM template snippet configures the 'UpdateNotificationLevel' setting to '1' (Disable all notifications), which is part of the 'Update' policy CSP. This setting disables automatic update checks and notifications, effectively preventing Windows 10 devices from automatically downloading and installing updates. The 'AllowAutoUpdate' setting is not present or set to '0', which would explicitly disable automatic updates, but the 'UpdateNotificationLevel' of '1' achieves the same outcome by suppressing all update-related notifications and background checks.

Answer

Users can sideload trusted apps.

Answer

Devices will receive updates from WSUS.

Answer

Developer unlock is allowed.

Question 11

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

Accepted Answer

Trigger a sync from Intune to force the device to check in.. The PowerShell command shown likely runs a compliance evaluation or sync action, but the device remains noncompliant because the evaluation results haven't been reported back to Intune. Triggering a sync from Intune forces the device to check in, upload its latest compliance status, and update the portal, which is the first troubleshooting step before considering re-enrollment or policy changes.

Answer

Re-enroll the device.

Answer

Delete the device from Intune and re-register.

Answer

Assign a new compliance policy to the device.

Question 12

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically receive the latest feature updates from the Windows 11 servicing channel. You configure a Windows 10 feature update policy targeting the devices. However, after 24 hours, devices still show Windows 10 version 22H2. What is the most likely cause?

Accepted Answer

The policy is a Windows 10 feature update policy, but devices need a Windows 11 feature update policy to upgrade to Windows 11.. A Windows 10 feature update policy is designed to move devices between Windows 10 feature versions (e.g., 22H2 to 23H2). To upgrade devices from Windows 10 to Windows 11, you must use a Windows 11 feature update policy, which specifically targets the Windows 11 servicing channel. Since the policy targets Windows 10 feature updates, it will not trigger the OS upgrade to Windows 11, leaving devices on Windows 10 22H2.

Answer

Windows Update for Business is disabled in group policy.

Answer

The policy is not assigned to a device group containing the devices.

Answer

Devices have not been restarted after policy assignment.

Question 13

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. Some devices running Windows 10 22H2 (build 19045.3803) are marked as noncompliant. What is the most likely reason?

Accepted Answer

The device has a password length of 6 characters, not meeting the minimum of 8.. Option A is correct because the compliance policy specifies a minimum password length of 8 characters, and devices with a password length of 6 characters fail this requirement. In Microsoft Intune, compliance policies evaluate device settings against defined rules, and a password length below the minimum is a common reason for noncompliance. The devices are running Windows 10 22H2 (build 19045.3803), which is within the allowed OS version range, so the issue is specifically the password policy.

Answer

The policy requires a firewall, but Windows Defender Firewall is disabled on the device.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device is running a build outside the allowed OS version range specified in the policy.

Question 14

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

Accepted Answer

Apple Automated Device Enrollment (ADE). Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Answer

Apple Configurator enrollment

Answer

Device Enrollment Manager (DEM) account

Answer

User-initiated enrollment via Company Portal

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Accepted Answer

Verify the device is a member of the assigned device group.. Option B is correct because the most common issue is that the assigned user or device group does not contain the target device. Option A is wrong because kiosk mode does not require a specific Windows edition; it works on Pro and Enterprise. Option C is wrong because Policy Manager is not a real Intune feature. Option D is wrong because notification is not required for kiosk mode to apply.

Answer

Ensure the device is running Windows 10 Enterprise.

Answer

Run the Policy Manager tool on the device.

Answer

Check the device's notification area for a policy update prompt.