MD-102 Prepare infrastructure for devices Practice Test 13 — 15 Questions

Question 1

You are configuring Windows Hello for Business in Microsoft Intune. Which THREE settings are required to enable Windows Hello for Business on Windows 10 devices?

Accepted Answer

Set minimum PIN length to at least 4 digits.. Windows Hello for Business requires a minimum PIN length of at least 4 digits when configured via Intune's identity protection policy. This setting is mandatory to enforce a baseline level of security for the PIN-based authentication method, and Intune will not enable Windows Hello for Business without a defined minimum PIN length.

Answer

Configure a certificate enrollment policy for smart cards.

Answer

Enable biometric authentication.

Question 2

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Accepted Answer

Assign to a device group.. Microsoft Intune supports assigning Microsoft 365 Apps for enterprise directly to device groups, which ensures the application is installed on the specified devices regardless of which user signs in. This method is useful for shared or kiosk devices where user-based assignment would not apply. Option E is correct because assigning to a Microsoft Entra ID user group is the standard method for user-based deployment, allowing the apps to be provisioned based on user identity.

Answer

Assign to individual users directly.

Answer

Assign to a distribution group.

Answer

Assign to a dynamic group using device attributes.

Question 3

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

Accepted Answer

A device with OS version 10.0.16299.0 (build 1709).. The compliance policy specifies a minimum OS version of 10.0.17134.1 (build 1803). Devices with an OS version lower than this minimum are marked non-compliant. Options A (build 16299.0, version 1709) and D (build 15063.0, version 1703) are both below the minimum, so they are non-compliant. Option B matches exactly and is compliant. Option C has a higher build (17134.2), which exceeds the minimum, making it compliant.

Answer

A device with OS version 10.0.17134.1 (build 1803).

Answer

A device with OS version 10.0.17134.2 (build 1803).

Question 4

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

Accepted Answer

Upload the hardware hash to Microsoft Intune to register the device.. The Get-AutopilotInfo script collects the hardware hash and device details but does not automatically register the device with Autopilot. A 'DeviceState' of 'Unknown' and 'AssignmentStatus' of 'NotAssigned' indicate the device is not yet registered in Intune. Uploading the hardware hash to Intune is the required first step to register the device, enabling Autopilot to recognize it and assign profiles.

Answer

Assign an Autopilot deployment profile to the device group.

Answer

Run the script again with the -Online parameter.

Answer

Use a provisioning package to set up the device manually.

Question 5

Refer to the exhibit. You create a new update ring policy for Windows 10 devices. You assign the policy to a test group. After a week, you notice that no devices have installed any quality updates. Devices are online and enrolled. What is the most likely reason?

Accepted Answer

Devices are assigned a different update ring policy that defers quality updates.. The most likely reason is that devices are assigned a different update ring policy that defers quality updates. In Microsoft Intune, if multiple update ring policies are assigned to a device, the policy with the most restrictive settings (i.e., the highest deferral or pause) takes precedence. Even though the new policy sets QualityUpdateDeferralInDays to 0, an existing policy with a positive deferral would delay installation. Option B is incorrect because feature update deferral does not affect quality updates. Option C is incorrect because the pause start date is not set; a null value means no pause. Option D is incorrect because the policy takes effect without requiring a restart; updates install based on deferral settings.

Answer

The feature update deferral period is too long.

Answer

The quality update pause start date is set to a future date.

Answer

The policy requires a restart to take effect.

Question 6

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

Accepted Answer

Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.. A Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Answer

Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

Answer

Set a device compliance policy that requires device name prefix 'CORP-'.

Answer

Modify the Enrollment Status Page (ESP) policy to require device naming.

Question 7

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the system context during automatic enrollment. The script must run before the user logs on. Which approach should you use?

Accepted Answer

Add the script as a device management extension (PowerShell script) in Intune, assigned to 'All Devices'.. Device management extension (PowerShell scripts) in Microsoft Intune run in the system context and execute during automatic enrollment before the user logs on. This is the only Intune method that supports system-context script execution at enrollment time without requiring a user session.

Answer

Assign the script as a compliance policy remediation.

Answer

Deploy the script as a proactive remediation in Microsoft Intune.

Answer

Embed the script in a device configuration profile using a custom OMA-URI.

Question 8

You are troubleshooting an Autopilot deployment where devices are not receiving the expected configuration policies after enrollment. The devices show as enrolled in Intune but are stuck in a 'pending' state for policy application. What is the most likely cause?

Accepted Answer

The user does not have an assigned Intune license.. When a device is enrolled in Intune but stuck in a 'pending' state for policy application, the most common cause is that the user account lacks an assigned Intune license. Without a license, the user cannot synchronize policies from the Intune service, even though the device itself appears in the console. This is a prerequisite for policy delivery and is often overlooked during troubleshooting.

Answer

The device is not registered in Autopilot.

Answer

The device has a slow internet connection.

Answer

The Autopilot profile is set to 'offline' mode.

Question 9

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

Accepted Answer

Create a Conditional Access policy requiring device to be marked as compliant.. A Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Answer

Create an app protection policy for Windows 365 app.

Answer

Configure the Cloud PC provisioning policy to allow only compliant devices.

Answer

Assign a device compliance policy to all users.

Question 10

You manage devices with Microsoft Intune. A user reports that their Windows 11 device is not receiving updates from Windows Update for Business. The device shows as compliant in Intune. You verify that update rings are assigned to the device. What should you check next?

Accepted Answer

Check the device's delivery optimization settings.. Delivery optimization settings control how Windows Update for Business downloads updates, and misconfigured settings (e.g., peer caching or bandwidth throttling) can prevent updates from being received even when update rings are properly assigned. Since the device is compliant and update rings are assigned, the next logical step is to verify that delivery optimization is not blocking or delaying the download. This aligns with Intune's troubleshooting workflow for Windows Update for Business issues.

Answer

Check if the device has a compliance policy that blocks updates.

Answer

Ensure that the device is not configured for dual scan.

Answer

Verify that the update ring is assigned to the correct Azure AD group.

Question 11

You need to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. The deployment must be available to users in the company portal. Which app type should you select?

Accepted Answer

Windows 10/11 (Microsoft 365 Apps). The 'Windows 10/11 (Microsoft 365 Apps)' app type in Intune is specifically designed to deploy Microsoft 365 Apps (formerly Office 365 ProPlus) with built-in support for the Office Deployment Tool (ODT) and XML configuration. This app type automatically handles the installation, updates, and licensing via the Microsoft 365 Apps for enterprise channel, and it appears in the Company Portal for user-initiated installation. Other app types lack the native integration for Microsoft 365 Apps deployment or do not support user-visible installation in the Company Portal.

Answer

Microsoft 365 (Web link)

Answer

Microsoft Store app (new)

Answer

Windows app (Win32)

Question 12

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that corporate data in managed apps is encrypted at rest. Which setting should you configure?

Accepted Answer

App protection policy – Data protection – Encrypt app data.. App Protection Policies (APP) in Microsoft Intune include a 'Data Protection' setting called 'Encrypt app data' that enforces encryption of corporate data at rest on iOS/iPadOS devices. This setting uses hardware-backed file-level encryption (Data Protection class) to protect data in managed apps, ensuring that even if the device is lost or stolen, the data remains inaccessible without the user's passcode.

Answer

Device compliance policy – Require data encryption.

Answer

Enrollment restrictions – Require encrypted backup.

Answer

Device configuration profile – Encryption settings.

Question 13

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

Accepted Answer

Devices must have line-of-sight to an on-premises domain controller.. For hybrid Azure AD join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Answer

Devices must have VPN connectivity to Azure.

Answer

An Intune connector for Active Directory must be installed.

Answer

Azure AD Connect must be configured with password hash sync.

Question 14

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

Accepted Answer

Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.. Setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Answer

Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

Answer

Set 'Update deferral period (days)' to 7.

Answer

Set 'Update deferral period (days)' to 30.

Question 15

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Accepted Answer

Users must have an Intune license assigned.. Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Answer

Devices must be connected via VPN.

Answer

Tenant must have Azure AD Premium P2.