MD-102 Prepare infrastructure for devices Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Accepted Answer

Disable screen capture.. To restrict screenshots on Android Enterprise devices, only the 'Disable screen capture' setting directly prevents the device from taking screenshots by using the FLAG_SECURE window flag. Options B and C ('Disable copy and paste' and 'Disable camera') do not prevent screen capture; they restrict clipboard operations and camera usage respectively. Therefore, the only correct setting is A.

Answer

Disable copy and paste.

Answer

Disable camera.

Answer

Disable Bluetooth.

Answer

Disable Wi-Fi.

Question 2

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Accepted Answer

The virtual machine does not have Secure Boot enabled in its firmware settings.. Secure Boot is a hardware-based feature that ensures the system boots using only software trusted by the PC manufacturer. In virtual machines, Secure Boot is often not enabled by default or may not be supported by the hypervisor. For Intune compliance, if the VM does not have Secure Boot enabled, it will report as non-compliant. Option C is correct because the VM's firmware settings likely have Secure Boot disabled. Option A is incorrect because the device may still be enrolled correctly. Option B is incorrect because password policy is unrelated to Secure Boot. Option D is incorrect because BitLocker is a separate encryption feature not required for Secure Boot.

Answer

The device is not enrolled in Intune correctly.

Answer

The password policy is conflicting with Secure Boot.

Answer

The device does not have BitLocker enabled, which is required for Secure Boot.

Question 3

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

Accepted Answer

The policy has not been assigned to the device or its user group.. The most likely reason is that the compliance policy was created but never assigned to the device or its user group. In Microsoft Intune, a compliance policy must be assigned to a security group that contains the device or its user; otherwise, the policy is not evaluated against the device, and the device will default to a compliant status. The PowerShell cmdlet shown only creates the policy object; it does not assign it.

Answer

The BitLocker setting is not supported on Windows 11.

Answer

The policy was not saved correctly due to a syntax error.

Answer

The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 5

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

Accepted Answer

Microsoft 365 Apps. The Microsoft 365 Apps app type in Intune is specifically designed to deploy Office 365 ProPlus (now Microsoft 365 Apps) suites, including Word, Excel, PowerPoint, and others, as a managed suite. This app type automatically configures the installation to use the Office Deployment Tool (ODT) with built-in settings for update channels, architecture (32-bit/64-bit), and language packs, and it makes the suite available in Company Portal for user-initiated installation. Unlike Win32 or other types, it handles the complex licensing and activation requirements for Microsoft 365 Apps without additional scripting.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 6

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

Accepted Answer

The AUMID for Microsoft Edge is not specified.. The most likely issue is that the AUMID for Microsoft Edge is not specified in the kiosk profile. For a single-app kiosk on Windows 11, Intune requires the Application User Model ID (AUMID) to launch the app correctly. Without it, the kiosk shell cannot identify which executable to run, resulting in a blank screen instead of the Edge browser.

Answer

The kiosk profile is not correctly assigned.

Answer

The device is not assigned to a user.

Answer

The device is not running Windows 10/11 Enterprise.

Question 7

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

Accepted Answer

Windows 10 and later update ring. The Windows 10 and later update ring policy in Intune is specifically designed to configure Windows Update for Business settings, including deferral periods for feature and quality updates. By setting the 'Feature update deferral period (days)' to 60 and 'Quality update deferral period (days)' to 14, you directly control how long updates are postponed after they are released by Microsoft. This policy applies to devices managed via Intune and leverages the Windows Update for Business service to enforce these deferrals.

Answer

Windows compliance policy

Answer

Windows feature update policy

Answer

Windows driver update policy

Question 8

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

Accepted Answer

Add a shell script under Devices > Scripts. In Microsoft Intune, shell scripts for macOS are managed under Devices > Scripts, where you can add a script with a specific shell (e.g., bash, sh, zsh) and configure its execution frequency, run context, and notifications. This is the correct method because Intune natively supports deploying and running shell scripts on macOS devices via the Intune management agent, without requiring additional infrastructure.

Answer

Use Company Portal to distribute the script

Answer

Add a PowerShell script under Devices > Scripts

Answer

Create a custom configuration profile with Bash script

Question 9

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

Accepted Answer

The device will be blocked from completing OOBE.. The Autopilot deployment profile shown has the Enrollment Status Page (ESP) configured with 'Block device use until all required apps and profiles are installed' enabled. When a required app fails to install during OOBE, the ESP enforces a hard block, preventing the user from proceeding past the ESP until the failure is resolved. This is why the device is blocked from completing OOBE, making option C correct.

Answer

The device will be allowed to proceed because enrollment status is notStarted.

Answer

The device will retry enrollment automatically.

Answer

The device will be blocked until retry due to pendingRetry setting.

Question 10

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

Accepted Answer

Set the install context to system.. Setting the install context to 'system' runs the Win32 app installer with the SYSTEM account, which has the highest privileges on a Windows device. This ensures the installer can perform actions requiring admin rights, such as writing to Program Files or modifying system registry keys, without user interaction or credential prompts. In Intune, the system context is the only way to silently deploy apps that demand elevated permissions.

Answer

Set the install context to user.

Answer

Assign the app as required for all users.

Answer

Use a line-of-business app type instead.

Question 11

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

Accepted Answer

To list the IDs of Windows devices.. The script uses Get-MgDevice with a filter for operatingSystem eq 'Windows' to retrieve all Windows device objects from Microsoft Entra ID, regardless of their join type (joined, registered, or hybrid). By selecting the DeviceId property, it outputs the unique identifiers of these devices. The DeviceId is the Entra ID object identifier, not the device name or Autopilot registration status.

Answer

To output the device names of all Windows devices.

Answer

To list devices that are registered in Autopilot.

Answer

To update the enrollment type of all Windows devices.

Question 12

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

Accepted Answer

Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment. Microsoft Entra ID (formerly Azure AD) registration or join is a prerequisite for Intune enrollment. Intune requires a device to have an identity in Entra ID to apply policies and manage compliance. Without this prerequisite, the device cannot authenticate or receive management commands from Intune.

Answer

Configure enrollment restrictions to require corporate ownership

Answer

Set device type restrictions to block unregistered devices

Answer

Configure automatic enrollment via Group Policy

Question 13

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

Accepted Answer

Configure Conditional Access policies in Microsoft Entra ID that require compliant devices. Conditional Access policies in Microsoft Entra ID can require that devices accessing Microsoft 365 services be marked as compliant by Intune. This ensures that only devices meeting your security policies (e.g., encryption, antivirus, OS patch level) are granted access, directly addressing the security team's concern about unmanaged devices on public Wi-Fi.

Answer

Deploy Windows Autopilot for all devices and require Entra ID join

Answer

Configure a VPN profile in Intune and enforce device compliance on the VPN server

Answer

Create a compliance policy in Intune and assign it to all users

Question 14

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device compliance policy. Device compliance policies in Microsoft Intune evaluate device settings against defined rules, such as requiring a passcode longer than six characters. When a device is marked noncompliant, Conditional Access can block access to corporate email. This is the correct mechanism because compliance policies are specifically designed to enforce security requirements like passcode length before granting resource access.

Answer

Device configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 15

Your organization wants to use Microsoft Intune to manage Windows devices that are joined to an on-premises Active Directory domain. The devices will be hybrid Azure AD joined. Which tool should you use to configure automatic enrollment into Intune?

Accepted Answer

Group Policy. For hybrid Microsoft Entra ID joined devices, automatic enrollment into Intune is configured via Group Policy. Specifically, you deploy the 'Enable automatic MDM enrollment using default Microsoft Entra ID credentials' policy setting, which triggers the MDM enrollment process using the user's Microsoft Entra ID credentials during sign-in. This is the only supported method for bulk, automatic enrollment of hybrid Microsoft Entra ID joined Windows devices without requiring additional infrastructure.

Answer

Windows Autopilot

Answer

System Center Updates Publisher (SCUP)

Answer

Configuration Manager Cloud Management Gateway (CMG)