MD-102 Prepare infrastructure for devices Practice Test 14 — 15 Questions

Question 1

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app to iOS devices. The app is signed with an enterprise certificate. Some devices report installation failure with error code 0x87D13B9F. What is the most likely cause?

Accepted Answer

The enterprise signing certificate is not trusted on the device.. Error code 0x87D13B9F in Microsoft Intune typically indicates a signing certificate trust issue. Since the app is signed with an enterprise certificate, the device must have that certificate installed and trusted in its trusted root store. If the certificate is not trusted, iOS will reject the installation, producing this specific error.

Answer

The app package is not signed.

Answer

The app is not available in the Apple App Store.

Answer

The device does not have enough storage space.

Question 2

Your organization wants to use Windows Autopilot to deploy new Windows 11 devices. What is required to register a device with Windows Autopilot?

Accepted Answer

The device's hardware hash (4K HH). Windows Autopilot requires the device's hardware hash (4K HH) to uniquely identify the device during the registration process. This hash is generated from the device's hardware components and is uploaded to the Microsoft Intune or Partner portal to associate the device with an Autopilot profile. Without the hardware hash, Autopilot cannot recognize the device as registered and will not apply the deployment profile.

Answer

The device's product key

Answer

The user's Microsoft account

Answer

The device's BIOS password

Question 3

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

Accepted Answer

The conditional access policy has the grant control set to 'Require device to be marked as compliant'.. Option A is correct because the most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Answer

All users have the required Microsoft 365 license.

Answer

The conditional access policy includes all cloud apps.

Answer

The device platform condition is set to iOS and Android only.

Question 4

Refer to the exhibit. You execute this PowerShell script to wipe noncompliant Windows devices. After running, you find that some compliant devices were also wiped. What is the most likely reason?

Accepted Answer

The script uses the wrong Graph API endpoint, causing all devices to be wiped.. Option C is correct because the script uses the wrong Graph API endpoint. The correct endpoint for wiping a device is `/deviceManagement/managedDevices/{deviceId}/wipe`, but the script likely uses an incorrect or generic endpoint (e.g., `/devices/{deviceId}/wipe` or a non-existent path), which causes the API to misinterpret the request or apply the wipe action to all devices in the tenant, including compliant ones. This is a common misconfiguration when targeting the Microsoft Graph API for Intune device actions.

Answer

The filter 'operatingSystem eq 'Windows'' does not match any devices, so the script wiped all devices.

Answer

The script wipes only noncompliant devices, but some compliant devices had a null compliance state.

Answer

The script does not check the device's compliance state before wiping.

Question 5

You need to enroll macOS devices into Microsoft Intune. What is the required enrollment method?

Accepted Answer

Company Portal app. The Company Portal app is the required enrollment method for macOS devices when using user-driven enrollment with Intune. It allows users to authenticate, download management profiles, and register their device via the Intune Company Portal, which is the standard approach for bring-your-own-device (BYOD) scenarios or when automated enrollment is not configured.

Answer

Device Enrollment Manager (DEM)

Answer

Apple Automated Device Enrollment (ADE)

Answer

Apple Configurator

Question 6

Your organization uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) and Microsoft Intune. You need to ensure that devices that are deemed 'at risk' by Microsoft Defender for Endpoint are automatically blocked from accessing corporate resources. What should you configure?

Accepted Answer

A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.. Option D is correct because the Device Health Attestation Service evaluates device health, but for Defender for Endpoint risk, you need a conditional access policy that uses the 'Require device to be marked as compliant' grant control, combined with a compliance policy that uses the 'Require the device to be at or under the Device Threat Level' setting. However, the option D says: 'A conditional access policy that requires the device to be marked as compliant, and a compliance policy that uses the Microsoft Defender for Endpoint device risk level.' That is exactly what is needed. Option A is wrong because an app protection policy is for app-level, not device-level. Option B is wrong because a device configuration policy does not enforce access control. Option C is wrong because a compliance policy alone does not block access; it only marks noncompliant.

Answer

An app protection policy in Intune that blocks access based on device risk.

Answer

A conditional access policy that requires device to be compliant, and a compliance policy that uses the Defender for Endpoint device risk level.

Answer

A device configuration policy that disables network access for at-risk devices.

Question 7

Which TWO of the following are required to configure Windows Autopilot for existing devices?

Accepted Answer

A hardware hash (4K HH) from the device.. Option D is correct because the hardware hash (4K HH) is the unique identifier that Windows Autopilot uses to associate a device with an Autopilot deployment profile. This hash must be harvested from the existing device (e.g., via a PowerShell script or a provisioning package) and uploaded to the Autopilot service to register the device. Without the hardware hash, the device cannot be recognized as an Autopilot device during the out-of-box experience (OOBE).

Answer

A Windows product key.

Answer

A local administrator account on the device.

Answer

An Azure AD Premium P1 license.

Question 8

Which THREE of the following are valid methods to enroll Android devices into Microsoft Intune?

Accepted Answer

Android Enterprise work profile. Option C is correct because Android Enterprise work profile is a supported enrollment method in Microsoft Intune that allows users to keep their personal apps and data separate from corporate data on the same device. Intune manages the work profile using the Android Enterprise platform, which provides containerization and policy enforcement without requiring full device control.

Answer

Android Device Administrator

Answer

Android Legacy

Question 9

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Accepted Answer

Allows end users to set up their own devices with minimal IT involvement.. Option B is correct because Windows Autopilot leverages the device's hardware identity (hash) to automatically enroll it in Microsoft Entra ID and join it to a domain or tenant, allowing end users to complete the setup process themselves with minimal IT intervention. This reduces helpdesk calls and streamlines the out-of-box experience (OOBE) by presenting only necessary screens.

Answer

Eliminates the requirement for a Microsoft Entra ID subscription.

Answer

Enables device provisioning over a VPN connection.

Answer

Supports deployment without any internet connectivity.

Question 10

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Accepted Answer

The Microsoft Intune agent installed on the Linux device.. Option A is correct because the Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

An Azure Active Directory Premium P2 license for each user.

Question 11

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes:
- 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune)
- 1,500 iOS devices (corporate-owned, managed via Intune)
- 500 Android devices (BYOD, managed via Intune with work profile)
- 200 macOS devices (corporate-owned, managed via Intune)

You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.

You have the following requirements:
1. Zero-touch enrollment for new Windows 11 devices.
2. Devices must be automatically configured with security policies and required applications.
3. Conditional access to Microsoft 365 resources based on device compliance.
4. Support for both corporate and BYOD devices.

Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

Accepted Answer

Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.. Option C is correct because Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Answer

Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.

Answer

Assign Microsoft Intune licenses to all users who will receive the new devices.

Answer

Create a compliance policy that requires BitLocker encryption and a minimum OS version.

Question 12

Your organization plans to deploy Windows 11 to 500 devices using Microsoft Intune. You need to ensure that each device receives the correct language pack and regional settings based on the user's location. Which configuration method should you use?

Accepted Answer

Configure Windows Autopilot with enrollment profile specifying language and region. Option C is correct because Autopilot with enrollment profile allows assigning language and region settings per device during OOBE. Option A is wrong because provisioning packages (PPKG) are for bulk deployment but not dynamic per-user settings. Option B is wrong because Configuration Manager task sequences require on-premises infrastructure and are less dynamic. Option D is wrong because PowerShell scripts run after provisioning, not during OOBE.

Answer

Deploy a PowerShell script via Intune to set language after enrollment

Answer

Use Configuration Manager task sequence with language packs

Answer

Create a provisioning package (PPKG) with language settings and apply via USB

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

Accepted Answer

Check the Intune console for Wi-Fi profile assignment and conflict status. Option A is correct because checking the Intune console for profile assignment and conflict is the fastest way to identify deployment issues. Option B is wrong because reviewing sign-in logs does not show Wi-Fi profile status. Option C is wrong because event logs are more granular and time-consuming. Option D is wrong because recreating the profile may not address the root cause.

Answer

Recreate the Wi-Fi profile in Intune with new settings

Answer

Run the 'netsh wlan show profiles' command on affected devices

Answer

Review Microsoft Entra ID sign-in logs for authentication failures

Question 14

You need to deploy a line-of-business (LOB) app to 100 iOS devices managed by Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

Upload the app package as an iOS LOB app in Intune. Option A is correct because Intune supports deploying internally developed LOB apps to iOS devices by uploading the signed .ipa package directly. Since the app is already signed with an enterprise certificate, it can be distributed via Intune's iOS LOB app workflow without requiring the Apple App Store or VPP.

Answer

Add the app as a Volume Purchase Program (VPP) app

Answer

Use an Enterprise Code Signing certificate to deploy via MDM

Answer

Publish the app to the Apple App Store and deploy as public app

Question 15

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

Accepted Answer

Security baselines are configured and assigned in Intune endpoint security. Option C is correct because Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Answer

Devices are onboarded to Defender for Endpoint

Answer

Group Policy objects are linked to the domain

Answer

Devices are registered in Microsoft 365 Defender portal