MD-102 Prepare infrastructure for devices Practice Test 14 — 15 Questions

Question 1

Your organization is deploying Microsoft Intune for the first time. You need to ensure that devices can enroll in Intune. Which of the following is a prerequisite for Intune enrollment?

Accepted Answer

A Microsoft Intune license assigned to the user. A Microsoft Intune license assigned to the user is a prerequisite because Intune uses Microsoft Entra ID (Azure AD) for identity and access management. Without an Intune license (e.g., Microsoft 365 E3, E5, or standalone Intune license) assigned to the user, the device cannot authenticate and enroll via the Intune enrollment service, as the license is required to authorize the enrollment request and apply device management policies.

Answer

A VPN connection to the corporate network

Answer

An on-premises Active Directory domain

Answer

A Configuration Manager infrastructure

Question 2

Your organization uses Microsoft Intune to manage devices. You need to configure a compliance policy for Windows devices that requires the device to be at a specific OS version and have antivirus enabled. Which TWO settings should you configure in the compliance policy?

Accepted Answer

Require antivirus (Windows Defender). A Windows compliance policy enforces a required OS build/version by setting the minimum OS version, which blocks devices running older builds than the specified value. Option B (Require antivirus (Windows Defender)) is correct because the compliance policy includes a setting that requires Windows Defender Antivirus to be enabled (and optionally up to date) on the device. Option A (Maximum OS version) is not appropriate here because the requirement is to ensure devices are at least a specific OS version, not to cap them at a maximum version. Option D (Device type) is not a compliance setting for enforcing OS version or antivirus state; it is used for targeting/platform scoping. Option E (Storage encryption) enforces BitLocker/device encryption and does not address the OS version or antivirus requirements.

Answer

Maximum OS version

Answer

Device type

Answer

Storage encryption

Question 3

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Accepted Answer

Intune licenses assigned to users. Intune licenses must be assigned to users to grant them access to the service. Without a license, the user cannot authenticate with Intune, and automatic enrollment will fail during the device registration step. This is a prerequisite enforced by Microsoft Entra ID and Intune together.

Answer

Apple Push Notification service certificate (for iOS)

Answer

Configuration Manager (for co-management)

Question 4

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Accepted Answer

Enables the Windows Firewall for the public network profile. The setting shown in the exhibit configures the Windows Firewall to enable the firewall for the public network profile. In Intune, the 'Windows Firewall' configuration policy allows administrators to define per-profile firewall states. Enabling the firewall for the public profile is a common security baseline requirement to protect devices on untrusted networks.

Answer

Disables the Windows Firewall for all network profiles

Answer

Enables Microsoft Defender Antivirus real-time protection

Answer

Disables the Windows Firewall for the domain network profile

Question 5

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to configure a Windows Autopilot deployment for new devices that are shipped directly to users. The devices must be automatically enrolled in Intune and configured with your organization's standard settings. What is the minimum requirement for the device to be recognized by Windows Autopilot?

Accepted Answer

The device must have its hardware hash uploaded to Microsoft Intune.. For a device to be recognized by Windows Autopilot, its hardware hash must be uploaded to Microsoft Intune. This hash uniquely identifies the device and allows Autopilot to associate it with your organization's Intune tenant. Without the hardware hash, the device cannot be targeted for Autopilot deployment.

Answer

The device must have a Microsoft Entra ID Premium P2 license assigned.

Answer

The device must be Azure AD registered before shipping.

Answer

The device must be joined to on-premises Active Directory first.

Question 6

You are troubleshooting a Windows 10 device that fails to enroll in Microsoft Intune. The device shows error code 0x8018000b. You verify that the user has a valid Intune license and that the device is running Windows 10 Pro. What is the most likely cause of the enrollment failure?

Accepted Answer

MDM enrollment is blocked by a local Group Policy or registry setting.. Error 0x8018000b indicates that the device is not allowed to enroll, typically because MDM enrollment is blocked by a local Group Policy or registry setting. Even with a valid license and Windows 10 Pro, if the 'MDM Enrollment' policy is disabled or the 'Enrollment automatic' registry key is misconfigured, the enrollment attempt will fail with this specific error.

Answer

The device is running Windows 10 Home edition.

Answer

The device is not connected to the internet.

Answer

The device has an expired certificate required for enrollment.

Question 7

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

Accepted Answer

Shared iPad enrollment using Apple Business Manager and Intune.. Shared iPad enrollment using Apple Business Manager (ABM) and Intune is designed specifically for scenarios where multiple students share the same iPad and each needs their own apps, data, and sign-in. It uses Managed Apple IDs and provides a personalized experience with separate user partitions, while the device remains supervised and managed by the school.

Answer

Automated Device Enrollment with user affinity.

Answer

User Enrollment

Answer

Device Enrollment (DEP) without user affinity.

Question 8

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

Accepted Answer

Create an app protection policy that restricts data transfer between work and personal apps.. App protection policies (also called MAM policies) in Intune are designed to protect corporate data at the app layer, independent of device enrollment. For Android Enterprise work profiles, an app protection policy can enforce data transfer restrictions such as blocking copy/paste between work and personal apps, restricting save-as, and controlling sharing. This directly addresses the requirement without affecting the personal side of the device.

Answer

Create a device configuration policy that disables clipboard sharing.

Answer

Create a device compliance policy that requires a work profile.

Answer

Create a conditional access policy that blocks personal apps.

Question 9

You need to configure Microsoft Intune to automatically retire a device if it has not checked in for 30 days. Where would you configure this setting?

Accepted Answer

Intune device cleanup rules. Intune device cleanup rules allow you to automatically retire devices that have not checked in for a specified number of days. This setting is configured under Tenant Administration > Device Cleanup Rules.

Answer

Conditional access policy

Answer

Device compliance policy

Answer

Device configuration profile

Question 10

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Accepted Answer

Set 'Defer quality updates (days)' to 0.. Option A is correct because setting 'Defer quality updates (days)' to 0 means quality updates (security fixes) are offered immediately when released, with no deferral, which matches the requirement to receive them as soon as possible. Option E is correct because setting 'Defer feature updates (days)' to 60 delays feature updates by exactly 60 days, satisfying the requirement to defer feature updates for up to 60 days. Option B is not correct because 'Semi-Annual Channel' is a servicing channel designation, not a deferral setting, and it does not by itself defer feature updates by 60 days. Option C is not correct because 'Update notification level' controls user-facing update notifications, not the timing of quality or feature update delivery. Option D is not correct because deferring quality updates by 60 days would delay security fixes, contradicting the goal of receiving them as soon as they are released.

Answer

Set 'Feature update channel' to 'Semi-Annual Channel'.

Answer

Set 'Update notification level' to 'Turn off notifications'.

Answer

Set 'Defer quality updates (days)' to 60.

Question 11

Your organization uses Microsoft Intune to manage corporate-owned iOS devices. You need to ensure that devices are supervised and can be configured with restrictions that cannot be removed by the user. Which THREE steps must you take?

Accepted Answer

Add devices to Apple Business Manager (ABM).. Supervision on iOS requires the device to be owned and enrolled through Apple's corporate enrollment channel, so option A is correct: the devices must be added to Apple Business Manager (ABM) so Apple recognizes them as organization-owned and eligible for supervised enrollment. Option B is correct because automated device enrollment (formerly DEP) must be configured in ABM and linked to Intune via an MDM server token, which is the mechanism that pushes the devices into Intune as supervised during Setup Assistant. Option C is correct because the Intune iOS enrollment profile used for these devices must have the 'Supervised' setting enabled; this profile is what actually applies supervision and allows restrictions that users cannot remove. Option D is not required because user assignment (or user affinity) is optional for automated device enrollment and does not create supervision. Option E is incorrect because a compliance policy only evaluates and reports device state; it cannot enable or grant supervision.

Answer

Assign a user to each device during enrollment.

Answer

Create a device compliance policy that requires supervision.

Question 12

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Accepted Answer

Check that Secure Boot is enabled.. Option A is correct because Windows 11 requires UEFI Secure Boot capability and the feature must be enabled on the device. Option C is correct because Windows 11 mandates TPM version 2.0, and it must be enabled and functioning in the firmware. Option D is correct because the minimum RAM requirement for Windows 11 is 4 GB. Option B is incorrect because while the processor must be 1 GHz or faster with 2 or more cores on a compatible 64-bit processor, the stated 1 core is insufficient. Option E is incorrect because the minimum storage requirement for Windows 11 is 64 GB, not 32 GB.

Answer

Check that the processor is at least 1GHz with 1 core.

Answer

Check that the device has at least 32GB of storage.

Question 13

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Accepted Answer

A Microsoft Defender for Endpoint license must be assigned.. Option B is correct because Microsoft Defender for Endpoint requires a valid license (e.g., Microsoft 365 E5 or a standalone Defender for Endpoint license) assigned to users before onboarding devices. Option C is correct because the scenario specifies deployment via Intune, so devices must be enrolled in Microsoft Intune to receive the onboarding configuration and policy. Option A is incorrect because Microsoft Entra ID join is not strictly required; devices can be domain-joined or workgroup-joined as long as they are Intune-enrolled and meet other requirements. Option D is incorrect because third-party antivirus does not need to be uninstalled; Defender for Endpoint can run in passive mode alongside it. Option E is incorrect because Microsoft Entra ID Premium is not a prerequisite for Defender for Endpoint deployment.

Answer

Devices must be joined to Azure AD.

Answer

Devices must have a third-party antivirus uninstalled.

Answer

An Azure AD Premium license must be assigned.

Question 14

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

Accepted Answer

In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.. To enable co-management and move the Device configuration workload to Intune, you need to configure co-management in ConfigMgr. This involves enabling co-management, selecting a pilot collection (or all devices), and setting the workload slider for Device configuration to either 'Pilot Intune' or 'Intune' (full migration). This triggers automatic enrollment in Intune via the co-management policy. Option A is incorrect because the Intune connector is not needed for co-management; enrollment happens via ConfigMgr policy. Option B is incorrect because Group Policy for automatic MDM enrollment is not required when using co-management; the enrollment is triggered by ConfigMgr. Option D is incorrect because hybrid Microsoft Entra ID join alone does not automatically enroll devices into co-management; the ConfigMgr co-management configuration is necessary.

Answer

Install the Intune connector for ConfigMgr and configure the workloads.

Answer

Create a Group Policy that enables automatic MDM enrollment to Intune.

Answer

Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.

Question 15

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to ensure that devices are enrolled automatically without user interaction and that the enrollment status page (ESP) is configured to block device use until required apps are installed. What should you configure?

Accepted Answer

Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile. Windows Autopilot self-deploying mode enrolls devices into Intune with zero user interaction — the device authenticates using its TPM-attested hardware identity, so no credentials are entered. Pairing it with an Enrollment Status Page (ESP) profile blocks the device from being used until required apps and policies are applied, which is exactly what the scenario requires.

Answer

Configure a Group Policy to auto-enroll devices into Intune

Answer

Configure a device enrollment manager (DEM) account

Answer

Configure co-management with Microsoft Configuration Manager