MD-102 Prepare infrastructure for devices Practice Test 15 — 15 Questions

Question 1

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

Accepted Answer

The device is powered off or not connected to the internet. Option D is correct because the device may be powered off or not connected to the internet, preventing check-in. Option A is wrong because certificate expiry would affect enrollment, not check-in. Option B is wrong because Intune service outage is unlikely for a single device. Option C is wrong because policy conflict would not prevent check-in.

Answer

The Intune service is experiencing an outage

Answer

The device has conflicting policies from another MDM

Answer

The device's enrollment certificate has expired

Question 2

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. Option A is correct because 'Require device to be marked as compliant' is the standard setting for this scenario. Option B is wrong because multi-factor authentication is separate. Option C is wrong because hybrid Azure AD join is for device identity, not compliance. Option D is wrong because app protection policies are for mobile app management, not device compliance.

Answer

Require multi-factor authentication

Answer

Require hybrid Azure AD joined device

Answer

Require approved client app

Question 3

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Windows Autopilot for new devices. Which prerequisite must be met for Autopilot to work with Entra ID?

Accepted Answer

Devices must be registered in Autopilot using hardware hash. Windows Autopilot requires that each device be registered in the Autopilot service using its unique hardware hash (also known as a hardware ID). This hash is collected from the device's firmware and uploaded to the Autopilot deployment service, which then associates the device with the target tenant. Without this registration, Autopilot cannot identify the device during the out-of-box experience (OOBE) and cannot automatically enroll it into Microsoft Entra ID.

Answer

Devices must be domain-joined to on-premises AD

Answer

An Azure AD Premium P2 license must be assigned

Answer

Configuration Manager must be deployed for OS imaging

Question 4

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

Accepted Answer

The DNS CNAME record for enrollment is missing or incorrect. The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Answer

The user does not have an Intune license assigned

Answer

The MDM authority is not set to Intune

Answer

The device firewall is blocking traffic to manage.microsoft.com

Question 5

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

Accepted Answer

Microsoft 365 Apps for Windows. The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Answer

Web link

Answer

Windows app (MSI)

Answer

Line-of-business app

Question 6

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Accepted Answer

Convert existing devices to Autopilot by uploading hardware hash. Option B is correct because Windows Autopilot allows you to import a hardware hash (a unique device identifier) from existing devices into Intune, converting them into Autopilot devices. This enables you to apply Autopilot deployment profiles and customize the OOBE without requiring a full OS reinstall, leveraging the device's existing identity.

Answer

Enforce security baselines on devices

Answer

Deploy third-party applications automatically

Answer

Configure BIOS settings remotely

Question 7

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Accepted Answer

MDM enrollment enabled in Microsoft Entra ID. Option B is correct because Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Answer

A device compliance policy assigned to the device

Answer

Azure AD Premium P1 license

Question 8

Which TWO are valid methods to deploy Windows 10/11 using Microsoft Intune?

Accepted Answer

Windows Autopilot. Windows Autopilot is a valid Intune deployment method because it uses cloud-based configuration to transform a new or existing device into a business-ready state without manual imaging. It leverages hardware hashes uploaded to Intune, which then applies policies, apps, and settings during the out-of-box experience (OOBE). This eliminates the need for traditional imaging infrastructure.

Answer

PXE boot from a distribution point

Answer

Network boot via WDS

Answer

Bootable USB media with Windows Setup

Question 9

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

Accepted Answer

The device does not meet authentication requirements. The JSON configuration sets 'minimumVersion' to '10.0.22000' (Windows 11) and 'maximumVersion' to '10.0.22621.0' (Windows 11 22H2), which excludes all Windows 10 builds. Since the user is attempting to enroll a Windows 10 device, it falls outside the allowed version range, causing the enrollment block. The error message 'enrollment is blocked' aligns with a version restriction failure, not an authentication issue.

Answer

The enrollment is restricted to Windows Holographic only

Answer

The device type filter excludes Windows 10

Answer

The user already has 5 devices enrolled

Question 10

You are the endpoint administrator for Contoso Ltd., a multinational company with 10,000 Windows 10 and 11 devices managed by Microsoft Intune. The company recently acquired a subsidiary that uses on-premises Active Directory and Configuration Manager. The subsidiary's devices are not joined to Microsoft Entra ID. Your goal is to migrate these devices to cloud management with Intune within six months. The subsidiary has 2,000 devices, all running Windows 10. The devices are currently domain-joined and managed by ConfigMgr. You need to choose the most efficient migration strategy that minimizes user disruption and leverages existing investments. The subsidiary has a high-speed WAN link to the corporate network. You have the following options: A) Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune. B) Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join. C) Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps. D) Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning. Which option should you choose?

Accepted Answer

Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join. Option B is correct because co-management allows you to gradually transition Configuration Manager workloads to Intune without disrupting existing management, leveraging the existing ConfigMgr infrastructure and high-speed WAN link. This minimizes user disruption by keeping devices domain-joined initially, then switching to Entra ID join after workloads are migrated, which is the most efficient path for 2,000 existing domain-joined devices.

Answer

Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps

Answer

Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning

Answer

Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune

Question 11

You are the endpoint administrator for a healthcare organization that uses Intune to manage 500 iOS devices used by clinicians. The devices are enrolled as corporate-owned, user-approved devices via Apple Business Manager (ABM). You need to deploy a new custom electronic health record (EHR) app that is not in the App Store. The app is distributed as an .ipa file signed with an enterprise certificate. The app must be installed silently without user interaction. The devices are supervised and managed with iOS MDM. You have the following options: A) Deploy the app as an iOS LOB app in Intune and assign to device groups. B) Deploy the app as a Volume Purchase Program (VPP) app. C) Use Apple Configurator to sideload the app via USB. D) Distribute the app via a web link to the .ipa hosted on a public CDN. Which option should you choose?

Accepted Answer

Deploy the app as an iOS LOB app in Intune and assign to device groups. Option C is correct because deploying the app as an iOS LOB app in Intune allows you to upload the enterprise-signed .ipa file directly and assign it to device groups. Since the devices are supervised and enrolled via ABM, Intune can silently install the app using MDM commands without user interaction, leveraging the device's trust for enterprise certificates.

Answer

Deploy the app as a Volume Purchase Program (VPP) app

Answer

Use Apple Configurator to sideload the app via USB

Answer

Distribute the app via a web link to the .ipa hosted on a public CDN

Question 12

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. C) Use a provisioning package (PPKG) to enroll devices. D) Use Group Policy to configure MDM enrollment. Which option should you choose?

Accepted Answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. The 'Switch to Intune' option in the device's 'Access work or school' settings is the correct choice because it allows a seamless migration from a legacy on-premises MDM to Microsoft Intune without requiring a device reset. This feature, available on Windows 10 devices already joined to Microsoft Entra ID, triggers an automatic MDM enrollment switch by communicating with the Intune service, preserving all existing data and settings.

Answer

Use Windows Autopilot to reset the devices and re-enroll

Answer

Use Group Policy to configure MDM enrollment

Answer

Use a provisioning package (PPKG) to enroll devices

Question 13

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with TPM 2.0 and UEFI Secure Boot enabled can enroll. Which configuration profile setting should you configure?

Accepted Answer

Enable Device Health Attestation (DHA) in enrollment restrictions. Device Health Attestation (DHA) in enrollment restrictions allows you to block enrollment for devices that do not meet specific hardware security requirements, such as TPM 2.0 and UEFI Secure Boot enabled. When configured, Intune verifies these attestation claims during the enrollment process and rejects non-compliant devices before they can enroll. This is the only setting that enforces hardware prerequisites at the enrollment stage, not after the device is already managed.

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Configure a BitLocker policy in Endpoint Security

Answer

Set a compliance policy for device health

Question 14

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

Accepted Answer

Apps are assigned to devices instead of users. Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Answer

Device type is restricted in enrollment restrictions

Answer

VPP token is not configured for user enrollment

Answer

User Enrollment does not support app distribution

Question 15

You need to prepare on-premises Windows devices for a migration to Microsoft Intune. Which tool should you use to generate a configuration package that can be deployed via Group Policy or manual installation?

Accepted Answer

Microsoft Intune Management Extension. The Microsoft Intune Management Extension (IME) is the correct tool because it generates a configuration package (a .intunewin file) that can be deployed via Group Policy or manual installation to on-premises Windows devices. This package contains the IME agent and a PowerShell script that, when executed, enrolls the device into Intune and applies MDM policies, enabling a seamless migration without requiring direct network connectivity to Intune during the initial deployment.

Answer

Windows Autopilot

Answer

Configuration Manager

Answer

Microsoft Intune Troubleshooting Tool