MD-102 Prepare infrastructure for devices Practice Test 15 — 15 Questions

Question 1

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Accepted Answer

Allows end users to set up their own devices with minimal IT involvement.. Windows Autopilot leverages the device's hardware identity (hash) to automatically enroll it in Microsoft Entra ID and join it to a domain or tenant, allowing end users to complete the setup process themselves with minimal IT intervention. This reduces helpdesk calls and streamlines the out-of-box experience (OOBE) by presenting only necessary screens.

Answer

Eliminates the requirement for a Microsoft Entra ID subscription.

Answer

Enables device provisioning over a VPN connection.

Answer

Supports deployment without any internet connectivity.

Question 2

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Accepted Answer

The Microsoft Intune agent installed on the Linux device.. The Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

An Azure Active Directory Premium P2 license for each user.

Question 3

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes:
- 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune)
- 1,500 iOS devices (corporate-owned, managed via Intune)
- 500 Android devices (BYOD, managed via Intune with work profile)
- 200 macOS devices (corporate-owned, managed via Intune)

You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.

You have the following requirements:
1. Zero-touch enrollment for new Windows 11 devices.
2. Devices must be automatically configured with security policies and required applications.
3. Conditional access to Microsoft 365 resources based on device compliance.
4. Support for both corporate and BYOD devices.

Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

Accepted Answer

Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.. Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Answer

Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.

Answer

Assign Microsoft Intune licenses to all users who will receive the new devices.

Answer

Create a compliance policy that requires BitLocker encryption and a minimum OS version.

Question 4

Your organization plans to deploy Windows 11 to 500 devices using Microsoft Intune. You need to ensure that each device receives the correct language pack and regional settings based on the user's location. Which configuration method should you use?

Accepted Answer

Configure Windows Autopilot with enrollment profile specifying language and region. Windows Autopilot with an enrollment profile allows you to specify language and region settings that are applied during the out-of-box experience (OOBE). This ensures each device receives the correct configuration based on the user's location without requiring post-enrollment scripts or manual intervention, making it the most efficient and scalable method for 500 devices managed by Intune.

Answer

Deploy a PowerShell script via Intune to set language after enrollment

Answer

Use Configuration Manager task sequence with language packs

Answer

Create a provisioning package (PPKG) with language settings and apply via USB

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

Accepted Answer

Check the Intune console for Wi-Fi profile assignment and conflict status. Checking the Intune console for Wi-Fi profile assignment and conflict status is the fastest way to identify deployment issues, such as the profile not being assigned to the affected devices or conflicts with other profiles. Option A is wrong because recreating the profile may not address the root cause and could be time-consuming without first verifying the current assignment. Option B is wrong because running 'netsh wlan show profiles' only lists profiles stored locally and does not show Intune deployment status. Option D is wrong because reviewing Microsoft Entra ID sign-in logs does not show Wi-Fi profile status or assignment conflicts.

Answer

Recreate the Wi-Fi profile in Intune with new settings

Answer

Run the 'netsh wlan show profiles' command on affected devices

Answer

Review Microsoft Entra ID sign-in logs for authentication failures

Question 6

You need to deploy a line-of-business (LOB) app to 100 iOS devices managed by Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

Upload the app package as an iOS LOB app in Intune. Intune supports deploying internally developed LOB apps to iOS devices by uploading the signed .ipa package directly. Since the app is already signed with an enterprise certificate, it can be distributed via Intune's iOS LOB app workflow without requiring the Apple App Store or VPP.

Answer

Add the app as a Volume Purchase Program (VPP) app

Answer

Use an Enterprise Code Signing certificate to deploy via MDM

Answer

Publish the app to the Apple App Store and deploy as public app

Question 7

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

Accepted Answer

Security baselines are configured and assigned in Intune endpoint security. Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Answer

Devices are onboarded to Defender for Endpoint

Answer

Group Policy objects are linked to the domain

Answer

Devices are registered in Microsoft 365 Defender portal

Question 8

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

Accepted Answer

The device is powered off or not connected to the internet. If the device is powered off or not connected to the internet, it cannot check in with Intune to receive new policies. Option A is wrong because an Intune service outage would affect multiple devices, not just one. Option C is wrong because conflicting policies would not prevent check-in; the device would still check in and report conflicts. Option D is wrong because an expired enrollment certificate would prevent enrollment or cause immediate issues, not just a delayed check-in after three days.

Answer

The Intune service is experiencing an outage

Answer

The device has conflicting policies from another MDM

Answer

The device's enrollment certificate has expired

Question 9

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Answer

Require multi-factor authentication

Answer

Require hybrid Azure AD joined device

Answer

Require approved client app

Question 10

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Windows Autopilot for new devices. Which prerequisite must be met for Autopilot to work with Entra ID?

Accepted Answer

Devices must be registered in Autopilot using hardware hash. Windows Autopilot requires that each device be registered in the Autopilot service using its unique hardware hash (also known as a hardware ID). This hash is collected from the device's firmware and uploaded to the Autopilot deployment service, which then associates the device with the target tenant. Without this registration, Autopilot cannot identify the device during the out-of-box experience (OOBE) and cannot automatically enroll it into Microsoft Entra ID.

Answer

Devices must be domain-joined to on-premises AD

Answer

An Azure AD Premium P2 license must be assigned

Answer

Configuration Manager must be deployed for OS imaging

Question 11

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

Accepted Answer

The DNS CNAME record for enrollment is missing or incorrect. The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Answer

The user does not have an Intune license assigned

Answer

The MDM authority is not set to Intune

Answer

The device firewall is blocking traffic to manage.microsoft.com

Question 12

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

Accepted Answer

Microsoft 365 Apps for Windows. The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Answer

Web link

Answer

Windows app (MSI)

Answer

Line-of-business app

Question 13

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Accepted Answer

Convert existing devices to Autopilot by uploading hardware hash. Windows Autopilot allows you to import a hardware hash (a unique device identifier) from existing devices into Intune, converting them into Autopilot devices. This enables you to apply Autopilot deployment profiles and customize the OOBE without requiring a full OS reinstall, leveraging the device's existing identity.

Answer

Enforce security baselines on devices

Answer

Deploy third-party applications automatically

Answer

Configure BIOS settings remotely

Question 14

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Accepted Answer

MDM enrollment enabled in Microsoft Entra ID. Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Answer

A device compliance policy assigned to the device

Answer

Azure AD Premium P1 license

Question 15

Which TWO are valid methods to deploy Windows 10/11 using Microsoft Intune?

Accepted Answer

Windows Autopilot. Windows Autopilot is a valid Intune deployment method because it uses cloud-based configuration to transform a new or existing device into a business-ready state without manual imaging. It leverages hardware hashes uploaded to Intune, which then applies policies, apps, and settings during the out-of-box experience (OOBE). This eliminates the need for traditional imaging infrastructure.

Answer

PXE boot from a distribution point

Answer

Network boot via WDS

Answer

Bootable USB media with Windows Setup