MD-102 Prepare infrastructure for devices Practice Test 16 — 15 Questions

Question 1

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obtain the hardware hash from the device manufacturer or reseller.. The hardware hash can be obtained from the device manufacturer or reseller (OEM) before the device is shipped. This is the recommended approach for new devices as it allows the hardware hash to be uploaded to Intune without needing to power on the device. Option A is wrong because adding the device to Microsoft Entra ID does not upload the hardware hash. Option C is wrong because Configuration Manager can collect hashes but requires the device to be on the network and is typically used for existing devices. Option D is wrong because running a PowerShell script on each device requires the device to be powered on and manually executed, which is less efficient for new devices.

Answer

Add the device to Microsoft Entra ID before shipping.

Answer

Use Microsoft Configuration Manager to collect the hardware hash.

Answer

Run a PowerShell script on each device to capture the hardware hash.

Question 2

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

Accepted Answer

Set the MDM user scope in Microsoft Entra ID to 'All' or 'Some'.. Microsoft Entra ID joined devices automatically enroll in Intune when the MDM user scope is set to 'All' or 'Some'. Option B is incorrect because the MDM discovery URL is configured automatically for Microsoft Entra ID joined devices and does not need manual configuration. Option C is incorrect because enrollment restrictions control which devices can enroll but do not trigger automatic enrollment. Option D is incorrect because device compliance policies are applied after enrollment, not before.

Answer

Configure the MDM discovery URL in Microsoft Entra ID.

Answer

Create an enrollment restriction that allows Windows devices.

Answer

Assign a device compliance policy to the user.

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

Accepted Answer

Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.. Enrollment platform restrictions in Intune let you define the minimum and maximum OS versions allowed to enroll for each platform, including iOS/iPadOS. Setting the minimum OS version to 16.0 blocks enrollment of devices running older versions at the enrollment gate. This is the correct control because the requirement is about enrollment eligibility, not ongoing compliance.

Answer

Create a device configuration profile that requires iOS 16.0.

Answer

Modify the enrollment profile to require iOS 16.0.

Answer

Create a compliance policy that requires iOS 16.0 or later.

Question 4

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Microsoft Entra ID join with automatic MDM enrollment.. The correct answers are B (Microsoft Entra ID join with automatic MDM enrollment) and D (Windows Autopilot). Both are valid methods to enroll Windows devices into Microsoft Intune. Option A (Android Zero Touch) is for Android devices, not Windows. Option C (Apple Business Manager) is for Apple devices. Option E (Samsung Knox Mobile Enrollment) is for Samsung Android devices.

Answer

Android Zero Touch.

Answer

Apple Business Manager.

Answer

Samsung Knox Mobile Enrollment.

Question 5

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

Accepted Answer

One of the required apps failed to install.. The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Answer

The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

Answer

The user attempted to retry the setup and it was blocked.

Answer

The device reset on failure is enabled, causing a reset loop.

Question 6

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant are blocked from accessing corporate resources. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that requires compliant devices.. Conditional Access policies in Microsoft Entra ID are the correct mechanism to enforce access controls based on device compliance status. By creating a policy that requires devices to be marked as compliant, you ensure that only compliant devices can access corporate resources, while non-compliant devices are blocked at the authentication level. This integrates with Intune compliance policies to evaluate device health before granting access.

Answer

Create a device compliance policy and assign it to users.

Answer

Create a device configuration profile that restricts access.

Answer

Configure enrollment restrictions to block non-compliant devices.

Question 7

Your organization uses Microsoft Defender for Endpoint. You need to ensure that devices onboarding to Microsoft Defender for Endpoint are automatically assigned to a specific device group based on their operating system version. What should you use?

Accepted Answer

Configure device group rules in Microsoft Defender for Endpoint using OS version condition.. Device group rules in Microsoft Defender for Endpoint allow you to automatically assign devices to groups based on conditions such as operating system version. This is the correct approach because it uses the built-in grouping engine that evaluates device attributes during onboarding, ensuring consistent and automated assignment without manual intervention.

Answer

Manually tag each device in the Microsoft 365 Defender portal.

Answer

Use Microsoft Entra ID dynamic groups based on device OS.

Answer

Create a Microsoft Intune compliance policy that tags devices by OS version.

Question 8

You need to deploy Microsoft 365 Apps to 1000 devices using Microsoft Intune. The devices are a mix of Windows 10 and Windows 11. Which app deployment method should you use to ensure the latest version is always installed?

Accepted Answer

Deploy Microsoft 365 Apps for enterprise as a built-in app type in Intune.. The Microsoft 365 Apps for enterprise built-in app type in Intune is specifically designed to deploy and manage Office with automatic updates from the Office Content Delivery Network (CDN). This method ensures that devices always receive the latest version of Microsoft 365 Apps without requiring manual intervention or custom configuration, as Intune handles the deployment policy and update channel settings natively.

Answer

Deploy a line-of-business app from the installation file.

Answer

Deploy a Win32 app with the Office Deployment Tool.

Answer

Deploy a custom script that installs Office from a network share.

Question 9

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Accepted Answer

The device has not checked in with the Intune service recently.. When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Answer

The device is marked as non-compliant.

Answer

The device does not have a valid device certificate.

Answer

The device enrollment profile has expired.

Question 10

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

Accepted Answer

The Conditional Access policy does not include the email application as a target.. A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it. Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.

Answer

The Conditional Access policy is set to 'Block' instead of 'Grant'.

Answer

The Conditional Access policy applies only to users in a specific group.

Answer

The compliance policy is not assigned to the users' devices.

Question 11

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

Accepted Answer

Configuration profiles. Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Answer

Update rings

Answer

Device enrollment profiles

Answer

Compliance policies

Question 12

Which TWO components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select two.)

Accepted Answer

Device registration in the Autopilot service using hardware hash.. Option B is correct because a device must first be registered in the Windows Autopilot service by uploading its hardware hash (collected via Get-WindowsAutopilotInfo or the OEM) so that the Autopilot service can recognize the device and associate it with the tenant during OOBE. Option D is correct because a Windows Autopilot deployment profile in Intune defines the critical settings for the user-driven Entra ID join scenario, including the deployment mode (User-Driven), the join type (Microsoft Entra joined), and the out-of-box experience options that drive the enrollment. Option A is not required: the Enrollment Status Page is an optional configuration that only controls what the user sees during device setup and does not enable the Autopilot deployment itself. Option C is incorrect because user-driven Autopilot with Microsoft Entra ID join does not require on-premises Active Directory domain join; that would be a hybrid Entra join scenario. Option E is incorrect because Microsoft Configuration Manager co-management is not a prerequisite for Autopilot; Intune alone is sufficient to deliver the deployment profile and manage the device.

Answer

Enrollment Status Page (ESP) configuration.

Answer

On-premises Active Directory domain join.

Answer

Microsoft Configuration Manager co-management.

Question 13

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Accepted Answer

Allows IT to provision devices remotely without physical access.. Option C is correct because Windows Autopilot lets IT provision and configure devices remotely through the cloud (Microsoft Intune/Endpoint Manager), so administrators never need to touch the hardware or maintain a staging network. Option D is correct because Autopilot uses the OEM-installed Windows image and applies configuration via Intune profiles and the Enrollment Status Page, eliminating the traditional wipe-and-load imaging and manual configuration steps. Options A, B, and E are not benefits of Autopilot: it requires internet connectivity to reach Intune and Microsoft Entra ID, it deliberately uses the existing OEM image rather than deploying custom images (that is what MDT/ConfigMgr imaging does), and although the Out-of-Box Experience is largely automated, the user still must sign in and may complete some steps, so it does not eliminate all user interaction.

Answer

Works offline without internet connectivity.

Answer

Enables deployment of custom operating system images.

Answer

Eliminates the need for any user interaction during setup.

Question 14

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

Accepted Answer

User-driven deployment with Microsoft Entra ID join.. The enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Answer

Self-deploying mode where no user interaction is required.

Answer

Hybrid Microsoft Entra ID join with on-premises domain controller.

Answer

On-premises Active Directory domain join only.

Question 15

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

Accepted Answer

Create a Windows feature update profile targeting Windows 11.. A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Answer

Deploy a configuration profile with the Windows 11 installation script.

Answer

Create a Windows update ring profile targeting Windows 11.

Answer

Configure a device compliance policy requiring Windows 11.