MD-102 Prepare infrastructure for devices Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device does not meet authentication requirements. The JSON configuration includes an 'authenticationRequirement' setting that mandates multifactor authentication (MFA) for enrollment. Since the user's device or account does not meet this MFA requirement, the enrollment is blocked. Authentication requirements are a common cause of enrollment failures, and the error message 'enrollment is blocked' typically aligns with such policy violations rather than version restrictions or device count limits.

Answer

The enrollment is restricted to Windows Holographic only

Answer

The device type filter excludes Windows 10

Answer

The user already has 5 devices enrolled

Question 2

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use Group Policy to configure MDM enrollment. C) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. D) Use a provisioning package (PPKG) to enroll devices. Which option should you choose?

Accepted Answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. Use the 'Switch to Intune' option in the device's 'Access work or school' settings. This feature is specifically designed for migrating devices from a legacy on-premises MDM to Intune without requiring a device reset. It is available on Windows 10 devices that are already joined to Microsoft Entra ID and enrolled in another MDM. Option A is incorrect because Windows Autopilot resets the device, which is not desired. Option B (Group Policy) can force enrollment to Intune but does not handle the migration from an existing MDM; it would likely cause a conflict or require manual steps. Option D (provisioning package) is typically used for initial bulk enrollment and may also require a reset or clean installation. Therefore, Option C is the only non-destructive migration method.

Answer

Use Windows Autopilot to reset the devices and re-enroll

Answer

Use Group Policy to configure MDM enrollment

Answer

Use a provisioning package (PPKG) to enroll devices

Question 3

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with TPM 2.0 and UEFI Secure Boot enabled can enroll. Which configuration profile setting should you configure?

Accepted Answer

Enable Device Health Attestation (DHA) in enrollment restrictions. Device Health Attestation (DHA) in enrollment restrictions allows you to block enrollment for devices that do not meet specific hardware security requirements, such as TPM 2.0 and UEFI Secure Boot enabled. When configured, Intune verifies these attestation claims during the enrollment process and rejects non-compliant devices before they can enroll. This is the only setting that enforces hardware prerequisites at the enrollment stage, not after the device is already managed.

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Configure a BitLocker policy in Endpoint Security

Answer

Set a compliance policy for device health

Question 4

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

Accepted Answer

Apps are assigned to devices instead of users. Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Answer

Device type is restricted in enrollment restrictions

Answer

VPP token is not configured for user enrollment

Answer

User Enrollment does not support app distribution

Question 5

A multinational organization uses Microsoft Entra ID joined devices with Intune. The security team wants to block enrollment of devices from non-corporate networks unless they have a compliant certificate. Which enrollment restriction should you configure?

Accepted Answer

Enrollment device restrictions with certificate requirement. Enrollment device restrictions in Intune allow you to block enrollment from non-corporate networks unless a compliant certificate is present. This is configured under 'Enrollment device restrictions' where you can set a 'Block' action for devices not on trusted networks and require a certificate for compliance, ensuring only authenticated devices can enroll from untrusted locations.

Answer

Device platform restrictions

Answer

Conditional Access policy requiring hybrid Azure AD join

Answer

Compliance policy for device health

Question 6

You need to configure Intune to automatically retire devices that have not checked in for 90 days. Where should you set this?

Accepted Answer

Device cleanup rules in Intune admin center. Device cleanup rules in the Intune admin center allow administrators to automatically retire or delete devices that have not checked in for a specified number of days. This is the correct location because the rule is specifically designed for lifecycle management of stale devices, not for compliance or enrollment policies. Setting the threshold to 90 days ensures that devices exceeding that inactivity period are removed from management.

Answer

Compliance policies

Answer

Enrollment restrictions

Answer

Windows Autopilot devices blade

Question 7

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work profile apps are encrypted and that the device owner cannot uninstall the Company Portal app. Which configuration profile should you deploy?

Accepted Answer

Device restrictions for Android Enterprise work profile. The 'Device restrictions for Android Enterprise work profile' profile includes settings to enforce encryption of work profile apps and to prevent the uninstallation of the Company Portal app. Specifically, the 'Require work profile encryption' setting ensures that work profile data is encrypted, and the 'Block uninstall of Company Portal' setting prevents the device owner from removing the Company Portal app. These settings are only available within the work profile restrictions profile, not in other profile types.

Answer

Device configuration profile with custom OMA-URI

Answer

Device restrictions for Android Enterprise fully managed

Answer

Compliance policy for Android Enterprise

Question 8

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

Accepted Answer

Automated device enrollment (with user affinity). Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Answer

User enrollment

Answer

Device enrollment (without user affinity)

Answer

Bring your own device (BYOD) enrollment

Question 9

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

Accepted Answer

MDM user scope in Microsoft Entra ID. The MDM user scope setting in Microsoft Entra ID (formerly Azure AD) controls which users can automatically enroll their Windows 10 devices into Intune when they join Entra ID. When set to 'All' or 'Some', the device triggers automatic MDM enrollment during the Entra ID join process using the MDM enrollment protocol (MS-MDE), eliminating the need for manual enrollment steps.

Answer

Compliance policies in Intune

Answer

Co-management slider in Configuration Manager

Answer

Enrollment device platform restrictions in Intune

Question 10

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Accepted Answer

Ensure the device has a Windows 10/11 Pro or Education license. Subscription activation requires a qualifying base license of Windows 10/11 Pro or Education. These editions support the subscription activation feature, which upgrades the device to Windows 10/11 Enterprise without requiring a separate product key. Without this base license, the device cannot be upgraded via subscription activation.

Answer

Enter a MAK key

Answer

Configure a KMS host key

Answer

Install the Azure AD Connect tool

Question 11

Which THREE permissions are required for a service account to register devices in Windows Autopilot? (Select THREE.)

Accepted Answer

Intune Administrator role. The Intune Administrator role is required because it grants the necessary permissions to manage Windows Autopilot deployment profiles, upload device hashes, and assign profiles to devices within the Microsoft Intune admin center. Without this role, a service account cannot configure or monitor the Autopilot registration process, as it is a core Intune workload.

Answer

Security Reader role

Answer

Global Administrator role

Question 12

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Accepted Answer

Devices enrolled in Microsoft Intune. Devices must be enrolled in Microsoft Intune to be co-managed; Intune enrollment is the mechanism that enables cloud-based management. Option B is correct because co-management requires Configuration Manager current branch (version 1606 or later) as a minimum. Option E is not strictly required: co-management supports both hybrid and pure Azure AD joined devices, though hybrid is common. Options C and D are not prerequisites; on-premises AD and PKI are optional.

Answer

On-premises Active Directory

Answer

Public Key Infrastructure (PKI)

Answer

Hybrid Microsoft Entra ID joined devices

Question 13

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Accepted Answer

Microsoft Entra ID Connect. In a hybrid deployment, Windows Hello for Business requires synchronization of user credentials from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID Connect (B) provides this synchronization, enabling the device to authenticate against both on-premises and cloud resources. Additionally, a Public Key Infrastructure (PKI) (C) is required to issue the certificate-based authentication keys used by Windows Hello for Business in hybrid deployments, as the on-premises domain controllers must trust the certificates.

Answer

Configuration Manager

Answer

Multifactor authentication (MFA)

Answer

Microsoft Intune

Question 14

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

Accepted Answer

Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.. It leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Answer

Deploy Windows Autopilot for all new devices and ignore existing devices.

Answer

Purchase a third-party MDM tool to manage non-compliant devices.

Answer

Ask all users to manually enroll their devices using the Company Portal app.

Question 15

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

Accepted Answer

Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.. Configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Azure AD-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Answer

Distribute a script to each user to run manually.

Answer

Deploy Windows Autopilot to reset and re-enroll each device.

Answer

Use the Intune Enrollment Status Page to force enrollment.