MD-102 Prepare infrastructure for devices Practice Test 16 — 15 Questions

Question 1

A multinational organization uses Microsoft Entra ID joined devices with Intune. The security team wants to block enrollment of devices from non-corporate networks unless they have a compliant certificate. Which enrollment restriction should you configure?

Accepted Answer

Enrollment device restrictions with certificate requirement. Option D is correct because enrollment device restrictions in Intune allow you to block enrollment from non-corporate networks unless a compliant certificate is present. This is configured under 'Enrollment device restrictions' where you can set a 'Block' action for devices not on trusted networks and require a certificate for compliance, ensuring only authenticated devices can enroll from untrusted locations.

Answer

Device platform restrictions

Answer

Conditional Access policy requiring hybrid Azure AD join

Answer

Compliance policy for device health

Question 2

Your organization plans to deploy Windows 11 devices using Windows Autopilot. You need to ensure that each device is automatically enrolled in Intune and receives a custom configuration profile during the out-of-box experience (OOBE). Which two components are required?

Accepted Answer

A device configuration profile assigned to the device. A device configuration profile assigned to the device is required because it defines the custom settings (e.g., security baselines, app restrictions, or network configurations) that must be applied during the out-of-box experience. Without this profile, the device would enroll in Intune but would not receive the specific custom configuration needed for the organization's compliance and operational requirements.

Answer

A Microsoft Defender for Endpoint policy

Answer

A compliance policy

Answer

Windows Autopilot hardware hash

Question 3

You need to configure Intune to automatically retire devices that have not checked in for 90 days. Where should you set this?

Accepted Answer

Device cleanup rules in Intune admin center. Device cleanup rules in the Intune admin center allow administrators to automatically retire or delete devices that have not checked in for a specified number of days. This is the correct location because the rule is specifically designed for lifecycle management of stale devices, not for compliance or enrollment policies. Setting the threshold to 90 days ensures that devices exceeding that inactivity period are removed from management.

Answer

Compliance policies

Answer

Enrollment restrictions

Answer

Windows Autopilot devices blade

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work profile apps are encrypted and that the device owner cannot uninstall the Company Portal app. Which configuration profile should you deploy?

Accepted Answer

Device restrictions for Android Enterprise work profile. Option C is correct because the 'Device restrictions for Android Enterprise work profile' profile includes settings to enforce encryption of work profile apps and to prevent the uninstallation of the Company Portal app. Specifically, the 'Require work profile encryption' setting ensures that work profile data is encrypted, and the 'Block uninstall of Company Portal' setting prevents the device owner from removing the Company Portal app. These settings are only available within the work profile restrictions profile, not in other profile types.

Answer

Device configuration profile with custom OMA-URI

Answer

Device restrictions for Android Enterprise fully managed

Answer

Compliance policy for Android Enterprise

Question 5

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

Accepted Answer

Automated device enrollment (with user affinity). Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Answer

User enrollment

Answer

Device enrollment (without user affinity)

Answer

Bring your own device (BYOD) enrollment

Question 6

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

Accepted Answer

MDM user scope in Microsoft Entra ID. Option B is correct because the MDM user scope setting in Microsoft Entra ID (formerly Azure AD) controls which users can automatically enroll their Windows 10 devices into Intune when they join Entra ID. When set to 'All' or 'Some', the device triggers automatic MDM enrollment during the Entra ID join process using the MDM enrollment protocol (MS-MDE), eliminating the need for manual enrollment steps.

Answer

Compliance policies in Intune

Answer

Co-management slider in Configuration Manager

Answer

Enrollment device platform restrictions in Intune

Question 7

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Accepted Answer

Ensure the device has a Windows 10/11 Pro or Education license. Option A is correct because subscription activation requires a qualifying base license of Windows 10/11 Pro or Education. These editions support the subscription activation feature, which upgrades the device to Windows 10/11 Enterprise without requiring a separate product key. Without this base license, the device cannot be upgraded via subscription activation.

Answer

Enter a MAK key

Answer

Configure a KMS host key

Answer

Install the Azure AD Connect tool

Question 8

Which THREE permissions are required for a service account to register devices in Windows Autopilot? (Select THREE.)

Accepted Answer

Intune Administrator role. Option A is correct because Intune Administrator can manage Autopilot devices. Option B is correct because the account must be able to read device information in Microsoft Entra ID. Option C is correct because the account needs to add devices to Autopilot. Option D is wrong because Security Reader cannot modify. Option E is wrong because Global Administrator is not required.

Answer

Security Reader role

Answer

Global Administrator role

Question 9

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Accepted Answer

Devices enrolled in Microsoft Intune. Option A is correct because devices must be enrolled in Microsoft Intune to establish the co-management authority. Co-management requires that the client is managed by both Configuration Manager and Intune simultaneously, and Intune enrollment is the mechanism that enables the cloud-based management workload. Without Intune enrollment, the device cannot receive policies or apps from Intune, breaking the co-management relationship.

Answer

Configuration Manager current branch

Answer

On-premises Active Directory

Answer

Public Key Infrastructure (PKI)

Question 10

Which THREE are valid methods to prepare an existing Windows 10 device for Intune management? (Select THREE.)

Accepted Answer

Install and sign in to the Company Portal app. Option A is correct because the Company Portal app is the primary client interface for Intune enrollment on Windows 10. When a user signs in with their work or school account, the app triggers the MDM enrollment process via the Windows Management Framework, registering the device with the Intune service and applying compliance policies.

Answer

Deploy a Group Policy to trigger enrollment

Answer

Join the device to Azure AD without MDM auto-enrollment

Question 11

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Accepted Answer

Microsoft Entra ID Connect. In a hybrid deployment, Windows Hello for Business requires synchronization of user credentials from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID Connect (B) provides this synchronization, enabling the device to authenticate against both on-premises and cloud resources. Additionally, a Public Key Infrastructure (PKI) (C) is required to issue the certificate-based authentication keys used by Windows Hello for Business in hybrid deployments, as the on-premises domain controllers must trust the certificates.

Answer

Configuration Manager

Answer

Multifactor authentication (MFA)

Answer

Microsoft Intune

Question 12

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

Accepted Answer

Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.. Option D is correct because it leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Answer

Deploy Windows Autopilot for all new devices and ignore existing devices.

Answer

Purchase a third-party MDM tool to manage non-compliant devices.

Answer

Ask all users to manually enroll their devices using the Company Portal app.

Question 13

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

Accepted Answer

Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.. Option A is correct because configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Azure AD-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Answer

Distribute a script to each user to run manually.

Answer

Deploy Windows Autopilot to reset and re-enroll each device.

Answer

Use the Intune Enrollment Status Page to force enrollment.

Question 14

You manage a fleet of 2,000 iOS devices for a healthcare organization. The devices are used by clinicians and must be enrolled in Intune. Due to security requirements, you must ensure that devices are supervised and that the Company Portal app is installed automatically. You have Apple Business Manager (ABM) set up with Intune. You need to configure the enrollment process so that when a new device is unboxed and turned on, it automatically enrolls and receives the required configuration. Which enrollment method should you use?

Accepted Answer

Automated Device Enrollment (ADE) with user affinity. Automated Device Enrollment (ADE) with user affinity is the correct method because it leverages Apple Business Manager (ABM) to supervise devices automatically during the initial setup, enforces the required supervision state, and installs the Company Portal app via a mandatory VPP app assignment. User affinity ensures that each device is associated with a specific clinician, enabling user-based policies and conditional access. This meets the healthcare organization's security requirements for supervised devices and automatic app deployment.

Answer

Device enrollment (without user affinity)

Answer

Company Portal enrollment

Answer

User enrollment (BYOD)

Question 15

Your organization recently deployed Windows 11 devices managed by Microsoft Intune. You need to ensure that only approved third-party drivers are installed on these devices. What is the best approach?

Accepted Answer

Configure Windows Update for Business group policy settings to block driver updates from Windows Update.. Option C is correct because Windows Update for Business (WUfB) group policy settings allow you to block driver updates from Windows Update, which prevents unauthorized third-party drivers from being installed automatically. This is the most direct and manageable approach for ensuring only approved drivers are installed on Windows 11 devices managed by Microsoft Intune, as it controls the driver update source without requiring complex driver signing or hardware ID management.

Answer

Deploy a Windows Driver Frameworks (WDF) Coinstaller to enforce driver signing.

Answer

Use Device Installation Restrictions to allow only approved hardware IDs.

Answer

Configure a Windows Defender Application Control policy to block unsigned drivers.