MD-102 Prepare infrastructure for devices Practice Test 17 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Microsoft Defender for Endpoint sensor is not connected to the cloud service.. The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Answer

The device is not compliant with Intune compliance policies.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device does not have Microsoft Defender Antivirus enabled.

Question 2

You are planning to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. Which TWO methods can you use to deploy Microsoft 365 Apps? (Choose two.)

Accepted Answer

Windows Installer (Win32) app type using the Office Deployment Tool.. Option B is correct because you can package Microsoft 365 Apps as a Windows Installer (Win32) app in Intune by using the Office Deployment Tool (ODT) to generate the setup.exe and Configuration.xml, then wrap it with the Intune Win32 Content Prep Tool for deployment. Option E is correct because Intune provides a dedicated built-in app type called 'Microsoft 365 Apps for Windows' (the Microsoft 365 Apps app type) that lets you select Office apps, update channel, and architecture directly without packaging. Option A is incorrect because the Android store app type deploys Android apps, not Windows Office apps. Option C is incorrect because a web link app type only creates a shortcut to a URL and does not install Microsoft 365 Apps. Option D is incorrect because the iOS store app type targets iOS devices, not Windows.

Answer

Android store app type.

Answer

Web link app type pointing to the Office website.

Answer

iOS store app type.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Accepted Answer

Windows Defender Application Control (WDAC).. Windows Defender Application Control (WDAC) (B) is correct because it is Microsoft's application control technology that enforces code integrity policies on Windows 10, allowing only approved/trusted binaries to execute based on publisher, hash, or file path rules. Intune application control policies (C) are correct because Intune can deploy and manage application control configurations—including WDAC and AppLocker policies—to Windows 10 devices, letting administrators centrally enforce which apps are allowed. AppLocker (D) is correct because it is a built-in Windows 10 application control feature that restricts which applications and files users can run using allow/deny rules based on publisher, path, or hash. Windows Information Protection (A) is not an application control mechanism; it is a data protection feature that helps prevent accidental data leakage by separating and encrypting corporate data, not by blocking unapproved applications. BitLocker (E) is a full-disk encryption feature that protects data at rest, and it has no role in controlling which applications are permitted to run.

Answer

Windows Information Protection (WIP).

Answer

BitLocker drive encryption.

Question 4

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

Accepted Answer

Set feature update deferral to 120 days and quality update deferral to 30 days.. The Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Answer

Set feature update deferral to 180 days and quality update deferral to 0 days.

Answer

Set feature update deferral to 30 days and quality update deferral to 120 days.

Answer

Set both feature and quality update deferrals to 60 days.

Question 5

You are planning to deploy Microsoft Intune for device management. Which ONE of the following is a prerequisite for enrolling Windows 10 devices in Intune?

Accepted Answer

Microsoft Intune license assigned to the user.. Option B is the correct prerequisite: a Microsoft Intune license must be assigned to the user enrolling the device. Option A (Microsoft Entra ID Premium P1/P2) is not required; Microsoft Entra ID Free is sufficient for Intune enrollment. Option C (Microsoft account) is not needed for corporate devices. Option D (Microsoft 365 E3) is a bundled subscription but not a standalone prerequisite. Option E (Azure Information Protection) is unrelated to device enrollment. Therefore, only one option is correct.

Answer

Microsoft Entra ID (Azure AD) Premium P1 or P2.

Answer

A Microsoft account (MSA) for each user.

Answer

Microsoft 365 E3 subscription.

Answer

Azure Information Protection license.

Question 6

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

Accepted Answer

Create a Conditional Access policy requiring device to be marked as compliant.. A Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Answer

Create an app protection policy for Windows 365 app.

Answer

Configure the Cloud PC provisioning policy to allow only compliant devices.

Answer

Assign a device compliance policy to all users.

Question 7

You need to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. The deployment must be available to users in the company portal. Which app type should you select?

Accepted Answer

Windows 10/11 (Microsoft 365 Apps). The 'Windows 10/11 (Microsoft 365 Apps)' app type in Intune is specifically designed to deploy Microsoft 365 Apps (formerly Office 365 ProPlus) with built-in support for the Office Deployment Tool (ODT) and XML configuration. This app type automatically handles the installation, updates, and licensing via the Microsoft 365 Apps for enterprise channel, and it appears in the Company Portal for user-initiated installation. Other app types lack the native integration for Microsoft 365 Apps deployment or do not support user-visible installation in the Company Portal.

Answer

Microsoft 365 (Web link)

Answer

Microsoft Store app (new)

Answer

Windows app (Win32)

Question 8

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

Accepted Answer

Devices must have line-of-sight to an on-premises domain controller.. For hybrid Microsoft Entra ID join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Answer

Devices must have VPN connectivity to Azure.

Answer

An Intune connector for Active Directory must be installed.

Answer

Azure AD Connect must be configured with password hash sync.

Question 9

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

Accepted Answer

The device's group membership is still being processed, so policies are not yet applied.. When a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet. The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Answer

The OMA-URI setting is invalid.

Answer

The device is not enrolled.

Answer

The device is not compliant.

Question 10

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

Accepted Answer

Apple Automated Device Enrollment (ADE). Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Answer

Apple Configurator enrollment

Answer

Device Enrollment Manager (DEM) account

Answer

User-initiated enrollment via Company Portal

Question 11

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Accepted Answer

Verify the device is a member of the assigned device group.. The most common reason a kiosk mode profile fails to apply is that the device is not a member of the assigned device group. Intune evaluates policy targeting based on group membership; if the device is missing from the group, the profile will never be delivered. Verifying group membership is the first logical troubleshooting step before investigating device-level issues.

Answer

Ensure the device is running Windows 10 Enterprise.

Answer

Run the Policy Manager tool on the device.

Answer

Check the device's notification area for a policy update prompt.

Question 12

Your organization wants to use Windows Autopilot to deploy new Windows 11 devices. What is required to register a device with Windows Autopilot?

Accepted Answer

The device's hardware hash (4K HH). Windows Autopilot requires the device's hardware hash (4K HH) to uniquely identify the device during the registration process. This hash is generated from the device's hardware components and is uploaded to the Microsoft Intune or Partner portal to associate the device with an Autopilot profile. Without the hardware hash, Autopilot cannot recognize the device as registered and will not apply the deployment profile.

Answer

The device's product key

Answer

The user's Microsoft account

Answer

The device's BIOS password

Question 13

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Accepted Answer

Allows end users to set up their own devices with minimal IT involvement.. Option B is correct because Windows Autopilot lets end users complete the out-of-box experience (OOBE) themselves, joining the device to Microsoft Entra ID and applying Intune policies with minimal IT interaction. Option D is correct because Autopilot uses the OEM-installed Windows image and cloud-based configuration, eliminating the need to build, maintain, and apply custom images or perform manual setup steps. Option A is incorrect because Autopilot depends on Microsoft Entra ID for device identity and user authentication, so an Entra ID subscription is still required. Option C is incorrect because Autopilot provisioning requires direct internet access and does not support deployment over a VPN connection during OOBE. Option E is incorrect because Autopilot is a cloud-based service that requires internet connectivity throughout provisioning.

Answer

Eliminates the requirement for a Microsoft Entra ID subscription.

Answer

Enables device provisioning over a VPN connection.

Answer

Supports deployment without any internet connectivity.

Question 14

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes:
- 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune)
- 1,500 iOS devices (corporate-owned, managed via Intune)
- 500 Android devices (BYOD, managed via Intune with work profile)
- 200 macOS devices (corporate-owned, managed via Intune)

You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.

You have the following requirements:
1. Zero-touch enrollment for new Windows 11 devices.
2. Devices must be automatically configured with security policies and required applications.
3. Conditional access to Microsoft 365 resources based on device compliance.
4. Support for both corporate and BYOD devices.

Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

Accepted Answer

Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.. Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Answer

Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.

Answer

Assign Microsoft Intune licenses to all users who will receive the new devices.

Answer

Create a compliance policy that requires BitLocker encryption and a minimum OS version.

Question 15

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

Accepted Answer

Check the Intune console for Wi-Fi profile assignment and conflict status. Checking the Intune console for Wi-Fi profile assignment and conflict status is the fastest way to identify deployment issues, such as the profile not being assigned to the affected devices or conflicts with other profiles. Option A is wrong because recreating the profile may not address the root cause and could be time-consuming without first verifying the current assignment. Option B is wrong because running 'netsh wlan show profiles' only lists profiles stored locally and does not show Intune deployment status. Option D is wrong because reviewing Microsoft Entra ID sign-in logs does not show Wi-Fi profile status or assignment conflicts.

Answer

Recreate the Wi-Fi profile in Intune with new settings

Answer

Run the 'netsh wlan show profiles' command on affected devices

Answer

Review Microsoft Entra ID sign-in logs for authentication failures