MD-102 Prepare infrastructure for devices Practice Test 18 — 15 Questions

Question 1

You need to deploy a line-of-business (LOB) app to 100 iOS devices managed by Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

Upload the app package as an iOS LOB app in Intune. Intune supports deploying internally developed LOB apps to iOS devices by uploading the signed .ipa package directly. Since the app is already signed with an enterprise certificate, it can be distributed via Intune's iOS LOB app workflow without requiring the Apple App Store or VPP.

Answer

Add the app as a Volume Purchase Program (VPP) app

Answer

Use an Enterprise Code Signing certificate to deploy via MDM

Answer

Publish the app to the Apple App Store and deploy as public app

Question 2

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

Accepted Answer

Security baselines are configured and assigned in Intune endpoint security. Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Answer

Devices are onboarded to Defender for Endpoint

Answer

Group Policy objects are linked to the domain

Answer

Devices are registered in Microsoft 365 Defender portal

Question 3

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

Accepted Answer

The device is powered off or not connected to the internet. If the device is powered off or not connected to the internet, it cannot check in with Intune to receive new policies. Option A is wrong because an Intune service outage would affect multiple devices, not just one. Option C is wrong because conflicting policies would not prevent check-in; the device would still check in and report conflicts. Option D is wrong because an expired enrollment certificate would prevent enrollment or cause immediate issues, not just a delayed check-in after three days.

Answer

The Intune service is experiencing an outage

Answer

The device has conflicting policies from another MDM

Answer

The device's enrollment certificate has expired

Question 4

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Answer

Require multi-factor authentication

Answer

Require hybrid Azure AD joined device

Answer

Require approved client app

Question 5

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Windows Autopilot for new devices. Which prerequisite must be met for Autopilot to work with Entra ID?

Accepted Answer

Devices must be registered in Autopilot using hardware hash. Windows Autopilot requires that each device be registered in the Autopilot service using its unique hardware hash (also known as a hardware ID). This hash is collected from the device's firmware and uploaded to the Autopilot deployment service, which then associates the device with the target tenant. Without this registration, Autopilot cannot identify the device during the out-of-box experience (OOBE) and cannot automatically enroll it into Microsoft Entra ID.

Answer

Devices must be domain-joined to on-premises AD

Answer

An Azure AD Premium P2 license must be assigned

Answer

Configuration Manager must be deployed for OS imaging

Question 6

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

Accepted Answer

Microsoft 365 Apps for Windows. The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Answer

Web link

Answer

Windows app (MSI)

Answer

Line-of-business app

Question 7

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Accepted Answer

Convert existing devices to Autopilot by uploading hardware hash. Option B is correct because Windows Autopilot supports registering existing devices by collecting their hardware hash (via the Get-WindowsAutoPilotInfo script or similar) and uploading it as a CSV to Intune, which creates an Autopilot device record so the device can be reset and reprovisioned through the Autopilot flow. Option D is correct because Autopilot's core purpose is to define and customize the out-of-box experience (OOBE) using deployment profiles, including settings like the privacy prompts, user account type, language/region, and whether the user is a standard user or local admin. Option A is not an Autopilot action; security baselines are enforced through Intune configuration profiles/policies, not through Autopilot itself. Option C is not specific to Autopilot; third-party applications are deployed via Intune app deployment (Win32 apps, MSI, Microsoft Store apps, etc.), which can be assigned to Autopilot-enrolled devices but is not an Autopilot capability. Option E is not an Autopilot function; BIOS/UEFI settings are typically configured through vendor tools (e.g., Dell Command | Configure, HP Client Management Script Library) or Intune's OEM-specific configuration, not Autopilot.

Answer

Enforce security baselines on devices

Answer

Deploy third-party applications automatically

Answer

Configure BIOS settings remotely

Question 8

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Accepted Answer

MDM enrollment enabled in Microsoft Entra ID. Option B is correct because MDM enrollment must be enabled in Microsoft Entra ID (the Mobility (MDM and MAM) settings) so that Windows devices can be automatically or manually enrolled into Intune; without this, the tenant cannot accept MDM enrollments. Option D is correct because each enrolling user must hold a valid Microsoft Intune license (for example, an Intune, EMS E3/E5, or Microsoft 365 license that includes Intune) to be entitled to enroll and manage the device. Option E is correct because the Windows device must have internet connectivity to reach the Microsoft Intune service endpoints (and dependent services such as the enrollment and MDM endpoints) to complete enrollment and receive policy. Option A is not required for enrollment itself, since a device compliance policy is applied after the device is enrolled and is used for conditional access evaluation, not as an enrollment prerequisite. Option C is not required, because Microsoft Entra ID P1 is not a prerequisite for Intune enrollment; Intune licensing covers the MDM functionality, and automatic MDM enrollment in Entra ID does not require P1.

Answer

A device compliance policy assigned to the device

Answer

Azure AD Premium P1 license

Question 9

Which TWO are valid methods to deploy Windows 10/11 using Microsoft Intune?

Accepted Answer

Windows Autopilot. Windows Autopilot (A) is a valid Intune-based deployment method that uses the device's hardware hash registered in Intune to apply an Autopilot profile, enroll the device in Microsoft Entra ID/Entra ID, and drive the Out-of-Box Experience (OOBE) so the device is configured and joined automatically without reimaging. Provisioning packages (B) are also valid: a .ppkg created with Windows Configuration Designer can be applied during OOBE or after installation to enroll the device into Intune (via the enrollment package or bulk enrollment token) and apply settings, making it a supported Intune deployment path. PXE boot from a distribution point (C) and network boot via WDS (D) are Configuration Manager/legacy imaging technologies, not Intune deployment methods, and bootable USB media with Windows Setup (E) is a manual OS installation method that does not itself deploy or enroll devices through Intune.

Answer

PXE boot from a distribution point

Answer

Network boot via WDS

Answer

Bootable USB media with Windows Setup

Question 10

You are the endpoint administrator for Contoso Ltd., a multinational company with 10,000 Windows 10 and 11 devices managed by Microsoft Intune. The company recently acquired a subsidiary that uses on-premises Active Directory and Configuration Manager. The subsidiary's devices are not joined to Microsoft Entra ID. Your goal is to migrate these devices to cloud management with Intune within six months. The subsidiary has 2,000 devices, all running Windows 10. The devices are currently domain-joined and managed by ConfigMgr. You need to choose the most efficient migration strategy that minimizes user disruption and leverages existing investments. The subsidiary has a high-speed WAN link to the corporate network. You have the following options: A) Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune. B) Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join. C) Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps. D) Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning. Which option should you choose?

Accepted Answer

Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join.. Co-management allows you to gradually transition Configuration Manager workloads to Intune without disrupting existing management, leveraging the existing ConfigMgr infrastructure and high-speed WAN link. This minimizes user disruption by keeping devices domain-joined initially, then switching to Entra ID join after workloads are migrated, which is the most efficient path for 2,000 existing domain-joined devices.

Answer

Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune.

Answer

Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps.

Answer

Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning.

Question 11

You need to configure Intune to automatically retire devices that have not checked in for 90 days. Where should you set this?

Accepted Answer

Device cleanup rules in Intune admin center. Device cleanup rules in the Intune admin center allow administrators to automatically retire or delete devices that have not checked in for a specified number of days. This is the correct location because the rule is specifically designed for lifecycle management of stale devices, not for compliance or enrollment policies. Setting the threshold to 90 days ensures that devices exceeding that inactivity period are removed from management.

Answer

Compliance policies

Answer

Enrollment restrictions

Answer

Windows Autopilot devices blade

Question 12

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

Accepted Answer

MDM user scope in Microsoft Entra ID. The MDM user scope setting in Microsoft Entra ID (formerly Azure AD) controls which users can automatically enroll their Windows 10 devices into Intune when they join Entra ID. When set to 'All' or 'Some', the device triggers automatic MDM enrollment during the Entra ID join process using the MDM enrollment protocol (MS-MDE), eliminating the need for manual enrollment steps.

Answer

Compliance policies in Intune

Answer

Co-management slider in Configuration Manager

Answer

Enrollment device platform restrictions in Intune

Question 13

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Accepted Answer

Devices enrolled in Microsoft Intune. Option A is correct because co-management requires that the Windows devices be enrolled in Microsoft Intune, which provides the MDM authority and the Intune workloads that Configuration Manager can hand over. Option B is correct because co-management is a feature of Configuration Manager current branch (version 1710 or later), so the site must be running a supported current branch release. Option C is not required because co-management works with Microsoft Entra ID (Azure AD) joined, hybrid joined, or even domain-joined devices, and on-premises Active Directory is not a prerequisite. Option D is not required because PKI certificates are only needed for specific scenarios such as HTTPS management or PKI-based authentication, not for enabling co-management itself. Option E is not required because hybrid Microsoft Entra ID joined devices are one supported device identity type, but co-management also supports Microsoft Entra ID joined and domain-joined devices, so hybrid join is not mandatory.

Answer

On-premises Active Directory

Answer

Public Key Infrastructure (PKI)

Answer

Hybrid Microsoft Entra ID joined devices

Question 14

Your organization is planning to deploy Microsoft Entra hybrid joined devices. What is a prerequisite for this configuration?

Accepted Answer

Microsoft Entra Connect must be installed and configured.. Microsoft Entra hybrid joined devices require synchronization of on-premises Active Directory identities to Microsoft Entra ID. Microsoft Entra Connect (or Microsoft Entra Connect Sync) is the tool that performs this identity synchronization, making it a mandatory prerequisite. Without it, the on-premises AD objects cannot be linked to Entra ID for hybrid join.

Answer

Azure AD Premium P1 license is required.

Answer

Microsoft Intune must be enabled for auto-enrollment.

Answer

Microsoft Defender for Endpoint must be deployed.

Question 15

A user reports that their Windows 11 device fails to enroll in Microsoft Intune. The device is Microsoft Entra joined and the user has a valid Intune license. What should you check first?

Accepted Answer

Check the Enrollment Status Page (ESP) profile configuration in Intune.. Enrollment Status Page (ESP) profiles can block enrollment if misconfigured, and checking the Intune console is the first step to see errors. Option A is wrong because BitLocker is not related to enrollment. Option C is wrong because the local admin password is not required for enrollment. Option D is wrong because the Autopilot profile is only relevant for Autopilot deployments, not general enrollment.

Answer

Verify that BitLocker is enabled on the device.

Answer

Ensure that the device has a local administrator password set.

Answer

Review the Windows Autopilot deployment profile assigned to the device.