MD-102 Prepare infrastructure for devices Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data is protected when users access Microsoft 365 apps. Which policy should you configure?

Accepted Answer

Deploy an Intune App Protection Policy (APP) for Microsoft 365 apps.. Intune App Protection Policies (APP) are designed specifically to protect corporate data at the app layer on iOS and Android, without requiring device enrollment. They enforce controls like PIN access, blocking copy/paste to personal apps, and selective wipe of corporate data within Microsoft 365 apps. This directly addresses the requirement to protect corporate data when users access Microsoft 365 apps.

Answer

Use a Mobile App Configuration policy to enforce app settings.

Answer

Create a Device Compliance policy for iOS devices.

Answer

Configure a Conditional Access policy to require compliant devices.

Question 2

You need to deploy Windows 10 Enterprise to 100 new computers using Microsoft Intune. The computers are not yet joined to Microsoft Entra ID. What is the recommended method?

Accepted Answer

Register the devices in Windows Autopilot and deploy an Autopilot profile.. Windows Autopilot is the recommended method for deploying Windows 10 Enterprise to new devices that are not yet joined to Microsoft Entra ID because it automates the entire provisioning process—from joining Entra ID to enrolling in Intune—without requiring any manual intervention or imaging. By registering the devices in Autopilot and deploying an Autopilot profile, the out-of-box experience (OOBE) is customized to join Entra ID and enroll in Intune automatically, ensuring a zero-touch deployment that aligns with modern management best practices.

Answer

Join each device to Entra ID manually and then enroll in Intune.

Answer

Create a provisioning package using Windows Configuration Designer and deploy via USB.

Answer

Use a Configuration Manager task sequence to deploy the OS.

Question 3

A company uses Microsoft Intune to manage Windows 10 devices. They want to prevent users from installing unapproved applications. Which approach provides the most granular control?

Accepted Answer

Deploy AppLocker rules via Intune to allow only approved publishers.. AppLocker provides the most granular control because it allows administrators to create rules based on publisher, product name, file name, file version, or file hash, and apply them to specific users or groups. Deployed via Intune, these rules can enforce which applications are allowed to run, effectively blocking unapproved installations. This level of detail (e.g., allowing only signed apps from a specific publisher) is not achievable with the other options.

Answer

Use the Microsoft Store for Business to deploy only approved apps.

Answer

Enable Windows Defender SmartScreen to block unknown apps.

Answer

Configure User Account Control (UAC) to always notify.

Question 4

Your organization requires that all corporate laptops be encrypted. You manage Windows 10 devices with Microsoft Intune. Which policy should you configure?

Accepted Answer

Create a BitLocker policy in Intune Endpoint Protection.. Microsoft Intune's Endpoint Protection policy includes a dedicated BitLocker settings section that allows administrators to enforce encryption on Windows 10 devices. This policy centrally manages BitLocker drive encryption, recovery key escrow to Microsoft Entra ID, and encryption method (e.g., XTS-AES 128-bit), meeting the requirement for corporate laptop encryption.

Answer

Enable Device Encryption in Windows settings.

Answer

Configure a FileVault policy for Windows devices.

Answer

Deploy an Encrypting File System (EFS) policy.

Question 5

Which TWO actions should you take to prepare a Windows 10 device for a deployment using Windows Autopilot?

Accepted Answer

Ensure the device has an internet connection during the out-of-box experience.. Option B is correct because Windows Autopilot relies on the device contacting Microsoft's cloud services (Intune and the Autopilot deployment service) during the out-of-box experience (OOBE) to download the deployment profile and enroll the device, so a working internet connection at OOBE is mandatory. Option E is correct because the device's hardware hash (a unique hardware identifier) must be captured and uploaded to Intune to register the device in the Windows Autopilot device list, which is what allows the Autopilot profile to be matched and applied to that specific device. Option A is not required because Autopilot performs the Microsoft Entra ID join automatically as part of the OOBE flow, so a manual join beforehand would defeat the purpose. Option C is not required because BitLocker is typically enabled automatically after Autopilot enrollment via Intune policy, not as a preparation step. Option D is not required because Autopilot does not mandate upgrading to the latest Windows 10 version beforehand; the device just needs a supported Windows 10 version that supports Autopilot.

Answer

Join the device to Microsoft Entra ID manually.

Answer

Enable BitLocker encryption on the device.

Answer

Upgrade the device to the latest Windows 10 version.

Question 6

Which THREE factors should you consider when planning a Microsoft Intune migration from Configuration Manager?

Accepted Answer

The use of co-management to gradually move workloads.. Option A is correct because co-management lets you attach Configuration Manager-managed devices to Intune and progressively shift workloads such as compliance policies, resource access, and Windows Update policies from Configuration Manager to Intune, enabling a controlled, phased migration rather than a disruptive cutover. Option C is correct because existing Configuration Manager applications and packages must be repackaged or converted into Intune-supported formats such as Win32 apps (.intunewin), line-of-business (LOB) apps, or Microsoft Store apps, and this compatibility assessment is essential for planning remediation and testing effort. Option E is correct because Intune is a cloud service, so devices must reach Microsoft endpoints over the internet, making bandwidth, proxy, firewall, and content-download requirements (for example, Windows Update for Business and Win32 app content) a key planning factor. Option B is not correct because Intune does not manage on-premises Windows Server workloads the way Configuration Manager does; servers generally remain with Configuration Manager or another on-premises tool. Option D is not correct because Intune is a fully cloud-hosted Microsoft service and requires no on-premises Intune server; only the Configuration Manager site infrastructure remains on-premises during co-management.

Answer

The ability to manage on-premises servers with Intune.

Answer

The need for an on-premises Intune server.

Question 7

Refer to the exhibit. A Microsoft Intune security baseline is configured for Windows 10 devices. What is the effect of this setting?

Accepted Answer

It reduces the CPU priority of scheduled scans to minimize performance impact.. This setting in the Microsoft Intune security baseline for Windows 10 configures the 'Low CPU priority for scheduled scans' policy for Microsoft Defender Antivirus. When enabled, it reduces the CPU priority of scheduled scans to minimize performance impact on the user's active workload, ensuring that background scanning does not interfere with foreground tasks.

Answer

It requires a reboot for the setting to take effect.

Answer

It enables real-time protection for scheduled scans.

Answer

It disables scheduled scans when the device is in use.

Question 8

You are the endpoint administrator for a company that uses Microsoft Intune. The security team requires that all Windows 11 devices automatically receive an Intune device configuration profile that enforces a minimum PIN length of 8 for Windows Hello for Business. You need to ensure the profile is applied without user interaction. What should you do?

Accepted Answer

Create a device configuration profile with the Windows Hello for Business template, configure the minimum PIN length setting, and assign the profile to all Windows 11 devices.. A device configuration profile with the Windows Hello for Business template is the correct Intune-native method to enforce PIN requirements. Assigning it to all Windows 11 devices ensures automatic application without user action. Compliance policies only assess, GPOs are for domain-joined devices, and scripts are not the preferred method for this policy.

Answer

Create a compliance policy that requires a minimum PIN length of 8, and assign it to all Windows 11 devices.

Answer

Create a Group Policy Object (GPO) in on-premises Active Directory and link it to the domain, then sync devices with Intune.

Answer

Deploy a PowerShell script through Intune that modifies the registry to set the minimum PIN length.

Question 9

You are the Microsoft 365 Endpoint Administrator for Contoso, Ltd. The company has an on-premises Active Directory Domain Services (AD DS) environment and uses Microsoft Entra ID with Microsoft Intune. You need to prepare infrastructure to deploy Windows 11 devices that are Microsoft Entra hybrid joined. You must ensure that devices can enroll in Intune without requiring user interaction during the out-of-box experience (OOBE). What should you configure first?

Accepted Answer

Configure automatic enrollment in Intune for Windows devices in the Microsoft Entra admin center.. Automatic enrollment in Intune must be enabled in Microsoft Entra ID to allow Microsoft Entra hybrid joined devices to enroll automatically. This setting ensures that devices receive Intune policies without user interaction, which is essential for zero-touch provisioning during OOBE. Other options either require manual steps or do not directly enable automatic enrollment.

Answer

Create a device enrollment manager (DEM) account in Intune and assign it to the deployment team.

Answer

Configure Windows Autopilot deployment profile with the 'Convert all targeted devices to Autopilot' option.

Answer

Deploy the Intune Company Portal app to devices via Group Policy.

Question 10

You are the endpoint administrator for Contoso, Ltd. The company uses Microsoft Intune and has a hybrid Microsoft Entra ID environment with an on-premises Active Directory Domain Services (AD DS) domain. You plan to deploy 200 new Windows 11 devices using Windows Autopilot. The devices must be joined to the on-premises AD DS domain and also registered in Microsoft Entra ID. You need to configure the Autopilot deployment profile to support this scenario. What should you do first?

Accepted Answer

Configure the deployment profile to use Microsoft Entra hybrid join and ensure the device has a line of sight to a domain controller.. For Windows Autopilot hybrid Microsoft Entra join, the deployment profile must be configured to use Microsoft Entra hybrid join, and the device must have network connectivity to a domain controller during deployment. This allows the device to be joined to on-premises AD DS and registered in Microsoft Entra ID. Simply assigning the profile or using user-driven mode without the hybrid join setting does not meet the requirement.

Answer

Assign the Autopilot deployment profile to a user group and configure the profile to use "User-driven" mode.

Answer

Create an Autopilot deployment profile with the "Convert all targeted devices to Autopilot" option enabled.

Answer

Configure the deployment profile to use Microsoft Entra join and assign the profile to a device group.

Question 11

You are an endpoint administrator for a company that uses Microsoft Intune. The company has a group of Windows 10 devices that are enrolled in Intune and are also co-managed with Configuration Manager. You need to configure a device configuration profile that applies a custom Start menu layout to these devices. You want to ensure that the profile is applied only to the co-managed devices and not to devices managed solely by Intune. What should you do?

Accepted Answer

Create a device configuration profile in Intune and assign it to a device group that contains only the co-managed devices.. The most straightforward way to target a configuration profile to a specific set of devices is to assign it to a device group containing those devices. Creating a group with only the co-managed devices and assigning the profile to that group ensures the policy applies exclusively to them. Other methods like scope tags or user groups do not provide the same precise device targeting.

Answer

Create a device configuration profile in Intune and use a scope tag to target only the co-managed devices.

Answer

Create a device configuration profile in Intune and assign it to a user group that contains users of the co-managed devices.

Answer

Create a device configuration profile in Intune and configure the "Configuration Manager Compliance" setting to require co-management.

Question 12

You are an Endpoint Administrator for a company that uses Microsoft Intune. The security team requires that Windows 11 devices assigned to the Finance department must use a specific set of DNS servers and must not allow users to modify the DNS settings. You create a device configuration profile using the Settings catalog. Which setting category should you use to enforce the DNS server assignment?

Accepted Answer

DNS. The Settings catalog exposes granular Windows configuration service provider settings, and the DNS category specifically includes settings to define DNS server addresses and prevent modification. Applying a device configuration profile with those settings to the Finance device group enforces the required DNS servers and blocks user changes, directly satisfying the security team's requirement.

Answer

VPN

Answer

Wi-Fi

Answer

Network proxy

Question 13

You are preparing to deploy Windows 11 devices using Windows Autopilot. The devices are Microsoft Entra joined. You need to ensure that during OOBE, devices are automatically assigned to the correct group for policy targeting. What should you configure?

Accepted Answer

Create a dynamic device group in Microsoft Entra ID with a rule based on the device's enrollment profile name.. Dynamic device groups in Microsoft Entra ID allow automatic membership based on device attributes such as enrollment profile name. This is ideal for Autopilot deployments because devices are automatically added to the correct group, enabling targeted policy and app assignments without manual effort.

Answer

Use a Group Policy object to add devices to an on-premises security group that is synced to Microsoft Entra ID.

Answer

Assign the Autopilot deployment profile to a static group that contains all users.

Answer

Configure a device category in Intune and assign it during OOBE.

Question 14

You are configuring a Windows Autopilot deployment for a group of remote users. The users will receive new Windows 11 devices and will sign in with their Microsoft Entra ID credentials. You need to ensure that the devices are automatically enrolled in Microsoft Intune and that the users are assigned the appropriate licenses. Which license must be assigned to the users?

Accepted Answer

Microsoft Intune Plan 1. To use Windows Autopilot and automatic enrollment in Intune, users must have an Intune license. Microsoft Intune Plan 1 is the standalone license that grants access to Intune features. While higher-tier licenses like Microsoft 365 E3 or E5 include Intune, they are not the specific required license. Microsoft Entra ID P1 is not an Intune license.

Answer

Microsoft Entra ID P1

Answer

Microsoft 365 E5

Answer

Microsoft 365 E3

Question 15

You are the Microsoft 365 Endpoint Administrator for Contoso, Ltd. The company has an on-premises Active Directory Domain Services (AD DS) domain named contoso.com and uses Microsoft Entra ID with Microsoft Intune. You must configure a Windows Autopilot deployment for existing Windows 11 devices that are already joined to the on-premises domain. The devices must remain domain-joined and also be registered in Microsoft Entra ID. You need to create the Autopilot deployment profile. Which deployment mode should you select?

Accepted Answer

Microsoft Entra hybrid joined. The requirement to keep devices joined to on-premises AD DS while also registering them in Microsoft Entra ID and managing them with Intune maps directly to the Microsoft Entra hybrid joined Autopilot mode. This mode uses the Intune Connector for Active Directory to create the computer object in AD DS during OOBE, ensuring the device is both domain-joined and Microsoft Entra registered.

Answer

Microsoft Entra registered

Answer

Existing device, no Autopilot

Answer

Microsoft Entra joined