MD-102 Prepare infrastructure for devices Practice Test 2 — 15 Questions

Question 1

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Accepted Answer

Verify that the Company Portal app is installed and updated on the device.. Option C is correct because Android enrollment often requires the Company Portal app to be installed from Google Play. If the device has Google Play Services disabled or the app is missing, enrollment fails. Option A is wrong because the issue is specific to work profiles, not device administrator. Option B is wrong because the enrollment token is for Android Enterprise dedicated devices, not personally-owned work profiles. Option D is wrong because Intune Service to Service Connector is not relevant to this enrollment type.

Answer

Confirm that the Intune Service to Service Connector is configured.

Answer

Check that the enrollment token has not expired.

Answer

Ensure Device Administrator enrollment is enabled.

Question 2

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Option B is correct because custom security baselines in Intune are created by copying the built-in baseline and modifying settings. Option A is wrong because you cannot edit the built-in baseline directly. Option C is wrong because custom baselines are created from existing baselines, not from scratch. Option D is wrong because security baselines are not configured via compliance policies.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 3

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Option A is correct because requiring devices to be marked as compliant in Intune filters for corporate-owned devices. Option B is wrong because Hybrid Azure AD join does not distinguish corporate vs. personal. Option C is wrong because multi-factor authentication does not check device ownership. Option D is wrong because approval of the client app is not about device ownership.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 4

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

Accepted Answer

The user account lacks an Intune license.. Option D is correct because error 0x80180014 indicates that the user does not have an Intune license assigned. Option A is wrong because the device is already registered. Option B is wrong because the issue is not enrollment restrictions. Option C is wrong because the error is not related to TPM attestation.

Answer

Enrollment restrictions are blocking personal devices.

Answer

The device is not registered in Autopilot.

Answer

TPM attestation failed due to hardware incompatibility.

Question 5

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

Accepted Answer

Microsoft 365 Apps. Option B is correct because Microsoft 365 Apps for Windows is a built-in app type in Intune. Option A is wrong because Windows app (Win32) is for custom applications. Option C is wrong because Microsoft Store app is for store-based apps. Option D is wrong because the web link is for linking to external sources.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 6

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

Accepted Answer

The AUMID for Microsoft Edge is not specified.. Option C is correct because for single-app kiosk, you must specify the AUMID of the app; Edge's AUMID is required. Option A is wrong because the issue is not about user accounts. Option B is wrong because the kiosk profile is configured. Option D is wrong because the kiosk mode does not require Windows 10/11 Enterprise specifically.

Answer

The kiosk profile is not correctly assigned.

Answer

The device is not assigned to a user.

Answer

The device is not running Windows 10/11 Enterprise.

Question 7

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

Accepted Answer

Windows 10 and later update ring. Option A is correct because the Update Rings policy includes settings for deferral periods. Option B is wrong because feature updates policy is for version targeting. Option C is wrong because driver updates policy is separate. Option D is wrong because Windows Update for Business is not a compliance policy.

Answer

Windows compliance policy

Answer

Windows feature update policy

Answer

Windows driver update policy

Question 8

Users have iOS/iPadOS devices enrolled in Intune. You need to ensure that corporate data in managed apps is encrypted at rest. What should you configure?

Accepted Answer

App protection policy for iOS/iPadOS. Option B is correct because app protection policies can enforce encryption of app data. Option A is wrong because compliance policies do not encrypt app data. Option C is wrong because device configuration profiles manage device settings, not app-level encryption. Option D is wrong because iOS itself encrypts at the device level, but not app-specific data.

Answer

iOS native encryption feature

Answer

Compliance policy for iOS/iPadOS

Answer

Device configuration profile with encryption settings

Question 9

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

Accepted Answer

Add a shell script under Devices > Scripts. Option A is correct because Intune supports shell scripts for macOS via the Scripts blade. Option B is wrong because PowerShell is for Windows. Option C is wrong because macOS does not have a Company Portal equivalent for scripts. Option D is wrong because there is no Bash script type in Intune; shell scripts are used.

Answer

Use Company Portal to distribute the script

Answer

Add a PowerShell script under Devices > Scripts

Answer

Create a custom configuration profile with Bash script

Question 10

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

Accepted Answer

The device will be blocked from completing OOBE.. Option B is correct because the setting "deviceEnrollmentFailureAction": "block" will block the device from proceeding if enrollment fails. Option A is wrong because the status is "notStarted". Option C is wrong because the block settings for notApplicable, pendingRetry, and timeout are false, but the failure action is block. Option D is wrong because the device will not retry automatically.

Answer

The device will be allowed to proceed because enrollment status is notStarted.

Answer

The device will retry enrollment automatically.

Answer

The device will be blocked until retry due to pendingRetry setting.

Question 11

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

Accepted Answer

Set the install context to system.. Option C is correct because Win32 apps can be configured to install in system context (admin privileges). Option A is wrong because user context does not provide admin rights. Option B is wrong because the app is Win32, not line-of-business. Option D is wrong because the assignment can be device-based.

Answer

Set the install context to user.

Answer

Assign the app as required for all users.

Answer

Use a line-of-business app type instead.

Question 12

Which TWO prerequisites are required for Windows Autopilot self-deploying mode?

Accepted Answer

Device is registered in Windows Autopilot. Options B and D are correct. Self-deploying mode requires the device to be registered in Autopilot, and it requires Windows 11/10 Pro, Enterprise, or Education. Option A is wrong because self-deploying mode does not require a user. Option C is wrong because TPM 2.0 is required for self-deploying mode, but it is not listed as a prerequisite for device registration. Option E is wrong because the user needs an Intune license only if a user is involved.

Answer

A user account with Intune license

Answer

Microsoft Entra ID P1 or P2 license

Answer

TPM 2.0 chip on the device

Question 13

Which THREE actions can be taken from the Intune admin center when a device is retired?

Accepted Answer

Retire. Options B, C, and D are correct. When retiring a device, you can wipe the device (factory reset), delete the device from Intune, and also retire it which removes management. Option A is wrong because remote lock is available but not during retirement; it's a separate action. Option E is wrong because resetting the passcode is not an option for retired devices.

Answer

Remote lock

Answer

Reset passcode

Question 14

Which TWO are valid methods to enroll iOS/iPadOS devices into Microsoft Intune?

Accepted Answer

Automated Device Enrollment (ADE). Options B and C are correct. Automated Device Enrollment (ADE) is the modern method for corporate devices, and Company Portal enrollment is for user-driven enrollment. Option A is wrong because Windows Autopilot is for Windows. Option D is wrong because Android Zero Touch is for Android. Option E is wrong because Apple Configurator 2 is for supervised devices but not a primary enrollment method; it's used for setup.

Answer

Apple Configurator 2

Answer

Windows Autopilot

Answer

Android Zero Touch enrollment

Question 15

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

Accepted Answer

To list the IDs of Microsoft Entra ID joined Windows devices.. Option C is correct because the script filters for devices with enrollment type 'windowsAzureADJoin' (Microsoft Entra ID joined) and outputs their IDs. Option A is wrong because it outputs IDs, not device names. Option B is wrong because it does not check the autopilot profile. Option D is wrong because it does not update any properties.

Answer

To output the device names of all Windows devices.

Answer

To list devices that are registered in Autopilot.

Answer

To update the enrollment type of all Windows devices.