MD-102 Prepare infrastructure for devices Practice Test 2 — 15 Questions

Question 1

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome. When a Conditional Access policy requires the use of Microsoft Edge or the Microsoft Authenticator app for accessing SharePoint, users attempting to use Chrome on Android will be blocked. The devices show as compliant in Intune, so the issue is not device compliance but the requirement for a specific approved client app. This policy enforces app-based conditional access, which overrides browser access unless the approved app is used.

Answer

The SharePoint site is configured to allow access only from specific IP ranges

Answer

The device compliance policy has a grace period for non-compliance, and the device is still within that period

Answer

An app protection policy is blocking access to SharePoint from the browser

Question 2

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

Accepted Answer

Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs. Apple Automated Device Enrollment (ADE) with supervision and allowing personal Apple IDs meets the school's requirements: devices are automatically enrolled in Intune, supervision enables full management control (e.g., blocking activation lock bypass), and allowing personal Apple IDs lets students install apps using their own accounts. This combination ensures devices are managed while preserving user flexibility.

Answer

Apple Automated Device Enrollment (ADE) with user affinity

Answer

Apple Device Enrollment (ADE) with Shared iPad mode

Answer

Apple User Enrollment

Question 3

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

Accepted Answer

The BitLocker recovery key is not escrowed to Microsoft Entra ID. The compliance policy is configured to require BitLocker, but Intune's 'Require BitLocker' setting in compliance policies actually checks both that BitLocker is enabled and that the recovery key is escrowed to Microsoft Entra ID. Even if BitLocker is actively encrypting the drive, failure to escrow the key results in non-compliance. This is why the device is marked non-compliant despite BitLocker being turned on.

Answer

BitLocker is only enabled on data drives, not the system drive

Answer

The device is running a version of Windows that does not support BitLocker

Answer

The device does not have a TPM chip

Question 4

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Accepted Answer

Microsoft Intune licenses. Option B is correct because Windows Autopilot requires Microsoft Intune licenses to manage and deploy devices, as Intune provides the MDM (Mobile Device Management) infrastructure for Autopilot profiles and enrollment. Option D is correct because Microsoft Entra ID P1 or P2 licenses are necessary for features like automatic MDM enrollment and device join, which are essential for Autopilot's cloud-based provisioning. Option A is not required because Autopilot is designed for cloud-first management and does not need an on-premises Active Directory domain. Option C is not required because Configuration Manager is optional for co-management scenarios but not a prerequisite for Autopilot. Option E is not required because while TPM 2.0 is recommended for Windows Hello and security features, it is not a strict prerequisite for using Autopilot.

Answer

An on-premises Active Directory domain

Answer

Configuration Manager

Answer

TPM 2.0 chip on all devices

Question 5

Refer to the exhibit. You are configuring a device compliance policy in Microsoft Intune for Windows devices. Based on the JSON configuration, what will happen if a device does not have a password set?

Accepted Answer

The device will be marked non-compliant and after 24 hours access will be blocked, then retired after 72 hours. The JSON configuration defines a grace period of 24 hours for non-compliance due to missing password, after which access is blocked, and a 72-hour period after which the device is retired. The device is marked non-compliant immediately when no password is set, but the actions (block access, retire) are scheduled based on these grace periods, not executed instantly.

Answer

The device will be marked non-compliant but no action is taken until the grace period expires

Answer

The device will be retired immediately because password is not set

Answer

The device will be immediately blocked from accessing corporate resources

Question 6

Refer to the exhibit. You have configured a Windows Update for Business policy in Intune. Based on the JSON, what is the effect on devices?

Accepted Answer

Quality updates are paused from June 1 to June 30, and feature updates are paused from July 1 to July 15. The JSON in the exhibit defines two separate pause windows: a quality update pause from June 1 to June 30 and a feature update pause from July 1 to July 15. Windows Update for Business in Intune supports independent pause configurations for quality (security) updates and feature (functionality) updates, so both pauses apply simultaneously to their respective update types. Devices will therefore not install quality updates during the first window nor feature updates during the second window.

Answer

Devices will not receive any updates from June 1 to July 15

Answer

Devices will receive all updates normally until July 15

Answer

The policy is invalid because pause dates cannot overlap

Question 7

Your company plans to deploy Microsoft 365 Apps to 500 devices using Microsoft Intune. You want to ensure that the Office suite is installed with only Word, Excel, and PowerPoint. Which approach should you use?

Accepted Answer

Use Microsoft Intune to deploy Office by configuring a Win32 app with the Office Deployment Tool and a custom XML.. The Office Deployment Tool (ODT) with a custom XML allows you to specify exactly which Office applications (Word, Excel, PowerPoint) are installed, and deploying it as a Win32 app via Microsoft Intune gives you full control over the installation parameters, including exclusion of other apps like Outlook or OneNote. The built-in Office 365 app type in Intune does not support granular selection of individual applications; it only allows you to choose the update channel and language, not a custom subset of apps.

Answer

Use Microsoft Intune to deploy Office by selecting the built-in Office 365 app type and then modify the installation options.

Answer

Use the Microsoft 365 admin center to assign licenses and then have users install from the portal.

Answer

Use Microsoft Configuration Manager to deploy Office with a task sequence.

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a compliance policy requiring devices to have BitLocker enabled. Some devices report as non-compliant even though BitLocker appears to be on. You discover these devices are using software-based encryption instead of hardware-based encryption. What should you do to resolve the compliance failure?

Accepted Answer

Modify the compliance policy to include 'BitLocker hardware encryption' as 'not configured' or set to 'allow software encryption'.. The compliance policy can be configured to accept both hardware and software encryption. By setting 'BitLocker hardware encryption' to 'not configured' or 'allow software encryption', the policy will consider software-based encryption as compliant. Option B is incorrect because TPM attestation is not required for this issue; the problem is the encryption type, not TPM presence. Option C is incorrect because BitLocker is available on Windows 10 Pro and Enterprise, so upgrading to Enterprise does not resolve the compliance failure. Option D is incorrect because changing 'require' to 'allow' for BitLocker would still require some form of encryption, but the policy currently requires it; the issue is that software encryption is not being recognized, so allowing it directly addresses the problem.

Answer

Configure the compliance policy to require TPM attestation.

Answer

Upgrade the devices to Windows 10 Enterprise edition.

Answer

Change the compliance policy setting from 'require' to 'allow' for BitLocker.

Question 9

You need to ensure that all corporate-owned Windows devices automatically receive security updates as soon as they are released by Microsoft. Which update ring policy setting should you configure in Microsoft Intune?

Accepted Answer

Set 'Defer quality updates' to 0 days.. Setting 'Defer quality updates' to 0 days in a Microsoft Intune update ring policy ensures that quality (security) updates are applied immediately upon release by Microsoft, with no deferral period. This configuration forces Windows devices to download and install security updates as soon as they are available from Windows Update, meeting the requirement for automatic and immediate security patching.

Answer

Set the 'Microsoft product updates' setting to 'Allow'.

Answer

Select the 'Windows Insider' channel for quality updates.

Answer

Select the 'Semi-Annual Channel' for feature updates.

Question 10

You are deploying Windows 10 to 100 new devices using Microsoft Deployment Toolkit (MDT). You want to integrate with Microsoft Intune for post-deployment management. Which MDT integration method should you use?

Accepted Answer

Create a provisioning package in MDT that includes the Intune enrollment configuration and apply it during the deployment task sequence.. MDT can create a provisioning package (PPKG) that includes Intune enrollment configuration (e.g., enrollment token, tenant ID) and apply it during the task sequence. This allows the device to automatically enroll into Intune after the OS deployment completes, enabling post-deployment management without requiring Configuration Manager or Autopilot.

Answer

Use Microsoft Configuration Manager to deploy the devices and then co-manage with Intune.

Answer

Configure Windows Autopilot for the devices and skip MDT.

Answer

Install the Intune connector for MDT and configure it during deployment.

Question 11

Refer to the exhibit. The JSON shows a managed device's properties retrieved from Microsoft Graph. The device's complianceState is 'noncompliant'. Which step should you take next to investigate why the device is noncompliant?

Accepted Answer

Query the device's compliance policy status via Graph API or Intune console.. The compliance policy details will show which specific policy is failed. Option A is incorrect because the device is already enrolled. Option C is incorrect because last sync time is recent. Option D is incorrect because jailbreak is not applicable to Windows.

Answer

Verify the last sync time to ensure the device is communicating.

Answer

Check if the device is properly enrolled by verifying azureADRegistered.

Answer

Check if the device is jailbroken or rooted.

Question 12

Refer to the exhibit. A PowerShell command is used to create a device category in Microsoft Intune. After running the command, you want to automatically assign devices to this category based on their Azure AD group membership. How should you configure this?

Accepted Answer

Map an Azure AD group to the Intune device category in the Intune console.. Intune provides a built-in capability to map an Microsoft Entra ID group to a device category. Once a device category is created (e.g., via PowerShell), you can configure automatic assignment by navigating to Devices > Categories in the Intune console, selecting 'Map Microsoft Entra ID groups' or similar, and specifying the group. Devices in that group are automatically assigned to the category. This is the direct configuration step, while Option A (creating a dynamic group) is a prerequisite but not the assignment step itself.

Answer

Create a dynamic device group in Azure AD that includes devices based on rules, then use that group to assign category via Intune.

Answer

Use a device configuration profile to set the device category.

Answer

Create a PowerShell script that runs daily to assign devices to the category based on group membership.

Question 13

Refer to the exhibit. A detection script for a Win32 app in Intune uses a WMI query. The script is expected to detect if BitLocker is not enabled. What will the script return if BitLocker is enabled on the device?

Accepted Answer

It returns no results, indicating that BitLocker is enabled.. The WMI query in the detection script uses the `SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter = 'C:' AND ProtectionStatus = 0` condition. When BitLocker is enabled, `ProtectionStatus` is 1, so no volumes match the query. The script returns no results, which Intune interprets as the application not being detected (i.e., BitLocker is enabled, so the detection condition is not met).

Answer

It returns the protection status as 1.

Answer

It returns the drive letter of the protected volume.

Answer

It returns an error because the query is invalid.

Question 14

Your organization is deploying Windows 10 devices using Windows Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are required to set up Windows Hello for Business. Which TWO configurations should you apply?

Accepted Answer

Configure a Windows Hello for Business enrollment policy in Intune.. Option D is correct. Configuring a Windows Hello for Business enrollment policy in Intune is sufficient to require users to set up Windows Hello during OOBE. Option C (device configuration policy) is not necessary for OOBE; it enforces settings after enrollment. Option A is incorrect because Autopilot deployment profiles do not directly enforce Windows Hello; they only configure the OOBE experience. Option B (Microsoft Entra ID device registration) is a prerequisite but not sufficient alone. Option E (custom script) is not a standard or recommended configuration for OOBE.

Answer

Configure a Windows Autopilot deployment profile to require Windows Hello for Business.

Answer

Enable Azure AD device registration.

Answer

Configure a Windows Hello for Business policy in Intune device configuration.

Answer

Deploy a custom script that enables Windows Hello.

Question 15

You are planning device management for a corporate environment with Windows 10, iOS, and Android devices. You need to implement a solution that allows users to access corporate email and documents securely on their personal devices without IT managing the entire device. Which THREE components should you include?

Accepted Answer

Azure AD application proxy for on-premises apps. Microsoft Entra application proxy (A) is correct because it publishes on-premises web applications (for example, Exchange or SharePoint) externally so personal devices can reach corporate email and documents without a VPN or full device management. Intune app protection policies (C) are correct because MAM policies protect corporate data at the app layer—enforcing PIN, encryption, and blocking copy/paste or save-as to personal apps—without enrolling or managing the whole device, which matches the BYOD requirement. Microsoft Entra Conditional Access policies (D) are correct because they gate access to corporate resources based on user, device state, app, and location signals, and can require compliant devices or app protection policies, tying the solution together securely. Device enrollment into Intune (B) and device compliance policies (E) are not appropriate here because both require the personal device to be enrolled and fully managed by IT, which the scenario explicitly excludes.

Answer

Device enrollment into Intune

Answer

Device compliance policies