MD-102 Prepare infrastructure for devices Practice Test 2 — 15 Questions

Question 1

Which TWO actions should you take to prepare a Windows 10 device for a deployment using Windows Autopilot?

Accepted Answer

Ensure the device has an internet connection during the out-of-box experience.. Windows Autopilot requires an internet connection during the Out-of-Box Experience (OOBE) to download the Autopilot profile from the Microsoft Intune service and to authenticate with Microsoft Entra ID. Without connectivity, the device cannot complete the enrollment or apply the deployment profile. Option E is also correct because collecting the hardware hash (e.g., using the Get-WindowsAutoPilotInfo.ps1 script) is necessary to generate a unique device identifier that must be uploaded to the Autopilot service to register the device before deployment. Joining manually (A), enabling BitLocker (C), or upgrading (D) are not prerequisites for Autopilot; these can be configured via the deployment profile or are handled automatically.

Answer

Join the device to Microsoft Entra ID manually.

Answer

Enable BitLocker encryption on the device.

Answer

Upgrade the device to the latest Windows 10 version.

Question 2

Refer to the exhibit. A Microsoft Intune security baseline is configured for Windows 10 devices. What is the effect of this setting?

Accepted Answer

It reduces the CPU priority of scheduled scans to minimize performance impact.. This setting in the Microsoft Intune security baseline for Windows 10 configures the 'Low CPU priority for scheduled scans' policy for Microsoft Defender Antivirus. When enabled, it reduces the CPU priority of scheduled scans to minimize performance impact on the user's active workload, ensuring that background scanning does not interfere with foreground tasks.

Answer

It requires a reboot for the setting to take effect.

Answer

It enables real-time protection for scheduled scans.

Answer

It disables scheduled scans when the device is in use.

Question 3

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.. Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.

Answer

Set up a device compliance policy in Microsoft Purview to block non-compliant devices.

Answer

Configure a device filter in Exchange Online to block devices that are not managed by Intune.

Answer

Deploy an email security policy via Intune to block access from non-compliant devices.

Question 4

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

Accepted Answer

Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.. Using a 'Provision Microsoft Entra ID' step with a bulk token in a Configuration Manager task sequence directly enables automatic Microsoft Entra ID join and Intune enrollment during OSD. The bulk token, generated from Microsoft Entra ID, allows devices to be joined without user interaction, which is essential for unattended, large-scale deployments.

Answer

Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

Answer

Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

Answer

Configure Windows Autopilot for existing devices and redeploy them.

Question 5

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.

Question 6

You need to configure device compliance for devices that are not running Windows. The devices include iOS, iPadOS, Android, and macOS. Which compliance settings are common across all platforms?

Accepted Answer

Require minimum OS version.. Requiring a minimum OS version is a compliance setting supported on all major platforms including iOS, iPadOS, Android, and macOS. Option B is correct. Option A is incorrect because while requiring a device password is common, the setting 'not allow simple passwords' is not universally available across all platforms (e.g., Android and iOS have password complexity but not a simple password toggle). Option C is incorrect because jailbreak/root detection is not available on all platforms; for example, Android and iOS support it but macOS does not have a native 'rooted' detection. Option D is incorrect because BitLocker is a Windows-specific encryption technology and is not available on iOS, iPadOS, Android, or macOS.

Answer

Require device password and not allow simple passwords.

Answer

Device must not be jailbroken/rooted.

Answer

Require BitLocker encryption.

Question 7

Your organization uses Microsoft Intune to manage devices. You have a compliance policy that requires devices to have a password of at least 6 characters. Some users report that their devices are marked as non-compliant even though they have a password set. What is the most likely cause?

Accepted Answer

The compliance policy is assigned to a user group that does not include the affected users.. The most likely cause is that the compliance policy is assigned to a user group that does not include the affected users. In Microsoft Intune, compliance policies are evaluated based on user or device group assignments. If a user is not a member of the assigned user group, the policy will not apply to their enrolled devices, and those devices will not be evaluated for compliance, often resulting in a non-compliant status or no status at all.

Answer

The password length setting is set to '6' but the device requires a minimum of 8.

Answer

The compliance policy is assigned to device groups, but the devices are user-enrolled.

Answer

The device uses a PIN instead of a password, which is not evaluated.

Question 8

You need to deploy a line-of-business (LOB) app to 100 Windows 10 devices managed by Intune. The app is packaged as an .msi file. Which app type should you choose in Intune?

Accepted Answer

Line-of-business app. For deploying a line-of-business (LOB) app packaged as an .msi file to Windows 10 devices managed by Intune, the correct app type is 'Line-of-business app'. This app type is specifically designed for sideloading enterprise internal apps that are not distributed via the Microsoft Store, and it supports .msi, .appx, and .appxbundle file formats. It allows direct upload of the .msi file to Intune and assigns it to users or devices without requiring complex Win32 app preparation.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 9

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

Accepted Answer

Add a compliance policy setting: 'Require the device to be at or under the machine risk score' with a low score.. Microsoft Defender for Endpoint integrates with Intune compliance policies via the 'Require the device to be at or under the machine risk score' setting. When a device stops reporting to Defender, its risk score escalates above the 'Low' threshold, causing Intune to mark it as non-compliant. This directly meets the requirement to flag non-reporting devices without additional scripting or conditional access complexity.

Answer

Create a Conditional Access policy requiring device compliance and blocking access if not compliant.

Answer

Enable 'Require BitLocker' compliance setting.

Answer

Deploy a PowerShell script via Intune that checks the Defender service status and reports to Intune custom compliance.

Question 10

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

Accepted Answer

Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.. It leverages Configuration Manager's 'Windows 10/11 feature update' servicing plan, which is specifically designed for in-place upgrades while preserving user data and settings. Enabling Delivery Optimization for peer-to-peer download reduces bandwidth consumption in remote offices by allowing devices to share upgrade content locally, addressing the limited bandwidth constraint.

Answer

Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.

Answer

Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.

Answer

Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.

Question 11

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

Accepted Answer

Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.. Update rings are the primary policy in Microsoft Intune for controlling how and when Windows 10 and later devices receive updates from Windows Update. Setting 'Automatic update behavior' to 'Auto install and reboot' ensures that critical and security updates are automatically downloaded and installed without user intervention, meeting the requirement for all Windows 11 devices.

Answer

Configure a device configuration profile with 'Windows Update for Business' settings.

Answer

Deploy a feature update policy to install the latest quality updates.

Answer

Create a device compliance policy that requires devices to have the latest updates.

Question 12

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices to authenticate to a corporate Wi-Fi network. Which TWO methods can you use to deploy the certificate?

Accepted Answer

Create a SCEP certificate profile in Intune.. A SCEP certificate profile in Intune allows iOS/iPadOS devices to request a certificate from a Simple Certificate Enrollment Protocol (SCEP) server, which can then be used for Wi-Fi authentication. This method supports automated enrollment and renewal of certificates without manual intervention, making it suitable for large-scale deployments.

Answer

Create a device compliance policy that includes the certificate.

Answer

Create a Wi-Fi profile and embed the certificate in the profile.

Answer

Create a VPN profile that includes the certificate.

Question 13

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?

Accepted Answer

Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.. AppLocker is a Windows feature that can be configured via Intune device configuration profiles to enforce application control policies. By creating an AppLocker rule for the 'Packaged apps' rule collection and setting the default action to 'Deny' for all users, you can explicitly allow only apps from the Microsoft Store, effectively blocking installation of non-Store apps.

Answer

Set 'Windows Update for Business' to defer feature updates.

Answer

Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.

Answer

Enable 'BitLocker' to encrypt the system drive.

Question 14

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Accepted Answer

Disable screen capture.. To restrict screenshots on Android Enterprise devices, only the 'Disable screen capture' setting directly prevents the device from taking screenshots by using the FLAG_SECURE window flag. Options B and C ('Disable copy and paste' and 'Disable camera') do not prevent screen capture; they restrict clipboard operations and camera usage respectively. Therefore, the only correct setting is A.

Answer

Disable copy and paste.

Answer

Disable camera.

Answer

Disable Bluetooth.

Answer

Disable Wi-Fi.

Question 15

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Accepted Answer

The virtual machine does not have Secure Boot enabled in its firmware settings.. Secure Boot is a hardware-based feature that ensures the system boots using only software trusted by the PC manufacturer. In virtual machines, Secure Boot is often not enabled by default or may not be supported by the hypervisor. For Intune compliance, if the VM does not have Secure Boot enabled, it will report as non-compliant. Option C is correct because the VM's firmware settings likely have Secure Boot disabled. Option A is incorrect because the device may still be enrolled correctly. Option B is incorrect because password policy is unrelated to Secure Boot. Option D is incorrect because BitLocker is a separate encryption feature not required for Secure Boot.

Answer

The device is not enrolled in Intune correctly.

Answer

The password policy is conflicting with Secure Boot.

Answer

The device does not have BitLocker enabled, which is required for Secure Boot.