MD-102 Prepare infrastructure for devices Practice Test 20 — 15 Questions

Question 1

You are preparing infrastructure for Microsoft Intune enrollment of Windows 11 devices. The company uses Microsoft Entra ID and requires that devices automatically enroll in Intune when users join them to Microsoft Entra ID. You also need to ensure that only users in a specific security group are allowed to enroll devices. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable automatic enrollment in Intune and set the MDM user scope in Microsoft Entra ID to the security group.. Automatic enrollment is turned on in the Intune admin center, while the user scope that determines who is eligible is configured in the Microsoft Entra ID mobility settings. Pointing the MDM user scope at the chosen security group restricts automatic Intune enrollment to those users, which is exactly what the scenario requires.

Answer

Create a device enrollment restriction in Intune that allows only the security group and enable Windows Autopilot for those devices.

Answer

Configure automatic MDM enrollment in the Microsoft Entra ID mobility settings and assign the Intune Enrollment scope to the security group.

Answer

Configure a Conditional Access policy that requires compliant devices and assign it to the security group.

Question 2

You are preparing infrastructure for Windows Autopilot deployment in a hybrid Microsoft Entra join scenario. You need to ensure that devices can join the on-premises domain and enroll in Intune. Which two components must you configure? (Choose two.)

Accepted Answer

Intune connector for Active Directory. For Windows Autopilot hybrid Microsoft Entra join, the Intune connector for Active Directory is essential to perform the offline domain join, and automatic MDM enrollment in Microsoft Entra ID ensures the device enrolls in Intune. These two components together enable the hybrid join and management workflow.

Answer

Device enrollment manager (DEM) account

Answer

Windows Autopilot deployment profile with 'Convert all targeted devices to Autopilot'

Answer

Microsoft Entra Connect with device writeback

Question 3

You are an endpoint administrator for a company that uses Microsoft Intune. You need to ensure that all Windows 10 devices are automatically enrolled in Intune when they are joined to Microsoft Entra ID. What should you configure?

Accepted Answer

In the Microsoft Intune admin center, enable automatic enrollment for Windows devices.. Automatic enrollment in Intune for Windows devices is enabled through the Microsoft Intune admin center by configuring the MDM user scope. This setting ensures that when a device joins Microsoft Entra ID, it automatically enrolls in Intune without user action. Other options either describe non-existent settings or do not provide automatic enrollment.

Answer

Create a device configuration profile with the "Enroll in Intune" setting enabled.

Answer

Configure a conditional access policy to require compliant devices.

Answer

Assign an Intune license to each user and instruct them to manually enroll their devices.

Question 4

You are the Microsoft 365 Endpoint Administrator for Contoso. The company uses Microsoft Intune to manage Windows 11 devices. You need to ensure that when devices are enrolled, they automatically receive a set of configuration settings without manual intervention. The settings include a custom Start menu layout and a set of allowed background apps. What should you create in Intune to achieve this?

Accepted Answer

A device configuration profile. Device configuration profiles in Microsoft Intune are designed to deliver settings to devices. They can configure Start menu layout, restrict apps, and many other settings. Once assigned, the settings are applied automatically, satisfying the requirement to avoid manual intervention. Compliance policies assess, Autopilot profiles customize OOBE, and app protection policies secure data within apps, none of which apply configuration settings.

Answer

An app protection policy

Answer

A compliance policy

Answer

A Windows Autopilot deployment profile

Question 5

You are setting up Microsoft Intune for a new company. The company has a mix of Windows 10, Windows 11, iOS, and Android devices. You need to ensure that devices can enroll in Intune automatically without user interaction for Windows devices that are Microsoft Entra joined. What should you configure?

Accepted Answer

Automatic enrollment in Intune.. Automatic enrollment in Intune is the feature that allows Windows devices that are Microsoft Entra joined or hybrid Microsoft Entra ID joined to enroll in Intune automatically without user interaction. This is configured in the Intune portal and ensures that devices are managed as soon as they join Microsoft Entra ID. This meets the requirement for automatic enrollment without user interaction for Windows devices.

Answer

Device enrollment manager.

Answer

Windows Autopilot deployment profile.

Answer

Enrollment restrictions.

Question 6

You are the Microsoft 365 Endpoint Administrator for Contoso, Ltd. Contoso has an on-premises Active Directory Domain Services (AD DS) forest and uses Microsoft Entra ID with Microsoft Intune. You plan to deploy 200 new Windows 11 devices by using Windows Autopilot in Microsoft Entra hybrid join mode. You need to ensure that each device is automatically joined to AD DS and registered in Microsoft Entra ID during the out-of-box experience. What should you configure first?

Accepted Answer

Install and configure the Intune Connector for Active Directory.. For Windows Autopilot in Microsoft Entra hybrid join mode, the device must join on-premises AD DS and then register with Microsoft Entra ID. The Intune Connector for Active Directory is the component that performs the offline domain join during OOBE and creates the computer object. Deployment profiles, enrollment restrictions, and automatic enrollment are supporting configurations, but none of them enables the actual domain join step.

Answer

Assign a Windows Autopilot deployment profile to all targeted devices.

Answer

Create a device enrollment restriction that blocks personal Windows devices.

Answer

Enable automatic enrollment for Windows devices in Intune.

Question 7

A company uses Microsoft Intune to manage its Windows devices. The IT team wants to ensure that new Windows devices can enroll without requiring users to manually enter the enrollment server address. The devices are already joined to Microsoft Entra ID. Which infrastructure component enables this automatic discovery?

Accepted Answer

The MDM discovery endpoint published in Microsoft Entra ID through the mobility settings.. Microsoft Entra ID publishes the MDM discovery endpoint when automatic enrollment is configured. A Microsoft Entra joined Windows device queries that endpoint during the join process and receives the Intune enrollment URL, so users do not need to enter a server address manually. This is the standard cloud-based discovery path.

Answer

A DNS SRV record for _enterpriseregistration in the on-premises DNS zone.

Answer

The Company Portal app installed on the device before enrollment.

Answer

The Intune enrollment policy in the Microsoft Intune admin center.

Question 8

You are a Microsoft 365 administrator for a company with 200 Windows 11 devices joined to Microsoft Entra ID. The security team requires that all devices automatically receive a set of configuration profiles and compliance policies without user intervention. You need to ensure that when devices are joined, they are automatically enrolled in Microsoft Intune and grouped for policy assignment. What should you configure?

Accepted Answer

Enable automatic MDM enrollment in Microsoft Entra ID and configure dynamic device groups in Microsoft Intune.. Automatic MDM enrollment in Microsoft Entra ID ensures devices are enrolled in Intune upon join. Dynamic device groups in Intune automatically include devices based on attributes, enabling policy assignment without manual intervention. Together, they provide the required zero-touch provisioning and grouping.

Answer

Create a conditional access policy requiring compliant devices and assign it to all users.

Answer

Deploy a Windows Autopilot deployment profile to all devices and use it to assign policies.

Answer

Configure a device compliance policy with a grace period and assign it to All Users.

Question 9

You are the endpoint administrator for a company that uses Microsoft Intune. You are preparing to deploy Windows 11 devices using Windows Autopilot. The devices will be used by remote workers who do not have access to the corporate network. You need to ensure that the devices are automatically enrolled in Intune and that users can sign in with their Microsoft Entra ID credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven mode with Microsoft Entra join.. User-driven mode with Microsoft Entra join is the correct choice for remote workers because it allows users to sign in with their Microsoft Entra ID credentials during OOBE, automatically joins the device to Microsoft Entra ID, and enrolls it in Intune without requiring on-premises network connectivity. Other modes either do not support user sign-in or require domain connectivity.

Answer

Self-deploying mode with Microsoft Entra join.

Answer

User-driven mode with Microsoft Entra hybrid join.

Answer

Pre-provisioning with Microsoft Entra hybrid join.

Question 10

You administer Microsoft Intune for a company with 2,000 Windows 11 devices. The security team requires that all devices automatically receive an Intune enrollment record when they are first powered on by end users, without requiring users to manually enroll. You have already configured a Windows Autopilot deployment profile and assigned it to a device group. Which additional configuration is required to meet the requirement?

Accepted Answer

Configure automatic enrollment in Microsoft Entra ID for Windows devices.. Automatic enrollment in Microsoft Entra ID is the tenant-level setting that allows Windows devices to enroll in Intune automatically when they join or register in Microsoft Entra ID. For Autopilot, this must be enabled so that devices create an Intune record without user intervention. The other options do not enable automatic enrollment; they are either unrelated features or incorrect assignment methods.

Answer

Enable the Enrollment Status Page (ESP) in the Autopilot profile.

Answer

Assign the Autopilot deployment profile to a user group instead of a device group.

Answer

Create a device configuration profile that enables the Intune Management Extension.

Question 11

You are preparing infrastructure for device management in Microsoft Intune. Your organization plans to deploy Windows 11 devices using Windows Autopilot in Microsoft Entra join mode. You need to ensure that the devices can be identified and assigned to the correct deployment profile. Which two actions must you perform? (Choose two.)

Accepted Answer

Register the device hardware hash in Intune.. To identify and assign Autopilot devices, you must register the hardware hash in Intune and create an Autopilot deployment profile assigned to a device group. The hardware hash allows Intune to recognize the device as an Autopilot device, and the profile determines the deployment settings. Without these two actions, the device will not receive the intended Autopilot configuration.

Answer

Deploy the Intune Company Portal app to all devices.

Answer

Enable automatic enrollment in Intune for all users.

Answer

Configure a conditional access policy requiring compliant devices.

Question 12

You are designing the Windows Autopilot deployment profile for a new subsidiary that has no on-premises infrastructure. All devices will be Microsoft Entra joined. The security team requires that during the out-of-box experience (OOBE), users authenticate with their Microsoft Entra credentials and that local administrator rights are not granted to the primary user. You also want to minimize the time spent at OOBE. Which deployment mode should you select in the Autopilot profile?

Accepted Answer

User-driven mode with Microsoft Entra join. User-driven mode with Microsoft Entra join allows the user to sign in with their Microsoft Entra credentials during OOBE, satisfying the authentication requirement. It does not grant local administrator rights by default, aligning with the security policy. The absence of on-premises infrastructure rules out hybrid join, and self-deploying mode skips user authentication, while pre-provisioning is unnecessary for the stated goals.

Answer

Microsoft Entra hybrid join with user-driven mode

Answer

Pre-provisioning with white glove

Answer

Self-deploying mode

Question 13

You administer Microsoft Intune for Northwind Traders. The security team wants to prevent users from enrolling personally owned Windows 10 devices while still allowing corporate-owned devices to enroll. You need to configure a device enrollment restriction that blocks personal Windows devices. Which platform setting should you modify?

Accepted Answer

Windows (MDM). Intune device enrollment restrictions are configured per platform. Windows 10 and Windows 11 devices that enroll in MDM use the Windows (MDM) platform. To block personal Windows devices while allowing corporate ones, an administrator sets the Windows (MDM) platform to Block for personally owned devices. Other platform entries such as Windows (ConfigMgr) or Windows Mobile do not apply to standard Windows 10 MDM enrollment.

Answer

Windows Mobile

Answer

Windows (ConfigMgr)

Answer

Windows (MDM) under Corporate Device Identifiers

Question 14

You are the endpoint administrator for a company that uses Microsoft Intune. The company has an on-premises network with Active Directory Domain Services (AD DS) and a Microsoft Entra tenant. You need to prepare the infrastructure for Windows Autopilot deployment of Microsoft Entra hybrid joined devices. You must ensure that the required components are in place to support the hybrid join process. Which two actions should you perform? (Choose two.)

Accepted Answer

Configure the Microsoft Entra Connect sync to include the device objects in the organizational unit (OU) where the devices will be created.. For Microsoft Entra hybrid joined Autopilot, you must install the Intune Connector for Active Directory on a server with line-of-sight to a domain controller, and configure Microsoft Entra Connect to sync the OU containing the device objects. These two components enable the creation of the computer account in AD DS during OOBE and ensure the device object is synchronized to Microsoft Entra ID, completing the hybrid join.

Answer

Create a device configuration profile that enables the Windows Push Notification Service (WNS).

Answer

Deploy a Windows Autopilot deployment profile with the deployment mode set to Microsoft Entra joined.

Answer

Assign the Intune Connector for Active Directory the necessary permissions in Microsoft Entra ID to create device objects.

Question 15

You are the endpoint administrator for Contoso, which uses Microsoft Intune. You need to enroll 200 new Windows 11 devices into Intune with the least administrative effort. The devices are currently running Windows 11 Pro and are connected to the internet. You want to avoid imaging or manually installing agents. What should you do?

Accepted Answer

Configure Windows Autopilot deployment profiles and register the device hardware IDs.. Windows Autopilot is designed to simplify and automate the enrollment of new Windows devices without reimaging. By registering hardware IDs, you can assign deployment profiles that automatically configure and enroll devices into Intune. This approach minimizes administrative effort and ensures devices are ready for use with minimal user interaction.

Answer

Deploy the Intune agent MSI to each device using a logon script.

Answer

Manually enroll each device by having users sign in with their Microsoft Entra ID credentials in Settings.

Answer

Use Group Policy to enable automatic MDM enrollment for all domain-joined devices.