MD-102 Prepare infrastructure for devices Practice Test 21 — 15 Questions

Question 1

Your company uses Microsoft Intune to manage devices. You need to ensure that Windows 11 devices can receive configuration profiles and compliance policies. You have already assigned the necessary licenses to users. What should you do first to prepare the devices for management?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enroll the devices into Microsoft Intune.. Before any policies or profiles can be applied, devices must be enrolled into Microsoft Intune. Enrollment is the process that registers the device with the service, enabling management capabilities. Once enrolled, you can assign compliance policies, configuration profiles, and other management tasks. The other actions listed are all dependent on enrollment.

Answer

Create a device compliance policy.

Answer

Configure a conditional access policy.

Answer

Deploy a configuration profile.

Question 2

You are configuring a Windows Autopilot deployment for devices that must be hybrid Microsoft Entra joined. The environment includes an on-premises Active Directory domain and Microsoft Entra Connect. You need to ensure the devices can complete the hybrid join during OOBE. Which configuration is required?

Accepted Answer

Configure the Autopilot deployment profile to use Microsoft Entra hybrid join and ensure the device can reach a domain controller and the Intune service during OOBE.. Hybrid Microsoft Entra join in Autopilot requires the deployment profile to specify that join type and requires network conditions that allow the device to contact a domain controller for the domain join and reach the cloud services for the Microsoft Entra join and Intune enrollment. Missing either condition prevents successful completion.

Answer

Deploy a VPN configuration profile that connects the device to the corporate network before the Autopilot profile is applied.

Answer

Configure the Autopilot deployment profile to use Microsoft Entra join and rely on Microsoft Entra Connect to convert the device to hybrid join after enrollment.

Answer

Enable Windows Hello for Business in the Autopilot deployment profile to trigger the hybrid join during OOBE.

Question 3

You are a Microsoft 365 Endpoint Administrator at Contoso. You have 200 Windows 11 devices enrolled in Microsoft Intune. The security team requires that all devices have a minimum OS build of 22621.1992 and that this requirement be enforced through a compliance policy. You need to configure the compliance policy in the Microsoft Intune admin center. Which policy type should you create?

Accepted Answer

Device compliance policy for Windows 10 and later. A device compliance policy for Windows 10 and later is the correct choice because it includes a setting to require a minimum OS version. By setting the minimum OS version to 10.0.22621.1992, Intune will evaluate the OS build and mark devices that do not meet the requirement as noncompliant, which can then trigger conditional access or other actions.

Answer

Endpoint security policy for Windows 10 and later

Answer

Device configuration profile for Windows 10 and later

Answer

App protection policy for Windows 10 and later

Question 4

You are the endpoint administrator for a company that uses Microsoft Intune. The company has a policy that all Windows devices must have a minimum OS version of 10.0.19045. You need to create a compliance policy that enforces this requirement. Which type of compliance setting should you configure?

Accepted Answer

Device Properties. The minimum OS version is a built-in setting under Device Properties in Intune compliance policies. Configuring it there ensures devices are evaluated against the specified version. Other setting categories like Device Health, System Security, and Custom Compliance serve different purposes and do not provide a direct way to set a minimum OS version.

Answer

Custom Compliance

Answer

Device Health

Answer

System Security

Question 5

You are preparing infrastructure for device management at Adventure Works. The company has an on-premises Active Directory Domain Services (AD DS) environment and uses Microsoft Intune. You need to configure a Windows Autopilot deployment profile that will be used for Microsoft Entra hybrid join. During testing, devices fail at the domain join step. You verify that the Intune Connector for Active Directory is installed and online. What should you check next?

Accepted Answer

The organizational unit (OU) specified in the deployment profile exists and the connector service account has permission to create computer objects in it.. When the Intune Connector for Active Directory is online but hybrid join still fails, the next checks are the organizational unit specified in the deployment profile and the permissions of the connector's service account. The connector creates the computer object in that OU, so an invalid OU path or insufficient rights prevents the domain join. TPM, UEFI, group assignment, and join type are not the cause when devices already reach the domain join step.

Answer

The device has a TPM 2.0 chip and is UEFI-enabled.

Answer

The Microsoft Entra ID join type is set to Microsoft Entra joined instead of Microsoft Entra hybrid joined.

Answer

The Windows Autopilot deployment profile is assigned to a device group and not a user group.

Question 6

You are an endpoint administrator for a company that uses Microsoft Intune. You need to configure a Windows 11 device to support multiple users who will sign in with their Microsoft Entra ID credentials. The device will be shared among shift workers. You want to ensure that each user receives their own configuration profiles and applications. What should you configure?

Accepted Answer

Shared multi-user device configuration profile.. For shared Windows devices used by multiple shift workers, you should configure a shared multi-user device configuration profile. This profile optimizes the device for shared use and allows each user to sign in with their own credentials, receiving personalized settings and applications. It is the correct choice for this scenario.

Answer

Windows Autopilot pre-provisioning mode.

Answer

Device enrollment manager (DEM) account.

Answer

Windows Autopilot self-deploying mode.

Question 7

You are planning to deploy Windows 11 devices using Windows Autopilot in Microsoft Intune. The company requires that the devices are Microsoft Entra joined and that the enrollment process includes the installation of required applications and configuration of device settings. You need to identify which two components are required to achieve this. (Choose two.)

Accepted Answer

Enrollment Status Page (ESP).. The Autopilot deployment profile defines the join type and OOBE settings, ensuring the device joins Microsoft Entra ID. The Enrollment Status Page (ESP) ensures that required applications and configurations are applied before the user reaches the desktop. Together, they meet the requirement of Microsoft Entra join with app installation and device configuration during enrollment. The other options are either for hybrid join, alternative provisioning, or post-enrollment security.

Answer

Microsoft Intune Connector for Active Directory.

Answer

Windows Configuration Designer package.

Answer

Device-based conditional access policy.

Question 8

You are the endpoint administrator for a company that uses Microsoft Intune to manage 500 Windows 11 devices. The security team requires that devices cannot be enrolled if they do not have a TPM 2.0 chip and Secure Boot enabled. You need to configure a device enrollment restriction to block enrollment of devices that do not meet these hardware requirements. What should you do?

Accepted Answer

In the Microsoft Intune admin center, create a device enrollment restriction for Windows and set the minimum TPM version and require Secure Boot.. Device enrollment restrictions are the correct tool to control which devices can enroll based on hardware attributes like TPM version and Secure Boot. Compliance policies and configuration profiles only act after enrollment, and Autopilot profiles shape the provisioning experience but do not enforce hardware prerequisites. Thus, only enrollment restrictions can block non-compliant hardware at the point of enrollment.

Answer

Configure a Windows Autopilot deployment profile with hardware requirements and assign it to all devices.

Answer

Create a configuration profile with a custom OMA-URI that checks for TPM and Secure Boot, and assign it to all devices.

Answer

Create a device compliance policy that requires TPM 2.0 and Secure Boot, and assign it to all users.

Question 9

You are an endpoint administrator for a company that uses Microsoft Intune. The company has a Microsoft Entra ID tenant with Intune configured. You need to ensure that when new Windows 10 devices are set up by users, they are automatically enrolled in Intune and receive company policies. The devices are purchased from a reseller and are not domain-joined. You want to minimize user interaction during setup. What should you configure?

Accepted Answer

Windows Autopilot deployment profile. Windows Autopilot deployment profiles allow you to configure the OOBE so that devices automatically enroll in Intune and receive policies with minimal user interaction. The device must first be registered with Autopilot, which can be done by the reseller or by capturing a hardware hash. Once registered, the profile ensures that when the user turns on the device, it connects to Intune and applies the desired configuration.

Answer

Conditional Access policy

Answer

Device enrollment restrictions

Answer

Microsoft Intune enrollment policy for Windows

Question 10

You are the Microsoft 365 Endpoint Administrator for Litware, Inc. Litware uses Microsoft Intune and has 500 Windows 11 devices that are already enrolled. The security team wants to require that all Windows devices use a specific set of compliance settings, and they want the settings to apply to devices in a specific department without affecting other departments. You need to deploy a compliance policy that targets only the department's devices. What should you do?

Accepted Answer

Create a compliance policy and assign it to a group containing the department's devices.. Compliance policies are assigned to groups, and to affect only a specific department's devices, the policy should be assigned to a device group that contains those devices. Assigning to all devices with exclusions, using a configuration profile, or targeting users would either invert the scope, fail to produce a compliance signal, or inadvertently include devices outside the department. Device group targeting is the precise and standard method.

Answer

Create a compliance policy and assign it to a group containing the department's users.

Answer

Create a compliance policy and assign it to all devices, then exclude the department's devices.

Answer

Create a device configuration profile and assign it to the department's devices.

Question 11

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to ensure that only devices running Windows 11 version 23H2 or later can enroll into Intune. You also want to block enrollment for older Windows versions. What should you configure?

Accepted Answer

An enrollment restriction for Windows devices.. To block enrollment based on OS version, you configure enrollment restrictions. Specifically, you create a Windows enrollment restriction and set a minimum OS version. Devices running versions below the minimum will be prevented from enrolling. This is a direct control over enrollment eligibility, unlike compliance policies or conditional access which operate after enrollment.

Answer

A device compliance policy with a minimum OS version rule.

Answer

A configuration profile with a Windows edition upgrade policy.

Answer

A conditional access policy requiring compliant devices.

Question 12

You are the administrator for a company that uses Microsoft Intune. The company has a policy that requires all Windows 10 devices to have a specific set of security settings applied via Intune configuration profiles. You need to ensure that these settings are applied to devices even if the user is not signed in, and that the settings cannot be overridden by the user. Which type of configuration profile should you use?

Accepted Answer

Device configuration profile with device scope.. Device configuration profiles with device scope apply settings directly to the device, independent of user sign-in, and enforce them so users cannot override. This meets the requirement of applying security settings even when no user is signed in. User-scoped profiles require sign-in, compliance policies only assess, and GPOs are not natively applied via Intune. Device-scoped profiles are the correct choice for device-wide security configurations.

Answer

Device configuration profile with user scope.

Answer

Compliance policy.

Answer

Group Policy Object (GPO) via Intune.

Question 13

You are deploying Windows 11 devices using Windows Autopilot. The devices must be joined to an on-premises Active Directory domain and also registered with Microsoft Entra ID. You need to configure the deployment profile. Which Autopilot mode should you use?

Accepted Answer

Microsoft Entra hybrid joined. Microsoft Entra hybrid joined mode is specifically designed for scenarios where devices need to be joined to on-premises Active Directory and registered with Microsoft Entra ID. This mode supports domain join during Autopilot and requires the Intune Connector for Active Directory to create computer objects in AD. It enables both cloud and on-premises management.

Answer

Microsoft Entra joined

Answer

Pre-provisioning (white glove)

Answer

Self-deploying mode

Question 14

You are setting up Microsoft Intune for a new subsidiary. The subsidiary has an existing on-premises Active Directory Domain Services (AD DS) and uses Microsoft Entra Connect to synchronize users to Microsoft Entra ID. You need to enable automatic enrollment of Windows 10 devices into Intune for users who are synchronized from AD DS. What should you configure first?

Accepted Answer

In Microsoft Entra ID, configure the Mobility (MDM and MAM) settings to enable automatic MDM enrollment for Windows devices.. Automatic Intune enrollment for Windows devices is enabled through the Mobility (MDM and MAM) configuration in Microsoft Entra ID. This setting, when scoped to users or groups, allows synchronized users to automatically enroll their Windows devices. Enrollment restrictions and Autopilot profiles serve different purposes and do not initiate automatic enrollment, while device writeback is unrelated to MDM enrollment.

Answer

In Microsoft Intune, create a Windows Autopilot deployment profile and assign it to all devices.

Answer

In Microsoft Intune, create a device enrollment restriction that allows Windows devices and assign it to all users.

Answer

In Microsoft Entra Connect, enable device writeback and synchronize device objects to Microsoft Entra ID.

Question 15

You are preparing infrastructure for Windows Autopilot at Contoso. You need to configure the environment so that devices can be deployed with Windows Autopilot in Microsoft Entra hybrid join mode. Which two components must be in place before devices can complete the hybrid join during OOBE? (Choose two.)

Accepted Answer

A Windows Autopilot deployment profile configured with the Microsoft Entra hybrid joined join type.. Autopilot hybrid join requires the Intune Connector for Active Directory to perform the offline domain join and a deployment profile configured for Microsoft Entra hybrid joined to direct the device through the correct OOBE path. Compliance policies, Configuration Manager enrollment proxy points, and Conditional Access policies do not perform the domain join or Entra registration steps, so they are not prerequisites for completing hybrid join.

Answer

A device compliance policy requiring BitLocker and Secure Boot.

Answer

A Configuration Manager site system role for the enrollment proxy point.

Answer

A conditional access policy requiring multifactor authentication for all users.