MD-102 Prepare infrastructure for devices Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown on a new Windows 11 device. The cmdlet completes successfully, but the device does not appear in Intune under Windows Autopilot devices. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user running the cmdlet does not have the required permissions in Intune.. The Get-WindowsAutopilotInfo cmdlet uploads the device's hardware hash to the Microsoft Intune service. If the user lacks the necessary Intune role permissions (e.g., 'Intune Administrator' or a custom role with 'Enroll and assign devices' permission), the upload succeeds locally but the device hash is rejected by the Intune service, so the device never appears in the Windows Autopilot device list.

Answer

The device does not have internet access.

Answer

The device is already registered in Autopilot, so the cmdlet does nothing.

Answer

The group tag 'Marketing' is invalid.

Question 2

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

Accepted Answer

The policy has not been assigned to the device or its user group.. The most likely reason is that the compliance policy was created but never assigned to the device or its user group. In Microsoft Intune, a compliance policy must be assigned to a security group that contains the device or its user; otherwise, the policy is not evaluated against the device, and the device will default to a compliant status. The PowerShell cmdlet shown only creates the policy object; it does not assign it.

Answer

The BitLocker setting is not supported on Windows 11.

Answer

The policy was not saved correctly due to a syntax error.

Answer

The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

Question 3

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Accepted Answer

Verify that the Company Portal app is installed and updated on the device.. In Android Enterprise personally-owned work profiles, the Company Portal app is required to initiate and complete the enrollment process. If the app is missing or outdated, the device cannot receive the management profile, even if enrollment restrictions allow Android Enterprise. Ensuring the Company Portal is installed and updated is the immediate next step after verifying that Android Enterprise is allowed.

Answer

Confirm that the Intune Service to Service Connector is configured.

Answer

Check that the enrollment token has not expired.

Answer

Ensure Device Administrator enrollment is enabled.

Question 4

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 5

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Conditional Access grant control 'Require device to be marked as compliant' ensures that only devices enrolled in Microsoft Intune and meeting your compliance policies (e.g., encryption, OS version, threat level) can access Microsoft 365 apps. This directly enforces the requirement that only corporate-owned devices are allowed, as compliance status is tied to managed devices. In contrast, other options either don't restrict to corporate-owned devices or address different security concerns.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 6

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

Accepted Answer

The user account lacks an Intune license.. Error code 0x80180014 during Intune enrollment specifically indicates a licensing issue. Even though the device is registered in Windows Autopilot and has internet connectivity, the user account performing the enrollment must have a valid Intune license assigned (e.g., Microsoft 365 E3, E5, or standalone Intune). Without the license, the Intune service rejects the enrollment request, returning this error.

Answer

Enrollment restrictions are blocking personal devices.

Answer

The device is not registered in Autopilot.

Answer

TPM attestation failed due to hardware incompatibility.

Question 7

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

Accepted Answer

Microsoft 365 Apps. The Microsoft 365 Apps app type in Intune is specifically designed to deploy Office 365 ProPlus (now Microsoft 365 Apps) suites, including Word, Excel, PowerPoint, and others, as a managed suite. This app type automatically configures the installation to use the Office Deployment Tool (ODT) with built-in settings for update channels, architecture (32-bit/64-bit), and language packs, and it makes the suite available in Company Portal for user-initiated installation. Unlike Win32 or other types, it handles the complex licensing and activation requirements for Microsoft 365 Apps without additional scripting.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 8

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

Accepted Answer

The AUMID for Microsoft Edge is not specified.. The most likely issue is that the AUMID for Microsoft Edge is not specified in the kiosk profile. For a single-app kiosk on Windows 11, Intune requires the Application User Model ID (AUMID) to launch the app correctly. Without it, the kiosk shell cannot identify which executable to run, resulting in a blank screen instead of the Edge browser.

Answer

The kiosk profile is not correctly assigned.

Answer

The device is not assigned to a user.

Answer

The device is not running Windows 10/11 Enterprise.

Question 9

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

Accepted Answer

Windows 10 and later update ring. The Windows 10 and later update ring policy in Intune is specifically designed to configure Windows Update for Business settings, including deferral periods for feature and quality updates. By setting the 'Feature update deferral period (days)' to 60 and 'Quality update deferral period (days)' to 14, you directly control how long updates are postponed after they are released by Microsoft. This policy applies to devices managed via Intune and leverages the Windows Update for Business service to enforce these deferrals.

Answer

Windows compliance policy

Answer

Windows feature update policy

Answer

Windows driver update policy

Question 10

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

Accepted Answer

Add a shell script under Devices > Scripts. In Microsoft Intune, shell scripts for macOS are managed under Devices > Scripts, where you can add a script with a specific shell (e.g., bash, sh, zsh) and configure its execution frequency, run context, and notifications. This is the correct method because Intune natively supports deploying and running shell scripts on macOS devices via the Intune management agent, without requiring additional infrastructure.

Answer

Use Company Portal to distribute the script

Answer

Add a PowerShell script under Devices > Scripts

Answer

Create a custom configuration profile with Bash script

Question 11

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

Accepted Answer

The device will be blocked from completing OOBE.. The Autopilot deployment profile shown has the Enrollment Status Page (ESP) configured with 'Block device use until all required apps and profiles are installed' enabled. When a required app fails to install during OOBE, the ESP enforces a hard block, preventing the user from proceeding past the ESP until the failure is resolved. This is why the device is blocked from completing OOBE, making option C correct.

Answer

The device will be allowed to proceed because enrollment status is notStarted.

Answer

The device will retry enrollment automatically.

Answer

The device will be blocked until retry due to pendingRetry setting.

Question 12

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

Accepted Answer

Set the install context to system.. Setting the install context to 'system' runs the Win32 app installer with the SYSTEM account, which has the highest privileges on a Windows device. This ensures the installer can perform actions requiring admin rights, such as writing to Program Files or modifying system registry keys, without user interaction or credential prompts. In Intune, the system context is the only way to silently deploy apps that demand elevated permissions.

Answer

Set the install context to user.

Answer

Assign the app as required for all users.

Answer

Use a line-of-business app type instead.

Question 13

Which TWO prerequisites are required for Windows Autopilot self-deploying mode?

Accepted Answer

Device is registered in Windows Autopilot. For Windows Autopilot self-deploying mode, the two key prerequisites are that the device must be registered in Windows Autopilot (A) and have a TPM 2.0 chip (E) for hardware-based attestation. A supported Windows edition (C) is also needed, but it is a general requirement for any Autopilot mode and not specific to self-deploying. Options B and D are not required because this mode is device-driven and does not need a user account or premium licensing.

Answer

A user account with Intune license

Answer

Windows 11/10 Pro, Enterprise, or Education edition

Answer

Microsoft Entra ID P1 or P2 license

Question 14

Which THREE actions can be taken from the Intune admin center when a device is retired?

Accepted Answer

Retire. When a device is retired in Intune, the device record is removed from management, and the device is no longer subject to compliance policies or conditional access. The Retire action (A) is the primary action that removes the device from Intune without wiping corporate data, while the Wipe action (D) resets the device to factory defaults and removes all data. The Delete action (E) permanently removes the device object from the Intune console, which is also available from the device blade after retirement or wipe.

Answer

Remote lock

Answer

Reset passcode

Question 15

Which TWO are valid methods to enroll iOS/iPadOS devices into Microsoft Intune?

Accepted Answer

Automated Device Enrollment (ADE). Options B and C are correct. Automated Device Enrollment (ADE) is the modern, automated method for enrolling corporate-owned iOS/iPadOS devices, while Company Portal enrollment allows users to enroll their personally owned devices. Option A is incorrect because Apple Configurator 2 is a tool for manually preparing devices, not a primary enrollment method. Option D is incorrect because Windows Autopilot is for Windows devices, not iOS/iPadOS. Option E is incorrect because Android Zero Touch enrollment is for Android devices.

Answer

Apple Configurator 2

Answer

Windows Autopilot

Answer

Android Zero Touch enrollment