MD-102 Prepare infrastructure for devices Practice Test 3 — 15 Questions

Question 1

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

Accepted Answer

Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment. Option B is correct because requiring Microsoft Entra join or registration forces device identity in Entra ID before Intune enrollment. Option A is wrong because automatic enrollment doesn't enforce registration first. Option C is wrong because device type restrictions affect allowed platforms, not identity. Option D is wrong because enrollment restrictions apply to enrolling users/devices, not identity prerequisites.

Answer

Configure enrollment restrictions to require corporate ownership

Answer

Set device type restrictions to block unregistered devices

Answer

Configure automatic enrollment via Group Policy

Question 2

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

Accepted Answer

Configure Conditional Access policies in Microsoft Entra ID that require compliant devices. Option D is correct because Conditional Access with device compliance policies is the standard approach to restrict access to compliant devices. Option A is wrong because VPN enforcement is not a direct Intune feature for conditional access. Option B is wrong because autopilot doesn't enforce access control. Option C is wrong because compliance policies alone don't enforce access; they require Conditional Access.

Answer

Deploy Windows Autopilot for all devices and require Entra ID join

Answer

Configure a VPN profile in Intune and enforce device compliance on the VPN server

Answer

Create a compliance policy in Intune and assign it to all users

Question 3

Your organization plans to use Windows Autopilot for device provisioning. You need to ensure devices are automatically registered in Microsoft Entra ID when they are powered on for the first time. Which prerequisite must be met?

Accepted Answer

Users must have Microsoft Entra ID P1 or P2 licenses assigned. Option C is correct because Autopilot requires Microsoft Entra ID P1 or P2 licenses to support automatic device registration. Option A is wrong because licenses are needed. Option B is wrong because Autopilot supports both Entra ID join and hybrid join. Option D is wrong because Intune licenses are required for management but Autopilot also requires Entra ID P1.

Answer

Devices must be pre-registered in Intune via an OEM or partner

Answer

Devices must have a TPM 2.0 chip for self-deploying mode

Answer

An on-premises Active Directory domain must be available

Question 4

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode longer than six characters can access corporate email. Which type of policy should you configure?

Accepted Answer

Device compliance policy. Option B is correct because device compliance policies evaluate security settings like passcode length and are used with Conditional Access. Option A is wrong because configuration profiles set settings but don't enforce access. Option C is wrong because app protection policies manage data at the app level. Option D is wrong because enrollment restrictions control which devices can enroll.

Answer

Device configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 5

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome. Option A is correct because Conditional Access policies often require a specific app (e.g., Outlook, Edge) and can block access if the wrong app is used, even if the device is compliant. Option B is wrong because if the device is compliant, the CA policy should allow it. Option C is wrong because network locations can be a factor but are less likely if the device is compliant. Option D is wrong because app protection policies are separate from SharePoint access via browser.

Answer

The SharePoint site is configured to allow access only from specific IP ranges

Answer

The device compliance policy has a grace period for non-compliance, and the device is still within that period

Answer

An app protection policy is blocking access to SharePoint from the browser

Question 6

Your organization wants to use Microsoft Intune to manage Windows devices that are joined to an on-premises Active Directory domain. The devices will be hybrid Azure AD joined. Which tool should you use to configure automatic enrollment into Intune?

Accepted Answer

Group Policy. Option D is correct because Group Policy is used to configure automatic enrollment for hybrid AD-joined devices. Option A is wrong because CMG is for co-management, not enrollment. Option B is wrong because autopilot is for new devices. Option C is wrong because SCUP is for updates.

Answer

Windows Autopilot

Answer

System Center Updates Publisher (SCUP)

Answer

Configuration Manager Cloud Management Gateway (CMG)

Question 7

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

Accepted Answer

Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs. Option C is correct because Device Enrollment (via Apple Business Manager) allows supervised enrollment while still allowing personal Apple IDs if configured. Option A is wrong because user enrollment limits management. Option B is wrong because it uses a shared device mode without Apple IDs. Option D is wrong because ADE is the same as Device Enrollment, but the key is allowing personal Apple IDs.

Answer

Apple Automated Device Enrollment (ADE) with user affinity

Answer

Apple Device Enrollment (ADE) with Shared iPad mode

Answer

Apple User Enrollment

Question 8

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

Accepted Answer

The BitLocker recovery key is not escrowed to Microsoft Entra ID. Option B is correct because the compliance policy often checks for the recovery key being escrowed to Entra ID, not just encryption. Option A is wrong because TPM is checked but not the primary issue. Option C is wrong because BitLocker on OS drive is required. Option D is wrong because version compatibility is usually not the issue.

Answer

BitLocker is only enabled on data drives, not the system drive

Answer

The device is running a version of Windows that does not support BitLocker

Answer

The device does not have a TPM chip

Question 9

Your organization is deploying Microsoft Intune for the first time. You need to ensure that devices can enroll in Intune. Which of the following is a prerequisite for Intune enrollment?

Accepted Answer

A Microsoft Intune license assigned to the user. A Microsoft Intune license assigned to the user is a prerequisite because Intune uses Azure Active Directory (Azure AD) for identity and access management. Without an Intune license (e.g., Microsoft 365 E3, E5, or standalone Intune license) assigned to the user, the device cannot authenticate and enroll via the Intune enrollment service, as the license is required to authorize the enrollment request and apply device management policies.

Answer

A VPN connection to the corporate network

Answer

An on-premises Active Directory domain

Answer

A Configuration Manager infrastructure

Question 10

Your organization uses Microsoft Intune to manage devices. You need to configure a compliance policy for Windows devices that requires the device to be at a specific OS version and have antivirus enabled. Which TWO settings should you configure in the compliance policy?

Accepted Answer

Require antivirus (Windows Defender). Option A and Option D are correct because 'Minimum OS version' and 'Require antivirus' are compliance policy settings for Windows. Option B is wrong because 'Maximum OS version' is not a typical setting; usually min version is used. Option C is wrong because 'Device type' is not a compliance setting. Option E is wrong because 'Storage encryption' is typically covered by BitLocker, not separate.

Answer

Maximum OS version

Answer

Device type

Answer

Storage encryption

Question 11

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Accepted Answer

Intune licenses assigned to users. Option A, Option B, and Option D are correct because Microsoft Entra ID, Intune, and licensing are required for automatic enrollment. Option C is wrong because Configuration Manager is optional. Option E is wrong because Apple Push Notification service is only for iOS device management, not for automatic enrollment across all platforms.

Answer

Apple Push Notification service certificate (for iOS)

Answer

Configuration Manager (for co-management)

Question 12

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Accepted Answer

Microsoft Intune licenses. Option B and Option D are correct because Autopilot requires Microsoft Entra ID P1/P2 and Intune licenses. Option A is wrong because on-prem AD is not required. Option C is wrong because Configuration Manager is not required. Option E is wrong because a TPM is only required for self-deploying mode.

Answer

An on-premises Active Directory domain

Answer

Configuration Manager

Answer

TPM 2.0 chip on all devices

Question 13

Refer to the exhibit. You are configuring a device compliance policy in Microsoft Intune for Windows devices. Based on the JSON configuration, what will happen if a device does not have a password set?

Accepted Answer

The device will be marked non-compliant and after 24 hours access will be blocked, then retired after 72 hours. Option C is correct because the compliance policy has a grace period of 24 hours before blocking, and then 72 hours before retiring. The device is not immediately blocked. Option A is wrong because there is a grace period. Option B is wrong because there are two actions: block then retire. Option D is wrong because the device is not immediately retired; it goes through block first.

Answer

The device will be marked non-compliant but no action is taken until the grace period expires

Answer

The device will be retired immediately because password is not set

Answer

The device will be immediately blocked from accessing corporate resources

Question 14

Refer to the exhibit. You have configured a Windows Update for Business policy in Intune. Based on the JSON, what is the effect on devices?

Accepted Answer

Quality updates are paused from June 1 to June 30, and feature updates are paused from July 1 to July 15. Option B is correct because quality updates are paused until June 30 and feature updates are paused until July 15. Devices will not receive quality updates after June 1 until June 30. Option A is wrong because feature updates are paused later. Option C is wrong because both types are paused. Option D is wrong because there are specific pause dates.

Answer

Devices will not receive any updates from June 1 to July 15

Answer

Devices will receive all updates normally until July 15

Answer

The policy is invalid because pause dates cannot overlap

Question 15

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Accepted Answer

Enables the Windows Firewall for the public network profile. Option A is correct because the setting ID references Windows Firewall public profile enable firewall, and the value '1' means enabled. Option B is wrong because it's firewall, not Defender. Option C is wrong because it's public profile, not domain. Option D is wrong because it enables, not disables.

Answer

Disables the Windows Firewall for all network profiles

Answer

Enables Microsoft Defender Antivirus real-time protection

Answer

Disables the Windows Firewall for the domain network profile