MD-102 Prepare infrastructure for devices Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. You configure an Enrollment Status Page (ESP) policy as shown. During Windows Autopilot deployment, a device fails to install one of the required apps. What happens to the device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device blocks use and the user cannot proceed. The Enrollment Status Page (ESP) policy is configured with the 'Show error when installation takes longer than specified number of minutes' option set to 'Block device use until all required apps and profiles are installed.' When a required app fails to install, the ESP enters an error state and, because the policy is set to block use, the device remains locked at the ESP screen, preventing the user from proceeding to the desktop. This behavior is enforced by the Autopilot client, which monitors the installation status of required apps and profiles and will not allow the user to bypass the ESP until all required items are successfully installed or the timeout is reached.

Answer

The device automatically resets and retries

Answer

The user can skip the installation and use the device

Answer

The user can retry the installation

Question 2

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Mail app that is required for corporate email. What configuration should you apply?

Accepted Answer

Configure a Managed App Configuration with the key 'preventManagedAppRemoval' set to true.. A Managed App Configuration with the 'preventManagedAppRemoval' key set to true prevents users from removing the Mail app from their device. Option A is incorrect because deploying the Mail app as a required volume-purchased app via Apple Business Manager only ensures the app is installed but does not prevent users from deleting it. Option C is incorrect because hiding the Mail app from the home screen does not prevent uninstall; it only removes the icon. Option D is incorrect because an app protection policy that blocks removal of corporate data applies to data within the app, not to the app itself.

Answer

Deploy the Mail app as a required volume-purchased app using Apple Business Manager.

Answer

Set a device restriction policy to hide the Mail app from the home screen.

Answer

Assign an app protection policy that blocks the removal of corporate data.

Question 3

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

Accepted Answer

The device has a non-compliant component that prevents policy application.. A non-compliant component (e.g., an outdated OS version, missing required app, or misconfigured setting) can cause the device to be marked as 'Not evaluated' if the compliance policy cannot be processed. The device is enrolled but the policy engine fails to evaluate compliance due to an underlying issue. Option A is incorrect: Certificate profiles are used for resource access, not for compliance evaluation. Option B is incorrect: The Intune Management Extension is for deploying Win32 apps and PowerShell scripts, not for compliance policies. Option D is incorrect: Enrollment tokens are used for enrollment; if expired, the device would not be enrolled at all.

Answer

The device does not have a valid certificate profile.

Answer

The Intune Management Extension is not installed.

Answer

The device's enrollment token has expired.

Question 4

Your organization is implementing Microsoft Entra ID join for Windows devices. You need to ensure that when users sign in with their Microsoft Entra ID credentials, they automatically get access to company resources without additional authentication. Which feature should you enable?

Accepted Answer

Primary Refresh Token (PRT). The Primary Refresh Token (PRT) is the key artifact that enables single sign-on (SSO) on Microsoft Entra ID-joined Windows devices. When a user signs in with their Entra ID credentials, Windows obtains a PRT, which is then used to silently request access tokens for company resources (like Microsoft 365, Exchange Online, and on-premises resources via hybrid setups). This eliminates additional authentication prompts. Without a PRT, users would be prompted for credentials each time they access a resource, defeating the seamless SSO experience.

Answer

Device compliance policies

Answer

Windows Hello for Business

Answer

Conditional Access policies

Question 5

You are troubleshooting a Windows 10 device that fails to install a required application from Microsoft Intune. The device shows the application as 'Enforced' but never installs. The application is a line-of-business (LOB) app. What should you check first?

Accepted Answer

Check if the application package has a valid code signing certificate.. For a line-of-business (LOB) app in Intune, a valid code signing certificate is required to ensure the app can be trusted and deployed. The most common reason an LOB app fails to install despite being enforced is a missing or invalid code signing certificate. Option A is incorrect because 'Required' intent is for user groups, not device groups; LOB apps can be assigned to device groups with 'Required' intent, so this is not the first check. Option B is incorrect because the Intune Management Extension is used for Win32 apps, not for LOB apps; LOB apps use a different deployment mechanism. Option D is incorrect because LOB apps are uploaded directly to Intune, not from the Microsoft Store for Business.

Answer

Ensure the app is assigned to a device group using 'Required' intent.

Answer

Verify that the Intune Management Extension is installed on the device.

Answer

Check if the app is available in the Microsoft Store for Business.

Question 6

Your organization uses Microsoft Intune to manage macOS devices. You need to configure FileVault disk encryption for all devices. After deploying the policy, some devices report that encryption is pending. What is the most likely reason?

Accepted Answer

The user has not approved the recovery key escrow.. For FileVault encryption via Intune, the user must approve the escrow of the personal recovery key. If the user has not approved it, encryption may remain pending. Option B is incorrect: user enrollment does support FileVault policy, as long as the device is managed. Option C is incorrect: FileVault does not require a PIN; it uses a password set during encryption. Option D is incorrect: FileVault encryption is available on both supervised and unsupervised macOS devices when managed by Intune.

Answer

The devices are enrolled using user enrollment.

Answer

The devices require a PIN to be set for recovery.

Answer

The devices are not supervised.

Question 7

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

Accepted Answer

Set 'Enable Windows Hello for Business' in the Autopilot profile.. The Windows Autopilot profile includes a setting called 'Enable Windows Hello for Business' that, when enabled, automatically configures the device to prompt the user to set up Windows Hello for Business during the out-of-box experience (OOBE). This setting is part of the Autopilot profile itself and does not require a separate policy or additional configuration to trigger the Hello setup prompt.

Answer

Ensure the device is Azure AD joined.

Answer

Create a separate Windows Hello for Business policy and assign it to the device group.

Answer

Configure the Enrollment Status Page to show Hello setup.

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 feature update using the Windows 10 Update Rings feature. However, the deployment fails and devices show error 0x800f0905. What is the most likely cause?

Accepted Answer

The feature update package is missing prerequisite updates.. Error 0x800f0905 indicates missing installation files for the feature update. This typically occurs when prerequisite updates are not installed. Therefore, the most likely cause is that the feature update package is missing prerequisite updates (Option C). Option A is incorrect because insufficient disk space would result in a different error. Option B is incorrect because the update ring does not involve language settings. Option D is incorrect because a maintenance window would not cause this error.

Answer

The device does not have enough free disk space.

Answer

The device is not set to the correct language for the update.

Answer

The update ring is configured with a maintenance window that is too short.

Question 9

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Accepted Answer

An on-premises Active Directory environment.. Option A is correct because Group Policy-based automatic MDM enrollment requires the devices to be domain-joined to an on-premises Active Directory, which provides the GPO infrastructure and the user/device context needed to trigger enrollment. Option B is correct because you must create and link a GPO that enables automatic MDM enrollment (Computer Configuration > Policies > Administrative Templates > Windows Components > MDM > Enable automatic MDM enrollment using default Microsoft Entra ID credentials), which is the actual mechanism that pushes devices into Intune. Option C is not required as a stated prerequisite in this scenario because an active Intune subscription is assumed by the enrollment goal itself and is not the Group Policy-specific prerequisite being tested. Option D is not required because Microsoft Entra Connect is only needed for directory synchronization in hybrid identity scenarios, not for GPO-based MDM enrollment. Option E is not required because Group Policy automatic enrollment works for domain-joined devices and does not mandate Microsoft Entra ID hybrid join.

Answer

A Microsoft Intune subscription must be active.

Answer

Azure AD Connect must be configured.

Answer

Devices must be Azure AD hybrid joined.

Question 10

You are configuring Microsoft Intune device compliance policies for Windows 10. Which FOUR settings can be evaluated by compliance policies? (Choose four.)

Accepted Answer

Minimum OS version. Option B (Minimum OS version) is correct because Intune Windows 10/11 compliance policies include a 'Minimum OS version' setting under Device Health/System Security that flags devices running builds older than the specified value as noncompliant. Option C (BitLocker encryption status) is correct because the 'Require BitLocker' setting under Device Security/Encryption evaluates whether the OS drive is encrypted with BitLocker and reports noncompliance if encryption is off or suspended. Option D (Password policy) is correct because the 'Password' requirements (minimum length, complexity, expiration, and previous password reuse) are configurable in Windows compliance policies and evaluated on the device. Option E (Threat level from Microsoft Defender for Endpoint) is correct because the 'Device Threat Level' setting integrates with MDE via the Intune–Defender connector and marks devices noncompliant when their risk level is at or above the configured threshold (e.g., Low, Medium, High). Option A (Windows Firewall status) is not among the compliance settings exposed by Intune Windows compliance policies; firewall configuration is handled through endpoint security/firewall configuration profiles rather than compliance evaluation.

Answer

Windows Firewall status

Question 11

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy an app that requires a VPN configuration when the app is launched. Which TWO options can you use to achieve this? (Choose two.)

Accepted Answer

Use a managed app configuration to include VPN settings.. Option A is correct because a managed app configuration (App Configuration Policy) in Intune can deliver key/value settings directly to a managed app, including VPN-related parameters, so the app can trigger or use the required VPN when launched. Option E is correct because a per-app VPN configuration profile in Intune is specifically designed to associate a VPN connection with a particular app, ensuring the VPN is used when that app starts. Option B is incorrect because device compliance policies only evaluate conditions such as OS version or encryption and do not configure or launch VPN connections for apps. Option C is incorrect because app protection policies (MAM) control data sharing, PIN, and conditional launch behavior, not VPN configuration. Option D is incorrect because a device-wide VPN profile applies VPN settings to the whole device rather than being tied to a specific app's launch requirement.

Answer

Use a device compliance policy to require VPN.

Answer

Assign an app protection policy that enables VPN.

Answer

Create a device-wide VPN configuration profile.

Question 12

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

Accepted Answer

The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.. In Intune, for FileVault recovery key escrow to occur, the 'Show recovery key' setting in the macOS endpoint protection profile must be configured to 'Show' or 'Show and hide'. If this setting is not configured, the user is not prompted to escrow the key, and Intune does not receive it. The profile may still enforce FileVault encryption, but without the escrow prompt, the recovery key remains only on the device.

Answer

FileVault encryption is not enabled on the device.

Answer

The recovery key type should be 'Institutional recovery key'.

Answer

Personal recovery key rotation is enabled, causing a conflict.

Question 13

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

Accepted Answer

The device has not been successfully registered in Windows Autopilot.. The diagnostics output shows that the device with serial number ABC123 is not successfully registered in Windows Autopilot, so it cannot receive an Autopilot profile. Without a valid Autopilot registration record tied to the device's hardware hash, the service has no profile to deliver during OOBE. The other options describe conditions that would produce different diagnostic symptoms or would not prevent profile delivery if registration were intact.

Answer

The Autopilot profile is not assigned to the device group.

Answer

The device was previously manually imaged.

Answer

The device is not connected to the internet during OOBE.

Question 14

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

Accepted Answer

The device is connected through a VPN that blocks Intune traffic.. The most likely cause is that the device is connected through a VPN that blocks Intune traffic. Intune requires direct internet access to communicate with its service. If the VPN restricts or filters this traffic, the device may remain enrolled but unable to check in or receive policies. Option B is incorrect because the device last checked in 5 days ago, which is within the 7-day window, so it would not be marked inactive. Option C is incorrect because the device shows as 'Enrolled'. Option D is incorrect because the Intune Connector for Active Directory is used for hybrid Microsoft Entra ID join scenarios, not for direct policy delivery to enrolled devices.

Answer

The device has not checked in for more than 7 days, causing Intune to mark it as inactive.

Answer

The device has been unenrolled from Intune.

Answer

The Intune Connector for Active Directory is not configured.

Question 15

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

Accepted Answer

Windows Hello for Business. The 'Windows Hello for Business' setting in the Autopilot profile directly controls whether users are prompted to configure biometric or PIN-based authentication during the out-of-box experience (OOBE). When enabled, this setting triggers the Windows Hello for Business enrollment flow immediately after user authentication, ensuring the device is provisioned with strong credential protection before the user reaches the desktop.

Answer

Skip privacy settings

Answer

Device name template

Answer

Language (Region)