MD-102 Prepare infrastructure for devices Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to configure a Windows Autopilot deployment for new devices that are shipped directly to users. The devices must be automatically enrolled in Intune and configured with your organization's standard settings. What is the minimum requirement for the device to be recognized by Windows Autopilot?

Accepted Answer

The device must have its hardware hash uploaded to Microsoft Intune.. Option D is correct because Windows Autopilot requires the device's hardware hash to be uploaded to the Autopilot service. Option A is incorrect because devices do not need to be joined to on-premises AD first. Option B is incorrect because Azure AD join is configured during the Autopilot process, not a prerequisite. Option C is incorrect because the hardware hash is the minimum requirement, not a Microsoft Entra ID Premium license (though some features may require it).

Answer

The device must have a Microsoft Entra ID Premium P2 license assigned.

Answer

The device must be Azure AD registered before shipping.

Answer

The device must be joined to on-premises Active Directory first.

Question 2

You are troubleshooting a Windows 10 device that fails to enroll in Microsoft Intune. The device shows error code 0x8018000b. You verify that the user has a valid Intune license and that the device is running Windows 10 Pro. What is the most likely cause of the enrollment failure?

Accepted Answer

MDM enrollment is blocked by a local Group Policy or registry setting.. Option C is correct because error 0x8018000b typically indicates that MDM enrollment is blocked via Group Policy or registry. Option A is incorrect because the error is specific to MDM enrollment blocking. Option B is incorrect because the device edition is Pro, which supports enrollment. Option D is incorrect because certificate issues usually produce different errors.

Answer

The device is running Windows 10 Home edition.

Answer

The device is not connected to the internet.

Answer

The device has an expired certificate required for enrollment.

Question 3

Your company plans to deploy Microsoft 365 Apps to 500 devices using Microsoft Intune. You want to ensure that the Office suite is installed with only Word, Excel, and PowerPoint. Which approach should you use?

Accepted Answer

Use Microsoft Intune to deploy Office by configuring a Win32 app with the Office Deployment Tool and a custom XML.. Option A is correct because the Office Deployment Tool allows you to configure which products are installed via an XML configuration file. Option B is incorrect because the Click-to-Run tool is part of the ODT but not the primary method. Option C is incorrect because Intune itself does not install Office without an XML configuration. Option D is incorrect because the Microsoft 365 admin center is for service configuration, not client installation.

Answer

Use Microsoft Intune to deploy Office by selecting the built-in Office 365 app type and then modify the installation options.

Answer

Use the Microsoft 365 admin center to assign licenses and then have users install from the portal.

Answer

Use Microsoft Configuration Manager to deploy Office with a task sequence.

Question 4

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

Accepted Answer

Shared iPad enrollment using Apple Business Manager and Intune.. Option B is correct because Shared iPad mode allows multiple users to sign in with Managed Apple IDs while data is kept separate. Option A is incorrect because User Enrollment is for personally owned devices. Option C is incorrect because Device Enrollment is for single-user corporate devices. Option D is incorrect because it is not a standard enrollment type.

Answer

Automated Device Enrollment with user affinity.

Answer

User Enrollment

Answer

Device Enrollment (DEP) without user affinity.

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a compliance policy requiring devices to have BitLocker enabled. Some devices report as non-compliant even though BitLocker appears to be on. You discover these devices are using software-based encryption instead of hardware-based encryption. What should you do to resolve the compliance failure?

Accepted Answer

Modify the compliance policy to include 'BitLocker hardware encryption' as 'not configured' or set to 'allow software encryption'.. Option C is correct because the compliance policy can be configured to accept both hardware and software encryption. Option A is incorrect because the TPM is used regardless of encryption type. Option B is incorrect because the policy does not need to be changed to 'required' if it already requires encryption. Option D is incorrect because BitLocker is available on Windows 10 Pro and Enterprise.

Answer

Configure the compliance policy to require TPM attestation.

Answer

Upgrade the devices to Windows 10 Enterprise edition.

Answer

Change the compliance policy setting from 'require' to 'allow' for BitLocker.

Question 6

You need to ensure that all corporate-owned Windows devices automatically receive security updates as soon as they are released by Microsoft. Which update ring policy setting should you configure in Microsoft Intune?

Accepted Answer

Set 'Defer quality updates' to 0 days.. Option D is correct because the 'Defer feature updates' and 'Defer quality updates' settings control how long updates are delayed; setting them to 0 ensures immediate installation. Option A is incorrect because it is a service channel, not a deferral setting. Option B is incorrect because 'Semi-Annual Channel' delays feature updates by 4 months. Option C is incorrect because 'Windows Insider' is for preview builds.

Answer

Set the 'Microsoft product updates' setting to 'Allow'.

Answer

Select the 'Windows Insider' channel for quality updates.

Answer

Select the 'Semi-Annual Channel' for feature updates.

Question 7

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

Accepted Answer

Create an app protection policy that restricts data transfer between work and personal apps.. Option B is correct because app protection policies (MAM) can restrict data transfer between work and personal contexts. Option A is incorrect because compliance policies do not control copy/paste behavior. Option C is incorrect because configuration policies set app settings, not data protection. Option D is incorrect because device compliance policies are not granular enough.

Answer

Create a device configuration policy that disables clipboard sharing.

Answer

Create a device compliance policy that requires a work profile.

Answer

Create a conditional access policy that blocks personal apps.

Question 8

You are deploying Windows 10 to 100 new devices using Microsoft Deployment Toolkit (MDT). You want to integrate with Microsoft Intune for post-deployment management. Which MDT integration method should you use?

Accepted Answer

Create a provisioning package in MDT that includes the Intune enrollment configuration and apply it during the deployment task sequence.. Option A is correct because MDT can generate a provisioning package that includes Intune enrollment details, which is applied during deployment. Option B is incorrect because MDT does not directly integrate with Intune via a connector. Option C is incorrect because Configuration Manager integration is separate. Option D is incorrect because Autopilot is a different deployment method.

Answer

Use Microsoft Configuration Manager to deploy the devices and then co-manage with Intune.

Answer

Configure Windows Autopilot for the devices and skip MDT.

Answer

Install the Intune connector for MDT and configure it during deployment.

Question 9

You need to configure Microsoft Intune to automatically retire a device if it has not checked in for 30 days. Where would you configure this setting?

Accepted Answer

Intune device cleanup rules. Option D is correct because device cleanup rules in Intune allow you to automatically retire devices that have not communicated for a specified period. Option A is incorrect because compliance policies handle non-compliance, not retirement based on inactivity. Option B is incorrect because conditional access controls access, not device cleanup. Option C is incorrect because configuration policies set settings, not cleanup rules.

Answer

Conditional access policy

Answer

Device compliance policy

Answer

Device configuration profile

Question 10

Refer to the exhibit. The JSON shows a managed device's properties retrieved from Microsoft Graph. The device's complianceState is 'noncompliant'. Which step should you take next to investigate why the device is noncompliant?

Accepted Answer

Query the device's compliance policy status via Graph API or Intune console.. Option B is correct because the compliance policy details will show which specific policy is failed. Option A is incorrect because the device is already enrolled. Option C is incorrect because last sync time is recent. Option D is incorrect because jailbreak is not applicable to Windows.

Answer

Verify the last sync time to ensure the device is communicating.

Answer

Check if the device is properly enrolled by verifying azureADRegistered.

Answer

Check if the device is jailbroken or rooted.

Question 11

Refer to the exhibit. A PowerShell command is used to create a device category in Microsoft Intune. After running the command, you want to automatically assign devices to this category based on their Azure AD group membership. How should you configure this?

Accepted Answer

Create a dynamic device group in Azure AD that includes devices based on rules, then use that group to assign category via Intune.. Option D is correct because dynamic device groups in Azure AD can use rules to assign devices to categories based on attributes. Option A is incorrect because manual assignment is not automated. Option B is incorrect because there is no direct mapping between Azure AD groups and Intune categories. Option C is incorrect because configuration profiles do not assign categories.

Answer

Use a device configuration profile to set the device category.

Answer

Map an Azure AD group to the Intune device category in the Intune console.

Answer

Create a PowerShell script that runs daily to assign devices to the category based on group membership.

Question 12

Refer to the exhibit. A detection script for a Win32 app in Intune uses a WMI query. The script is expected to detect if BitLocker is not enabled. What will the script return if BitLocker is enabled on the device?

Accepted Answer

It returns no results, indicating that BitLocker is enabled.. Option C is correct because the query returns volumes where ProtectionStatus = 0 (not protected). If BitLocker is enabled, ProtectionStatus = 1, so no results are returned, meaning the script would return a non-detection (often $false or exit 1 depending on script). Option A is incorrect because the query does not return when protection is on. Option B is incorrect because no results are returned. Option D is incorrect because the query is valid.

Answer

It returns the protection status as 1.

Answer

It returns the drive letter of the protected volume.

Answer

It returns an error because the query is invalid.

Question 13

Your organization is deploying Windows 10 devices using Windows Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are required to set up Windows Hello for Business. Which TWO configurations should you apply?

Accepted Answer

Configure a Windows Hello for Business policy in Intune device configuration.. Options B and C are correct. Windows Hello for Business deployment requires a PIN policy and enrollment policy to be configured. Option A is not required because Autopilot profiles do not directly enforce Hello. Option D is a prerequisite but not sufficient alone. Option E is an alternative but not a direct configuration for OOBE.

Answer

Configure a Windows Autopilot deployment profile to require Windows Hello for Business.

Answer

Enable Azure AD device registration.

Answer

Deploy a custom script that enables Windows Hello.

Question 14

You are planning device management for a corporate environment with Windows 10, iOS, and Android devices. You need to implement a solution that allows users to access corporate email and documents securely on their personal devices without IT managing the entire device. Which THREE components should you include?

Accepted Answer

Azure AD application proxy for on-premises apps. Options A, B, and C are correct. MAM policies protect app data at the application level without full device management. Conditional access controls access based on compliance. Azure AD app proxy provides secure remote access to on-premises apps. Option D is not needed because device enrollment is not required. Option E is for device-level management, not app-level.

Answer

Device enrollment into Intune

Answer

Device compliance policies

Question 15

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Accepted Answer

Set 'Defer quality updates (days)' to 0.. Options B and D are correct. Setting deferral for quality updates to 0 ensures immediate installation. Setting feature update deferral to 60 days delays feature updates. Option A is not a setting in update rings. Option C is incorrect because feature updates should be deferred, not quality. Option E is a service channel, not a deferral setting.

Answer

Set 'Feature update channel' to 'Semi-Annual Channel'.

Answer

Set 'Update notification level' to 'Turn off notifications'.

Answer

Set 'Defer quality updates (days)' to 60.