MD-102 Prepare infrastructure for devices Practice Test 5 — 15 Questions

Question 1

You are troubleshooting a Windows 11 device that fails to enroll in Intune via Group Policy. The device is domain-joined and you have configured the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO. The user has a valid Microsoft 365 license. What is the most likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device is not registered in Azure AD.. Automatic MDM enrollment via Group Policy using default Microsoft Entra ID credentials requires the device to be Microsoft Entra ID registered (or hybrid Microsoft Entra ID joined) so that the user's Microsoft Entra ID credentials can be used to enroll the device into Intune. If the device is only domain-joined and not registered in Microsoft Entra ID, the GPO cannot obtain the necessary Microsoft Entra ID token, causing enrollment to fail.

Answer

The GPO is not linked to the correct organizational unit.

Answer

The user does not have an Intune license assigned.

Answer

The device does not have a service connection point configured.

Question 2

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Accepted Answer

TPM 2.0 chip. Option D (TPM 2.0 chip) is correct because Windows Autopilot self-deploying mode requires a TPM 2.0 chip to establish the hardware-backed device identity and attestation needed for zero-touch provisioning without user credentials. Option E (Network connectivity to Microsoft Intune) is correct because the device must reach Intune endpoints over the internet to download the Autopilot profile, enroll in MDM, and receive policies during the self-deploying flow. Option A is not required because self-deploying mode is designed for kiosk/shared devices and does not need a licensed user account to enroll. Option B is not required because Autopilot uses the device's existing OEM digital license or hardware hash, not a manually entered product key. Option C is not required because self-deploying mode explicitly uses no user affinity, enrolling the device without assigning it to a user.

Answer

A user account with Intune license

Answer

A Windows product key

Answer

MDM user affinity

Question 3

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Accepted Answer

Microsoft Intune tenant. Co-management requires an Intune tenant (A) because Intune is the MDM authority that receives the workloads you shift from Configuration Manager, and the tenant must be licensed and configured to accept device enrollments. It also requires Configuration Manager current branch (B), since only current branch supports the Cloud Attach/co-management feature and the client-side agent that performs the workload handoff. Microsoft Entra ID (E) is required because devices must have an identity in Entra ID (via hybrid Microsoft Entra ID join or Microsoft Entra ID join) for Intune to manage them and for the co-management policies to apply. A service connection point (C) is not strictly required for co-management itself — it is used for cloud services like tenant attach, co-management's Cloud Attach wizard, and Microsoft Store for Business — and PKI certificates (D) are optional, since Intune can use its own certificates or no certificates at all for many workloads.

Answer

Service connection point (Cloud Attach)

Answer

Public key infrastructure (PKI) certificates

Question 4

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

Accepted Answer

The policy will block access to the Microsoft Store and Cortana.. The policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device. Option D is wrong because the policy does not affect app installation from other sources.

Answer

The policy will apply only to the primary user of the device.

Answer

The policy will prevent users from installing apps from outside the Microsoft Store.

Answer

The policy will block the camera on all devices.

Question 5

Refer to the exhibit. An Intune compliance policy JSON for Windows 10 devices. A device with OS version 10.0.19041.1 and no encryption reports as noncompliant. What is the most likely reason?

Accepted Answer

The device does not have BitLocker encryption enabled.. The compliance policy specifies storageRequireEncryption: true, but the device does not have BitLocker encryption enabled, causing noncompliance. Option A is incorrect because the OS version 10.0.19041.1 is below the maximum allowed (10.0.19044.1). Option B is incorrect because 'deviceDefault' allows any valid Windows password type, including numeric PIN. Option C is incorrect because the OS version is above the minimum required (10.0.19041.0).

Answer

The OS version exceeds the maximum allowed version.

Answer

The password type is set to 'deviceDefault' which does not support numeric PIN.

Answer

The OS version is below the minimum requirement.

Question 6

Refer to the exhibit. An Autopilot device registration JSON. What does the '%RAND:5%' placeholder do?

Accepted Answer

It generates a random 5-character string.. In an Autopilot device registration JSON, the %RAND:5% placeholder is a variable that generates a random 5-character string when the deployment profile is applied. It is commonly used to create unique values such as a random computer name suffix or a unique identifier, ensuring no two devices get the same value. This is part of the Windows Autopilot deployment profile variables.

Answer

It inserts the device's model name.

Answer

It inserts the device's serial number.

Answer

It inserts the user's principal name.

Question 7

Your organization uses Microsoft Intune for device management. You need to ensure that only corporate-owned devices can enroll in Intune. Which configuration should you use?

Accepted Answer

Use Device Enrollment Manager (DEM) accounts to enroll devices.. Device Enrollment Manager (DEM) accounts allow designated administrators to enroll devices on behalf of other users, and these devices are automatically marked as corporate-owned. Option B is incorrect because a compliance policy can require corporate ownership as a condition, but it does not block personal devices from enrolling; it only marks them noncompliant after enrollment. Option C is incorrect because device categories are for organizational grouping, not for enforcing corporate-only enrollment. Option D is incorrect because enrollment restrictions can block personally owned devices, but they do not automatically designate devices as corporate-owned; DEM is the appropriate method for ensuring only corporate-owned devices enroll.

Answer

Assign a compliance policy that requires the device to be corporate-owned.

Answer

Create a device category for corporate devices and instruct users to select it during enrollment.

Answer

Configure enrollment restrictions to block personally owned devices.

Question 8

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

Accepted Answer

The user does not have an Intune license assigned.. The device showing as 'Not compliant' in the Intune console indicates it is enrolled in Intune. The most likely cause for compliance policies not being applied is that the user does not have a valid Intune license assigned. Without a license, the device can be enrolled but compliance policies will not be evaluated or enforced. Option B is incorrect because the device is enrolled (as evidenced by its appearance in the console). Option C is incorrect because a stale policy would still apply if the device is enrolled and licensed. Option D is incorrect because network connectivity would affect policy retrieval but the device would still be enrolled and licensed.

Answer

The device is not enrolled in Intune.

Answer

The compliance policy is stale and needs to be re-assigned.

Answer

The device has no network connectivity.

Question 9

Refer to the exhibit. You have configured the above enrollment restriction in Microsoft Intune. A user attempts to enroll a personal Windows 11 device. What will be the outcome?

Accepted Answer

The device will be blocked from enrolling.. The enrollment restriction shown in the exhibit (not visible here, but implied by the correct answer) blocks personal Windows devices. Since the user attempts to enroll a personal Windows 11 device, the restriction will prevent enrollment. Intune enrollment restrictions can block personal devices by platform or ownership type.

Answer

The device will be prompted to confirm enrollment.

Answer

The device will enroll but will be marked as non-compliant.

Answer

The device will enroll successfully because it meets the OS requirements.

Question 10

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to enroll a personally owned device with a work profile. Which enrollment method should the user use?

Accepted Answer

Android Enterprise personally owned work profile enrollment.. Android Enterprise personally owned devices with a work profile use the 'Bring your own device' (BYOD) enrollment method. Option A is wrong because corporate-owned dedicated devices use a different method. Option C is wrong because fully managed devices are corporate-owned. Option D is wrong because corporate-owned work profile is for corporate devices with work profile.

Answer

Android Enterprise fully managed enrollment.

Answer

Android Enterprise corporate-owned work profile enrollment.

Answer

Corporate-owned dedicated device enrollment.

Question 11

Your organization is deploying Windows Autopilot self-deploying mode for kiosk devices. The devices will be used in a public area and must not require user interaction during the initial setup. What is the prerequisite for this deployment?

Accepted Answer

The device must have a TPM 2.0 chip.. Windows Autopilot self-deploying mode relies on the device's TPM 2.0 chip to cryptographically attest its identity to Microsoft Entra ID without any user interaction. The TPM 2.0 provides hardware-bound keys that enable the device to authenticate itself and automatically enroll, which is essential for kiosk devices in public areas where no user credentials can be supplied during initial setup.

Answer

A user must be assigned to the device in Microsoft Entra ID.

Answer

An enrollment profile must be assigned to the user.

Answer

The device must be added to Microsoft Entra ID manually.

Question 12

A user reports that their Windows device is not appearing in the Intune console after enrollment. The device is joined to Microsoft Entra ID and the user has an Intune license. What should you check first?

Accepted Answer

Ensure that the MDM user scope in Microsoft Entra ID is set to 'All' or 'Some'.. The most common reason a device fails to appear in the Intune console after enrollment is that the MDM user scope in Microsoft Entra ID is not configured to include the user. The MDM user scope determines which users can automatically enroll their devices into Intune; if it is set to 'None', enrollment is blocked entirely. Since the device is already joined to Microsoft Entra ID and the user has an Intune license, the first step is to verify this scope setting.

Answer

Assign an Intune license to the device.

Answer

Verify that enrollment restrictions are not blocking the device.

Answer

Check if the device is compliant.

Question 13

Your organization plans to use Microsoft Intune to manage macOS devices. Which TWO prerequisites are required for macOS enrollment?

Accepted Answer

An Apple Push Notification service (APNs) certificate.. Option A is correct because Intune requires an Apple Push Notification service (APNs) certificate to communicate with and manage enrolled macOS devices; without a valid APNs certificate, Intune cannot send management commands to Apple devices. Option D is correct because macOS devices must be joined or registered in Microsoft Entra ID (Azure AD) so that user identity and device records can be established for Intune enrollment and policy targeting. Option B is not required because user enrollment certificates from a public CA are not a prerequisite for standard Intune macOS enrollment. Option C is not required because a VPP token is only needed for purchasing and assigning apps through Apple Business Manager, not for basic macOS enrollment. Option E is not required because a Configuration Manager connector is only relevant for co-management scenarios, not for standalone Intune macOS enrollment.

Answer

A user enrollment certificate from a public CA.

Answer

A Volume Purchase Program (VPP) token.

Answer

A Microsoft Configuration Manager connector.

Question 14

Your organization uses Microsoft Intune and you need to configure Windows Autopilot for hybrid Microsoft Entra ID join. Which THREE components are required?

Accepted Answer

A domain join profile (configured in Intune).. Option A is correct because hybrid Microsoft Entra ID join requires a domain join profile in Intune that specifies the on-premises Active Directory domain and the organizational unit (OU) where the device account will be created during Autopilot. Option C is correct because an Autopilot deployment profile is mandatory to define the deployment mode (for example, user-driven) and the join type (Microsoft Entra hybrid join) that tells the device how to register with Autopilot. Option E is correct because an enrollment status page (ESP) profile is required in hybrid Autopilot scenarios to block device use until all device-targeted policies and apps are installed, ensuring the domain join and Intune enrollment complete successfully. Option B is not required because a compliance policy is optional and only enforces conditional access rules after enrollment, not a prerequisite for hybrid join. Option D is not required because an MDM push certificate is used for macOS and iOS/iPadOS enrollment, whereas Windows devices enroll via the built-in Intune MDM channel and Autopilot.

Answer

A device compliance policy.

Answer

An MDM push certificate.

Question 15

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

Accepted Answer

The device does not have a TPM 2.0 chip.. Windows Autopilot self-deploying mode requires a TPM 2.0 chip to perform hardware-based attestation and automatically enroll the device without user interaction. If the device lacks TPM 2.0, the provisioning process will fail because the required cryptographic keys for attestation cannot be generated, preventing the device from completing the self-deploying profile.

Answer

The device name template is invalid.

Answer

The profile requires a user to sign in during deployment.

Answer

The language settings are not configured.