MD-102 Prepare infrastructure for devices Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage corporate-owned iOS devices. You need to ensure that devices are supervised and can be configured with restrictions that cannot be removed by the user. Which THREE steps must you take?

Accepted Answer

Add devices to Apple Business Manager (ABM).. Options A, B, and C are correct. Supervising devices requires Apple Business Manager, automated enrollment, and a supervision profile. Option D is not required because supervised devices do not need user affinity for supervision. Option E is for device compliance, not supervision.

Answer

Assign a user to each device during enrollment.

Answer

Create a device compliance policy that requires supervision.

Question 2

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Accepted Answer

Configure a BitLocker policy in Intune that enables key escrow to Azure AD.. Options A, C, and D are correct. Intune management enables remote wipe. BitLocker policy with key escrow stores keys in Azure AD. Azure AD join is required for key escrow. Option B is not required because key escrow works without on-premises AD. Option E is for on-premises AD joined devices.

Answer

Join devices to on-premises Active Directory.

Answer

Configure a Group Policy to escrow BitLocker keys to Active Directory.

Question 3

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Accepted Answer

Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.. Options B and D are correct. Device type restrictions allow you to block personal devices. Enrollment restrictions include device platform and personal/corporate settings. Option A is not a restriction setting. Option C is for compliance, not enrollment. Option E is for conditional access, not enrollment blocking.

Answer

Create a conditional access policy that blocks devices not marked as corporate.

Answer

Create a conditional access policy that requires compliant devices.

Answer

Create a device compliance policy that marks personal devices as non-compliant.

Question 4

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Accepted Answer

Check that Secure Boot is enabled.. Options A, B, and C are correct. TPM 2.0, Secure Boot, and 4GB RAM are minimum requirements. Option D is incorrect because the requirement is 64GB storage. Option E is incorrect because the requirement is 1GHz or faster with 2 cores.

Answer

Check that the processor is at least 1GHz with 1 core.

Answer

Check that the device has at least 32GB of storage.

Question 5

You are troubleshooting an issue where Windows 10 devices are not receiving policies from Microsoft Intune. The devices are enrolled and show as 'active' in the console. Which THREE steps should you take to diagnose the problem?

Accepted Answer

Verify the last sync time in Intune console.. Options A, C, and E are correct. Checking the sync time helps determine if the device is communicating. Re-enrolling can fix some issues. Checking the MDM diagnostic logs provides detailed error info. Option B is not necessary because the device is already enrolled. Option D is not a standard troubleshooting step.

Answer

Re-register the device in Azure AD.

Answer

Check the device's local firewall rules for Intune ports.

Question 6

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Accepted Answer

A Microsoft Defender for Endpoint license must be assigned.. Options A and D are correct. Devices must be enrolled in Intune to receive the configuration. A Defender for Endpoint license is required. Option B is not required because Defender is built into Windows 10. Option C is not a prerequisite. Option E is not required for deployment.

Answer

Devices must be joined to Azure AD.

Answer

Devices must have a third-party antivirus uninstalled.

Answer

An Azure AD Premium license must be assigned.

Question 7

Your company is deploying iOS devices using Apple Business Manager and Intune. You need to ensure that devices are automatically configured with Wi-Fi settings, email profiles, and a list of required apps during the initial setup. Which THREE configurations should you create in Intune?

Accepted Answer

A device configuration profile for Wi-Fi settings.. Options B, C, and D are correct. Device configuration profiles can push Wi-Fi and email settings. Required apps can be assigned as mandatory. Option A is not used for iOS. Option E is for compliance, not configuration.

Answer

A Windows configuration designer provisioning package.

Answer

A device compliance policy for iOS.

Question 8

You are configuring Windows Information Protection (WIP) in Microsoft Intune. You want to protect corporate data from being accidentally shared to personal locations while still allowing the user to work productively. Which THREE settings should you configure?

Accepted Answer

Define network boundaries (corporate IP ranges, DNS suffixes).. Options A, B, and D are correct. Protected apps are allowed to access corporate data. The data recovery agent ensures encrypted data can be recovered. Network boundaries define corporate network locations. Option C is not a WIP setting. Option E is for configuration profiles, not WIP.

Answer

Configure a device configuration profile to enable WIP.

Answer

Set the 'Share over' data transfer policy to 'Block'.

Question 9

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

Accepted Answer

In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.. Option D is correct because to co-manage devices, you must configure the co-management properties in ConfigMgr with the correct pilot collection and workload slider. Option A is incorrect because Intune enrollment happens via ConfigMgr policy, not Azure AD join alone. Option B is incorrect because the Intune connector does not handle workload distribution. Option C is incorrect because automatic enrollment in Intune requires Group Policy or ConfigMgr policy to trigger it.

Answer

Install the Intune connector for ConfigMgr and configure the workloads.

Answer

Create a Group Policy that enables automatic MDM enrollment to Intune.

Answer

Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.

Question 10

Your company has 200 iOS devices that are enrolled in Microsoft Intune via Apple Business Manager. The devices are used by field sales representatives who need access to the corporate CRM app and email. You need to ensure that if a device is lost or stolen, the corporate data can be removed without affecting personal data. The devices are configured with user affinity. What should you do?

Accepted Answer

Perform a selective wipe (corporate data removal) from Intune.. Option B is correct because selective wipe removes only corporate data while leaving personal data intact on devices with user affinity. Option A is incorrect because full wipe removes all data. Option C is incorrect because retiring the device removes it from management but does not remove data. Option D is incorrect because compliance policies do not remove data.

Answer

Perform a full wipe on the device from Intune.

Answer

Retire the device from Intune.

Answer

Create a device compliance policy to mark the device as noncompliant.

Question 11

Your organization is deploying Windows 10 devices using Windows Autopilot. The devices are purchased from a vendor and will be shipped directly to users. You need to ensure that the devices are automatically enrolled in Intune and configured with your organization's standard settings as soon as the user turns on the device and connects to the internet. The devices should be Azure AD joined. What is the minimal configuration required?

Accepted Answer

Upload the device's hardware hash to Microsoft Intune.. Option C is correct because the hardware hash must be uploaded to Intune for Autopilot to recognize the device. Option A is incorrect because the hash is not automatically available. Option B is incorrect because the hash is uploaded to Intune, not Azure AD. Option D is incorrect because the user does not need to perform any pre-configuration.

Answer

Ask the vendor to configure the devices with your organization's settings before shipping.

Answer

Upload the device's hardware hash to Azure AD.

Answer

Instruct the user to manually enroll the device after receiving it.

Question 12

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to ensure that devices are enrolled automatically without user interaction and that the enrollment status page (ESP) is configured to block device use until required apps are installed. What should you configure?

Accepted Answer

Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile. Option C is correct because Windows Autopilot with self-deploying mode allows zero-touch enrollment, and the Enrollment Status Page (ESP) can be configured to block device use until required apps are installed. Option A is wrong because co-management requires Configuration Manager and does not provide zero-touch enrollment. Option B is wrong because DEM is for Android and iOS, not Windows. Option D is wrong because GPO does not provide automatic enrollment into Intune.

Answer

Configure a Group Policy to auto-enroll devices into Intune

Answer

Configure a device enrollment manager (DEM) account

Answer

Configure co-management with Microsoft Configuration Manager

Question 13

A user reports that their Windows 11 device is not receiving a required security baseline policy from Microsoft Intune. The device appears as compliant in the Microsoft Intune admin center. Other devices in the same group receive the policy. You verify that the policy is assigned to the correct group and that the user is a member. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently or has a policy conflict. Option D is correct because the problem is isolated to one device, and the user is in the correct group. The most likely cause is that the device is in a pending state such as waiting for check-in or has a conflict with another policy. Option A is wrong because if the user were not in the group, the policy would not apply to any devices, but other devices in the same group receive the policy. Option B is wrong because the device is compliant. Option C is wrong because the policy is assigned to the group and other devices receive it.

Answer

The user is not a member of the Azure AD group that the policy is assigned to

Answer

The policy is not assigned to any group

Answer

The device is marked as non-compliant and has been blocked

Question 14

Your company deploys Microsoft Defender for Endpoint to Windows devices managed by Microsoft Intune. You need to ensure that all devices send diagnostic data at the 'Optional diagnostic data' level. Which configuration profile type should you use?

Accepted Answer

Device restrictions. Option A is correct because 'Device restrictions' includes the 'Diagnostic data' setting to control the level of diagnostic data sent to Microsoft. Option B is wrong because 'Endpoint protection' focuses on security settings like Defender Antivirus, not diagnostic data. Option C is wrong because 'Administrative templates' are for ADMX-backed policies, but the diagnostic data setting is available in device restrictions. Option D is wrong because 'Custom' is not the simplest way.

Answer

Administrative templates

Answer

Endpoint protection

Answer

Custom

Question 15

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom VPN configuration that uses per-app VPN and certificate-based authentication. The certificate is already deployed via a PKCS certificate profile. However, the VPN connection fails. What is the most likely reason?

Accepted Answer

The per-app VPN profile does not include the app bundle IDs or is not associated with the certificate. Option B is correct because per-app VPN on iOS requires a VPN profile that includes the app identifier list and associates it with the certificate, and the certificate must be properly configured. Option A is wrong because the certificate is already deployed. Option C is wrong because per-app VPN does not require a separate MDM profile for each app. Option D is wrong because the VPN server type is not necessarily the issue.

Answer

The certificate is not trusted by the device

Answer

The VPN profile is not assigned to the correct device group

Answer

The VPN server type is not supported by iOS