MD-102 Prepare infrastructure for devices Practice Test 6 — 15 Questions

Question 1

You are planning the enrollment of 500 Android Enterprise personally-owned work profile devices. Management requires that users must not be able to remove the work profile from their device. Which enrollment method should you use?

Accepted Answer

Android Enterprise dedicated devices. Option C is correct because Android Enterprise dedicated devices are fully managed and cannot have the work profile removed by the user. Option A is wrong because personally-owned work profile allows users to remove the work profile. Option B is wrong because corporate-owned work profile is for company-owned devices. Option D is wrong because fully managed is for corporate-owned devices.

Answer

Android Enterprise corporate-owned work profile

Answer

Android Enterprise fully managed

Answer

Android Enterprise personally-owned work profile

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a PowerShell script via Intune management extension to install a legacy application. The script runs successfully on most devices, but fails on devices that have the 'LocalSystem' account disabled. What should you do to resolve the issue?

Accepted Answer

Configure the script to run in the user context by modifying the script settings in Intune. Option D is correct because the Intune management extension runs scripts in the system context, but if the LocalSystem account is disabled, the script may fail. Running the script in the user context may bypass this issue. Option A is wrong because changing the script to run as a different user is not directly supported. Option B is wrong because the management extension is required. Option C is wrong because re-enabling LocalSystem is not recommended and may have security implications.

Answer

Change the script to run as the logged-on user using a scheduled task

Answer

Deploy the script using Microsoft Configuration Manager instead

Answer

Re-enable the LocalSystem account on the affected devices

Question 3

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Accepted Answer

Endpoint protection. Option B is correct because 'Endpoint protection' for macOS includes FileVault settings. Option A is wrong because 'Device features' includes settings like wallpaper and lock screen. Option C is wrong because 'Device restrictions' includes general settings, not encryption. Option D is wrong because 'Custom' is not the standard method.

Answer

Custom

Answer

Device restrictions

Answer

Device features

Question 4

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

Accepted Answer

Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center. Option A is correct because you can upload the hardware hashes directly to the Autopilot devices page in Intune. Option B is wrong because the OEM can register devices for you, but you already have the hashes. Option C is wrong because Microsoft Store for Business is deprecated. Option D is wrong because Windows Configuration Designer is for provisioning packages, not Autopilot registration.

Answer

Use the Microsoft Store for Business to automatically register devices

Answer

Contact the OEM to register the devices using the device serial numbers

Answer

Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a Windows 10 feature update policy to keep devices on a specific version. After deployment, some devices report that the update is not being offered. The devices are not in a maintenance window. What is the most likely cause?

Accepted Answer

Windows Update for Business deferral or pause settings are blocking the update. Option D is correct because feature update policies require that devices are not paused for updates. Option A is wrong because the policy is assigned. Option B is wrong because the devices are not in a maintenance window. Option C is wrong because feature update policies do not require a specific build.

Answer

The devices are running a build that is newer than the target version

Answer

The policy is not assigned to the correct group

Answer

The devices are in a maintenance window that blocks updates

Question 6

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Accepted Answer

Microsoft Defender for Endpoint license assigned to the user or device. Options A and C are correct. A: Microsoft Defender for Endpoint requires a license for each device. C: The macOS device must be enrolled in Intune to receive the configuration profile. Option B is wrong because Microsoft Defender for Endpoint does not require a VPN. Option D is wrong because Microsoft Intune management extension is for Windows only. Option E is wrong because onboarding to Microsoft Defender for Cloud is optional.

Answer

Microsoft Intune management extension installed on the device

Answer

Onboarding to Microsoft Defender for Cloud

Answer

A VPN connection to the corporate network

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a set of Line-of-Business (LOB) apps using the Microsoft Intune Management Extension. Which THREE conditions must be met?

Accepted Answer

The Microsoft Intune Management Extension must be installed on the device. Options B, C, and D are correct. B: The Intune Management Extension is required to deploy PowerShell scripts and Win32 apps. C: The device must be Azure AD joined or hybrid Azure AD joined. D: The device must have connectivity to Intune. Option A is wrong because LOB apps can be deployed to Intune-managed devices without Configuration Manager. Option E is wrong because the management extension runs as SYSTEM, not user context.

Answer

The app must be deployed in user context

Answer

The devices must be co-managed with Microsoft Configuration Manager

Question 8

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Accepted Answer

Request the hardware hash from the device manufacturer (OEM). Options A and D are correct. A: If the device is already running Windows, you can use a PowerShell script to get the hardware hash. D: OEMs can provide the hardware hash during manufacturing. Option B is wrong because the hardware hash is not available in BIOS. Option C is wrong because Windows Configuration Designer does not generate hardware hashes. Option E is wrong because Microsoft Intune can import hardware hashes but not generate them.

Answer

Extract the hardware hash from the device BIOS

Answer

Use Microsoft Intune to generate the hardware hash from the device serial number

Answer

Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

Question 9

You have deployed the compliance policy shown in the exhibit. A Windows 10 device reports as non-compliant. The device has Windows 10 version 21H2 (build 19044.1288), password is set with 8 characters and includes numbers only, firewall is active, Defender is enabled, and BitLocker is on. Which setting is causing non-compliance?

Accepted Answer

passwordRequiredType. Option C is correct because the policy requires 'alphanumeric' password (letters and numbers), but the device uses numbers only. Option A is wrong because the device build 19044.1288 is within the allowed range (19042.0 to 19045.999). Option B is wrong because password length of 8 meets the minimum. Option D is wrong because the firewall is active.

Answer

passwordMinimumLength

Answer

osMinimumVersion

Answer

activeFirewallRequired

Question 10

Refer to the exhibit. You run the PowerShell cmdlet shown and get the output. You need to investigate why Laptop-02 is non-compliant. Which additional cmdlet should you run to get the non-compliance reasons?

Accepted Answer

Get-MgDeviceManagementManagedDeviceCompliancePolicyState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc. Option B is correct because Get-MgDeviceManagementManagedDeviceCompliancePolicyState retrieves the compliance policy state and reasons for each device. Option A is wrong because Get-MgDeviceManagementDeviceConfigurationState gets device configuration states, not compliance reasons. Option C is wrong because Get-MgDeviceManagementManagedDeviceConfigurationState gets configuration state. Option D is wrong because Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary summarizes settings, not per-device reasons.

Answer

Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -DeviceCompliancePolicyId <id>

Answer

Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Answer

Get-MgDeviceManagementDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Question 11

Refer to the exhibit. You configure an Enrollment Status Page (ESP) policy as shown. During Windows Autopilot deployment, a device fails to install one of the required apps. What happens to the device?

Accepted Answer

The device blocks use and the user cannot proceed. Option D is correct because 'allowDeviceUseOnInstallFailure' is set to false, so the device will block use on install failure. Additionally, 'allowDeviceResetOnInstallFailure' is false, so the device will not reset. 'blockDeviceSetupRetryByUser' is true, so the user cannot retry. Option A is wrong because the user cannot retry. Option B is wrong because the device will not reset. Option C is wrong because the user cannot skip.

Answer

The device automatically resets and retries

Answer

The user can skip the installation and use the device

Answer

The user can retry the installation

Question 12

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

Accepted Answer

Create an Autopilot deployment profile with 'Assign to' set to 'All devices' and ensure the device is registered in Autopilot.. Option A is correct because the Enrollment Status Page (ESP) is not required for enrollment; Autopilot profile with Intune enrollment is the key. Option B is incorrect because the ESP is a separate configuration. Option C is incorrect because Azure AD hybrid join is not required for Autopilot. Option D is incorrect because for new devices, the Autopilot profile triggers enrollment.

Answer

Join the device to Azure AD hybrid by configuring a domain join profile.

Answer

Configure the Enrollment Status Page (ESP) to require device enrollment.

Answer

Manually add the device serial number to Intune via the admin center.

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Mail app that is required for corporate email. What configuration should you apply?

Accepted Answer

Configure a Managed App Configuration with the key 'preventManagedAppRemoval' set to true.. Option B is correct because a Managed App Configuration with the 'preventManagedAppRemoval' key prevents removal. Option A is incorrect because the Mail app is removed and reinstalled, not prevented. Option C is incorrect because app protection policies apply to data, not app removal. Option D is incorrect because MDM restrictions can hide apps but not prevent uninstall by users if they have permission.

Answer

Deploy the Mail app as a required volume-purchased app using Apple Business Manager.

Answer

Set a device restriction policy to hide the Mail app from the home screen.

Answer

Assign an app protection policy that blocks the removal of corporate data.

Question 14

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

Accepted Answer

The device has a non-compliant component that prevents policy application.. Option D is correct because a non-compliant component can cause the device to show 'Not evaluated' if the policy is not applied. Option A is incorrect because a valid token is required for enrollment; if it were expired, the device would not be enrolled. Option B is incorrect because the Intune management extension handles Win32 apps, not compliance policies. Option C is incorrect because a certificate profile is not required for compliance evaluation.

Answer

The device does not have a valid certificate profile.

Answer

The Intune Management Extension is not installed.

Answer

The device's enrollment token has expired.

Question 15

Your organization is implementing Microsoft Entra ID join for Windows devices. You need to ensure that when users sign in with their Microsoft Entra ID credentials, they automatically get access to company resources without additional authentication. Which feature should you enable?

Accepted Answer

Primary Refresh Token (PRT). Option C is correct because Microsoft Entra ID joined devices use Primary Refresh Token (PRT) for SSO. Option A is incorrect because Windows Hello for Business provides passwordless sign-in but is not required for automatic resource access. Option B is incorrect because Conditional Access policies control access, not automatic authentication. Option D is incorrect because device compliance policies are for compliance, not SSO.

Answer

Device compliance policies

Answer

Windows Hello for Business

Answer

Conditional Access policies