MD-102 Prepare infrastructure for devices Practice Test 6 — 15 Questions

Question 1

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a BitLocker policy in Intune that enables key escrow to Azure AD.. Intune's BitLocker policy includes a setting to automatically store recovery keys in Azure AD, which is essential for key escrow. This integration ensures that if a device is lost or stolen, administrators can retrieve the recovery key from Azure AD to access encrypted data or perform a remote wipe. Without this policy, BitLocker keys would not be escrowed to Azure AD even if the device is enrolled in Intune.

Answer

Join devices to on-premises Active Directory.

Answer

Configure a Group Policy to escrow BitLocker keys to Active Directory.

Question 2

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Accepted Answer

Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.. Setting 'Allow personally owned devices' to 'No' in enrollment restrictions explicitly blocks users from enrolling personal devices while still allowing corporate-owned device enrollment. This setting is enforced at the time of enrollment, preventing personal devices from being added to Intune management entirely.

Answer

Create a conditional access policy that blocks devices not marked as corporate.

Answer

Create a conditional access policy that requires compliant devices.

Answer

Create a device compliance policy that marks personal devices as non-compliant.

Question 3

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Accepted Answer

Check that Secure Boot is enabled.. Options A, C, and D are correct. Windows 11 requires TPM 2.0, Secure Boot, and at least 4GB of RAM. Option B is incorrect because the processor must be at least 1 GHz with 2 cores, not 1 core. Option E is incorrect because the storage requirement is at least 64GB, not 32GB.

Answer

Check that the processor is at least 1GHz with 1 core.

Answer

Check that the device has at least 32GB of storage.

Question 4

You are troubleshooting an issue where Windows 10 devices are not receiving policies from Microsoft Intune. The devices are enrolled and show as 'active' in the console. Which THREE steps should you take to diagnose the problem?

Accepted Answer

Verify the last sync time in Intune console.. Options A, D, and E are correct. Verifying the last sync time (A) helps determine if the device has checked in recently and whether policies should have been applied. Re-enrolling the device (D) can resolve enrollment or communication issues by forcing a fresh registration and policy download. Collecting MDM diagnostic logs (E) provides detailed error information from the device side. Option B is unnecessary because the device is already enrolled and active; re-registering in Azure AD would not address policy delivery issues. Option C is not a standard troubleshooting step for Intune policy problems, as Intune uses HTTPS (port 443) which is typically allowed by default firewalls.

Answer

Re-register the device in Azure AD.

Answer

Check the device's local firewall rules for Intune ports.

Question 5

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Accepted Answer

A Microsoft Defender for Endpoint license must be assigned.. A Microsoft Defender for Endpoint license is required because it provides the entitlement to use the Defender for Endpoint service, including its advanced threat protection, endpoint detection and response (EDR), and vulnerability management capabilities. Without this license, the service cannot be provisioned or used, even if the devices are properly enrolled and configured.

Answer

Devices must be joined to Azure AD.

Answer

Devices must have a third-party antivirus uninstalled.

Answer

An Azure AD Premium license must be assigned.

Question 6

Your company is deploying iOS devices using Apple Business Manager and Intune. You need to ensure that devices are automatically configured with Wi-Fi settings, email profiles, and a list of required apps during the initial setup. Which THREE configurations should you create in Intune?

Accepted Answer

A device configuration profile for Wi-Fi settings.. Options A, D, and E are correct. Device configuration profiles (A) can deploy Wi-Fi settings to iOS devices. Device configuration profiles (D) can also deploy email settings. An iOS app configuration policy (E) can be used to require specific apps during enrollment. Option B is incorrect because Windows Configuration Designer provisioning packages are for Windows devices, not iOS. Option C is incorrect because a device compliance policy is for compliance checking, not initial configuration.

Answer

A Windows configuration designer provisioning package.

Answer

A device compliance policy for iOS.

Question 7

You are configuring Windows Information Protection (WIP) in Microsoft Intune. You want to protect corporate data from being accidentally shared to personal locations while still allowing the user to work productively. Which THREE settings should you configure?

Accepted Answer

Define network boundaries (corporate IP ranges, DNS suffixes).. Options C, D, and E are correct. To protect corporate data with Windows Information Protection (WIP) in Intune, you must define network boundaries (C) to identify corporate network locations, configure a data recovery agent certificate (D) to allow encrypted data recovery, and add protected apps (E) that are allowed to access corporate data. Option A is incorrect because WIP is enabled through a Windows Information Protection policy, not a device configuration profile. Option B is incorrect because setting 'Share over' to 'Block' would prevent all sharing, which is not productive; WIP uses data transfer policies to allow controlled sharing.

Answer

Configure a device configuration profile to enable WIP.

Answer

Set the 'Share over' data transfer policy to 'Block'.

Question 8

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

Accepted Answer

In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.. To enable co-management and move the Device configuration workload to Intune, you need to configure co-management in ConfigMgr. This involves enabling co-management, selecting a pilot collection (or all devices), and setting the workload slider for Device configuration to either 'Pilot Intune' or 'Intune' (full migration). This triggers automatic enrollment in Intune via the co-management policy. Option A is incorrect because the Intune connector is not needed for co-management; enrollment happens via ConfigMgr policy. Option B is incorrect because Group Policy for automatic MDM enrollment is not required when using co-management; the enrollment is triggered by ConfigMgr. Option D is incorrect because hybrid Azure AD join alone does not automatically enroll devices into co-management; the ConfigMgr co-management configuration is necessary.

Answer

Install the Intune connector for ConfigMgr and configure the workloads.

Answer

Create a Group Policy that enables automatic MDM enrollment to Intune.

Answer

Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.

Question 9

Your company has 200 iOS devices that are enrolled in Microsoft Intune via Apple Business Manager. The devices are used by field sales representatives who need access to the corporate CRM app and email. You need to ensure that if a device is lost or stolen, the corporate data can be removed without affecting personal data. The devices are configured with user affinity. What should you do?

Accepted Answer

Perform a selective wipe (corporate data removal) from Intune.. Performing a selective wipe (corporate data removal) from Intune removes only corporate data while leaving personal data intact on devices with user affinity. Option A is incorrect because a full wipe removes all data, including personal data. Option B is incorrect because retiring the device removes it from management but does not remove corporate data. Option D is incorrect because a compliance policy marks the device as noncompliant but does not remove data.

Answer

Perform a full wipe on the device from Intune.

Answer

Retire the device from Intune.

Answer

Create a device compliance policy to mark the device as noncompliant.

Question 10

Your organization is deploying Windows 10 devices using Windows Autopilot. The devices are purchased from a vendor and will be shipped directly to users. You need to ensure that the devices are automatically enrolled in Intune and configured with your organization's standard settings as soon as the user turns on the device and connects to the internet. The devices should be Azure AD joined. What is the minimal configuration required?

Accepted Answer

Upload the device's hardware hash to Microsoft Intune.. The hardware hash must be uploaded to Microsoft Intune for Autopilot to automatically recognize the device, enroll it in Intune, and join it to Azure AD upon first boot. Option A is incorrect because vendors cannot pre-configure Autopilot settings; they should provide the hardware hash. Option B is incorrect because the hardware hash is uploaded to Intune, not Azure AD directly. Option C is incorrect because the user should not manually enroll; Autopilot automates the process.

Answer

Ask the vendor to configure the devices with your organization's settings before shipping.

Answer

Upload the device's hardware hash to Azure AD.

Answer

Instruct the user to manually enroll the device after receiving it.

Question 11

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to ensure that devices are enrolled automatically without user interaction and that the enrollment status page (ESP) is configured to block device use until required apps are installed. What should you configure?

Accepted Answer

Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile. Windows Autopilot with self-deploying mode allows zero-touch enrollment, and the Enrollment Status Page (ESP) can be configured to block device use until required apps are installed. Option A is wrong because Group Policy does not provide automatic enrollment into Intune. Option B is wrong because a device enrollment manager (DEM) account is used for bulk enrollment but does not provide automatic zero-touch enrollment. Option D is wrong because co-management with Microsoft Configuration Manager does not provide zero-touch enrollment without additional configuration.

Answer

Configure a Group Policy to auto-enroll devices into Intune

Answer

Configure a device enrollment manager (DEM) account

Answer

Configure co-management with Microsoft Configuration Manager

Question 12

A user reports that their Windows 11 device is not receiving a required security baseline policy from Microsoft Intune. The device appears as compliant in the Microsoft Intune admin center. Other devices in the same group receive the policy. You verify that the policy is assigned to the correct group and that the user is a member. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently or has a policy conflict. The most likely cause is that the device has not checked in with Intune recently or has a policy conflict. Even though the device appears compliant in the admin center, compliance status is based on the last check-in data; if the device hasn't synced recently, it won't receive new or updated policies. Policy conflicts, such as overlapping settings from multiple baselines or configuration profiles, can also prevent a specific security baseline from applying, even when the device is otherwise compliant.

Answer

The user is not a member of the Azure AD group that the policy is assigned to

Answer

The policy is not assigned to any group

Answer

The device is marked as non-compliant and has been blocked

Question 13

Your company deploys Microsoft Defender for Endpoint to Windows devices managed by Microsoft Intune. You need to ensure that all devices send diagnostic data at the 'Optional diagnostic data' level. Which configuration profile type should you use?

Accepted Answer

Device restrictions. The correct configuration profile type is 'Device restrictions' (Option B). In Microsoft Intune, the Device restrictions profile for Windows 10/11 includes the 'Diagnostic data' setting under the General category, which allows you to configure the level of diagnostic data sent to Microsoft, including 'Optional diagnostic data'. Option A (Administrative templates) is used for ADMX-backed policies but is not the simplest method for this specific setting. Option C (Endpoint protection) focuses on security settings like Microsoft Defender Antivirus and does not contain diagnostic data settings. Option D (Custom) could be used but is not the recommended or simplest approach.

Answer

Administrative templates

Answer

Endpoint protection

Answer

Custom

Question 14

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom VPN configuration that uses per-app VPN and certificate-based authentication. The certificate is already deployed via a PKCS certificate profile. However, the VPN connection fails. What is the most likely reason?

Accepted Answer

The per-app VPN profile does not include the app bundle IDs or is not associated with the certificate. Per-app VPN on iOS requires a VPN profile that includes the app identifier list and associates it with the certificate, and the certificate must be properly configured. Option A is wrong because the certificate is already deployed. Option C is wrong because per-app VPN does not require a separate MDM profile for each app. Option D is wrong because the VPN server type is not necessarily the issue.

Answer

The certificate is not trusted by the device

Answer

The VPN profile is not assigned to the correct device group

Answer

The VPN server type is not supported by iOS

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a PowerShell script via Intune management extension to install a legacy application. The script runs successfully on most devices, but fails on devices that have the 'LocalSystem' account disabled. What should you do to resolve the issue?

Accepted Answer

Configure the script to run in the user context by modifying the script settings in Intune. The Intune Management Extension runs PowerShell scripts under the LocalSystem account by default. When this account is disabled, the script cannot execute. Configuring the script to run in the user context (option A) bypasses this dependency by executing the script under the logged-on user's security context, which is still active even if LocalSystem is disabled.

Answer

Change the script to run as the logged-on user using a scheduled task

Answer

Deploy the script using Microsoft Configuration Manager instead

Answer

Re-enable the LocalSystem account on the affected devices