MD-102 Prepare infrastructure for devices Practice Test 6 — 15 Questions

Question 1

Your organization is planning to deploy Windows 11 to 5000 devices using Microsoft Intune. The devices are currently a mix of Windows 10 and Windows 11 eligible hardware. You need to ensure that only devices meeting the Windows 11 hardware requirements can be upgraded. What is the most efficient way to achieve this using Intune?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Windows feature update profile targeting Windows 11 and assign it to all devices; Intune will automatically skip ineligible devices.. A Windows feature update profile in Intune automatically checks device hardware eligibility before applying the Windows 11 upgrade. Intune queries the Windows Update for Business service, which evaluates TPM 2.0, Secure Boot, CPU generation, and RAM requirements; devices that do not meet the minimum hardware requirements are skipped without any manual intervention or additional configuration.

Answer

Use Windows Autopilot to reset each device and manually verify hardware compatibility.

Answer

Create a dynamic device group based on TPM version and assign a Windows 10 update ring to non-compliant devices.

Answer

Create a compliance policy requiring TPM 2.0 and Secure Boot, then assign a Windows 11 update ring to compliant devices.

Question 2

You manage devices with Microsoft Intune. Some Windows devices are not receiving required security updates despite being assigned to an update ring for Windows 10. You verify that the devices are active and connected to the internet. What is the most likely cause?

Accepted Answer

The update ring has a deferral period configured that delays updates for 30 days.. The most likely cause is that the update ring has a deferral period configured that delays updates for 30 days. In Microsoft Intune, update rings for Windows 10 allow administrators to set deferral periods for quality and feature updates. A deferral period of 30 days means that even if the device is active and connected, it will not install the update until the specified number of days after Microsoft releases it. This explains why the devices are not receiving the updates despite being compliant and online.

Answer

The devices have a compliance policy requiring a specific version that is not yet met.

Answer

The devices are not connected to a corporate VPN.

Answer

Delivery Optimization is disabled on the devices.

Question 3

You are configuring Windows Autopilot for new devices. The devices need to be automatically enrolled in Intune and assigned to a specific group based on their serial number. What is the required step before the devices can be recognized by Autopilot?

Accepted Answer

Register the devices using their hardware hash in the Microsoft Intune admin center.. Before Windows Autopilot can recognize and automatically enroll devices, they must be registered as Autopilot devices. This is done by uploading their hardware hash (a unique identifier derived from the device's TPM and other hardware) into the Microsoft Intune admin center. Once registered, the device is associated with an Autopilot profile and can be automatically enrolled in Intune and assigned to a group based on its serial number during the out-of-box experience.

Answer

Configure Intune enrollment for all users using device enrollment managers.

Answer

Join the devices to Microsoft Entra ID manually before shipping.

Answer

Upload a CSV file with device serial numbers to Microsoft Entra ID.

Question 4

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

Accepted Answer

The devices have TPM version 1.2 instead of 2.0.. The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Answer

The devices are not joined to Microsoft Entra ID.

Answer

The BitLocker policy is configured only for Windows 11 Enterprise devices.

Answer

The devices are running Windows 10 instead of Windows 11.

Question 5

Which TWO actions should you take to prepare infrastructure for devices running macOS in your organization? (Select two.)

Accepted Answer

Deploy the Company Portal app to macOS devices.. The Company Portal app is the primary interface for users to enroll macOS devices in Microsoft Intune, access corporate resources, and manage compliance. Deploying it ensures users can initiate enrollment and receive policies. Option B is correct because enrolling macOS devices in Intune is the foundational step to apply management policies, deploy apps, and enforce compliance settings via MDM.

Answer

Configure Windows Autopilot for macOS devices.

Answer

Join macOS devices to Microsoft Entra ID.

Answer

Use Group Policy to manage macOS settings.

Question 6

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

Accepted Answer

The OS build is greater than the maximum version specified.. The policy defines the maximum OS version as 10.0.22621.0 (Windows 10 22H2), but the device is running a build that exceeds this maximum. Although the device build is 22621, the policy may interpret the build range as exclusive, or the device has a newer build (e.g., 22631) that is greater than the maximum. In either case, the OS build is greater than the allowed maximum, causing non-compliance. Option A is incorrect because the validOperatingSystemBuildRanges property is not the issue. Option C is incorrect because the build is not less than the minimum version. Option D is incorrect because the policy does not require a password.

Answer

The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.

Answer

The OS build is less than the minimum version.

Answer

The policy requires a password but the devices have no password.

Question 7

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

Accepted Answer

Quality updates are paused until March 15, 2025.. The JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Answer

The quality update deferral of 7 days has not yet elapsed since the last update.

Answer

The quality update pause has expired, but quality updates are still blocked.

Answer

Feature updates are deferred for 30 days, preventing all updates.

Question 8

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can access company resources, while allowing users to enroll personal devices for limited access. You plan to use enrollment restrictions and compliance policies. What should you configure?

Accepted Answer

Set enrollment device platform restrictions to block personally owned devices, and create a compliance policy to mark personal devices as noncompliant.. Enrollment device platform restrictions can block personally owned devices from enrolling, while a compliance policy can mark personal devices that do enroll as noncompliant. This combination ensures corporate-owned devices get full access, and personal devices are either blocked or flagged for limited access via conditional access policies.

Answer

Configure enrollment restrictions to block all devices from enrolling.

Answer

Configure a compliance policy that requires devices to be corporate-owned.

Answer

Create a conditional access policy that requires devices to be marked as compliant.

Question 9

You are troubleshooting an issue where users report that they cannot install required line-of-business (LOB) apps from Microsoft Intune Company Portal on their Windows 10 devices. The apps are assigned as 'Required' to a dynamic device group. You verify that the devices are enrolled and compliant. What is the most likely cause of the failure?

Accepted Answer

The dynamic device group is not updating membership correctly.. For required LOB apps assigned to a dynamic device group, the device must be a member of the group to receive the app assignment. If the dynamic group membership is not updating correctly, the device may be excluded, and the app will not be pushed or become available in Company Portal. Despite enrollment and compliance, without correct group membership, the app cannot be installed. Option C is incorrect because Intune installs required apps using the system account, so local administrator privileges are not necessary for the installation itself.

Answer

The apps are not published in the Company Portal.

Answer

The user is not a local administrator on the device.

Answer

The enrollment restrictions block installation of LOB apps.

Question 10

You are designing a Windows Autopilot deployment for a new fleet of devices. The devices will be shipped directly to users from the vendor. You need to ensure that the devices automatically enroll in Microsoft Intune and receive a standard set of applications during the out-of-box experience (OOBE). Which Autopilot deployment profile should you assign?

Accepted Answer

User-Driven mode (Azure AD joined) with user-assigned apps.. User-Driven mode with Microsoft Entra ID joined and user-assigned apps is correct because the devices are shipped directly to users, who will perform the OOBE themselves. This mode requires a user to sign in with Microsoft Entra ID credentials, which triggers automatic enrollment in Microsoft Intune and applies the assigned user-targeted apps during the enrollment process.

Answer

Pre-provisioning (White Glove) mode with device-assigned apps.

Answer

Self-Deploying mode (Azure AD registered) with device-assigned apps.

Answer

Self-Deploying mode (Azure AD joined) with user-assigned apps.

Question 11

You need to deploy a custom Windows 10 image to 100 new devices using Microsoft Intune. The devices are not yet enrolled. Which method should you use to deploy the image and enroll the devices?

Accepted Answer

Use Windows Autopilot to deploy a custom image and automatically enroll the devices.. Windows Autopilot is the modern, cloud-native deployment method in Microsoft Intune that allows you to deploy a custom Windows 10 image (via the Autopilot deployment profile and a customized OOBE) and automatically enroll devices into Intune without any on-premises infrastructure. It leverages the device's hardware hash to identify and target the device, then applies a deployment profile that configures the out-of-box experience and joins the device to Microsoft Entra ID (or Hybrid Microsoft Entra ID), which triggers automatic Intune enrollment. This method scales to 100 devices with minimal manual intervention, unlike PXE or USB approaches that require physical access and additional infrastructure.

Answer

Use PXE boot to deploy the image and then enroll via a provisioning package.

Answer

Create a bootable USB with the image and manually enroll each device.

Answer

Use Microsoft Configuration Manager to deploy the image and enroll via co-management.

Question 12

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

Accepted Answer

The enrollment restrictions are set to block personally owned devices.. The error 'This device is not allowed to enroll' typically occurs when enrollment restrictions block the device type or ownership. In this scenario, although iOS enrollment is allowed, the restriction likely blocks personally owned devices. If users are trying to enroll personal iOS devices, the restriction preventing personally owned devices would cause this error. Option A is incorrect because a conditional access policy requiring compliant devices blocks access to resources after enrollment, not the enrollment itself. Option B is incorrect because the Apple MDM push certificate is required for Intune to communicate with iOS devices, but a missing certificate would cause a different error related to certificate setup. Option D is incorrect because terms of use appear after the enrollment attempt and would not prevent the initial enrollment.

Answer

A conditional access policy requires compliant devices.

Answer

The Apple MDM push certificate is not configured.

Answer

The users have not accepted the terms of use.

Question 13

You need to configure Windows 10 devices to automatically encrypt their drives using BitLocker when they enroll in Microsoft Intune. You have created a BitLocker policy in Endpoint Security. However, after enrollment, some devices are not encrypted. You verify that the devices have a TPM 2.0 and meet hardware requirements. What is the most likely reason for the failure?

Accepted Answer

The BitLocker policy does not require a recovery password to be saved to Azure AD.. BitLocker requires a recovery key to be escrowed to Microsoft Entra ID before encryption can proceed when managed via Intune. If the policy does not mandate saving the recovery password to Microsoft Entra ID, the encryption process will fail silently on devices that meet all hardware prerequisites, including TPM 2.0. This is a common configuration oversight in Endpoint Security BitLocker policies.

Answer

The devices do not have Secure Boot enabled.

Answer

The TPM is not enabled in the BIOS.

Answer

The devices are not compliant with the BitLocker compliance policy.

Question 14

You need to manage updates for Windows 10 devices using Microsoft Intune. You want to ensure that critical security updates are installed within 7 days of release, while feature updates are deferred for 60 days. Which approach should you use?

Accepted Answer

Create a Windows update ring policy with quality update deferral set to 7 days and feature update deferral set to 60 days.. Windows update ring policies in Microsoft Intune allow granular control over both quality (security) and feature update deferral periods. Setting quality update deferral to 7 days ensures critical security patches are installed within a week, while feature update deferral of 60 days delays non-security feature updates. This directly meets the requirement without additional profiles or compliance policies.

Answer

Create a Windows feature update profile to deploy the latest feature update after 60 days.

Answer

Create a device compliance policy requiring devices to install updates within 7 days.

Answer

Configure Windows Update for Business settings via a configuration profile.

Question 15

You need to configure device compliance policies in Microsoft Intune for Windows 10 devices. Which THREE settings can you include in a compliance policy? (Choose three.)

Accepted Answer

Require BitLocker.. Option A (Require BitLocker) is correct because Intune Windows 10/11 compliance policies include a Device Health setting that requires BitLocker drive encryption to be enabled, and devices without it are marked noncompliant. Option B (Maximum OS version) is correct because compliance policies support OS version rules with both a minimum and a maximum allowed version, so you can block devices running versions newer than the permitted build. Option E (Minimum OS version) is correct because the same OS version rule enforces a minimum acceptable Windows build, marking older, unsupported versions noncompliant. Option C (Allow camera) is not a compliance setting; restricting hardware like the camera is done through device configuration profiles or app protection/restriction policies, not compliance. Option D (Require a password to unlock the device) is not a Windows 10 compliance setting; password requirements in Intune compliance apply to platforms such as Android and iOS/iPadOS, while Windows uses settings like BitLocker, Secure Boot, and code integrity.

Answer

Allow camera.

Answer

Require a password to unlock the device.