MD-102 Prepare infrastructure for devices Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Accepted Answer

Endpoint protection. 'Endpoint protection' profiles include FileVault settings for macOS. Option A is incorrect because 'Custom' profiles are used for importing custom settings, not for encryption. Option C is incorrect because 'Device restrictions' contain general restrictions but not FileVault. Option D is incorrect because 'Device features' include settings like wallpaper and lock screen, not encryption.

Answer

Custom

Answer

Device restrictions

Answer

Device features

Question 2

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

Accepted Answer

Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center. Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center is the standard method to register devices for Windows Autopilot. Option A is incorrect because the Microsoft Store for Business is deprecated and no longer supports Autopilot registration. Option B is incorrect because while OEMs can register devices, you already have the hardware hashes, making direct upload more efficient. Option C is incorrect because Windows Configuration Designer is used to create provisioning packages for manual setup, not for Autopilot device registration.

Answer

Use the Microsoft Store for Business to automatically register devices

Answer

Contact the OEM to register the devices using the device serial numbers

Answer

Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings

Question 3

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Update for Business deferral or pause settings are blocking the update. The most likely cause is that Windows Update for Business deferral or pause settings are blocking the update. Feature update policies in Intune rely on Windows Update for Business to deliver updates. If a device has deferral periods set (e.g., for quality or feature updates) or has updates paused, the policy will not apply until those settings are cleared. Options A and D are incorrect: a newer build does not prevent the policy from targeting, and devices not in a maintenance window would still receive updates. Option C is possible but less likely, as the policy assignment would typically be verified before deployment.

Answer

The devices are running a build that is newer than the target version

Answer

The policy is not assigned to the correct group

Answer

The devices are in a maintenance window that blocks updates

Question 4

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Accepted Answer

Microsoft Defender for Endpoint license assigned to the user or device. The correct prerequisites are: A and B. For A: Microsoft Defender for Endpoint requires a valid license assigned to the user or device. For B: The macOS device must be enrolled in Microsoft Intune to receive the configuration profile and policies for Defender. Option C is incorrect because the Microsoft Intune management extension is for Windows only, not macOS. Option D is incorrect because onboarding to Microsoft Defender for Cloud is not a prerequisite; Defender for Endpoint can be deployed independently. Option E is incorrect because a VPN connection is not required for Defender for Endpoint to function on macOS.

Answer

Microsoft Intune management extension installed on the device

Answer

Onboarding to Microsoft Defender for Cloud

Answer

A VPN connection to the corporate network

Question 5

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Microsoft Intune Management Extension must be installed on the device. The correct options are B, C, and E. B: The Intune Management Extension must be installed on the device to deploy LOB apps. C: The device must have connectivity to Microsoft Intune for the management extension to communicate. E: The device must be Azure AD joined or hybrid Azure AD joined to support Intune management. Option A is incorrect because the app is deployed in system context, not user context. Option D is incorrect because co-management with Configuration Manager is not required for deploying LOB apps via Intune Management Extension.

Answer

The app must be deployed in user context

Answer

The devices must be co-managed with Microsoft Configuration Manager

Question 6

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Accepted Answer

Request the hardware hash from the device manufacturer (OEM). OEMs can provide the hardware hash for devices they manufacture, which can be uploaded to Microsoft Intune or the Autopilot deployment service. This method is commonly used for new devices ordered directly from the manufacturer, as the hash is generated during the manufacturing process and included in the device's packaging or accessible via the OEM's portal.

Answer

Extract the hardware hash from the device BIOS

Answer

Use Microsoft Intune to generate the hardware hash from the device serial number

Answer

Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

Question 7

You have deployed the compliance policy shown in the exhibit. A Windows 10 device reports as non-compliant. The device has Windows 10 version 21H2 (build 19044.1288), password is set with 8 characters and includes numbers only, firewall is active, Defender is enabled, and BitLocker is on. Which setting is causing non-compliance?

Accepted Answer

passwordRequiredType. The compliance policy requires an alphanumeric password (letters and numbers), but the device uses a password with numbers only. Option A is incorrect because a password length of 8 meets the minimum length requirement. Option C is incorrect because the device's OS build (19044.1288) falls within the allowed range (19042.0 to 19045.999). Option D is incorrect because the firewall is active.

Answer

passwordMinimumLength

Answer

osMinimumVersion

Answer

activeFirewallRequired

Question 8

Refer to the exhibit. You run the PowerShell cmdlet shown and get the output. You need to investigate why Laptop-02 is non-compliant. Which additional cmdlet should you run to get the non-compliance reasons?

Accepted Answer

Get-MgDeviceManagementManagedDeviceCompliancePolicyState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc. Get-MgDeviceManagementManagedDeviceCompliancePolicyState retrieves the compliance policy state for a specific managed device, including the non-compliance reasons. This cmdlet returns compliance policy state details per device, which allows you to investigate why Laptop-02 is non-compliant. Option B is incorrect because Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary provides a summary of settings across devices, not per-device reasons. Option C is incorrect because Get-MgDeviceManagementManagedDeviceConfigurationState retrieves device configuration state, not compliance policy state. Option D is incorrect because Get-MgDeviceManagementDeviceConfigurationState retrieves device configuration state, not compliance reasons.

Answer

Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -DeviceCompliancePolicyId <id>

Answer

Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Answer

Get-MgDeviceManagementDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Question 9

Refer to the exhibit. You configure an Enrollment Status Page (ESP) policy as shown. During Windows Autopilot deployment, a device fails to install one of the required apps. What happens to the device?

Accepted Answer

The device blocks use and the user cannot proceed. The Enrollment Status Page (ESP) policy is configured with the 'Show error when installation takes longer than specified number of minutes' option set to 'Block device use until all required apps and profiles are installed.' When a required app fails to install, the ESP enters an error state and, because the policy is set to block use, the device remains locked at the ESP screen, preventing the user from proceeding to the desktop. This behavior is enforced by the Autopilot client, which monitors the installation status of required apps and profiles and will not allow the user to bypass the ESP until all required items are successfully installed or the timeout is reached.

Answer

The device automatically resets and retries

Answer

The user can skip the installation and use the device

Answer

The user can retry the installation

Question 10

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

Accepted Answer

Create an Autopilot deployment profile with 'Assign to' set to 'All devices' and ensure the device is registered in Autopilot.. Windows Autopilot requires both a registered device (identified by hardware hash) and an assigned deployment profile to trigger automatic enrollment in Microsoft Intune during the first power-on. Setting 'Assign to' to 'All devices' ensures the profile applies to any registered Autopilot device, and the device registration step links the hardware identity to your tenant. Without this combination, the device will not automatically enroll.

Answer

Join the device to Azure AD hybrid by configuring a domain join profile.

Answer

Configure the Enrollment Status Page (ESP) to require device enrollment.

Answer

Manually add the device serial number to Intune via the admin center.

Question 11

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Managed App Configuration with the key 'preventManagedAppRemoval' set to true.. A Managed App Configuration with the 'preventManagedAppRemoval' key set to true prevents users from removing the Mail app from their device. Option A is incorrect because deploying the Mail app as a required volume-purchased app via Apple Business Manager only ensures the app is installed but does not prevent users from deleting it. Option C is incorrect because hiding the Mail app from the home screen does not prevent uninstall; it only removes the icon. Option D is incorrect because an app protection policy that blocks removal of corporate data applies to data within the app, not to the app itself.

Answer

Deploy the Mail app as a required volume-purchased app using Apple Business Manager.

Answer

Set a device restriction policy to hide the Mail app from the home screen.

Answer

Assign an app protection policy that blocks the removal of corporate data.

Question 12

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

Accepted Answer

The device has a non-compliant component that prevents policy application.. A non-compliant component (e.g., an outdated OS version, missing required app, or misconfigured setting) can cause the device to be marked as 'Not evaluated' if the compliance policy cannot be processed. The device is enrolled but the policy engine fails to evaluate compliance due to an underlying issue. Option A is incorrect: Certificate profiles are used for resource access, not for compliance evaluation. Option B is incorrect: The Intune Management Extension is for deploying Win32 apps and PowerShell scripts, not for compliance policies. Option D is incorrect: Enrollment tokens are used for enrollment; if expired, the device would not be enrolled at all.

Answer

The device does not have a valid certificate profile.

Answer

The Intune Management Extension is not installed.

Answer

The device's enrollment token has expired.

Question 13

Your organization is implementing Microsoft Entra ID join for Windows devices. You need to ensure that when users sign in with their Microsoft Entra ID credentials, they automatically get access to company resources without additional authentication. Which feature should you enable?

Accepted Answer

Primary Refresh Token (PRT). Primary Refresh Tokens (PRTs) are used on Microsoft Entra ID joined devices to enable single sign-on (SSO). When a user signs in with their Microsoft Entra ID credentials, the PRT is cached and automatically used to authenticate against company resources without prompting for credentials again. Option A is incorrect because device compliance policies enforce security requirements but do not handle authentication. Option B is incorrect because Windows Hello for Business provides passwordless sign-in but is not required for automatic resource access. Option C is incorrect because Conditional Access policies evaluate access conditions but do not provide automatic authentication.

Answer

Device compliance policies

Answer

Windows Hello for Business

Answer

Conditional Access policies

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user has not approved the recovery key escrow.. For FileVault encryption via Intune, the user must approve the escrow of the personal recovery key. If the user has not approved it, encryption may remain pending. Option B is incorrect: user enrollment does support FileVault policy, as long as the device is managed. Option C is incorrect: FileVault does not require a PIN; it uses a password set during encryption. Option D is incorrect: FileVault encryption is available on both supervised and unsupervised macOS devices when managed by Intune.

Answer

The devices are enrolled using user enrollment.

Answer

The devices require a PIN to be set for recovery.

Answer

The devices are not supervised.

Question 15

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

Accepted Answer

Set 'Enable Windows Hello for Business' in the Autopilot profile.. The Windows Autopilot profile includes a setting called 'Enable Windows Hello for Business' that, when enabled, automatically configures the device to prompt the user to set up Windows Hello for Business during the out-of-box experience (OOBE). This setting is part of the Autopilot profile itself and does not require a separate policy or additional configuration to trigger the Hello setup prompt.

Answer

Ensure the device is Azure AD joined.

Answer

Create a separate Windows Hello for Business policy and assign it to the device group.

Answer

Configure the Enrollment Status Page to show Hello setup.