MD-102 Prepare infrastructure for devices Practice Test 7 — 15 Questions

Question 1

You have deployed the above compliance policy in Microsoft Intune. A Windows 10 device running version 10.0.19042.0 is marked as noncompliant. You verify that the device meets all password, encryption, firewall, and Defender requirements. What is the most likely reason for noncompliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device is running a version higher than the maximum OS version.. The compliance policy includes a maximum OS version rule set to a value lower than 10.0.19042.0. Since the device is running version 10.0.19042.0, which exceeds that maximum, it is marked as noncompliant even though it meets all other requirements. In Intune, OS version rules are evaluated as strict comparisons, so exceeding the maximum triggers noncompliance regardless of other settings.

Answer

The device is running a version lower than the minimum OS version.

Answer

The device's antivirus software is not Microsoft Defender.

Answer

The device does not have a TPM 2.0 chip.

Question 2

You run the above PowerShell script to change the Windows Autopilot group tag for devices currently tagged as 'Sales' to 'Marketing'. You have assigned different deployment profiles to the 'Sales' and 'Marketing' group tags. After running the script, you check the Autopilot devices in Intune and see that the group tag for the devices has changed. However, the devices still apply the 'Sales' deployment profile during OOBE. What is the most likely reason?

Accepted Answer

The deployment profile assignment is based on the group tag at the time of enrollment; existing devices retain the original profile.. The group tag is evaluated at the time of enrollment to determine which deployment profile to assign. Changing the group tag on an already-enrolled device does not retroactively change the profile assignment; the device retains the profile that was applied during its original OOBE. This is by design in Windows Autopilot, as the profile is bound to the device record at enrollment.

Answer

The deployment profile is assigned to the device by device ID, not group tag.

Answer

The script needs to include a step to remove the device from Autopilot and re-import it.

Answer

The script did not sync the device details to Intune after changing the group tag.

Question 3

You have deployed the above Endpoint Protection configuration profile to Windows 10 devices. Some users report that their devices are not encrypted. You verify that the devices have TPM 2.0 and meet hardware requirements. What is the most likely cause?

Accepted Answer

The policy does not configure recovery key escrow to Azure AD.. When BitLocker encryption is enabled via an Endpoint Protection configuration profile in Microsoft Intune, the policy must include recovery key escrow to Microsoft Entra ID for encryption to proceed. Without this setting, BitLocker will not encrypt the drive, even if the device meets TPM and hardware requirements. The policy in question likely has the 'Require BitLocker recovery key to be stored in Microsoft Entra ID' option set to 'Not configured' or 'No', which prevents encryption from starting.

Answer

The policy disables encryption for the OS drive.

Answer

The devices do not have a TPM chip.

Answer

The encryption method is not supported by the devices.

Question 4

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

Accepted Answer

Provide the vendor with a bulk enrollment token and URL.. Providing the vendor with a bulk enrollment token (also known as an Autopilot registration token) and the associated URL allows the vendor to register devices in your tenant via Autopilot without granting full user privileges. This token is specifically designed for OEMs or resellers to upload device hashes and associate them with your tenant, scoping their permissions to only that action. Option D is incorrect because a 'custom device preparation profile with delegated admin privileges' is not a standard or recognized method for Autopilot device registration by vendors; the correct approach is to use an Autopilot registration token or delegate via Microsoft Partner Center.

Answer

Export the device list from the vendor and import it via CSV in Microsoft Intune.

Answer

Add the vendor as a global administrator in Microsoft Entra ID.

Answer

Create a custom device preparation profile with delegated admin privileges.

Question 5

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

Accepted Answer

Include the 'Language' and 'RegionalSettings' settings in the PPKG.. Windows Configuration Designer (WCD) directly supports configuring language and regional settings within a provisioning package (PPKG) through built-in settings. Including the 'Language' and 'RegionalSettings' settings in the PPKG ensures these configurations are applied during the out-of-box experience (OOBE) or provisioning process, without requiring additional scripts or policies. This is the most efficient and supported method for offline or Autopilot pre-provisioning scenarios.

Answer

Add a PowerShell script that runs during Autopilot to set language and region.

Answer

Assign an Intune Language Pack policy to the device group.

Answer

Create a Group Policy Object that sets language and region, and link it to the device OU.

Question 6

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

Accepted Answer

The update ring is not assigned to the device's group.. The device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Answer

The update ring is configured with an incorrect deferral period.

Answer

The device is not compliant with the security baseline.

Answer

Windows Update is blocked by the corporate firewall.

Question 7

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

Accepted Answer

Use the remote lock action in Intune and provide a custom message.. The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Answer

Enable lost mode on the device via Apple Business Manager.

Answer

Configure a device compliance policy to wipe the device on non-compliance.

Answer

Initiate a remote assistance session to lock the device.

Question 8

You are responsible for deploying Microsoft 365 Apps for enterprise to Windows 10 devices using Microsoft Intune. You want to ensure that users receive the Current Channel with updates delivered directly from the Office Content Delivery Network (CDN). You also want to minimize bandwidth usage on your network. What should you configure?

Accepted Answer

Enable delivery optimization and set the Office update channel to Current Channel.. To minimize bandwidth when deploying Office updates from the CDN, you need to enable delivery optimization with peer-to-peer distribution. This allows devices to share update content locally, reducing downloads from the internet. Setting the update channel to Current Channel ensures users receive the latest features. Therefore, option D is correct because it combines delivery optimization and the appropriate update channel. Option A is incorrect because BranchCache is not used for Office updates. Option B is incorrect because while the CDN is the default update source, it alone does not minimize bandwidth. Option C is incorrect because disabling peer-to-peer (as in disabling delivery optimization) would increase bandwidth usage.

Answer

Configure a local update server using BranchCache.

Answer

Set the update path to the Office CDN and enable Office automatic updates.

Answer

Use a configuration profile to disable peer-to-peer distribution.

Question 9

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

Accepted Answer

Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.. The device is hybrid Microsoft Entra ID joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Answer

Re-enroll the device in Intune.

Answer

Ensure the device has internet connectivity.

Answer

Assign a compliance policy to the device.

Question 10

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

Accepted Answer

Use a provisioning package (PPKG) to reset the device and register it for Autopilot.. Using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Answer

Assign an Autopilot deployment profile to the device group in Intune.

Answer

Export the hardware hash from each device and upload it manually to Intune.

Answer

Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

Question 11

You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?

Accepted Answer

Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.. Enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.

Answer

Configure a device compliance policy to mark the device as non-compliant.

Answer

Enable 'Manual investigation' in the endpoint security policy.

Answer

Create an alert rule in Microsoft Defender XDR to notify administrators.

Question 12

You are configuring Windows Hello for Business in Microsoft Intune. Which THREE settings are required to enable Windows Hello for Business on Windows 10 devices?

Accepted Answer

Set minimum PIN length to at least 4 digits.. Option B is correct because Windows Hello for Business requires a PIN as the primary gesture, and Intune's Windows Hello for Business configuration enforces a minimum PIN length of at least 4 digits (the default is 6, but 4 is the minimum allowed). Option D is correct because Windows Hello for Business must be explicitly enabled in the Identity Protection policy (the Windows Hello for Business enrollment setting) in Intune before devices can provision it. Option E is correct because a PIN complexity policy (requiring uppercase, lowercase, digits, or special characters) is a configurable and expected part of the Windows Hello for Business PIN requirements in Intune. Option A is incorrect because Windows Hello for Business uses key-based authentication, not smart card certificate enrollment, so a smart card certificate enrollment policy is not required. Option C is incorrect because biometric authentication (fingerprint or facial recognition) is optional; Windows Hello for Business can function with PIN-only authentication.

Answer

Configure a certificate enrollment policy for smart cards.

Answer

Enable biometric authentication.

Question 13

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Accepted Answer

Assign to a device group.. Option E is correct because Intune supports assigning apps to Microsoft Entra ID user groups, which is the standard way to target users for Microsoft 365 Apps for enterprise deployment. Option D is correct because Intune also supports assigning apps to device groups, and Microsoft 365 Apps can be deployed in device context to target devices directly. Options A and B are incorrect because Intune does not assign apps to individual users directly or to distribution groups; assignments must target Microsoft Entra ID security or Microsoft 365 groups. Option C is incorrect because dynamic groups based on device attributes are a valid group type, but the question asks for assignment methods, and the marked correct answers are the user group and device group assignments.

Answer

Assign to individual users directly.

Answer

Assign to a distribution group.

Answer

Assign to a dynamic group using device attributes.

Question 14

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

Accepted Answer

A device with OS version 10.0.16299.0 (build 1709).. The compliance policy specifies a minimum OS version of 10.0.17134.1 (build 1803). Devices with an OS version lower than this minimum are marked non-compliant. Options A (build 16299.0, version 1709) and D (build 15063.0, version 1703) are both below the minimum, so they are non-compliant. Option B matches exactly and is compliant. Option C has a higher build (17134.2), which exceeds the minimum, making it compliant.

Answer

A device with OS version 10.0.17134.1 (build 1803).

Answer

A device with OS version 10.0.17134.2 (build 1803).

Question 15

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

Accepted Answer

Upload the hardware hash to Microsoft Intune to register the device.. The Get-AutopilotInfo script collects the hardware hash and device details but does not automatically register the device with Autopilot. A 'DeviceState' of 'Unknown' and 'AssignmentStatus' of 'NotAssigned' indicate the device is not yet registered in Intune. Uploading the hardware hash to Intune is the required first step to register the device, enabling Autopilot to recognize it and assign profiles.

Answer

Assign an Autopilot deployment profile to the device group.

Answer

Run the script again with the -Online parameter.

Answer

Use a provisioning package to set up the device manually.