MD-102 Prepare infrastructure for devices Practice Test 7 — 15 Questions

Question 1

You are troubleshooting a Windows 10 device that fails to install a required application from Microsoft Intune. The device shows the application as 'Enforced' but never installs. The application is a line-of-business (LOB) app. What should you check first?

Accepted Answer

Check if the application package has a valid code signing certificate.. Option A is correct because LOB apps require a valid code signing certificate. Option B is incorrect because the Intune Management Extension handles Win32 apps, not LOB apps. Option C is incorrect because LOB apps do not require a specific distribution method. Option D is incorrect because the app may not be in the catalog but can still be uploaded.

Answer

Ensure the app is assigned to a device group using 'Required' intent.

Answer

Verify that the Intune Management Extension is installed on the device.

Answer

Check if the app is available in the Microsoft Store for Business.

Question 2

Your organization uses Microsoft Intune to manage macOS devices. You need to configure FileVault disk encryption for all devices. After deploying the policy, some devices report that encryption is pending. What is the most likely reason?

Accepted Answer

The user has not approved the recovery key escrow.. Option B is correct because FileVault encryption requires the user to approve the recovery key escrow. Option A is incorrect because macOS devices can be encrypted via Intune. Option C is incorrect because user enrollment does not affect FileVault policy applicability. Option D is incorrect because a PIN is not required for FileVault; it uses a password.

Answer

The devices are enrolled using user enrollment.

Answer

The devices require a PIN to be set for recovery.

Answer

The devices are not supervised.

Question 3

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

Accepted Answer

Set 'Enable Windows Hello for Business' in the Autopilot profile.. Option A is correct because Autopilot profiles have settings for Windows Hello for Business. Option B is incorrect because the Enrollment Status Page does not configure Hello. Option C is incorrect because a separate policy is not required; it can be set in the profile. Option D is incorrect because Azure AD join is a prerequisite, not a configuration for Hello.

Answer

Ensure the device is Azure AD joined.

Answer

Create a separate Windows Hello for Business policy and assign it to the device group.

Answer

Configure the Enrollment Status Page to show Hello setup.

Question 4

A user has an Android Enterprise fully managed device. The device is enrolled in Microsoft Intune and all policies are applied. However, the user cannot install a required app from the managed Play Store. The app appears in the company portal but fails to install. What should you check first?

Accepted Answer

Verify that the app has been approved in the managed Google Play store.. Option B is correct because managed Play Store apps require approval. Option A is incorrect unless the app is not available in the managed store. Option C is incorrect because enrollment token is for enrollment, not app installation. Option D is incorrect because unapproved apps are not blocked by default.

Answer

Ensure that the device has a policy to allow installation of unapproved apps.

Answer

Check if the device's enrollment token is still valid.

Answer

Check if the app is available in the unmanaged Play Store.

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 feature update using the Windows 10 Update Rings feature. However, the deployment fails and devices show error 0x800f0905. What is the most likely cause?

Accepted Answer

The feature update package is missing prerequisite updates.. Option A is correct because error 0x800f0905 indicates missing installation files. Option B is incorrect because the update ring does not include language settings. Option C is incorrect because a maintenance window does not cause this error. Option D is incorrect because disk space would cause a different error.

Answer

The device does not have enough free disk space.

Answer

The device is not set to the correct language for the update.

Answer

The update ring is configured with a maintenance window that is too short.

Question 6

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Accepted Answer

An on-premises Active Directory environment.. Options B and D are correct. Group Policy enrollment requires an on-premises AD and automatic enrollment via GPO. Option A is not required because hybrid join is not mandatory. Option C is incorrect because Azure AD Connect is needed for hybrid join but not for pure AD enrollment. Option E is incorrect because Intune subscription is required, but the question asks for prerequisites for Group Policy enrollment, which includes automatic enrollment policy.

Answer

A Microsoft Intune subscription must be active.

Answer

Azure AD Connect must be configured.

Answer

Devices must be Azure AD hybrid joined.

Question 7

You are configuring Microsoft Intune device compliance policies for Windows 10. Which THREE settings can be evaluated by compliance policies? (Choose three.)

Accepted Answer

Minimum OS version. Options A, B, and E are correct. Compliance policies can evaluate threat level, OS version, and password settings. Option C is incorrect because BitLocker is evaluated by device configuration policies, not compliance. Option D is incorrect because firewall status is a configuration policy, not typically a compliance setting.

Answer

Windows Firewall status

Answer

BitLocker encryption status

Question 8

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy an app that requires a VPN configuration when the app is launched. Which TWO options can you use to achieve this? (Choose two.)

Accepted Answer

Use a managed app configuration to include VPN settings.. Options B and C are correct. A per-app VPN profile can be assigned to the app, or a managed app configuration can include VPN settings. Option A is incorrect because device-wide VPN does not restrict to specific apps. Option D is incorrect because app protection policies do not manage VPN. Option E is incorrect because device compliance does not include VPN configuration.

Answer

Use a device compliance policy to require VPN.

Answer

Assign an app protection policy that enables VPN.

Answer

Create a device-wide VPN configuration profile.

Question 9

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

Accepted Answer

Ensure the password includes characters from at least 3 character sets.. Option C is correct because passwordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers. Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Answer

Increase passwordMinimumLength to 10.

Answer

Set passwordExpirationDays to 0 to never expire.

Answer

Set passwordRequiredType to 'alphanumeric' (it is already set).

Question 10

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

Accepted Answer

The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.. Option D is correct because 'Show recovery key: Not configured' means the user is not prompted to escrow the key. Option A is incorrect because encryption is enabled. Option B is incorrect because rotation is enabled. Option C is incorrect because the key type is personal.

Answer

FileVault encryption is not enabled on the device.

Answer

The recovery key type should be 'Institutional recovery key'.

Answer

Personal recovery key rotation is enabled, causing a conflict.

Question 11

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

Accepted Answer

The device has not been successfully registered in Windows Autopilot.. Option A is correct because 'NotRegistered' indicates the device is not properly registered in Autopilot. Option B is incorrect because if the profile were not assigned, it would show 'NotAssigned' but still registered. Option C is incorrect because the diagnostics show registration status. Option D is incorrect because the device can still be registered even if it has been imaged.

Answer

The Autopilot profile is not assigned to the device group.

Answer

The device was previously manually imaged.

Answer

The device is not connected to the internet during OOBE.

Question 12

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

Accepted Answer

The devices must be registered in Microsoft Intune via the hardware vendor or manually.. Option A is correct because Autopilot requires the device to be registered in Microsoft Intune (or Entra ID) before it can be automatically enrolled. Option B is wrong because a local admin account is not required. Option C is wrong because a hybrid join configuration is optional. Option D is wrong because BitLocker is not a prerequisite for enrollment.

Answer

The organization must have a hybrid Azure AD join configuration in place.

Answer

BitLocker must be enabled on the devices before they are shipped.

Answer

A local administrator account must be created on each device prior to deployment.

Question 13

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

Accepted Answer

The device has not checked in for more than 7 days, causing Intune to mark it as inactive.. Option C is correct because if the device has not checked in for more than 7 days, it may be considered inactive and policies won't be delivered. Option A is wrong because a VPN can still allow check-in if internet is available. Option B is wrong because the enrollment was successful. Option D is wrong because the Intune connector is for on-premises scenarios.

Answer

The device is connected through a VPN that blocks Intune traffic.

Answer

The device has been unenrolled from Intune.

Answer

The Intune Connector for Active Directory is not configured.

Question 14

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

Accepted Answer

Client apps. Option B is correct because the 'Client apps' workload enables automatic enrollment to Intune. Option A is wrong because 'Windows Update policies' is for update management. Option C is wrong because 'Endpoint Protection' is separate. Option D is wrong because 'Resource access' is not the correct workload.

Answer

Endpoint Protection

Answer

Windows Update policies

Answer

Resource access

Question 15

A company uses Microsoft Intune to manage iOS devices. They need to ensure that only devices with a passcode of at least 6 characters can access corporate email. Which type of policy should they create?

Accepted Answer

Device compliance policy. Option A is correct because device compliance policies enforce security requirements like passcode length. Option B is wrong because configuration policies set settings but don't enforce compliance. Option C is wrong because app protection policies target app-level protection. Option D is wrong because enrollment restrictions control device types.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy