MD-102 Prepare infrastructure for devices Practice Test 8 — 15 Questions

Question 1

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

Accepted Answer

Windows Hello for Business. Option C is correct because the 'Windows Hello for Business' setting in the Autopilot profile controls this behavior. Option A is wrong because the 'Language' setting is for locale. Option B is wrong because 'Skip privacy settings' bypasses privacy, not Hello. Option D is wrong because 'Device name template' is for naming.

Answer

Skip privacy settings

Answer

Device name template

Answer

Language (Region)

Question 2

You are troubleshooting a Windows 11 device that fails to enroll in Intune via Group Policy. The device is domain-joined and you have configured the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO. The user has a valid Microsoft 365 license. What is the most likely reason for the failure?

Accepted Answer

The device is not registered in Azure AD.. Option D is correct because the GPO trigger requires the device to be registered in Azure AD; domain-join alone is not enough. Option A is wrong because the user license is present. Option B is wrong because the GPO is correct. Option C is wrong because the service connection point is for SCCM.

Answer

The GPO is not linked to the correct organizational unit.

Answer

The user does not have an Intune license assigned.

Answer

The device does not have a service connection point configured.

Question 3

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

Accepted Answer

Assign the app and configure 'Require device compliance' with a filter for minimum OS version.. Option B is correct because 'Require device compliance' in assignment allows filtering by OS version. Option A is wrong because 'Required' installs to all assigned devices. Option C is wrong because 'Available for enrolled devices' makes it optional. Option D is wrong because 'Uninstall' removes the app.

Answer

Assign the app with 'Uninstall' intent.

Answer

Assign the app as 'Available for enrolled devices' without filters.

Answer

Assign the app as 'Required' to all devices.

Question 4

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

Accepted Answer

Device restrictions configuration policy. Option C is correct because device restrictions include settings to block unknown sources. Option A is wrong because compliance policy checks security, but doesn't block installation. Option B is wrong because app configuration policies configure apps, not device settings. Option D is wrong because enrollment restrictions control enrollment, not app installation.

Answer

Device compliance policy

Answer

App configuration policy

Answer

Enrollment restriction

Question 5

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

Accepted Answer

Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.. Option A is correct because Defender for Endpoint can integrate with Intune to trigger remediation actions. Option B is wrong because Microsoft Sentinel is for SIEM, not automatic remediation. Option C is wrong because Microsoft Purview focuses on compliance. Option D is wrong because Microsoft Foundry is an AI platform.

Answer

Configure a Microsoft Sentinel playbook.

Answer

Configure a Microsoft Foundry AI model.

Answer

Configure a Microsoft Purview data loss prevention policy.

Question 6

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Accepted Answer

TPM 2.0 chip. Options B and C are correct. Self-deploying mode requires a physical TPM 2.0 chip for attestation and network connectivity to Microsoft Intune. Option A is wrong because a user account is not required. Option D is wrong because a product key is not needed. Option E is wrong because a mobile device management (MDM) user affinity is not required.

Answer

A user account with Intune license

Answer

A Windows product key

Answer

MDM user affinity

Question 7

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Accepted Answer

Microsoft Intune tenant. Options A, B, and D are correct. Co-management requires Azure AD (Entra ID) for identity, Intune tenant for enrollment, and Configuration Manager current branch for management. Option C is not required; a service connection point is needed for cloud attach, but not specifically for co-management. Option E is not required; a PKI is optional.

Answer

Service connection point (Cloud Attach)

Answer

Public key infrastructure (PKI) certificates

Question 8

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Accepted Answer

Retain the Autopilot registration. Options B and D are correct. Autopilot reset can remove personal files and apps, and retain the device's Autopilot registration. Option A is wrong because Autopilot reset does not reinstall Windows from scratch; it uses the existing OS. Option C is wrong because it does not remove the device from Intune. Option E is wrong because it does not change the primary user.

Answer

Change the primary user of the device

Answer

Reinstall Windows 11 from scratch

Answer

Remove the device from Microsoft Intune

Question 9

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

Accepted Answer

The policy will block access to the Microsoft Store and Cortana.. Option A is correct because the policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device. Option D is wrong because the policy does not affect app installation from other sources.

Answer

The policy will apply only to the primary user of the device.

Answer

The policy will prevent users from installing apps from outside the Microsoft Store.

Answer

The policy will block the camera on all devices.

Question 10

Refer to the exhibit. An Intune compliance policy JSON for Windows 10 devices. A device with OS version 10.0.19041.1 and no encryption reports as noncompliant. What is the most likely reason?

Accepted Answer

The device does not have BitLocker encryption enabled.. Option B is correct because the policy requires encryption (storageRequireEncryption: true) and the device does not have encryption enabled. Option A is wrong because the OS version is within range. Option C is wrong because password type is deviceDefault which includes PIN. Option D is wrong because the OS version is within range.

Answer

The OS version exceeds the maximum allowed version.

Answer

The password type is set to 'deviceDefault' which does not support numeric PIN.

Answer

The OS version is below the minimum requirement.

Question 11

Refer to the exhibit. An Autopilot device registration JSON. What does the '%RAND:5%' placeholder do?

Accepted Answer

It generates a random 5-character string.. Option C is correct because %RAND:5% generates a random 5-character string to ensure unique device names. Option A is wrong because it's not based on serial. Option B is wrong because it's not the model. Option D is wrong because it's not user-specific.

Answer

It inserts the device's model name.

Answer

It inserts the device's serial number.

Answer

It inserts the user's principal name.

Question 12

Your organization uses Microsoft Intune for device management. You need to ensure that only corporate-owned devices can enroll in Intune. Which configuration should you use?

Accepted Answer

Use Device Enrollment Manager (DEM) accounts to enroll devices.. Option C is correct because Device Enrollment Manager (DEM) accounts allow designated users to enroll corporate-owned devices without the device needing to be pre-registered as corporate. Option A is wrong because enrollment restrictions can block personal devices but do not designate corporate ownership. Option B is wrong because a compliance policy is applied after enrollment. Option D is wrong because device categories are used for grouping, not enrollment control.

Answer

Assign a compliance policy that requires the device to be corporate-owned.

Answer

Create a device category for corporate devices and instruct users to select it during enrollment.

Answer

Configure enrollment restrictions to block personally owned devices.

Question 13

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

Accepted Answer

Obtain the hardware hash from the device manufacturer or reseller.. Option A is correct because the OEM or reseller can upload the hardware hash directly to Intune via the OEM API or Partner Center. Option B is wrong because running a PowerShell script on the device requires it to be powered on, which delays the process. Option C is wrong because Configuration Manager can upload hashes but requires the device to be on the network. Option D is wrong because Microsoft Entra ID does not store hardware hashes.

Answer

Add the device to Microsoft Entra ID before shipping.

Answer

Use Microsoft Configuration Manager to collect the hardware hash.

Answer

Run a PowerShell script on each device to capture the hardware hash.

Question 14

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

Accepted Answer

Set the MDM user scope in Microsoft Entra ID to 'All' or 'Some'.. Option D is correct because Microsoft Entra ID joined devices automatically enroll in Intune when the MDM user scope is set to 'All' or 'Some'. Option A is wrong because the MDM discovery URL is configured automatically for Microsoft Entra ID joined devices. Option B is wrong because enrollment restrictions do not trigger automatic enrollment. Option C is wrong because device compliance policies are applied after enrollment.

Answer

Configure the MDM discovery URL in Microsoft Entra ID.

Answer

Create an enrollment restriction that allows Windows devices.

Answer

Assign a device compliance policy to the user.

Question 15

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

Accepted Answer

The device is not enrolled in Intune.. Option B is correct because if the device is not enrolled in Intune, it cannot receive policies. Option A is wrong because even if the user is not licensed, the device may still enroll but policies may not apply. Option C is wrong because a stale policy would still apply. Option D is wrong because network connectivity affects policy retrieval, not enrollment.

Answer

The user does not have an Intune license assigned.

Answer

The compliance policy is stale and needs to be re-assigned.

Answer

The device has no network connectivity.