MD-102 Prepare infrastructure for devices Practice Test 8 — 15 Questions

Question 1

A user has an Android Enterprise fully managed device. The device is enrolled in Microsoft Intune and all policies are applied. However, the user cannot install a required app from the managed Play Store. The app appears in the company portal but fails to install. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the app has been approved in the managed Google Play store.. The correct first step is to verify that the app has been approved in the managed Google Play store. For Android Enterprise fully managed devices, apps from the managed Play Store must be approved by the IT admin before they can be installed. Even if the app appears in Company Portal, if it is not approved, installation will fail. Therefore, checking approval status is the most likely cause.

Answer

Ensure that the device has a policy to allow installation of unapproved apps.

Answer

Check if the device's enrollment token is still valid.

Answer

Check if the app is available in the unmanaged Play Store.

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 feature update using the Windows 10 Update Rings feature. However, the deployment fails and devices show error 0x800f0905. What is the most likely cause?

Accepted Answer

The feature update package is missing prerequisite updates.. Error 0x800f0905 indicates missing installation files for the feature update. This typically occurs when prerequisite updates are not installed. Therefore, the most likely cause is that the feature update package is missing prerequisite updates (Option C). Option A is incorrect because insufficient disk space would result in a different error. Option B is incorrect because the update ring does not involve language settings. Option D is incorrect because a maintenance window would not cause this error.

Answer

The device does not have enough free disk space.

Answer

The device is not set to the correct language for the update.

Answer

The update ring is configured with a maintenance window that is too short.

Question 3

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Accepted Answer

An on-premises Active Directory environment.. Options A and B are correct. Group Policy enrollment into Intune requires an on-premises Active Directory environment (A) to target devices via Group Policy, and a Group Policy object (B) configured with the MDM enrollment settings to enable automatic enrollment. Option C is incorrect because an Intune subscription is necessary but not a prerequisite specific to Group Policy enrollment—it is a general requirement. Option D is incorrect because Azure AD Connect is needed for hybrid identity, but Group Policy enrollment works with on-premises AD only. Option E is incorrect because hybrid Azure AD join is not required for Group Policy enrollment; devices can be on-premises joined and still enroll.

Answer

A Microsoft Intune subscription must be active.

Answer

Azure AD Connect must be configured.

Answer

Devices must be Azure AD hybrid joined.

Question 4

You are configuring Microsoft Intune device compliance policies for Windows 10. Which FOUR settings can be evaluated by compliance policies? (Choose four.)

Accepted Answer

Minimum OS version. Compliance policies in Microsoft Intune can evaluate minimum OS version (B), password policy (D), threat level from Microsoft Defender for Endpoint (E), and BitLocker encryption status (C). Windows Firewall status (A) is not evaluated by compliance policies but by device configuration policies. Therefore, all options except A are valid compliance policy settings.

Answer

Windows Firewall status

Question 5

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy an app that requires a VPN configuration when the app is launched. Which TWO options can you use to achieve this? (Choose two.)

Accepted Answer

Use a managed app configuration to include VPN settings.. Options A and E are correct. A per-app VPN configuration profile (E) can be assigned to the app to trigger VPN on launch. Alternatively, a managed app configuration (A) can include VPN settings to enable per-app VPN. Option B is incorrect because a device compliance policy cannot configure VPN settings. Option C is incorrect because app protection policies do not manage VPN connectivity. Option D is incorrect because a device-wide VPN profile applies to all traffic and does not restrict to specific apps.

Answer

Use a device compliance policy to require VPN.

Answer

Assign an app protection policy that enables VPN.

Answer

Create a device-wide VPN configuration profile.

Question 6

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

Accepted Answer

Ensure the password includes characters from at least 3 character sets.. PasswordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers. Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Answer

Increase passwordMinimumLength to 10.

Answer

Set passwordExpirationDays to 0 to never expire.

Answer

Set passwordRequiredType to 'alphanumeric' (it is already set).

Question 7

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

Accepted Answer

The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.. If the 'Show recovery key' setting is not configured (set to 'Not configured'), the user is not prompted to escrow the recovery key during encryption. FileVault encryption is enabled on the device (option A is incorrect). The recovery key type is personal, not institutional (option B is incorrect). Personal recovery key rotation does not cause a conflict (option D is incorrect).

Answer

FileVault encryption is not enabled on the device.

Answer

The recovery key type should be 'Institutional recovery key'.

Answer

Personal recovery key rotation is enabled, causing a conflict.

Question 8

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

Accepted Answer

The device has not been successfully registered in Windows Autopilot.. 'NotRegistered' indicates the device is not properly registered in Autopilot. Option B is incorrect because if the profile were not assigned, it would show 'NotAssigned' but still registered. Option C is incorrect because the diagnostics show registration status. Option D is incorrect because the device can still be registered even if it has been imaged.

Answer

The Autopilot profile is not assigned to the device group.

Answer

The device was previously manually imaged.

Answer

The device is not connected to the internet during OOBE.

Question 9

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

Accepted Answer

The devices must be registered in Microsoft Intune via the hardware vendor or manually.. Autopilot requires the device to be registered in Microsoft Intune (or Entra ID) before it can be automatically enrolled. Option B is incorrect because a hybrid Azure AD join is not a prerequisite for Autopilot enrollment; it is an optional configuration. Option C is incorrect because BitLocker does not need to be enabled before shipment; it can be configured later via policy. Option D is incorrect because a local administrator account is not required; Autopilot can create accounts during deployment.

Answer

The organization must have a hybrid Azure AD join configuration in place.

Answer

BitLocker must be enabled on the devices before they are shipped.

Answer

A local administrator account must be created on each device prior to deployment.

Question 10

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

Accepted Answer

The device is connected through a VPN that blocks Intune traffic.. The most likely cause is that the device is connected through a VPN that blocks Intune traffic. Intune requires direct internet access to communicate with its service. If the VPN restricts or filters this traffic, the device may remain enrolled but unable to check in or receive policies. Option B is incorrect because the device last checked in 5 days ago, which is within the 7-day window, so it would not be marked inactive. Option C is incorrect because the device shows as 'Enrolled'. Option D is incorrect because the Intune Connector for Active Directory is used for hybrid Azure AD join scenarios, not for direct policy delivery to enrolled devices.

Answer

The device has not checked in for more than 7 days, causing Intune to mark it as inactive.

Answer

The device has been unenrolled from Intune.

Answer

The Intune Connector for Active Directory is not configured.

Question 11

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

Accepted Answer

Client apps. The 'Client apps' workload in Configuration Manager co-management is responsible for synchronizing client applications and enabling automatic enrollment of devices to Intune after the Configuration Manager client is installed. Option A (Endpoint Protection) is incorrect because it manages endpoint protection policies, not enrollment. Option B (Windows Update policies) is incorrect because it governs Windows Update for Business policies, not Intune enrollment. Option C (Resource access) is incorrect because it configures resource access policies like certificates and VPN, not automatic enrollment.

Answer

Endpoint Protection

Answer

Windows Update policies

Answer

Resource access

Question 12

A company uses Microsoft Intune to manage iOS devices. They need to ensure that only devices with a passcode of at least 6 characters can access corporate email. Which type of policy should they create?

Accepted Answer

Device compliance policy. Device compliance policies enforce security requirements like passcode length at the device level. Option A (App protection policy) is incorrect because it targets app-level data protection, not device settings. Option B (Enrollment restriction) is incorrect because it controls which devices can enroll but does not enforce passcode requirements. Option C (Device configuration policy) is incorrect because it configures device settings but does not enforce compliance with policies.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy

Question 13

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

Accepted Answer

Windows Hello for Business. The 'Windows Hello for Business' setting in the Autopilot profile directly controls whether users are prompted to configure biometric or PIN-based authentication during the out-of-box experience (OOBE). When enabled, this setting triggers the Windows Hello for Business enrollment flow immediately after user authentication, ensuring the device is provisioned with strong credential protection before the user reaches the desktop.

Answer

Skip privacy settings

Answer

Device name template

Answer

Language (Region)

Question 14

You are troubleshooting a Windows 11 device that fails to enroll in Intune via Group Policy. The device is domain-joined and you have configured the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO. The user has a valid Microsoft 365 license. What is the most likely reason for the failure?

Accepted Answer

The device is not registered in Azure AD.. For the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO to succeed, the device must be registered in Azure AD. Since the device is only domain-joined and no Azure AD registration has occurred, the enrollment fails. Option B is incorrect because the GPO is configured correctly; if it were not linked, it would not apply at all. Option C is incorrect because the user has a valid Microsoft 365 license that includes Intune. Option D is incorrect because a service connection point is used for Configuration Manager co-management, not for this GPO.

Answer

The GPO is not linked to the correct organizational unit.

Answer

The user does not have an Intune license assigned.

Answer

The device does not have a service connection point configured.

Question 15

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

Accepted Answer

Assign the app and configure 'Require device compliance' with a filter for minimum OS version.. Intune allows you to create a filter based on device properties such as OS version, and apply that filter to app assignments. This ensures the deployment is only available to devices meeting the minimum OS version. Option B is incorrect because 'Uninstall' intent would remove the app, not deploy it with OS filtering. Option C is incorrect because 'Available for enrolled devices' without filters does not enforce any OS version requirement. Option D is incorrect because assigning as 'Required' to all devices does not filter by OS version.

Answer

Assign the app with 'Uninstall' intent.

Answer

Assign the app as 'Available for enrolled devices' without filters.

Answer

Assign the app as 'Required' to all devices.