MD-102 Prepare infrastructure for devices Practice Test 9 — 15 Questions

Question 1

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

Accepted Answer

Device restrictions configuration policy. Device restrictions configuration policy includes the setting to block installation of apps from unknown sources on Android Enterprise devices. Option B (Device compliance policy) is incorrect because compliance policies enforce security requirements but do not block app installations. Option C (App configuration policy) is incorrect because app configuration policies are used to pre-configure app settings, not to restrict installation. Option D (Enrollment restriction) is incorrect because enrollment restrictions control whether devices can enroll, not app installation behavior.

Answer

Device compliance policy

Answer

App configuration policy

Answer

Enrollment restriction

Question 2

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

Accepted Answer

Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.. Microsoft Defender for Endpoint can integrate with Microsoft Intune to automatically trigger remediation actions when critical vulnerabilities are found. Option A is incorrect because Microsoft Sentinel is a SIEM and SOAR platform; while it can automate responses, it is not the direct integration for Intune remediation. Option B is incorrect because Microsoft Foundry is an AI platform, not used for device remediation. Option C is incorrect because Microsoft Purview focuses on data governance and compliance, not device remediation.

Answer

Configure a Microsoft Sentinel playbook.

Answer

Configure a Microsoft Foundry AI model.

Answer

Configure a Microsoft Purview data loss prevention policy.

Question 3

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Accepted Answer

TPM 2.0 chip. Options D and E are correct. Self-deploying mode requires a physical TPM 2.0 chip for attestation and network connectivity to Microsoft Intune. Option A is wrong because a user account is not required. Option B is wrong because a product key is not needed. Option C is wrong because MDM user affinity is not required.

Answer

A user account with Intune license

Answer

A Windows product key

Answer

MDM user affinity

Question 4

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Accepted Answer

Microsoft Intune tenant. Options A, B, and E are correct. Co-management requires Microsoft Intune tenant (A) for cloud enrollment, Configuration Manager current branch (B) for on-premises management, and Microsoft Entra ID (E) for identity synchronization and hybrid join. Option C is not a requirement; the service connection point is used for cloud attach but is not mandatory for co-management. Option D is not required; PKI certificates are optional for co-management, as Intune can handle certificate enrollment via SCEP or PKCS if needed.

Answer

Service connection point (Cloud Attach)

Answer

Public key infrastructure (PKI) certificates

Question 5

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Accepted Answer

Retain the Autopilot registration. Options C and D are correct. Windows Autopilot reset retains the device's Autopilot registration (option C) and removes personal files and apps (option D). Option A is incorrect because Autopilot reset does not change the primary user; that requires a different process. Option B is incorrect because Autopilot reset does not reinstall Windows from scratch; it refreshes the existing OS. Option E is incorrect because Autopilot reset does not remove the device from Microsoft Intune; that would require a manual action.

Answer

Change the primary user of the device

Answer

Reinstall Windows 11 from scratch

Answer

Remove the device from Microsoft Intune

Question 6

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

Accepted Answer

The policy will block access to the Microsoft Store and Cortana.. The policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device. Option D is wrong because the policy does not affect app installation from other sources.

Answer

The policy will apply only to the primary user of the device.

Answer

The policy will prevent users from installing apps from outside the Microsoft Store.

Answer

The policy will block the camera on all devices.

Question 7

Refer to the exhibit. An Intune compliance policy JSON for Windows 10 devices. A device with OS version 10.0.19041.1 and no encryption reports as noncompliant. What is the most likely reason?

Accepted Answer

The device does not have BitLocker encryption enabled.. The compliance policy specifies storageRequireEncryption: true, but the device does not have BitLocker encryption enabled, causing noncompliance. Option A is incorrect because the OS version 10.0.19041.1 is below the maximum allowed (10.0.19044.1). Option B is incorrect because 'deviceDefault' allows any valid Windows password type, including numeric PIN. Option C is incorrect because the OS version is above the minimum required (10.0.19041.0).

Answer

The OS version exceeds the maximum allowed version.

Answer

The password type is set to 'deviceDefault' which does not support numeric PIN.

Answer

The OS version is below the minimum requirement.

Question 8

Refer to the exhibit. An Autopilot device registration JSON. What does the '%RAND:5%' placeholder do?

Accepted Answer

It generates a random 5-character string.. The placeholder %RAND:5% generates a random 5-character string, ensuring unique device names during Autopilot deployment. Options A, C, and D are incorrect; %RAND:5% does not use the device model, serial number, or user principal name.

Answer

It inserts the device's model name.

Answer

It inserts the device's serial number.

Answer

It inserts the user's principal name.

Question 9

Your organization uses Microsoft Intune for device management. You need to ensure that only corporate-owned devices can enroll in Intune. Which configuration should you use?

Accepted Answer

Use Device Enrollment Manager (DEM) accounts to enroll devices.. Device Enrollment Manager (DEM) accounts allow designated administrators to enroll devices on behalf of other users, and these devices are automatically marked as corporate-owned. Option B is incorrect because a compliance policy can require corporate ownership as a condition, but it does not block personal devices from enrolling; it only marks them noncompliant after enrollment. Option C is incorrect because device categories are for organizational grouping, not for enforcing corporate-only enrollment. Option D is incorrect because enrollment restrictions can block personally owned devices, but they do not automatically designate devices as corporate-owned; DEM is the appropriate method for ensuring only corporate-owned devices enroll.

Answer

Assign a compliance policy that requires the device to be corporate-owned.

Answer

Create a device category for corporate devices and instruct users to select it during enrollment.

Answer

Configure enrollment restrictions to block personally owned devices.

Question 10

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

Accepted Answer

Obtain the hardware hash from the device manufacturer or reseller.. The hardware hash can be obtained from the device manufacturer or reseller (OEM) before the device is shipped. This is the recommended approach for new devices as it allows the hardware hash to be uploaded to Intune without needing to power on the device. Option A is wrong because adding the device to Microsoft Entra ID does not upload the hardware hash. Option C is wrong because Configuration Manager can collect hashes but requires the device to be on the network and is typically used for existing devices. Option D is wrong because running a PowerShell script on each device requires the device to be powered on and manually executed, which is less efficient for new devices.

Answer

Add the device to Microsoft Entra ID before shipping.

Answer

Use Microsoft Configuration Manager to collect the hardware hash.

Answer

Run a PowerShell script on each device to capture the hardware hash.

Question 11

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

Accepted Answer

Set the MDM user scope in Microsoft Entra ID to 'All' or 'Some'.. Microsoft Entra ID joined devices automatically enroll in Intune when the MDM user scope is set to 'All' or 'Some'. Option B is incorrect because the MDM discovery URL is configured automatically for Microsoft Entra ID joined devices and does not need manual configuration. Option C is incorrect because enrollment restrictions control which devices can enroll but do not trigger automatic enrollment. Option D is incorrect because device compliance policies are applied after enrollment, not before.

Answer

Configure the MDM discovery URL in Microsoft Entra ID.

Answer

Create an enrollment restriction that allows Windows devices.

Answer

Assign a device compliance policy to the user.

Question 12

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

Accepted Answer

The user does not have an Intune license assigned.. The device showing as 'Not compliant' in the Intune console indicates it is enrolled in Intune. The most likely cause for compliance policies not being applied is that the user does not have a valid Intune license assigned. Without a license, the device can be enrolled but compliance policies will not be evaluated or enforced. Option B is incorrect because the device is enrolled (as evidenced by its appearance in the console). Option C is incorrect because a stale policy would still apply if the device is enrolled and licensed. Option D is incorrect because network connectivity would affect policy retrieval but the device would still be enrolled and licensed.

Answer

The device is not enrolled in Intune.

Answer

The compliance policy is stale and needs to be re-assigned.

Answer

The device has no network connectivity.

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

Accepted Answer

Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.. Enrollment platform restrictions allow you to set a minimum OS version for enrollment, preventing devices with older iOS versions from enrolling. Option A is incorrect because a device configuration profile is applied after enrollment and manages device settings, not enrollment requirements. Option B is incorrect because the enrollment profile defines the enrollment method (e.g., user vs. device enrollment), not OS version restrictions. Option C is incorrect because a compliance policy is applied after enrollment; it can mark devices as non-compliant but does not block enrollment itself.

Answer

Create a device configuration profile that requires iOS 16.0.

Answer

Modify the enrollment profile to require iOS 16.0.

Answer

Create a compliance policy that requires iOS 16.0 or later.

Question 14

Refer to the exhibit. You have configured the above enrollment restriction in Microsoft Intune. A user attempts to enroll a personal Windows 11 device. What will be the outcome?

Accepted Answer

The device will be blocked from enrolling.. The enrollment restriction is configured to block personally owned Windows devices. Since the user is trying to enroll a personal Windows 11 device, enrollment will be blocked regardless of OS version. Option B is incorrect because no prompt is shown; it's a block, not a prompt. Option C is incorrect because enrollment is blocked, so the device never becomes non-compliant. Option D is incorrect because the restriction specifically blocks personal devices, so OS version does not matter; enrollment fails.

Answer

The device will be prompted to confirm enrollment.

Answer

The device will enroll but will be marked as non-compliant.

Answer

The device will enroll successfully because it meets the OS requirements.

Question 15

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to enroll a personally owned device with a work profile. Which enrollment method should the user use?

Accepted Answer

Android Enterprise personally owned work profile enrollment.. Android Enterprise personally owned devices with a work profile use the 'Bring your own device' (BYOD) enrollment method. Option A is wrong because corporate-owned dedicated devices use a different method. Option C is wrong because fully managed devices are corporate-owned. Option D is wrong because corporate-owned work profile is for corporate devices with work profile.

Answer

Android Enterprise fully managed enrollment.

Answer

Android Enterprise corporate-owned work profile enrollment.

Answer

Corporate-owned dedicated device enrollment.