MD-102 Prepare infrastructure for devices Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

Accepted Answer

Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.. Option A is correct because platform restrictions allow you to set minimum OS versions for enrollment. Option B is wrong because compliance policies are applied after enrollment. Option C is wrong because device configuration profiles manage settings, not enrollment. Option D is wrong because the enrollment profile specifies enrollment method, not OS version restrictions.

Answer

Create a device configuration profile that requires iOS 16.0.

Answer

Modify the enrollment profile to require iOS 16.0.

Answer

Create a compliance policy that requires iOS 16.0 or later.

Question 2

Refer to the exhibit. You have configured the above enrollment restriction in Microsoft Intune. A user attempts to enroll a personal Windows 11 device. What will be the outcome?

Accepted Answer

The device will be blocked from enrolling.. Option D is correct because the restriction blocks personal device enrollment for Windows. The device will be blocked during enrollment regardless of OS version. Option A is wrong because OS version is not checked since the restriction blocks personal devices. Option B is wrong because the restriction is not a compliance policy. Option C is wrong because the device is not allowed.

Answer

The device will be prompted to confirm enrollment.

Answer

The device will enroll but will be marked as non-compliant.

Answer

The device will enroll successfully because it meets the OS requirements.

Question 3

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to enroll a personally owned device with a work profile. Which enrollment method should the user use?

Accepted Answer

Android Enterprise personally owned work profile enrollment.. Option B is correct because Android Enterprise personally owned devices with a work profile use the 'Bring your own device' (BYOD) enrollment method. Option A is wrong because corporate-owned dedicated devices use a different method. Option C is wrong because fully managed devices are corporate-owned. Option D is wrong because corporate-owned work profile is for corporate devices with work profile.

Answer

Android Enterprise fully managed enrollment.

Answer

Android Enterprise corporate-owned work profile enrollment.

Answer

Corporate-owned dedicated device enrollment.

Question 4

Your organization is deploying Windows Autopilot self-deploying mode for kiosk devices. The devices will be used in a public area and must not require user interaction during the initial setup. What is the prerequisite for this deployment?

Accepted Answer

The device must have a TPM 2.0 chip.. Option A is correct because self-deploying mode requires the device to be a physical device with a TPM 2.0 chip for attestation. Option B is wrong because self-deploying mode does not require a user to sign in. Option C is wrong because self-deploying mode uses a device-based enrollment token, not a user-based one. Option D is wrong because the device must be pre-registered in Intune as an Autopilot device.

Answer

A user must be assigned to the device in Microsoft Entra ID.

Answer

An enrollment profile must be assigned to the user.

Answer

The device must be added to Microsoft Entra ID manually.

Question 5

A user reports that their Windows device is not appearing in the Intune console after enrollment. The device is joined to Microsoft Entra ID and the user has an Intune license. What should you check first?

Accepted Answer

Ensure that the MDM user scope in Microsoft Entra ID is set to 'All' or 'Some'.. The most common reason a device fails to appear in the Intune console after enrollment is that the MDM user scope in Microsoft Entra ID is not configured to include the user. The MDM user scope determines which users can automatically enroll their devices into Intune; if it is set to 'None', enrollment is blocked entirely. Since the device is already joined to Microsoft Entra ID and the user has an Intune license, the first step is to verify this scope setting.

Answer

Assign an Intune license to the device.

Answer

Verify that enrollment restrictions are not blocking the device.

Answer

Check if the device is compliant.

Question 6

Your organization plans to use Microsoft Intune to manage macOS devices. Which TWO prerequisites are required for macOS enrollment?

Accepted Answer

An Apple Push Notification service (APNs) certificate.. An Apple Push Notification service (APNs) certificate is required for macOS enrollment because it establishes a persistent, secure connection between Microsoft Intune and Apple's servers. This certificate enables Intune to send management commands, policies, and app installations to macOS devices. Without a valid APNs certificate, Intune cannot communicate with enrolled devices, making enrollment impossible.

Answer

A user enrollment certificate from a public CA.

Answer

A Volume Purchase Program (VPP) token.

Answer

A Microsoft Configuration Manager connector.

Question 7

Your organization uses Microsoft Intune and you need to configure Windows Autopilot for hybrid Microsoft Entra ID join. Which THREE components are required?

Accepted Answer

A domain join profile (configured in Intune).. A domain join profile is required for hybrid Microsoft Entra ID join because it provides the on-premises Active Directory domain information that the device needs during Autopilot provisioning. Without this profile, the device cannot complete the domain join step, which is essential for establishing the hybrid identity state.

Answer

A device compliance policy.

Answer

An MDM push certificate.

Question 8

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Microsoft Entra ID join with automatic MDM enrollment.. Option A is correct because Windows Autopilot is a valid enrollment method. Option E is correct because Microsoft Entra ID join with automatic Intune enrollment is valid. Option B is wrong because Apple Business Manager is for Apple devices. Option C is wrong because Android Zero Touch is for Android devices. Option D is wrong because Samsung Knox Mobile Enrollment is for Samsung Android devices.

Answer

Android Zero Touch.

Answer

Apple Business Manager.

Answer

Samsung Knox Mobile Enrollment.

Question 9

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

Accepted Answer

The device does not have a TPM 2.0 chip.. Windows Autopilot self-deploying mode requires a TPM 2.0 chip to perform hardware-based attestation and automatically enroll the device without user interaction. If the device lacks TPM 2.0, the provisioning process will fail because the required cryptographic keys for attestation cannot be generated, preventing the device from completing the self-deploying profile.

Answer

The device name template is invalid.

Answer

The profile requires a user to sign in during deployment.

Answer

The language settings are not configured.

Question 10

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

Accepted Answer

One of the required apps failed to install.. The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Answer

The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

Answer

The user attempted to retry the setup and it was blocked.

Answer

The device reset on failure is enabled, causing a reset loop.

Question 11

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant are blocked from accessing corporate resources. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that requires compliant devices.. Conditional Access policies in Azure AD are the correct mechanism to enforce access controls based on device compliance status. By creating a policy that requires devices to be marked as compliant, you ensure that only compliant devices can access corporate resources, while non-compliant devices are blocked at the authentication level. This integrates with Intune compliance policies to evaluate device health before granting access.

Answer

Create a device compliance policy and assign it to users.

Answer

Create a device configuration profile that restricts access.

Answer

Configure enrollment restrictions to block non-compliant devices.

Question 12

Your organization is planning to deploy Windows 11 to 5000 devices using Microsoft Intune. The devices are currently a mix of Windows 10 and Windows 11 eligible hardware. You need to ensure that only devices meeting the Windows 11 hardware requirements can be upgraded. What is the most efficient way to achieve this using Intune?

Accepted Answer

Create a Windows feature update profile targeting Windows 11 and assign it to all devices; Intune will automatically skip ineligible devices.. Option B is correct because a Windows feature update profile in Intune automatically checks device hardware eligibility before applying the Windows 11 upgrade. Intune queries the Windows Update for Business service, which evaluates TPM 2.0, Secure Boot, CPU generation, and RAM requirements; devices that do not meet the minimum hardware requirements are skipped without any manual intervention or additional configuration.

Answer

Use Windows Autopilot to reset each device and manually verify hardware compatibility.

Answer

Create a dynamic device group based on TPM version and assign a Windows 10 update ring to non-compliant devices.

Answer

Create a compliance policy requiring TPM 2.0 and Secure Boot, then assign a Windows 11 update ring to compliant devices.

Question 13

You manage devices with Microsoft Intune. Some Windows devices are not receiving required security updates despite being assigned to an update ring for Windows 10. You verify that the devices are active and connected to the internet. What is the most likely cause?

Accepted Answer

The update ring has a deferral period configured that delays updates for 30 days.. The most likely cause is that the update ring has a deferral period configured that delays updates for 30 days. In Microsoft Intune, update rings for Windows 10 allow administrators to set deferral periods for quality and feature updates. A deferral period of 30 days means that even if the device is active and connected, it will not install the update until the specified number of days after Microsoft releases it. This explains why the devices are not receiving the updates despite being compliant and online.

Answer

The devices have a compliance policy requiring a specific version that is not yet met.

Answer

The devices are not connected to a corporate VPN.

Answer

Delivery Optimization is disabled on the devices.

Question 14

You are configuring Windows Autopilot for new devices. The devices need to be automatically enrolled in Intune and assigned to a specific group based on their serial number. What is the required step before the devices can be recognized by Autopilot?

Accepted Answer

Register the devices using their hardware hash in the Microsoft Intune admin center.. Before Windows Autopilot can recognize and automatically enroll devices, they must be registered as Autopilot devices. This is done by uploading their hardware hash (a unique identifier derived from the device's TPM and other hardware) into the Microsoft Intune admin center. Once registered, the device is associated with an Autopilot profile and can be automatically enrolled in Intune and assigned to a group based on its serial number during the out-of-box experience.

Answer

Configure Intune enrollment for all users using device enrollment managers.

Answer

Join the devices to Microsoft Entra ID manually before shipping.

Answer

Upload a CSV file with device serial numbers to Microsoft Entra ID.

Question 15

Your organization uses Microsoft Defender for Endpoint. You need to ensure that devices onboarding to Microsoft Defender for Endpoint are automatically assigned to a specific device group based on their operating system version. What should you use?

Accepted Answer

Configure device group rules in Microsoft Defender for Endpoint using OS version condition.. Device group rules in Microsoft Defender for Endpoint allow you to automatically assign devices to groups based on conditions such as operating system version. This is the correct approach because it uses the built-in grouping engine that evaluates device attributes during onboarding, ensuring consistent and automated assignment without manual intervention.

Answer

Manually tag each device in the Microsoft 365 Defender portal.

Answer

Use Microsoft Entra ID dynamic groups based on device OS.

Answer

Create a Microsoft Intune compliance policy that tags devices by OS version.