MD-102 Prepare infrastructure for devices Practice Test 9 — 15 Questions

Question 1

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The conditional access policy has the grant control set to 'Require device to be marked as compliant'.. The most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Answer

All users have the required Microsoft 365 license.

Answer

The conditional access policy includes all cloud apps.

Answer

The device platform condition is set to iOS and Android only.

Question 2

Refer to the exhibit. You execute this PowerShell script to wipe noncompliant Windows devices. After running, you find that some compliant devices were also wiped. What is the most likely reason?

Accepted Answer

The script uses the wrong Graph API endpoint, causing all devices to be wiped.. The script uses the wrong Graph API endpoint. The correct endpoint for wiping a device is `/deviceManagement/managedDevices/{deviceId}/wipe`, but the script likely uses an incorrect or generic endpoint (e.g., `/devices/{deviceId}/wipe` or a non-existent path), which causes the API to misinterpret the request or apply the wipe action to all devices in the tenant, including compliant ones. This is a common misconfiguration when targeting the Microsoft Graph API for Intune device actions.

Answer

The filter 'operatingSystem eq 'Windows'' does not match any devices, so the script wiped all devices.

Answer

The script wipes only noncompliant devices, but some compliant devices had a null compliance state.

Answer

The script does not check the device's compliance state before wiping.

Question 3

You need to enroll macOS devices into Microsoft Intune. What is the required enrollment method?

Accepted Answer

Company Portal app. The Company Portal app is the required enrollment method for macOS devices when using user-driven enrollment with Intune. It allows users to authenticate, download management profiles, and register their device via the Intune Company Portal, which is the standard approach for bring-your-own-device (BYOD) scenarios or when automated enrollment is not configured.

Answer

Device Enrollment Manager (DEM)

Answer

Apple Automated Device Enrollment (ADE)

Answer

Apple Configurator

Question 4

Your organization uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) and Microsoft Intune. You need to ensure that devices that are deemed 'at risk' by Microsoft Defender for Endpoint are automatically blocked from accessing corporate resources. What should you configure?

Accepted Answer

A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.. To block devices at risk by Microsoft Defender for Endpoint from accessing corporate resources, you need to configure a compliance policy that evaluates the device risk level from Defender for Endpoint (using the 'Require the device to be at or under the Device Threat Level' setting) and marks devices as noncompliant if they exceed the threshold. Then, configure a Conditional Access policy that targets all cloud apps and uses the 'Grant' control to 'Require device to be marked as compliant', which will block noncompliant devices. This combination is exactly described in Option B. Option A is incorrect because an app protection policy controls access at the app level, not device level. Option C is incorrect because although it describes a similar setup, it does not explicitly state that the conditional access policy blocks noncompliant devices, and the order of configuration is reversed; the standard approach is option B. Option D is incorrect because a device configuration policy does not enforce access control; it configures device settings.

Answer

An app protection policy in Intune that blocks access based on device risk.

Answer

A conditional access policy that requires device to be compliant, and a compliance policy that uses the Defender for Endpoint device risk level.

Answer

A device configuration policy that disables network access for at-risk devices.

Question 5

Which TWO of the following are required to configure Windows Autopilot for existing devices?

Accepted Answer

A hardware hash (4K HH) from the device.. Option D is correct because Windows Autopilot for existing devices (the "Convert all targeted devices to Autopilot" / JSON-based enrollment flow) requires the device's hardware hash (4K HH) so the device can be registered as an Autopilot device in Intune; the hash is captured and uploaded to create the Autopilot device record. Option E is correct because the Autopilot deployment profile must be assigned to a device group (typically an Microsoft Entra ID dynamic device group populated from the uploaded hardware hashes) for the profile to apply during OOBE. Option A is not required, since Autopilot for existing devices does not need a Windows product key to be entered or configured. Option B is not required as a configuration prerequisite, because the enrollment flow uses the existing OS and Intune enrollment rather than requiring a local administrator account to be pre-created. Option C is not required for this scenario, since Microsoft Entra ID P1 is not a prerequisite for the Autopilot for existing devices configuration itself.

Answer

A Windows product key.

Answer

A local administrator account on the device.

Answer

An Azure AD Premium P1 license.

Question 6

Which THREE of the following are valid methods to enroll Android devices into Microsoft Intune?

Accepted Answer

Android Enterprise work profile. Option C (Android Enterprise work profile) is correct because Intune supports enrolling corporate-owned or BYOD Android devices with a work profile that separates business data from personal data via the managed Google Play store. Option D (Android Open Source Project (AOSP)) is correct because Intune supports AOSP enrollment for dedicated, purpose-built devices that lack Google Mobile Services, using the Intune app or a token-based enrollment flow. Option E (Android Enterprise fully managed) is correct because Intune supports fully managed Android Enterprise enrollment for corporate-owned devices, giving IT full control of the device through managed Google Play. Option A (Android Device Administrator) is not a valid current enrollment method since Google deprecated Android Device Administrator in favor of Android Enterprise, and Intune no longer offers it as a supported enrollment path. Option B (Android Legacy) is not a real Intune enrollment method; it is not an option in the Intune enrollment workflow and does not correspond to any supported Android management mode.

Answer

Android Device Administrator

Answer

Android Legacy

Question 7

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Accepted Answer

The Microsoft Intune agent installed on the Linux device.. Option A is correct because managing a Linux device with Microsoft Intune requires installing the Microsoft Intune app/agent (the Microsoft Intune app for Linux) on the device, which performs enrollment and enables compliance and configuration management. Option B is correct because Intune only supports specific Linux distributions and versions, such as Ubuntu 20.04 LTS or later (and a few other supported distros like RHEL), so a supported OS is a prerequisite. Option D is correct because the Linux device must have network connectivity to the Microsoft Intune service endpoints (and related Microsoft 365/Entra endpoints) so the agent can enroll, check in, and receive policies. Option C is not required because Intune-managed Linux devices are enrolled via the Intune agent and use Microsoft Entra ID for identity, not an on-premises Active Directory domain join. Option E is not required because Intune Linux management does not mandate an Microsoft Entra ID P2 license per user; the necessary Intune licensing is what applies, not P2 specifically.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

An Azure Active Directory Premium P2 license for each user.

Question 8

Your organization plans to deploy Windows 11 to 500 devices using Microsoft Intune. You need to ensure that each device receives the correct language pack and regional settings based on the user's location. Which configuration method should you use?

Accepted Answer

Configure Windows Autopilot with enrollment profile specifying language and region. Windows Autopilot with an enrollment profile allows you to specify language and region settings that are applied during the out-of-box experience (OOBE). This ensures each device receives the correct configuration based on the user's location without requiring post-enrollment scripts or manual intervention, making it the most efficient and scalable method for 500 devices managed by Intune.

Answer

Deploy a PowerShell script via Intune to set language after enrollment

Answer

Use Configuration Manager task sequence with language packs

Answer

Create a provisioning package (PPKG) with language settings and apply via USB

Question 9

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

Accepted Answer

The DNS CNAME record for enrollment is missing or incorrect. The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Answer

The user does not have an Intune license assigned

Answer

The MDM authority is not set to Intune

Answer

The device firewall is blocking traffic to manage.microsoft.com

Question 10

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

Accepted Answer

The device does not meet authentication requirements. The JSON configuration includes an 'authenticationRequirement' setting that mandates multifactor authentication (MFA) for enrollment. Since the user's device or account does not meet this MFA requirement, the enrollment is blocked. Authentication requirements are a common cause of enrollment failures, and the error message 'enrollment is blocked' typically aligns with such policy violations rather than version restrictions or device count limits.

Answer

The enrollment is restricted to Windows Holographic only

Answer

The device type filter excludes Windows 10

Answer

The user already has 5 devices enrolled

Question 11

You are the endpoint administrator for a healthcare organization that uses Intune to manage 500 iOS devices used by clinicians. The devices are enrolled as corporate-owned, user-approved devices via Apple Business Manager (ABM). You need to deploy a new custom electronic health record (EHR) app that is not in the App Store. The app is distributed as an .ipa file signed with an enterprise certificate. The app must be installed silently without user interaction. The devices are supervised and managed with iOS MDM. You have the following options: A) Deploy the app as an iOS LOB app in Intune and assign to device groups. B) Deploy the app as a Volume Purchase Program (VPP) app. C) Use Apple Configurator to sideload the app via USB. D) Distribute the app via a web link to the .ipa hosted on a public CDN. Which option should you choose?

Accepted Answer

Deploy the app as an iOS LOB app in Intune and assign to device groups.. Intune LOB app deployment on supervised devices allows silent installation of enterprise-signed .ipa files by automatically trusting the enterprise certificate via MDM. No user interaction is required. Option C (Apple Configurator) requires physical USB connection and manual trust acceptance, making it non-silent. Option B (VPP) only applies to App Store apps. Option D relies on user-initiated download and installation, also not silent.

Answer

Deploy the app as a Volume Purchase Program (VPP) app.

Answer

Use Apple Configurator to sideload the app via USB.

Answer

Distribute the app via a web link to the .ipa hosted on a public CDN.

Question 12

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use Group Policy to configure MDM enrollment. C) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. D) Use a provisioning package (PPKG) to enroll devices. Which option should you choose?

Accepted Answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. Use the 'Switch to Intune' option in the device's 'Access work or school' settings. This feature is specifically designed for migrating devices from a legacy on-premises MDM to Intune without requiring a device reset. It is available on Windows 10 devices that are already joined to Microsoft Entra ID and enrolled in another MDM. Option A is incorrect because Windows Autopilot resets the device, which is not desired. Option B (Group Policy) can force enrollment to Intune but does not handle the migration from an existing MDM; it would likely cause a conflict or require manual steps. Option D (provisioning package) is typically used for initial bulk enrollment and may also require a reset or clean installation. Therefore, Option C is the only non-destructive migration method.

Answer

Use Windows Autopilot to reset the devices and re-enroll

Answer

Use Group Policy to configure MDM enrollment

Answer

Use a provisioning package (PPKG) to enroll devices

Question 13

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with TPM 2.0 and UEFI Secure Boot enabled can enroll. Which configuration profile setting should you configure?

Accepted Answer

Enable Device Health Attestation (DHA) in enrollment restrictions. Device Health Attestation (DHA) in enrollment restrictions allows you to block enrollment for devices that do not meet specific hardware security requirements, such as TPM 2.0 and UEFI Secure Boot enabled. When configured, Intune verifies these attestation claims during the enrollment process and rejects non-compliant devices before they can enroll. This is the only setting that enforces hardware prerequisites at the enrollment stage, not after the device is already managed.

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Configure a BitLocker policy in Endpoint Security

Answer

Set a compliance policy for device health

Question 14

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

Accepted Answer

Apps are assigned to devices instead of users. Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Answer

Device type is restricted in enrollment restrictions

Answer

VPP token is not configured for user enrollment

Answer

User Enrollment does not support app distribution

Question 15

You need to prepare on-premises Windows devices for a migration to Microsoft Intune. Which tool should you use to generate a configuration package that can be deployed via Group Policy or manual installation?

Accepted Answer

Windows Autopilot. Windows Autopilot for existing devices allows you to generate a configuration package (a .ppkg file) that can be deployed via Group Policy or manual installation to enroll on-premises Windows devices into Microsoft Intune. This package includes provisioning settings that configure MDM enrollment targetting the Intune server, enabling a seamless migration.

Answer

Configuration Manager

Answer

Microsoft Intune Management Extension

Answer

Microsoft Intune Troubleshooting Tool