MD-102 Prepare infrastructure for devices — Timed 20 Questions

Question 1

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.. Conditional Access in Microsoft Entra ID can block access based on device compliance status. Intune compliance policies define the compliance requirements, and Conditional Access policies enforce the access control. Option A is correct. Option B is wrong because device filters don't check compliance. Option C is wrong because it doesn't enforce compliance. Option D is wrong because it's for device enrollment, not access control.

Answer

Set up a device compliance policy in Microsoft Purview to block non-compliant devices.

Answer

Configure a device filter in Exchange Online to block devices that are not managed by Intune.

Answer

Deploy an email security policy via Intune to block access from non-compliant devices.

Question 2

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

Accepted Answer

Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.. In Configuration Manager, the 'Provision Microsoft Entra ID' step in a task sequence can be used to perform a bulk token-based join. This is the recommended approach for Windows 10 devices. Option B is correct. Option A is wrong because it's not for bulk OSD. Option C is wrong because Autopilot is for user-driven scenarios. Option D is wrong because MDM enrollment via GPO is not typically used during OSD.

Answer

Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

Answer

Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

Answer

Configure Windows Autopilot for existing devices and redeploy them.

Question 3

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot uses a device-specific hardware hash that is uploaded to Intune. Based on the assigned Autopilot profile and deployment profile, the device automatically joins Entra ID and enrolls in Intune. Option A is correct. Option B is wrong because a provisioning package is not needed for Autopilot. Option C is wrong because a Configuration Manager client is not required. Option D is wrong because Group Policy does not apply during Autopilot.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.

Question 4

You need to configure device compliance for devices that are not running Windows. The devices include iOS, iPadOS, Android, and macOS. Which compliance settings are common across all platforms?

Accepted Answer

Require minimum OS version.. Requiring a minimum OS version is a common compliance setting across all major platforms. Option B is correct. Option A is wrong because BitLocker is Windows-only. Option C is wrong because jailbreak detection is available only on iOS/iPadOS. Option D is wrong because requiring a password is common, but 'simple passwords' is not a standard compliance setting; the setting is 'require password' which is common, but the question asks for common settings, and 'minimum OS version' is universally supported.

Answer

Require device password and not allow simple passwords.

Answer

Device must not be jailbroken/rooted.

Answer

Require BitLocker encryption.

Question 5

Your organization uses Microsoft Intune to manage devices. You have a compliance policy that requires devices to have a password of at least 6 characters. Some users report that their devices are marked as non-compliant even though they have a password set. What is the most likely cause?

Accepted Answer

The compliance policy is assigned to a user group that does not include the affected users.. Intune compliance policies for password length are specific to the platform. For example, on Android, the password length setting might be interpreted differently. However, the most common issue is that the compliance policy is not assigned to the correct group, or the device has not checked in. But given the options, the most likely cause is that the policy is assigned to a group that the device or user is not a member of. Option C is correct. Option A is wrong because the user may be in the target group but the device might not. Option B is wrong because the policy is correct. Option D is wrong because the password complexity setting is separate.

Answer

The password length setting is set to '6' but the device requires a minimum of 8.

Answer

The compliance policy is assigned to device groups, but the devices are user-enrolled.

Answer

The device uses a PIN instead of a password, which is not evaluated.

Question 6

You need to deploy a line-of-business (LOB) app to 100 Windows 10 devices managed by Intune. The app is packaged as an .msi file. Which app type should you choose in Intune?

Accepted Answer

Line-of-business app. For Windows LOB apps, Intune supports .msi, .exe, .appx, and .msix. The 'Line-of-business app' type is used for .msi files. Option A is correct. Option B is wrong because 'Windows app (Win32)' is for .intunewin files. Option C is wrong because 'Microsoft Store app' is for store apps. Option D is wrong because 'Web link' is for web apps.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 7

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

Accepted Answer

Add a compliance policy setting: 'Require the device to be at or under the machine risk score' with a low score.. Intune compliance policies can include a rule to require that the device is marked as a 'healthy' device by Microsoft Defender for Endpoint. This rule evaluates the device's sensor state. Option A is correct. Option B is wrong because it's for device health attestation, not Defender. Option C is wrong because Conditional Access does not flag compliance; it enforces access. Option D is wrong because a compliance policy for Defender is not a script.

Answer

Create a Conditional Access policy requiring device compliance and blocking access if not compliant.

Answer

Enable 'Require BitLocker' compliance setting.

Answer

Deploy a PowerShell script via Intune that checks the Defender service status and reports to Intune custom compliance.

Question 8

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

Accepted Answer

Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.. For in-place upgrades with limited bandwidth, using peer caching or Delivery Optimization is recommended. However, Configuration Manager supports 'Express updates' for feature updates? No, express updates are for quality updates. For feature updates, you can use 'Windows 10/11 feature update' via 'Windows servicing' or a task sequence. The best approach is to use a task sequence that downloads the upgrade content from a distribution point, but to minimize bandwidth, you can enable BranchCache or use 'Download content from distribution point and run locally'. Among the options, using a task sequence with 'Pre-stage content' on USB drives or using 'Download content from distribution point and run locally' is possible. But the question asks for 'in-place upgrade while preserving user data' and 'limited bandwidth'. Configuration Manager's 'Windows 10/11 feature update' deployment does not support preserving user data? Actually, the 'Feature update' method is an in-place upgrade that preserves apps and settings. It uses Delivery Optimization to download from peers and the internet, which can help with bandwidth. Option A is correct. Option B is wrong because a provisioning package is for new devices. Option C is wrong because Autopilot is not for in-place upgrade. Option D is wrong because a task sequence can preserve data but requires more bandwidth unless you pre-cache content.

Answer

Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.

Answer

Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.

Answer

Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.

Question 9

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

Accepted Answer

Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.. Intune uses 'Update rings for Windows 10 and later' to configure Windows Update settings. Within the update ring, you can set 'Automatic update behavior' to 'Auto install and reboot' or similar. Option C is correct. Option A is wrong because compliance policies don't control update installation. Option B is wrong because device configuration profiles can configure some update settings, but the dedicated update ring policy is the intended method. Option D is wrong because feature updates are for version upgrades, not quality updates.

Answer

Configure a device configuration profile with 'Windows Update for Business' settings.

Answer

Deploy a feature update policy to install the latest quality updates.

Answer

Create a device compliance policy that requires devices to have the latest updates.

Question 10

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices to authenticate to a corporate Wi-Fi network. Which TWO methods can you use to deploy the certificate?

Accepted Answer

Create a SCEP certificate profile in Intune.. Intune supports deploying certificates via SCEP or PKCS profiles. Option A and Option D are correct. Option B is wrong because a Wi-Fi profile can reference a certificate but does not deploy the certificate itself. Option C is wrong because a compliance policy does not deploy certificates. Option E is wrong because a VPN profile can reference a certificate but does not deploy it.

Answer

Create a device compliance policy that includes the certificate.

Answer

Create a Wi-Fi profile and embed the certificate in the profile.

Answer

Create a VPN profile that includes the certificate.

Question 11

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?

Accepted Answer

Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.. In Intune, you can use a device configuration profile (Settings Catalog) to configure 'AppLocker' or 'SmartScreen' settings. Specifically, 'AppLocker' can block non-store apps, and 'SmartScreen' can block unknown apps. Option A and Option D are correct. Option B is wrong because Windows Defender Firewall does not control app installation. Option C is wrong because BitLocker is for encryption. Option E is wrong because Windows Update for Business controls updates.

Answer

Set 'Windows Update for Business' to defer feature updates.

Answer

Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.

Answer

Enable 'BitLocker' to encrypt the system drive.

Question 12

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which THREE settings can you use?

Accepted Answer

Disable screen capture.. In Intune, for Android Enterprise, you can restrict screenshots using a device restrictions profile. The settings include 'Disable screen capture' (which prevents screenshots), 'Disable camera', and 'Disable copy and paste' can also help but are not directly about screenshots. However, the question asks for 'restricts the device from taking screenshots'. The actual setting is 'Disable screen capture'. Additionally, you can use 'Microsoft Defender for Endpoint' or 'Mobile Threat Defense' to detect screenshot attempts? No, that's not typical. The correct settings are: 'Disable screen capture' in device restrictions, 'Allow screenshots' (set to block), and possibly 'Disable Assistant'? No. The typical setting is 'Disable screen capture'. Since it's a 'Which THREE' and only one setting directly blocks screenshots, the other two could be 'Disable camera' and 'Disable copy and paste'? Not directly. Actually, there is also 'Disable screen share'? Not in Intune. I need to adjust: For Android, the device restrictions profile includes 'Disable screen capture' (under General). There is also 'Disable camera' and 'Disable copy and paste' under General. These three can be used together to restrict data leakage. So options: A, B, D. Option C is wrong because 'Disable Wi-Fi' does not restrict screenshots. Option E is wrong because 'Disable Bluetooth' does not.

Answer

Disable Bluetooth.

Answer

Disable Wi-Fi.

Question 13

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Accepted Answer

The virtual machine does not have Secure Boot enabled in its firmware settings.. Secure Boot is a hardware-based feature that ensures the system boots using only software that is trusted by the PC manufacturer. Virtual machines typically do not have Secure Boot enabled by default, or they may not support it. Option B is correct. Option A is wrong because the device might be managed. Option C is wrong because BitLocker is separate. Option D is wrong because the password policy is not related.

Answer

The device is not enrolled in Intune correctly.

Answer

The password policy is conflicting with Secure Boot.

Answer

The device does not have BitLocker enabled, which is required for Secure Boot.

Question 14

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown on a new Windows 11 device. The cmdlet completes successfully, but the device does not appear in Intune under Windows Autopilot devices. What is the most likely cause?

Accepted Answer

The user running the cmdlet does not have the required permissions in Intune.. The cmdlet 'Get-WindowsAutopilotInfo.ps1' with -Online uploads the hardware hash to Intune. For it to work, the device must have internet access and the user running the cmdlet must have the appropriate permissions in Intune (e.g., Intune Administrator role). Option D is correct. Option A is wrong because the cmdlet is for Autopilot, not for running on a device that is already Autopilot-registered. Option B is wrong because the device must be online. Option C is wrong because the group tag is optional and does not prevent upload.

Answer

The device does not have internet access.

Answer

The device is already registered in Autopilot, so the cmdlet does nothing.

Answer

The group tag 'Marketing' is invalid.

Question 15

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

Accepted Answer

The policy has not been assigned to the device or its user group.. The compliance policy has BitLockerEnabled set to $true, which should require BitLocker. However, the device might be showing as compliant because the policy has not been assigned to the device, or the device has not evaluated the policy. But the most likely reason from the options is that the device is not subject to the policy because it is not assigned. Option C is correct. Option A is wrong because the policy was created. Option B is wrong because the setting is correct. Option D is wrong because TPM is required but not related to BitLocker compliance directly.

Answer

The BitLocker setting is not supported on Windows 11.

Answer

The policy was not saved correctly due to a syntax error.

Answer

The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

Question 16

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Accepted Answer

Verify that the Company Portal app is installed and updated on the device.. Option C is correct because Android enrollment often requires the Company Portal app to be installed from Google Play. If the device has Google Play Services disabled or the app is missing, enrollment fails. Option A is wrong because the issue is specific to work profiles, not device administrator. Option B is wrong because the enrollment token is for Android Enterprise dedicated devices, not personally-owned work profiles. Option D is wrong because Intune Service to Service Connector is not relevant to this enrollment type.

Answer

Confirm that the Intune Service to Service Connector is configured.

Answer

Check that the enrollment token has not expired.

Answer

Ensure Device Administrator enrollment is enabled.

Question 17

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Option B is correct because custom security baselines in Intune are created by copying the built-in baseline and modifying settings. Option A is wrong because you cannot edit the built-in baseline directly. Option C is wrong because custom baselines are created from existing baselines, not from scratch. Option D is wrong because security baselines are not configured via compliance policies.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 18

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Option A is correct because requiring devices to be marked as compliant in Intune filters for corporate-owned devices. Option B is wrong because Hybrid Azure AD join does not distinguish corporate vs. personal. Option C is wrong because multi-factor authentication does not check device ownership. Option D is wrong because approval of the client app is not about device ownership.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 19

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

Accepted Answer

The user account lacks an Intune license.. Option D is correct because error 0x80180014 indicates that the user does not have an Intune license assigned. Option A is wrong because the device is already registered. Option B is wrong because the issue is not enrollment restrictions. Option C is wrong because the error is not related to TPM attestation.

Answer

Enrollment restrictions are blocking personal devices.

Answer

The device is not registered in Autopilot.

Answer

TPM attestation failed due to hardware incompatibility.

Question 20

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

Accepted Answer

Microsoft 365 Apps. Option B is correct because Microsoft 365 Apps for Windows is a built-in app type in Intune. Option A is wrong because Windows app (Win32) is for custom applications. Option C is wrong because Microsoft Store app is for store-based apps. Option D is wrong because the web link is for linking to external sources.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app