Courseiva

CCNA Prepare infrastructure for devices Questions

75 of 237 questions · Page 1/4 · Prepare infrastructure for devices · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom VPN configuration that uses per-app VPN and certificate-based authentication. The certificate is already deployed via a PKCS certificate profile. However, the VPN connection fails. What is the most likely reason?

A.The certificate is not trusted by the device
B.The per-app VPN profile does not include the app bundle IDs or is not associated with the certificate
C.The VPN profile is not assigned to the correct device group
D.The VPN server type is not supported by iOS
AnswerB

The per-app VPN profile must specify the apps and associate the certificate.

Why this answer

Per-app VPN on iOS requires a VPN profile that includes the app identifier list and associates it with the certificate, and the certificate must be properly configured. Option A is wrong because the certificate is already deployed. Option C is wrong because per-app VPN does not require a separate MDM profile for each app.

Option D is wrong because the VPN server type is not necessarily the issue.

Practice this question →
2
Multi-Selectmedium

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Select 2 answers
A.Enforce security baselines on devices
B.Convert existing devices to Autopilot by uploading hardware hash
C.Deploy third-party applications automatically
D.Customize the out-of-box experience (OOBE) for users
E.Configure BIOS settings remotely
AnswersB, D

Allows redeploying existing devices.

Why this answer

Windows Autopilot allows you to import a hardware hash (a unique device identifier) from existing devices into Intune, converting them into Autopilot devices. This enables you to apply Autopilot deployment profiles and customize the OOBE without requiring a full OS reinstall, leveraging the device's existing identity.

Exam trap

The trap here is that candidates confuse Windows Autopilot's OOBE customization capabilities with broader device management features like security baselines or third-party app deployment, which are handled by Intune policies after enrollment, not during the Autopilot provisioning phase.

Practice this question →
3
MCQhard

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

A.The device does not meet authentication requirements
B.The enrollment is restricted to Windows Holographic only
C.The device type filter excludes Windows 10
D.The user already has 5 devices enrolled
AnswerA

requireDeviceAuthentication prevents enrollment without proper device auth.

Why this answer

The JSON configuration includes an 'authenticationRequirement' setting that mandates multifactor authentication (MFA) for enrollment. Since the user's device or account does not meet this MFA requirement, the enrollment is blocked. Authentication requirements are a common cause of enrollment failures, and the error message 'enrollment is blocked' typically aligns with such policy violations rather than version restrictions or device count limits.

Exam trap

The trap is that candidates may focus on version range but the actual block is due to authentication requirements specified in the JSON.

How to eliminate wrong answers

Option A is incorrect because the error is not related to authentication; the JSON does not contain any authentication-related settings (e.g., 'requireMultiAuth' or 'deviceEnrollmentLimit'). Option B is incorrect because the JSON does not specify 'deviceType' or 'platform' restrictions; it only filters by OS version, not by Holographic or any specific SKU. Option C is incorrect because the device type filter is not present in the JSON; the restriction is based on OS version range, not device type.

Option D is incorrect because the JSON does not include a 'deviceEnrollmentLimit' key; the user's device count is not restricted by this configuration.

Practice this question →
4
MCQmedium

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

A.Configure enrollment restrictions to require corporate ownership
B.Set device type restrictions to block unregistered devices
C.Configure automatic enrollment via Group Policy
D.Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment
AnswerD

This ensures devices are registered in Entra ID before they can enroll in Intune.

Why this answer

Microsoft Entra ID (formerly Azure AD) registration or join is a prerequisite for Intune enrollment. Intune requires a device to have an identity in Entra ID to apply policies and manage compliance. Without this prerequisite, the device cannot authenticate or receive management commands from Intune.

Exam trap

The trap here is that candidates often confuse 'enrollment restrictions' (which control device platform or ownership) with the prerequisite of having an Entra ID identity, leading them to select Option A or B instead of understanding that Entra ID registration is a separate, mandatory step before Intune enrollment can proceed.

How to eliminate wrong answers

Option A is wrong because enrollment restrictions for corporate ownership control how devices are marked (e.g., personal vs. corporate), not whether they are registered in Entra ID. Option B is wrong because device type restrictions block specific platforms or OS versions, not unregistered devices; there is no built-in restriction to block devices that lack an Entra ID registration. Option C is wrong because automatic enrollment via Group Policy enables Intune enrollment for domain-joined devices but does not enforce that the device must be registered in Entra ID before enrollment; it uses a different enrollment method (GPO-triggered MDM enrollment) that may not require prior Entra ID registration.

Practice this question →
5
MCQhard

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

A.To output the device names of all Windows devices.
B.To list the IDs of Windows devices.
C.To list devices that are registered in Autopilot.
D.To update the enrollment type of all Windows devices.
AnswerB

Correct. The script lists the unique IDs (`DeviceId`) of all Windows devices in Microsoft Entra ID. While the option says 'joined', the script does not filter by join type; it returns all Windows devices in the directory.

Why this answer

The script uses Get-MgDevice with a filter for operatingSystem eq 'Windows' to retrieve all Windows device objects from Microsoft Entra ID, regardless of their join type (joined, registered, or hybrid). By selecting the DeviceId property, it outputs the unique identifiers of these devices. The DeviceId is the Entra ID object identifier, not the device name or Autopilot registration status.

Exam trap

The trap here is confusing DeviceId (the Entra ID object ID) with the device name or Autopilot registration, leading candidates to select options about listing names or Autopilot devices instead of device IDs.

How to eliminate wrong answers

Option A is wrong because the script selects `DeviceId`, not `DisplayName` or `DeviceName`; it outputs IDs, not device names. Option C is wrong because `Get-MgDevice` retrieves all Entra ID registered/joined devices, not specifically Autopilot-registered devices; Autopilot devices are listed via `Get-MgDeviceManagementWindowsAutopilotDeviceIdentity`. Option D is wrong because the script only reads device data with a `Select` operation; it does not call any `Update-MgDevice` cmdlet or modify enrollment type.

Practice this question →
6
MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

A.Set feature update deferral to 180 days and quality update deferral to 0 days.
B.Set feature update deferral to 30 days and quality update deferral to 120 days.
C.Set feature update deferral to 120 days and quality update deferral to 30 days.
D.Set both feature and quality update deferrals to 60 days.
AnswerC

This matches the required deferral periods.

Why this answer

The Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Exam trap

The trap here is that candidates often confuse the deferral periods for feature and quality updates, mistakenly swapping the values or assuming a single deferral applies to both, when the question explicitly requires independent settings for each update type.

How to eliminate wrong answers

Option A is wrong because setting feature update deferral to 180 days exceeds the required 120-day deferral, and setting quality update deferral to 0 days provides no deferral, failing the 30-day requirement. Option B is wrong because it reverses the deferral periods: feature updates would be deferred only 30 days (not 120) and quality updates would be deferred 120 days (not 30), which does not match the specified requirements. Option D is wrong because setting both deferrals to 60 days would defer feature updates by only 60 days instead of the required 120 days, and quality updates by 60 days instead of 30 days, failing both conditions.

Practice this question →
7
MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

A.Create a device configuration profile that requires iOS 16.0.
B.Modify the enrollment profile to require iOS 16.0.
C.Create a compliance policy that requires iOS 16.0 or later.
D.Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.
AnswerD

Platform restrictions block devices with older OS versions during enrollment.

Why this answer

Enrollment platform restrictions allow you to set a minimum OS version for enrollment, preventing devices with older iOS versions from enrolling. Option A is incorrect because a device configuration profile is applied after enrollment and manages device settings, not enrollment requirements. Option B is incorrect because the enrollment profile defines the enrollment method (e.g., user vs. device enrollment), not OS version restrictions.

Option C is incorrect because a compliance policy is applied after enrollment; it can mark devices as non-compliant but does not block enrollment itself.

Practice this question →
8
Multi-Selecthard

Which THREE actions can be taken from the Intune admin center when a device is retired?

Select 3 answers
A.Retire
B.Remote lock
C.Reset passcode
D.Wipe
E.Delete
AnswersA, D, E

Retirement is the action itself.

Why this answer

When a device is retired in Intune, the device record is removed from management, and the device is no longer subject to compliance policies or conditional access. The Retire action (A) is the primary action that removes the device from Intune without wiping corporate data, while the Wipe action (D) resets the device to factory defaults and removes all data. The Delete action (E) permanently removes the device object from the Intune console, which is also available from the device blade after retirement or wipe.

Exam trap

The trap here is that candidates confuse the Retire action with the Wipe action, or assume that Remote lock and Reset passcode are part of the retire workflow, when in fact they are independent remote actions that do not remove the device from management.

Practice this question →
9
MCQeasy

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

A.The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.
B.The Configuration Manager client and a site code for automatic site assignment.
C.A provisioning package containing the MDM enrollment settings.
D.A Group Policy Object that configures automatic MDM enrollment.
AnswerA

Autopilot requires the hardware hash to identify the device and the profile to define the deployment settings.

Why this answer

Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Exam trap

The trap here is that candidates often confuse provisioning packages (PPKG) with Autopilot, but Autopilot is specifically designed to eliminate the need for any local media or manual steps, relying solely on cloud-based device identity and profile assignment.

How to eliminate wrong answers

Option B is wrong because the Configuration Manager client and site code are used for co-management or traditional client management, not for Windows Autopilot's zero-touch provisioning which relies on cloud-based enrollment via Intune. Option C is wrong because a provisioning package (PPKG) is used for manual or bulk provisioning via Windows Configuration Designer, not for the automatic, cloud-driven Autopilot process that requires no local media or USB drive. Option D is wrong because Group Policy Objects (GPOs) are applied after the device is already joined to the domain and enrolled, and they cannot trigger the initial Autopilot enrollment flow which happens before the device has network access to a domain controller.

Practice this question →
10
MCQhard

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

A.The device does not have a valid certificate profile.
B.The Intune Management Extension is not installed.
C.The device has a non-compliant component that prevents policy application.
D.The device's enrollment token has expired.
AnswerC

If a device is non-compliant, it may not receive further policies until remediated.

Why this answer

A non-compliant component (e.g., an outdated OS version, missing required app, or misconfigured setting) can cause the device to be marked as 'Not evaluated' if the compliance policy cannot be processed. The device is enrolled but the policy engine fails to evaluate compliance due to an underlying issue. Option A is incorrect: Certificate profiles are used for resource access, not for compliance evaluation.

Option B is incorrect: The Intune Management Extension is for deploying Win32 apps and PowerShell scripts, not for compliance policies. Option D is incorrect: Enrollment tokens are used for enrollment; if expired, the device would not be enrolled at all.

Practice this question →
11
MCQmedium

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

A.Device restrictions configuration policy
B.Device compliance policy
C.App configuration policy
D.Enrollment restriction
AnswerA

Device restrictions configuration policy includes the setting to block installation of apps from unknown sources on Android Enterprise devices.

Why this answer

Device restrictions configuration policy includes the setting to block installation of apps from unknown sources on Android Enterprise devices. Option B (Device compliance policy) is incorrect because compliance policies enforce security requirements but do not block app installations. Option C (App configuration policy) is incorrect because app configuration policies are used to pre-configure app settings, not to restrict installation.

Option D (Enrollment restriction) is incorrect because enrollment restrictions control whether devices can enroll, not app installation behavior.

Practice this question →
12
Multi-Selecthard

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Select 3 answers
A.Apple Push Notification service certificate (for iOS)
B.Intune licenses assigned to users
C.Microsoft Entra ID (for identity and device registration)
D.Microsoft Intune subscription (for MDM authority)
E.Configuration Manager (for co-management)
AnswersB, C, D

Users must have Intune licenses to enroll devices.

Why this answer

Intune licenses must be assigned to users to grant them access to the service. Without a license, the user cannot authenticate with Intune, and automatic enrollment will fail during the device registration step. This is a prerequisite enforced by Microsoft Entra ID and Intune together.

Exam trap

The trap here is that candidates often confuse prerequisites for device management (like APNs certificate) with prerequisites for automatic enrollment, leading them to select Apple Push Notification service certificate as a required component when it is only needed after enrollment for iOS device management.

Practice this question →
13
Multi-Selecteasy

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Select 2 answers
A.Android Zero Touch.
B.Microsoft Entra ID join with automatic MDM enrollment.
C.Apple Business Manager.
D.Windows Autopilot.
E.Samsung Knox Mobile Enrollment.
AnswersB, D

Microsoft Entra ID join with automatic MDM enrollment automatically enrolls Windows devices in Intune when they join Entra ID.

Why this answer

The correct answers are B (Microsoft Entra ID join with automatic MDM enrollment) and D (Windows Autopilot). Both are valid methods to enroll Windows devices into Microsoft Intune. Option A (Android Zero Touch) is for Android devices, not Windows.

Option C (Apple Business Manager) is for Apple devices. Option E (Samsung Knox Mobile Enrollment) is for Samsung Android devices.

Practice this question →
14
MCQhard

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

A.Upload the hardware hash to Microsoft Intune to register the device.
B.Assign an Autopilot deployment profile to the device group.
C.Run the script again with the -Online parameter.
D.Use a provisioning package to set up the device manually.
AnswerA

Registration is required for Autopilot to work.

Why this answer

The Get-AutopilotInfo script collects the hardware hash and device details but does not automatically register the device with Autopilot. A 'DeviceState' of 'Unknown' and 'AssignmentStatus' of 'NotAssigned' indicate the device is not yet registered in Intune. Uploading the hardware hash to Intune is the required first step to register the device, enabling Autopilot to recognize it and assign profiles.

Exam trap

The trap here is that candidates assume running the script with an online parameter (like -Online) would automatically register the device, but the script is offline-only and requires manual upload of the hardware hash to Intune.

How to eliminate wrong answers

Option B is wrong because assigning an Autopilot deployment profile to a device group is only possible after the device is registered in Intune; without registration, the device is not in any group and cannot receive profiles. Option C is wrong because the Get-AutopilotInfo script does not support an -Online parameter; the script is designed to run locally and output a CSV file for manual upload. Option D is wrong because using a provisioning package bypasses Autopilot entirely and is used for manual, non-Autopilot provisioning, which does not prepare the device for Autopilot deployment.

Practice this question →
15
MCQmedium

You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?

A.Configure a device compliance policy to mark the device as non-compliant.
B.Enable 'Manual investigation' in the endpoint security policy.
C.Create an alert rule in Microsoft Defender XDR to notify administrators.
D.Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.
AnswerD

Automatic remediation allows Defender to take action on detected threats.

Why this answer

Enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.

Exam trap

The trap here is that candidates often confuse alerting or compliance policies with actual remediation actions, mistakenly thinking that marking a device non-compliant or creating an alert will automatically remediate the threat, when in fact only the antivirus policy's automatic remediation setting directly triggers the remediation action on the device.

How to eliminate wrong answers

Option A is wrong because configuring a device compliance policy to mark the device as non-compliant only triggers conditional access restrictions or user notifications; it does not perform any remediation action on the detected threat itself. Option B is wrong because 'Manual investigation' is not a valid setting in endpoint security policies; Microsoft Defender for Endpoint uses automated investigation and response (AIR) capabilities, and manual investigation is a separate process, not a configuration toggle. Option C is wrong because creating an alert rule in Microsoft Defender XDR only sends notifications to administrators about detected threats; it does not cause the device to automatically receive a remediation action.

Practice this question →
16
MCQmedium

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

A.Use the Microsoft Store for Business to automatically register devices
B.Contact the OEM to register the devices using the device serial numbers
C.Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings
D.Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center
AnswerD

This is the standard method to register devices.

Why this answer

Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center is the standard method to register devices for Windows Autopilot. Option A is incorrect because the Microsoft Store for Business is deprecated and no longer supports Autopilot registration. Option B is incorrect because while OEMs can register devices, you already have the hardware hashes, making direct upload more efficient.

Option C is incorrect because Windows Configuration Designer is used to create provisioning packages for manual setup, not for Autopilot device registration.

Practice this question →
17
MCQeasy

You need to deploy a line-of-business (LOB) app to 100 iOS devices managed by Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

A.Upload the app package as an iOS LOB app in Intune
B.Add the app as a Volume Purchase Program (VPP) app
C.Use an Enterprise Code Signing certificate to deploy via MDM
D.Publish the app to the Apple App Store and deploy as public app
AnswerA

Direct method for custom enterprise apps.

Why this answer

Intune supports deploying internally developed LOB apps to iOS devices by uploading the signed .ipa package directly. Since the app is already signed with an enterprise certificate, it can be distributed via Intune's iOS LOB app workflow without requiring the Apple App Store or VPP.

Exam trap

The trap here is confusing the signing certificate (used to sign the app) with the deployment method, leading candidates to select Option C, which describes a prerequisite rather than a distribution mechanism.

How to eliminate wrong answers

Option B is wrong because Volume Purchase Program (VPP) apps are purchased from the Apple App Store and assigned to devices via managed distribution, not used for custom LOB apps. Option C is wrong because Enterprise Code Signing certificates are used to sign the app, not as a deployment method; MDM deploys the app via Intune's LOB app upload, not by using the certificate directly. Option D is wrong because publishing to the Apple App Store is unnecessary and contradicts the requirement to deploy a signed LOB app; public apps are for store-distributed apps, not enterprise-signed ones.

Practice this question →
18
MCQhard

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

A.Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.
B.Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.
C.Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.
D.Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.
AnswerB

Feature updates in ConfigMgr perform in-place upgrades and can use Delivery Optimization to reduce bandwidth.

Why this answer

It leverages Configuration Manager's 'Windows 10/11 feature update' servicing plan, which is specifically designed for in-place upgrades while preserving user data and settings. Enabling Delivery Optimization for peer-to-peer download reduces bandwidth consumption in remote offices by allowing devices to share upgrade content locally, addressing the limited bandwidth constraint.

Exam trap

The trap here is that candidates may confuse provisioning packages (Option A) as a valid upgrade method, but they are designed for offline provisioning and cannot perform an in-place upgrade with user data preservation, while the feature update servicing plan is the correct, supported method for this scenario.

How to eliminate wrong answers

Option A is wrong because provisioning packages are intended for initial device configuration and offline deployment, not for in-place upgrades; they cannot orchestrate a Windows 11 upgrade while preserving existing user data and settings. Option C is wrong because Windows Autopilot reset wipes the device and reinstalls Windows, which does not preserve user data and settings; restoring from OneDrive is a separate process and not part of an in-place upgrade. Option D is wrong because configuring a task sequence to download content from the internet does not inherently reduce distribution point load; it shifts the download source to the internet, which may still consume significant bandwidth unless combined with peer caching or Delivery Optimization, and the task sequence method is more complex than the dedicated feature update servicing plan.

Practice this question →
19
MCQmedium

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

A.The update ring is configured with an incorrect deferral period.
B.The device is not compliant with the security baseline.
C.Windows Update is blocked by the corporate firewall.
D.The update ring is not assigned to the device's group.
AnswerD

Without proper assignment, the policy does not apply to the device.

Why this answer

The device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Exam trap

The trap here is that candidates assume a compliant device with a correctly configured policy will always receive updates, but they overlook the critical step of verifying that the device is actually a member of the assigned group, which is a separate prerequisite from compliance or policy configuration.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the deferral period is set correctly in the Windows Update for Business logs, so an incorrect deferral period is not the cause. Option B is wrong because the device is reported as compliant, and compliance with a security baseline is not a prerequisite for receiving update ring policies; update rings are applied via policy assignment, not compliance status. Option C is wrong because if Windows Update were blocked by a corporate firewall, the device would likely show errors connecting to Windows Update services, but the logs confirm the deferral period is correctly set, indicating the policy is being processed locally; a firewall block would prevent updates from downloading, not prevent the policy from being applied.

Practice this question →
20
Multi-Selecthard

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy an app that requires a VPN configuration when the app is launched. Which TWO options can you use to achieve this? (Choose two.)

Select 2 answers
A.Use a managed app configuration to include VPN settings.
B.Use a device compliance policy to require VPN.
C.Assign an app protection policy that enables VPN.
D.Create a device-wide VPN configuration profile.
E.Create a per-app VPN configuration profile and assign it to the app.
AnswersA, E

Managed app configuration can include VPN settings to apply when the app launches.

Why this answer

Options A and E are correct. A per-app VPN configuration profile (E) can be assigned to the app to trigger VPN on launch. Alternatively, a managed app configuration (A) can include VPN settings to enable per-app VPN.

Option B is incorrect because a device compliance policy cannot configure VPN settings. Option C is incorrect because app protection policies do not manage VPN connectivity. Option D is incorrect because a device-wide VPN profile applies to all traffic and does not restrict to specific apps.

Practice this question →
21
Multi-Selectmedium

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Select 2 answers
A.A user account with Intune license
B.A Windows product key
C.MDM user affinity
D.TPM 2.0 chip
E.Network connectivity to Microsoft Intune
AnswersD, E

TPM 2.0 is required for hardware attestation.

Why this answer

Options D and E are correct. Self-deploying mode requires a physical TPM 2.0 chip for attestation and network connectivity to Microsoft Intune. Option A is wrong because a user account is not required.

Option B is wrong because a product key is not needed. Option C is wrong because MDM user affinity is not required.

Practice this question →
22
MCQmedium

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

A.Set up a device compliance policy in Microsoft Purview to block non-compliant devices.
B.Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.
C.Configure a device filter in Exchange Online to block devices that are not managed by Intune.
D.Deploy an email security policy via Intune to block access from non-compliant devices.
AnswerB

This correctly combines Intune compliance with Entra ID Conditional Access to block non-compliant devices.

Why this answer

Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.

Exam trap

The trap here is that candidates confuse device compliance enforcement with email security profiles or legacy device filters, not realizing that Conditional Access in Entra ID is the only modern, cloud-native method to gate access based on Intune compliance for Exchange Online.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview is a compliance and data governance solution, not a device access control tool; it does not enforce device compliance for email access. Option C is wrong because Exchange Online device filters are legacy and only block devices based on properties like device type or OS, not compliance status managed by Intune. Option D is wrong because Intune email security policies configure email profile settings (e.g., server, encryption) on managed devices but do not block access from non-compliant devices at the authentication layer.

Practice this question →
23
Multi-Selecthard

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Select 2 answers
A.Configuration Manager
B.Microsoft Entra ID Connect
C.Public Key Infrastructure (PKI)
D.Multifactor authentication (MFA)
E.Microsoft Intune
AnswersB, C

Synchronizes on-premises AD with Microsoft Entra ID.

Why this answer

In a hybrid deployment, Windows Hello for Business requires synchronization of user credentials from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID Connect (B) provides this synchronization, enabling the device to authenticate against both on-premises and cloud resources. Additionally, a Public Key Infrastructure (PKI) (C) is required to issue the certificate-based authentication keys used by Windows Hello for Business in hybrid deployments, as the on-premises domain controllers must trust the certificates.

Exam trap

The trap here is that candidates often confuse prerequisites (like MFA) with required infrastructure components, leading them to select MFA instead of recognizing that PKI and directory synchronization are the two mandatory elements for hybrid deployments.

Practice this question →
24
MCQhard

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the system context during automatic enrollment. The script must run before the user logs on. Which approach should you use?

A.Add the script as a device management extension (PowerShell script) in Intune, assigned to 'All Devices'.
B.Assign the script as a compliance policy remediation.
C.Deploy the script as a proactive remediation in Microsoft Intune.
D.Embed the script in a device configuration profile using a custom OMA-URI.
AnswerA

Device management extension scripts run in system context during enrollment.

Why this answer

Device management extension (PowerShell scripts) in Microsoft Intune run in the system context and execute during automatic enrollment before the user logs on. This is the only Intune method that supports system-context script execution at enrollment time without requiring a user session.

Exam trap

The trap here is that candidates confuse proactive remediations (which also run PowerShell scripts) with device management extension scripts, not realizing that proactive remediations require a user session and are intended for post-enrollment health checks, not pre-logon provisioning.

How to eliminate wrong answers

Option B is wrong because compliance policy remediations run only after the device has been evaluated for compliance, which occurs after enrollment and user logon, not before. Option C is wrong because proactive remediations are designed for ongoing detection and remediation of common support issues, not for first-run deployment during automatic enrollment. Option D is wrong because custom OMA-URI profiles are used to configure device settings via CSPs, not to execute PowerShell scripts in the system context.

Practice this question →
25
Multi-Selectmedium

Which TWO Intune policies can be used to enforce encryption on macOS devices?

Select 2 answers
A.Device Compliance policy that requires BitLocker.
B.Device Compliance policy that requires Disk Encryption.
C.Device Configuration policy (Device Restrictions) for Disk Encryption.
D.Device Configuration policy (Endpoint Protection) for FileVault.
E.Device Compliance policy that requires FileVault.
AnswersD, E

This policy configures FileVault settings.

Why this answer

FileVault is the native full-disk encryption solution for macOS, and Intune's Device Configuration policy (Endpoint Protection) provides a dedicated profile to enable and enforce FileVault encryption. Option E is correct because a Device Compliance policy can also require FileVault encryption as a compliance setting, allowing conditional access to block non-compliant devices.

Exam trap

The trap here is that candidates confuse the generic 'Disk Encryption' term with the macOS-specific FileVault, or assume that BitLocker (a Windows-only feature) can be applied to macOS, leading them to select options A or B instead of the correct FileVault-based answers.

Practice this question →
26
MCQhard

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

A.Deploy Windows Autopilot for all new devices and ignore existing devices.
B.Purchase a third-party MDM tool to manage non-compliant devices.
C.Ask all users to manually enroll their devices using the Company Portal app.
D.Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.
AnswerD

This leverages automation and policy enforcement to increase enrollment.

Why this answer

It leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Exam trap

The trap here is that candidates may assume manual enrollment (Option C) is sufficient, overlooking the scalability and enforcement capabilities of automatic enrollment and Conditional Access, which are essential for achieving high enrollment rates in a large enterprise with mixed device platforms.

How to eliminate wrong answers

Option A is wrong because ignoring existing devices leaves 40% of the current fleet unmanaged, failing to meet the 95% enrollment target; Windows Autopilot is only for new devices and does not address existing non-compliant Android devices. Option B is wrong because purchasing a third-party MDM tool introduces unnecessary cost and complexity, and does not integrate with Intune or Microsoft Defender for Endpoint, which is required for Windows devices; the goal is to increase Intune enrollment, not replace it. Option C is wrong because relying solely on manual enrollment via Company Portal is inefficient and unlikely to achieve 95% enrollment within 6 months, as it depends on user initiative and does not enforce compliance for non-compliant Android devices.

Practice this question →
27
MCQeasy

A user reports that their Windows device is not appearing in the Intune console after enrollment. The device is joined to Microsoft Entra ID and the user has an Intune license. What should you check first?

A.Ensure that the MDM user scope in Microsoft Entra ID is set to 'All' or 'Some'.
B.Assign an Intune license to the device.
C.Verify that enrollment restrictions are not blocking the device.
D.Check if the device is compliant.
AnswerA

The MDM user scope controls automatic enrollment.

Why this answer

The most common reason a device fails to appear in the Intune console after enrollment is that the MDM user scope in Microsoft Entra ID is not configured to include the user. The MDM user scope determines which users can automatically enroll their devices into Intune; if it is set to 'None', enrollment is blocked entirely. Since the device is already joined to Microsoft Entra ID and the user has an Intune license, the first step is to verify this scope setting.

Exam trap

The trap here is that candidates often jump to troubleshooting enrollment restrictions or compliance policies, overlooking the foundational MDM user scope which must be explicitly configured to allow enrollment to proceed.

How to eliminate wrong answers

Option B is wrong because Intune licenses are assigned to users, not devices; the user already has a license, so assigning one to the device is not a valid action. Option C is wrong because enrollment restrictions (e.g., platform or version blocks) would typically cause an enrollment failure with an error message, not a silent absence from the console after a successful join. Option D is wrong because device compliance is evaluated after enrollment and does not affect whether the device appears in the Intune console; a non-compliant device still shows up.

Practice this question →
28
MCQmedium

Your organization recently deployed Windows 11 devices managed by Microsoft Intune. You need to ensure that only approved third-party drivers are installed on these devices. What is the best approach?

A.Deploy a Windows Driver Frameworks (WDF) Coinstaller to enforce driver signing.
B.Use Device Installation Restrictions to allow only approved hardware IDs.
C.Configure Windows Update for Business group policy settings to block driver updates from Windows Update.
D.Configure a Windows Defender Application Control policy to block unsigned drivers.
AnswerD

Correct. Windows Defender Application Control (WDAC) enforces a code integrity policy that allows only drivers signed by trusted publishers or with specific hashes to install. This ensures that only approved third-party drivers can be installed, regardless of the source.

Why this answer

Windows Defender Application Control (WDAC) allows you to configure code integrity policies that restrict driver installation to only those that are signed by approved publishers or have known-good hashes. This ensures that only approved third-party drivers, as defined by your organization's policy, can be installed, regardless of the installation source (Windows Update, manual, or otherwise). Option C is insufficient because blocking driver updates from Windows Update does not prevent manual installation of unapproved drivers.

Options A and B do not provide a comprehensive enforcement mechanism for driver approval.

Exam trap

Candidates often assume that blocking driver updates from Windows Update is sufficient, but this does not prevent manual installation or side-loading of drivers. WDAC provides a stronger control by enforcing code integrity at installation time.

How to eliminate wrong answers

Option A is wrong because Windows Driver Frameworks (WDF) Coinstaller is used to install and register driver packages, not to enforce driver signing; it does not restrict which drivers can be installed. Option B is wrong because Device Installation Restrictions based on hardware IDs can block specific devices but do not control driver updates from Windows Update; they are designed to prevent installation of devices, not drivers. Option D is wrong because Windows Defender Application Control (WDAC) blocks unsigned binaries from executing, but it does not specifically target driver updates from Windows Update; it is a broader security control that can block legitimate signed drivers if not properly configured, and it is not the best approach for simply restricting driver updates.

Practice this question →
29
MCQhard

Refer to the exhibit. An Intune compliance policy JSON for Windows 10 devices. A device with OS version 10.0.19041.1 and no encryption reports as noncompliant. What is the most likely reason?

A.The OS version exceeds the maximum allowed version.
B.The password type is set to 'deviceDefault' which does not support numeric PIN.
C.The OS version is below the minimum requirement.
D.The device does not have BitLocker encryption enabled.
AnswerD

The policy requires encryption (storageRequireEncryption: true), and since the device lacks encryption, it is noncompliant.

Why this answer

The compliance policy specifies storageRequireEncryption: true, but the device does not have BitLocker encryption enabled, causing noncompliance. Option A is incorrect because the OS version 10.0.19041.1 is below the maximum allowed (10.0.19044.1). Option B is incorrect because 'deviceDefault' allows any valid Windows password type, including numeric PIN.

Option C is incorrect because the OS version is above the minimum required (10.0.19041.0).

Practice this question →
30
MCQmedium

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

A.The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.
B.The OS build is greater than the maximum version specified.
C.The OS build is less than the minimum version.
D.The policy requires a password but the devices have no password.
AnswerB

Correct. The maximum version is exclusive, so build 22621 equals the maximum and is not less than it, making devices non-compliant.

Why this answer

The policy defines the maximum OS version as 10.0.22621.0 (Windows 10 22H2), but the device is running a build that exceeds this maximum. Although the device build is 22621, the policy may interpret the build range as exclusive, or the device has a newer build (e.g., 22631) that is greater than the maximum. In either case, the OS build is greater than the allowed maximum, causing non-compliance.

Option A is incorrect because the validOperatingSystemBuildRanges property is not the issue. Option C is incorrect because the build is not less than the minimum version. Option D is incorrect because the policy does not require a password.

Exam trap

Intune's osMaximumVersion is exclusive; a build equal to the maximum is non-compliant.

Practice this question →
31
Multi-Selecthard

Which THREE permissions are required for a service account to register devices in Windows Autopilot? (Select THREE.)

Select 3 answers
A.Intune Administrator role
B.Security Reader role
C.Global Administrator role
D.Windows Autopilot device enrollment manager (DEM) permissions
E.Microsoft Entra ID join permission
AnswersA, D, E

This role allows managing Autopilot devices.

Why this answer

The Intune Administrator role is required because it grants the necessary permissions to manage Windows Autopilot deployment profiles, upload device hashes, and assign profiles to devices within the Microsoft Intune admin center. Without this role, a service account cannot configure or monitor the Autopilot registration process, as it is a core Intune workload.

Exam trap

The trap here is that candidates often select Global Administrator thinking it is required for all administrative tasks, but Microsoft explicitly recommends using the Intune Administrator role combined with DEM permissions to follow least-privilege principles for Autopilot registration.

Practice this question →
32
MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a Windows 10 feature update policy to keep devices on a specific version. After deployment, some devices report that the update is not being offered. The devices are not in a maintenance window. What is the most likely cause?

A.The devices are running a build that is newer than the target version
B.Windows Update for Business deferral or pause settings are blocking the update
C.The policy is not assigned to the correct group
D.The devices are in a maintenance window that blocks updates
AnswerB

Deferral or pause can prevent the update from being offered.

Why this answer

The most likely cause is that Windows Update for Business deferral or pause settings are blocking the update. Feature update policies in Intune rely on Windows Update for Business to deliver updates. If a device has deferral periods set (e.g., for quality or feature updates) or has updates paused, the policy will not apply until those settings are cleared.

Options A and D are incorrect: a newer build does not prevent the policy from targeting, and devices not in a maintenance window would still receive updates. Option C is possible but less likely, as the policy assignment would typically be verified before deployment.

Practice this question →
33
MCQhard

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

A.The SharePoint site is configured to allow access only from specific IP ranges
B.The device compliance policy has a grace period for non-compliance, and the device is still within that period
C.An app protection policy is blocking access to SharePoint from the browser
D.A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome
AnswerD

Conditional Access can require approved client apps; using an unapproved app can block access.

Why this answer

When a Conditional Access policy requires the use of Microsoft Edge or the Microsoft Authenticator app for accessing SharePoint, users attempting to use Chrome on Android will be blocked. The devices show as compliant in Intune, so the issue is not device compliance but the requirement for a specific approved client app. This policy enforces app-based conditional access, which overrides browser access unless the approved app is used.

Exam trap

The trap here is that candidates assume device compliance is the only factor for access, overlooking that Conditional Access policies can enforce app-level requirements even on compliant devices, causing a false sense of security when devices show as compliant.

How to eliminate wrong answers

Option A is wrong because IP range restrictions would block all traffic from outside those ranges, not just from Chrome on compliant devices, and the issue is specific to the browser used. Option B is wrong because a grace period for non-compliance would allow access temporarily, but the devices are already compliant, so no grace period is active. Option C is wrong because an app protection policy (MAM) blocks data transfer or access from unmanaged apps, but it does not specifically block SharePoint access from a browser; it would apply to apps, not the browser itself, and the issue is browser-specific.

Practice this question →
34
MCQeasy

You need to configure Intune to automatically retire devices that have not checked in for 90 days. Where should you set this?

A.Compliance policies
B.Enrollment restrictions
C.Windows Autopilot devices blade
D.Device cleanup rules in Intune admin center
AnswerD

This allows automatic retirement of inactive devices.

Why this answer

Device cleanup rules in the Intune admin center allow administrators to automatically retire or delete devices that have not checked in for a specified number of days. This is the correct location because the rule is specifically designed for lifecycle management of stale devices, not for compliance or enrollment policies. Setting the threshold to 90 days ensures that devices exceeding that inactivity period are removed from management.

Exam trap

The trap here is that candidates often confuse compliance policies (which can mark devices as non-compliant for inactivity) with the actual retirement action, but compliance policies do not automatically retire devices—they only trigger conditional access or user notifications, whereas device cleanup rules perform the actual removal.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device configuration and health against rules (e.g., requiring encryption or a minimum OS version) and can mark devices as non-compliant, but they do not automatically retire devices based solely on check-in inactivity. Option B is wrong because enrollment restrictions control which devices can enroll (e.g., by platform, OS version, or device manufacturer) and do not manage post-enrollment lifecycle actions like retirement. Option C is wrong because the Windows Autopilot devices blade is used to manage Autopilot deployment profiles and device registration for zero-touch provisioning, not to configure automatic retirement rules for stale devices.

Practice this question →
35
MCQhard

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

A.Devices must have line-of-sight to an on-premises domain controller.
B.Devices must have VPN connectivity to Azure.
C.An Intune connector for Active Directory must be installed.
D.Azure AD Connect must be configured with password hash sync.
AnswerA

Required to join the domain during Autopilot.

Why this answer

For hybrid Azure AD join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Exam trap

The trap here is that candidates often confuse the Intune connector for Active Directory (which is needed for device writeback in hybrid scenarios) with the actual domain join requirement, but the connector does not replace the need for direct line-of-sight to a domain controller.

How to eliminate wrong answers

Option B is wrong because VPN connectivity to Azure is not required; the device needs connectivity to on-premises domain controllers, not Azure. Option C is wrong because the Intune connector for Active Directory is used for device writeback and synchronization, not for the domain join step itself. Option D is wrong because password hash sync is a feature of Azure AD Connect for authentication, not a prerequisite for hybrid Azure AD join; the device must be able to authenticate to the on-premises domain controller directly.

Practice this question →
36
MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode longer than six characters can access corporate email. Which type of policy should you configure?

A.Device configuration profile
B.Device compliance policy
C.Enrollment restriction
D.App protection policy
AnswerB

Compliance policies check passcode length and are used with Conditional Access for access control.

Why this answer

Device compliance policies in Microsoft Intune evaluate device settings against defined rules, such as requiring a passcode longer than six characters. When a device is marked noncompliant, Conditional Access can block access to corporate email. This is the correct mechanism because compliance policies are specifically designed to enforce security requirements like passcode length before granting resource access.

Exam trap

The trap here is confusing device configuration profiles (which can set a passcode policy) with compliance policies (which enforce and block access), leading candidates to choose Option A because they think 'configure a policy' means setting the passcode requirement, not enforcing it.

How to eliminate wrong answers

Option A is wrong because device configuration profiles are used to configure device settings (e.g., Wi-Fi, VPN, or passcode policy) but do not enforce compliance or block access to resources; they simply push settings. Option C is wrong because enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version), not post-enrollment security requirements like passcode length. Option D is wrong because app protection policies (MAM) manage data within apps (e.g., copy/paste, encryption) and do not enforce device-level passcode requirements; they apply even on unmanaged devices.

Practice this question →
37
MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. They want to prevent users from installing unapproved applications. Which approach provides the most granular control?

A.Use the Microsoft Store for Business to deploy only approved apps.
B.Deploy AppLocker rules via Intune to allow only approved publishers.
C.Enable Windows Defender SmartScreen to block unknown apps.
D.Configure User Account Control (UAC) to always notify.
AnswerB

AppLocker provides granular control over app execution.

Why this answer

AppLocker allows creating rules based on publisher, path, or hash, enabling granular control to allow only approved applications. Intune policies can deploy AppLocker rules to Windows 10 devices. Option A is wrong because the Microsoft Store for Business only controls store apps, not all applications.

Option C is wrong because SmartScreen only warns about unknown apps but does not block installation. Option D is wrong because UAC only prompts for elevation and does not prevent installation.

Exam trap

Candidates often confuse AppLocker with SmartScreen or UAC, but AppLocker is the only option that allows rule-based control over all applications.

Practice this question →
38
MCQhard

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

A.Install the Intune connector for ConfigMgr and configure the workloads.
B.Create a Group Policy that enables automatic MDM enrollment to Intune.
C.In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.
D.Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.
AnswerC

This configures the workload movement and triggers Intune enrollment for pilot devices.

Why this answer

To enable co-management and move the Device configuration workload to Intune, you need to configure co-management in ConfigMgr. This involves enabling co-management, selecting a pilot collection (or all devices), and setting the workload slider for Device configuration to either 'Pilot Intune' or 'Intune' (full migration). This triggers automatic enrollment in Intune via the co-management policy.

Option A is incorrect because the Intune connector is not needed for co-management; enrollment happens via ConfigMgr policy. Option B is incorrect because Group Policy for automatic MDM enrollment is not required when using co-management; the enrollment is triggered by ConfigMgr. Option D is incorrect because hybrid Azure AD join alone does not automatically enroll devices into co-management; the ConfigMgr co-management configuration is necessary.

Practice this question →
39
MCQeasy

Your organization is deploying Windows 10 devices using Windows Autopilot. The devices are purchased from a vendor and will be shipped directly to users. You need to ensure that the devices are automatically enrolled in Intune and configured with your organization's standard settings as soon as the user turns on the device and connects to the internet. The devices should be Azure AD joined. What is the minimal configuration required?

A.Ask the vendor to configure the devices with your organization's settings before shipping.
B.Upload the device's hardware hash to Azure AD.
C.Instruct the user to manually enroll the device after receiving it.
D.Upload the device's hardware hash to Microsoft Intune.
AnswerD

The hash is needed for Autopilot device recognition.

Why this answer

The hardware hash must be uploaded to Microsoft Intune for Autopilot to automatically recognize the device, enroll it in Intune, and join it to Azure AD upon first boot. Option A is incorrect because vendors cannot pre-configure Autopilot settings; they should provide the hardware hash. Option B is incorrect because the hardware hash is uploaded to Intune, not Azure AD directly.

Option C is incorrect because the user should not manually enroll; Autopilot automates the process.

Practice this question →
40
MCQeasy

Refer to the exhibit. You configure an Enrollment Status Page (ESP) policy as shown. During Windows Autopilot deployment, a device fails to install one of the required apps. What happens to the device?

A.The device blocks use and the user cannot proceed
B.The device automatically resets and retries
C.The user can skip the installation and use the device
D.The user can retry the installation
AnswerA

The device blocks use because allowDeviceUseOnInstallFailure is false.

Why this answer

The Enrollment Status Page (ESP) policy is configured with the 'Show error when installation takes longer than specified number of minutes' option set to 'Block device use until all required apps and profiles are installed.' When a required app fails to install, the ESP enters an error state and, because the policy is set to block use, the device remains locked at the ESP screen, preventing the user from proceeding to the desktop. This behavior is enforced by the Autopilot client, which monitors the installation status of required apps and profiles and will not allow the user to bypass the ESP until all required items are successfully installed or the timeout is reached.

Exam trap

The trap here is that candidates often assume the user can simply skip or retry the failed installation and continue, but the 'Block device use' setting explicitly prevents any progression until all required apps are installed, making the device effectively unusable until the issue is resolved.

How to eliminate wrong answers

Option B is wrong because the ESP does not automatically reset and retry the device; it only retries the installation of failed apps within the same session, but if the app continues to fail, the device remains blocked. Option C is wrong because the 'Block device use until all required apps and profiles are installed' setting explicitly prevents the user from skipping the installation; the user cannot proceed until the required apps are installed or the timeout expires. Option D is wrong because while the user can manually retry the installation from the ESP error screen, the question states the device 'fails to install' and the policy blocks use, meaning the user cannot simply retry and proceed—they are stuck at the ESP until the app installs successfully or the timeout triggers a different action.

Practice this question →
41
Multi-Selectmedium

Your organization uses Microsoft Intune to manage devices. You need to configure a compliance policy for Windows devices that requires the device to be at a specific OS version and have antivirus enabled. Which TWO settings should you configure in the compliance policy?

Select 2 answers
A.Maximum OS version
B.Require antivirus (Windows Defender)
C.Minimum OS version
D.Device type
E.Storage encryption
AnswersB, C

Requires Windows Defender to be active.

Why this answer

The correct settings are 'Require antivirus (Windows Defender)' and 'Minimum OS version'. These are standard compliance policy settings for Windows devices in Microsoft Intune. 'Maximum OS version' is not typically used for compliance; instead, a minimum version ensures devices are up-to-date. 'Device type' is not a compliance setting. 'Storage encryption' is a compliance setting (Require BitLocker), but it is not required by the scenario's specific criteria.

Practice this question →
42
MCQhard

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

A.The device will be allowed to proceed because enrollment status is notStarted.
B.The device will retry enrollment automatically.
C.The device will be blocked from completing OOBE.
D.The device will be blocked until retry due to pendingRetry setting.
AnswerC

Failure action is set to block.

Why this answer

The Autopilot deployment profile shown has the Enrollment Status Page (ESP) configured with 'Block device use until all required apps and profiles are installed' enabled. When a required app fails to install during OOBE, the ESP enforces a hard block, preventing the user from proceeding past the ESP until the failure is resolved. This is why the device is blocked from completing OOBE, making option C correct.

Exam trap

The trap here is that candidates confuse the ESP's 'block device use' setting with a simple retry mechanism, assuming the device will automatically retry or proceed, when in fact a hard block is enforced until the failure is resolved.

How to eliminate wrong answers

Option A is wrong because the enrollment status is not 'notStarted'; the ESP tracks installation progress, and a failure triggers a blocking state, not a pass-through. Option B is wrong because the ESP does not automatically retry enrollment; it blocks the device and requires manual intervention (e.g., reset or troubleshooting) unless a retry timeout is configured, which is not shown in the exhibit. Option D is wrong because 'pendingRetry' is not a valid ESP state; the ESP uses states like 'installing', 'failed', or 'timeout', and the device is blocked immediately upon failure, not placed into a pending retry state.

Practice this question →
43
MCQeasy

You need to manage updates for Windows 10 devices using Microsoft Intune. You want to ensure that critical security updates are installed within 7 days of release, while feature updates are deferred for 60 days. Which approach should you use?

A.Create a Windows update ring policy with quality update deferral set to 7 days and feature update deferral set to 60 days.
B.Create a Windows feature update profile to deploy the latest feature update after 60 days.
C.Create a device compliance policy requiring devices to install updates within 7 days.
D.Configure Windows Update for Business settings via a configuration profile.
AnswerA

Update rings allow granular deferral settings for quality and feature updates.

Why this answer

Windows update ring policies in Microsoft Intune allow granular control over both quality (security) and feature update deferral periods. Setting quality update deferral to 7 days ensures critical security patches are installed within a week, while feature update deferral of 60 days delays non-security feature updates. This directly meets the requirement without additional profiles or compliance policies.

Exam trap

The trap here is that candidates often confuse update ring policies (which manage deferral periods) with feature update profiles (which target specific versions) or compliance policies (which only report compliance status), leading them to select B or C instead of the correct ring-based approach.

How to eliminate wrong answers

Option B is wrong because a Windows feature update profile is used to deploy a specific feature update version (e.g., Windows 10 22H2) to devices, not to manage deferral periods for ongoing updates; it does not control quality update timing. Option C is wrong because device compliance policies can require a minimum OS version or patch level but cannot enforce specific deferral periods for quality or feature updates; they are for compliance evaluation, not update scheduling. Option D is wrong because configuring Windows Update for Business settings via a configuration profile is a legacy approach that lacks the unified deferral management available in update ring policies; update rings are the modern, recommended method in Intune for controlling update deferrals.

Practice this question →
44
MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to enroll a personally owned device with a work profile. Which enrollment method should the user use?

A.Android Enterprise fully managed enrollment.
B.Android Enterprise personally owned work profile enrollment.
C.Android Enterprise corporate-owned work profile enrollment.
D.Corporate-owned dedicated device enrollment.
AnswerB

This creates a work profile on a personal device.

Why this answer

Android Enterprise personally owned devices with a work profile use the 'Bring your own device' (BYOD) enrollment method. Option A is wrong because corporate-owned dedicated devices use a different method. Option C is wrong because fully managed devices are corporate-owned.

Option D is wrong because corporate-owned work profile is for corporate devices with work profile.

Practice this question →
45
MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a PowerShell script via Intune management extension to install a legacy application. The script runs successfully on most devices, but fails on devices that have the 'LocalSystem' account disabled. What should you do to resolve the issue?

A.Configure the script to run in the user context by modifying the script settings in Intune
B.Change the script to run as the logged-on user using a scheduled task
C.Deploy the script using Microsoft Configuration Manager instead
D.Re-enable the LocalSystem account on the affected devices
AnswerA

Intune allows scripts to run in user context, which may resolve the issue.

Why this answer

The Intune Management Extension runs PowerShell scripts under the LocalSystem account by default. When this account is disabled, the script cannot execute. Configuring the script to run in the user context (option A) bypasses this dependency by executing the script under the logged-on user's security context, which is still active even if LocalSystem is disabled.

Exam trap

The trap here is that candidates assume the LocalSystem account is always available and try to re-enable it (option D) or switch to a different deployment tool (option C), rather than recognizing that Intune's user context execution setting directly solves the problem without compromising security.

How to eliminate wrong answers

Option B is wrong because creating a scheduled task to run as the logged-on user is an unsupported workaround that adds complexity and does not leverage Intune's native script execution settings; Intune already supports running scripts in user context directly. Option C is wrong because deploying via Configuration Manager does not resolve the root cause—it still requires a system context or a different execution method, and it introduces additional infrastructure and licensing requirements. Option D is wrong because re-enabling the LocalSystem account is a security risk and an unnecessary change; the account is often disabled for security hardening, and the correct solution is to adapt the script execution context rather than altering system accounts.

Practice this question →
46
MCQhard

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

A.Add a PowerShell script that runs during Autopilot to set language and region.
B.Include the 'Language' and 'RegionalSettings' settings in the PPKG.
C.Assign an Intune Language Pack policy to the device group.
D.Create a Group Policy Object that sets language and region, and link it to the device OU.
AnswerB

Windows Configuration Designer allows embedding language and regional settings directly.

Why this answer

Windows Configuration Designer (WCD) directly supports configuring language and regional settings within a provisioning package (PPKG) through built-in settings. Including the 'Language' and 'RegionalSettings' settings in the PPKG ensures these configurations are applied during the out-of-box experience (OOBE) or provisioning process, without requiring additional scripts or policies. This is the most efficient and supported method for offline or Autopilot pre-provisioning scenarios.

Exam trap

The trap here is that candidates often assume a PowerShell script or Intune policy is required for language configuration, overlooking that Windows Configuration Designer provides native, first-class settings for language and region within a PPKG.

How to eliminate wrong answers

Option A is wrong because adding a PowerShell script that runs during Autopilot to set language and region is unnecessary and less reliable; the PPKG can natively set these settings without scripting, and Autopilot does not guarantee script execution before user logon for language pack installation. Option C is wrong because Intune Language Pack policies are designed for deploying language packs to already-provisioned devices, not for setting regional settings during the initial provisioning process via a PPKG. Option D is wrong because Group Policy Objects (GPOs) require domain-joined devices and Active Directory, which are not applicable during the provisioning phase of a PPKG-based deployment, and GPOs cannot be applied during OOBE.

Practice this question →
47
Multi-Selectmedium

You are planning to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. Which TWO methods can you use to deploy Microsoft 365 Apps? (Choose two.)

Select 2 answers
A.Android store app type.
B.Windows Installer (Win32) app type using the Office Deployment Tool.
C.Web link app type pointing to the Office website.
D.iOS store app type.
E.Microsoft 365 Apps for Windows app type in Intune.
AnswersB, E

Win32 apps can deploy Office via the Office Deployment Tool.

Why this answer

The Windows Installer (Win32) app type in Intune allows you to deploy Microsoft 365 Apps using the Office Deployment Tool (ODT), which provides granular control over installation settings, languages, and update channels. Option E is correct because Intune includes a dedicated 'Microsoft 365 Apps for Windows' app type that simplifies deployment by automatically configuring the ODT XML and handling the installation process without manual scripting.

Exam trap

The trap here is that candidates often confuse the 'Web link' app type with a valid deployment method, thinking it will trigger an installation, when in fact it only provides a browser shortcut to the Office website without any local installation.

Practice this question →
48
MCQhard

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes: - 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune) - 1,500 iOS devices (corporate-owned, managed via Intune) - 500 Android devices (BYOD, managed via Intune with work profile) - 200 macOS devices (corporate-owned, managed via Intune) You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services. You have the following requirements: 1. Zero-touch enrollment for new Windows 11 devices. 2. Devices must be automatically configured with security policies and required applications. 3. Conditional access to Microsoft 365 resources based on device compliance. 4. Support for both corporate and BYOD devices. Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

A.Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.
B.Assign Microsoft Intune licenses to all users who will receive the new devices.
C.Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.
D.Create a compliance policy that requires BitLocker encryption and a minimum OS version.
AnswerC

Registering the hardware hash is the first step to enable Autopilot, which provides zero-touch deployment.

Why this answer

Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Exam trap

The trap here is confusing post-enrollment configuration steps (like creating groups or compliance policies) with the prerequisite enrollment mechanism, leading candidates to select a step that is necessary but not sufficient for zero-touch deployment.

How to eliminate wrong answers

Option A is wrong because creating a dynamic device group in Entra ID is a post-enrollment step for applying policies or targeting apps, not a mechanism for zero-touch enrollment itself. Option B is wrong because assigning Intune licenses is a prerequisite for enrollment but does not automate the enrollment process; it must be combined with Autopilot registration to achieve zero-touch. Option D is wrong because creating a compliance policy enforces security settings after enrollment, but it does not initiate or automate the enrollment process.

Practice this question →
49
Multi-Selecthard

You are configuring Windows Hello for Business in Microsoft Intune. Which THREE settings are required to enable Windows Hello for Business on Windows 10 devices?

Select 3 answers
A.Configure a certificate enrollment policy for smart cards.
B.Set minimum PIN length to at least 4 digits.
C.Enable biometric authentication.
D.Enable Windows Hello for Business in the identity protection policy.
E.Configure a PIN complexity policy.
AnswersB, D, E

A minimum PIN length is required.

Why this answer

Windows Hello for Business requires a minimum PIN length of at least 4 digits when configured via Intune's identity protection policy. This setting is mandatory to enforce a baseline level of security for the PIN-based authentication method, and Intune will not enable Windows Hello for Business without a defined minimum PIN length.

Exam trap

The trap here is that candidates often assume biometric authentication is required for Windows Hello for Business, but Microsoft explicitly allows PIN-only deployments, and the mandatory settings are enabling the feature and configuring PIN complexity (including minimum length).

Practice this question →
50
MCQeasy

Your organization requires that all corporate laptops be encrypted. You manage Windows 10 devices with Microsoft Intune. Which policy should you configure?

A.Enable Device Encryption in Windows settings.
B.Configure a FileVault policy for Windows devices.
C.Create a BitLocker policy in Intune Endpoint Protection.
D.Deploy an Encrypting File System (EFS) policy.
AnswerC

BitLocker provides full disk encryption and can be managed via Intune.

Why this answer

Microsoft Intune's Endpoint Protection policy includes a dedicated BitLocker settings section that allows administrators to enforce encryption on Windows 10 devices. This policy centrally manages BitLocker drive encryption, recovery key escrow to Azure AD, and encryption method (e.g., XTS-AES 128-bit), meeting the requirement for corporate laptop encryption.

Exam trap

The trap here is confusing file-level encryption (EFS) with full-disk encryption (BitLocker), or assuming that Device Encryption in Windows settings is the same as BitLocker, when in fact Device Encryption is a limited feature only available on specific hardware and lacks the management capabilities of Intune's BitLocker policy.

How to eliminate wrong answers

Option A is wrong because 'Enable Device Encryption' in Windows settings is a client-side toggle that only enables hardware-based encryption on devices that support InstantGo (Modern Standby), and it cannot be centrally managed or enforced via Intune policy. Option B is wrong because FileVault is Apple's full-disk encryption technology for macOS, not applicable to Windows 10 devices. Option D is wrong because Encrypting File System (EFS) provides file-level encryption, not full-disk encryption, and is managed via NTFS permissions or Group Policy, not Intune's endpoint protection policies for BitLocker.

Practice this question →
51
MCQhard

You are deploying Windows 10 to 100 new devices using Microsoft Deployment Toolkit (MDT). You want to integrate with Microsoft Intune for post-deployment management. Which MDT integration method should you use?

A.Use Microsoft Configuration Manager to deploy the devices and then co-manage with Intune.
B.Configure Windows Autopilot for the devices and skip MDT.
C.Create a provisioning package in MDT that includes the Intune enrollment configuration and apply it during the deployment task sequence.
D.Install the Intune connector for MDT and configure it during deployment.
AnswerC

The provisioning package can include MDM enrollment settings.

Why this answer

MDT can create a provisioning package (PPKG) that includes Intune enrollment configuration (e.g., enrollment token, tenant ID) and apply it during the task sequence. This allows the device to automatically enroll into Intune after the OS deployment completes, enabling post-deployment management without requiring Configuration Manager or Autopilot.

Exam trap

The trap here is that candidates may confuse MDT integration with Configuration Manager co-management or assume a dedicated Intune connector exists, when in fact MDT relies on provisioning packages for Intune enrollment.

How to eliminate wrong answers

Option A is wrong because it suggests using Configuration Manager to deploy the devices and then co-manage with Intune, which is a valid approach but not an MDT integration method; the question specifically asks for MDT integration, and this option bypasses MDT entirely. Option B is wrong because it recommends skipping MDT and using Windows Autopilot, which is a separate deployment method and does not integrate with MDT; the question requires using MDT for deployment. Option D is wrong because there is no 'Intune connector for MDT' — Intune enrollment is configured via provisioning packages or scripts, not a dedicated connector; this option describes a fictional component.

Practice this question →
52
Multi-Selectmedium

You are configuring Microsoft Intune device compliance policies for Windows 10. Which FOUR settings can be evaluated by compliance policies? (Choose four.)

Select 4 answers
A.Windows Firewall status
B.Minimum OS version
C.BitLocker encryption status
D.Password policy (length, complexity)
E.Threat level from Microsoft Defender for Endpoint
AnswersB, C, D, E

Correct. Minimum OS version is a common compliance policy setting.

Why this answer

Compliance policies in Microsoft Intune can evaluate minimum OS version (B), password policy (D), threat level from Microsoft Defender for Endpoint (E), and BitLocker encryption status (C). Windows Firewall status (A) is not evaluated by compliance policies but by device configuration policies. Therefore, all options except A are valid compliance policy settings.

Exam trap

A common mistake is to think BitLocker encryption status is not evaluated by compliance policies, but it is available under Device Health settings in Intune compliance policies.

Practice this question →
53
Multi-Selectmedium

Your organization uses Microsoft Intune to manage corporate-owned iOS devices. You need to ensure that devices are supervised and can be configured with restrictions that cannot be removed by the user. Which THREE steps must you take?

Select 3 answers
A.Add devices to Apple Business Manager (ABM).
B.Configure automated device enrollment (formerly DEP) in ABM and link to Intune.
C.Create an iOS enrollment profile in Intune with 'Supervised' enabled.
D.Assign a user to each device during enrollment.
E.Create a device compliance policy that requires supervision.
AnswersA, B, C

ABM is required for supervision.

Why this answer

Options A, B, and C are correct. Supervising devices requires Apple Business Manager, automated enrollment, and a supervision profile. Option D is not required because supervised devices do not need user affinity for supervision.

Option E is for device compliance, not supervision.

Practice this question →
54
MCQhard

You are troubleshooting a Windows 10 device that fails to enroll in Microsoft Intune. The device shows error code 0x8018000b. You verify that the user has a valid Intune license and that the device is running Windows 10 Pro. What is the most likely cause of the enrollment failure?

A.The device is running Windows 10 Home edition.
B.MDM enrollment is blocked by a local Group Policy or registry setting.
C.The device is not connected to the internet.
D.The device has an expired certificate required for enrollment.
AnswerB

This error code indicates enrollment is disabled via policy.

Why this answer

Error 0x8018000b indicates that the device is not allowed to enroll, typically because MDM enrollment is blocked by a local Group Policy or registry setting. Even with a valid license and Windows 10 Pro, if the 'MDM Enrollment' policy is disabled or the 'Enrollment automatic' registry key is misconfigured, the enrollment attempt will fail with this specific error.

Exam trap

The trap here is that candidates often assume error 0x8018000b is a licensing or connectivity issue, but it specifically indicates that enrollment is administratively blocked, not that the device is unsupported or offline.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the device runs Windows 10 Pro, not Home edition, and error 0x8018000b is not related to edition restrictions (which would produce a different error). Option C is wrong because lack of internet connectivity would generate a different error (e.g., 0x8018000a or timeout), not 0x8018000b. Option D is wrong because an expired certificate would produce a certificate-related error (e.g., 0x80180014 or 0x8018000c), not the specific 'enrollment blocked' code 0x8018000b.

Practice this question →
55
Multi-Selecthard

Which THREE factors should you consider when planning a Microsoft Intune migration from Configuration Manager?

Select 3 answers
A.The use of co-management to gradually move workloads.
B.The ability to manage on-premises servers with Intune.
C.The compatibility of existing application packages with Intune formats (Win32, LOB).
D.The need for an on-premises Intune server.
E.Network bandwidth requirements for device communication with Intune.
AnswersA, C, E

Co-management enables you to manage devices with both Configuration Manager and Intune, allowing a phased migration.

Why this answer

Co-management allows you to attach your existing Configuration Manager deployment to Microsoft Intune, enabling a gradual migration of workloads (e.g., compliance policies, device configuration, Windows Update policies) at your own pace. This hybrid approach lets you keep some management functions on-premises while testing and shifting others to the cloud, minimizing disruption and providing a rollback path.

Exam trap

The trap here is that candidates often assume Intune can manage on-premises servers like Configuration Manager does, or that an on-premises Intune server exists, when in reality Intune is purely cloud-based and cannot replace Configuration Manager for server management.

Practice this question →
56
MCQmedium

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

A.Devices are onboarded to Defender for Endpoint
B.Group Policy objects are linked to the domain
C.Security baselines are configured and assigned in Intune endpoint security
D.Devices are registered in Microsoft 365 Defender portal
AnswerC

Directly manages baseline compliance.

Why this answer

Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Exam trap

The trap here is that candidates often confuse onboarding to Defender for Endpoint (which enables security telemetry and threat detection) with the separate requirement of configuring and assigning Intune security baselines to enforce and report compliance.

How to eliminate wrong answers

Option A is wrong because onboarding devices to Defender for Endpoint ensures they can send telemetry and be managed for threat detection, but it does not by itself configure or report on security baseline compliance; that requires Intune security baseline policies. Option B is wrong because Group Policy objects are a traditional on-premises management tool that does not report compliance to Intune; Intune uses its own policy engine and MDM channel, not GPOs. Option D is wrong because registering devices in the Microsoft 365 Defender portal is part of the Defender for Endpoint onboarding process and does not create or assign security baseline policies; compliance reporting to Intune requires the Intune security baseline assignment.

Practice this question →
57
MCQhard

You are troubleshooting a Windows 11 device that fails to enroll in Intune via Group Policy. The device is domain-joined and you have configured the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO. The user has a valid Microsoft 365 license. What is the most likely reason for the failure?

A.The device is not registered in Azure AD.
B.The GPO is not linked to the correct organizational unit.
C.The user does not have an Intune license assigned.
D.The device does not have a service connection point configured.
AnswerA

Correct. The device must be registered in Azure AD (Hybrid Azure AD Join) for the GPO to trigger automatic MDM enrollment. Domain-join alone is insufficient.

Why this answer

For the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO to succeed, the device must be registered in Azure AD. Since the device is only domain-joined and no Azure AD registration has occurred, the enrollment fails. Option B is incorrect because the GPO is configured correctly; if it were not linked, it would not apply at all.

Option C is incorrect because the user has a valid Microsoft 365 license that includes Intune. Option D is incorrect because a service connection point is used for Configuration Manager co-management, not for this GPO.

Practice this question →
58
MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with TPM 2.0 and UEFI Secure Boot enabled can enroll. Which configuration profile setting should you configure?

A.Create a Conditional Access policy requiring compliant devices
B.Configure a BitLocker policy in Endpoint Security
C.Set a compliance policy for device health
D.Enable Device Health Attestation (DHA) in enrollment restrictions
AnswerD

DHA verifies TPM and Secure Boot before enrollment.

Why this answer

Device Health Attestation (DHA) in enrollment restrictions allows you to block enrollment for devices that do not meet specific hardware security requirements, such as TPM 2.0 and UEFI Secure Boot enabled. When configured, Intune verifies these attestation claims during the enrollment process and rejects non-compliant devices before they can enroll. This is the only setting that enforces hardware prerequisites at the enrollment stage, not after the device is already managed.

Exam trap

The trap here is that candidates confuse post-enrollment compliance policies (which only mark devices non-compliant) with enrollment restrictions (which block enrollment entirely), leading them to choose Option C instead of D.

How to eliminate wrong answers

Option A is wrong because a Conditional Access policy requiring compliant devices operates after enrollment, checking compliance status during resource access, not blocking enrollment itself. Option B is wrong because a BitLocker policy in Endpoint Security configures encryption settings on already-enrolled devices and does not enforce TPM or Secure Boot requirements during enrollment. Option C is wrong because a compliance policy for device health evaluates devices after they are enrolled and can mark them non-compliant, but it does not prevent enrollment from occurring in the first place.

Practice this question →
59
MCQeasy

You need to deploy Windows 10 Enterprise to 100 new computers using Microsoft Intune. The computers are not yet joined to Microsoft Entra ID. What is the recommended method?

A.Join each device to Entra ID manually and then enroll in Intune.
B.Create a provisioning package using Windows Configuration Designer and deploy via USB.
C.Register the devices in Windows Autopilot and deploy an Autopilot profile.
D.Use a Configuration Manager task sequence to deploy the OS.
AnswerC

Autopilot automates the deployment and enrollment process.

Why this answer

Windows Autopilot is the recommended method for deploying Windows 10 Enterprise to new devices that are not yet joined to Microsoft Entra ID because it automates the entire provisioning process—from joining Entra ID to enrolling in Intune—without requiring any manual intervention or imaging. By registering the devices in Autopilot and deploying an Autopilot profile, the out-of-box experience (OOBE) is customized to join Entra ID and enroll in Intune automatically, ensuring a zero-touch deployment that aligns with modern management best practices.

Exam trap

The trap here is that candidates often confuse provisioning packages (Option B) as the recommended method for cloud-only deployments, but Autopilot is specifically designed for zero-touch, cloud-native provisioning and is the correct answer for new devices not yet joined to Entra ID.

How to eliminate wrong answers

Option A is wrong because manually joining each device to Entra ID and then enrolling in Intune is not recommended for 100 new computers; it is labor-intensive, error-prone, and defeats the purpose of automated, scalable deployment. Option B is wrong because provisioning packages created with Windows Configuration Designer are typically used for bulk provisioning in on-premises or hybrid scenarios, but they do not leverage cloud-native Autopilot capabilities and require physical USB deployment, which is less efficient for remote or large-scale rollouts. Option D is wrong because using a Configuration Manager task sequence to deploy the OS is a traditional imaging approach that relies on on-premises infrastructure and does not integrate natively with cloud-based Entra ID join and Intune enrollment, making it unsuitable for a modern, cloud-first deployment strategy.

Practice this question →
60
Multi-Selectmedium

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Select 2 answers
A.Eliminates the requirement for a Microsoft Entra ID subscription.
B.Allows end users to set up their own devices with minimal IT involvement.
C.Enables device provisioning over a VPN connection.
D.Reduces the need for custom imaging and manual setup.
E.Supports deployment without any internet connectivity.
AnswersB, D

Autopilot provides a self-service deployment experience.

Why this answer

Windows Autopilot leverages the device's hardware identity (hash) to automatically enroll it in Microsoft Entra ID and join it to a domain or tenant, allowing end users to complete the setup process themselves with minimal IT intervention. This reduces helpdesk calls and streamlines the out-of-box experience (OOBE) by presenting only necessary screens.

Exam trap

The trap here is that candidates often assume Autopilot can work over a VPN or without internet because it is a cloud-based service, but it requires direct internet access during OOBE before any VPN client is installed.

Practice this question →
61
MCQmedium

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

A.Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.
B.Distribute a script to each user to run manually.
C.Deploy Windows Autopilot to reset and re-enroll each device.
D.Use the Intune Enrollment Status Page to force enrollment.
AnswerA

This enables automatic enrollment for hybrid joined devices.

Why this answer

Configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Azure AD-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Exam trap

The trap here is that candidates often confuse the Enrollment Status Page (ESP) as an enrollment trigger, when in fact it is a post-enrollment configuration tool, or they mistakenly believe Autopilot is required for hybrid devices, ignoring the simpler automatic enrollment path via MDM scope and hybrid join.

How to eliminate wrong answers

Option B is wrong because distributing a script for manual execution requires user interaction and administrative overhead, which contradicts the goal of minimal user interaction and rapid enrollment. Option C is wrong because Windows Autopilot resets the device and requires re-joining to Azure AD, which is disruptive, time-consuming, and not suitable for already domain-joined devices that only need Intune enrollment. Option D is wrong because the Enrollment Status Page (ESP) is a configuration within Intune that controls device setup progress during enrollment, not a mechanism to trigger or force enrollment on unenrolled devices.

Practice this question →
62
MCQmedium

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Windows Autopilot for new devices. Which prerequisite must be met for Autopilot to work with Entra ID?

A.Devices must be registered in Autopilot using hardware hash
B.Devices must be domain-joined to on-premises AD
C.An Azure AD Premium P2 license must be assigned
D.Configuration Manager must be deployed for OS imaging
AnswerA

Prerequisite for Autopilot deployment.

Why this answer

Windows Autopilot requires that each device be registered in the Autopilot service using its unique hardware hash (also known as a hardware ID). This hash is collected from the device's firmware and uploaded to the Autopilot deployment service, which then associates the device with the target tenant. Without this registration, Autopilot cannot identify the device during the out-of-box experience (OOBE) and cannot automatically enroll it into Microsoft Entra ID.

Exam trap

The trap here is that candidates often assume Autopilot requires an on-premises domain join (option B) because they confuse Autopilot with traditional imaging or hybrid Azure AD join scenarios, but Autopilot's core value is cloud-native, domain-join-free provisioning.

How to eliminate wrong answers

Option B is wrong because Autopilot devices do not need to be domain-joined to on-premises Active Directory; Autopilot is designed to directly join devices to Microsoft Entra ID (formerly Azure AD) during OOBE, bypassing any on-premises dependency. Option C is wrong because while Azure AD Premium P2 licenses provide additional features like Identity Protection and Privileged Identity Management, Autopilot itself only requires Azure AD Premium P1 (or Microsoft 365 E3/E5) for the Autopilot deployment profile and automatic enrollment; P2 is not a prerequisite. Option D is wrong because Configuration Manager is not required for Autopilot; Autopilot uses cloud-based provisioning via Microsoft Intune and does not rely on any on-premises imaging or OS deployment tool like Configuration Manager.

Practice this question →
63
MCQmedium

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to configure a Windows Autopilot deployment for new devices that are shipped directly to users. The devices must be automatically enrolled in Intune and configured with your organization's standard settings. What is the minimum requirement for the device to be recognized by Windows Autopilot?

A.The device must have a Microsoft Entra ID Premium P2 license assigned.
B.The device must have its hardware hash uploaded to Microsoft Intune.
C.The device must be Azure AD registered before shipping.
D.The device must be joined to on-premises Active Directory first.
AnswerB

The hardware hash uniquely identifies the device for Autopilot.

Why this answer

The minimum requirement for a device to be recognized by Windows Autopilot is that its hardware hash must be uploaded to Microsoft Intune. This hash uniquely identifies the device and allows Autopilot to associate it with the correct deployment profile during the out-of-box experience. Option A is incorrect because while some Autopilot features may require Microsoft Entra ID Premium P2, it is not a minimum requirement for device recognition.

Option C is incorrect because the device does not need to be Azure AD registered before shipping; registration occurs during the Autopilot process. Option D is incorrect because joining on-premises Active Directory is not required; Autopilot devices are typically Azure AD joined.

Practice this question →
64
MCQmedium

You are designing a Windows Autopilot deployment for a new fleet of devices. The devices will be shipped directly to users from the vendor. You need to ensure that the devices automatically enroll in Microsoft Intune and receive a standard set of applications during the out-of-box experience (OOBE). Which Autopilot deployment profile should you assign?

A.User-Driven mode (Azure AD joined) with user-assigned apps.
B.Pre-provisioning (White Glove) mode with device-assigned apps.
C.Self-Deploying mode (Azure AD registered) with device-assigned apps.
D.Self-Deploying mode (Azure AD joined) with user-assigned apps.
AnswerA

User-Driven mode allows users to sign in and receive user-assigned apps during OOBE.

Why this answer

User-Driven mode with Azure AD joined and user-assigned apps is correct because the devices are shipped directly to users, who will perform the OOBE themselves. This mode requires a user to sign in with Azure AD credentials, which triggers automatic enrollment in Microsoft Intune and applies the assigned user-targeted apps during the enrollment process.

Exam trap

The trap here is confusing Self-Deploying mode with user-assigned apps, but Self-Deploying mode is designed for devices without a user context and only supports device-assigned apps, making it unsuitable for user-driven app delivery.

How to eliminate wrong answers

Option B is wrong because Pre-provisioning (White Glove) mode requires an IT technician to perform the initial setup before shipping, which contradicts the scenario where devices ship directly to users. Option C is wrong because Self-Deploying mode with Azure AD registered does not support full Intune enrollment with user-assigned apps; it is designed for kiosk or shared devices and uses device-assigned apps only. Option D is wrong because Self-Deploying mode with Azure AD joined cannot use user-assigned apps; it is intended for devices without a user context, so apps must be device-assigned.

Practice this question →
65
Multi-Selecthard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a set of Line-of-Business (LOB) apps using the Microsoft Intune Management Extension. Which THREE conditions must be met?

Select 3 answers
A.The app must be deployed in user context
B.The Microsoft Intune Management Extension must be installed on the device
C.The device must have connectivity to Microsoft Intune
D.The devices must be co-managed with Microsoft Configuration Manager
E.The device must be Azure AD joined or hybrid Azure AD joined
AnswersB, C, E

The extension is required for Win32 app deployment.

Why this answer

The correct options are B, C, and E. B: The Intune Management Extension must be installed on the device to deploy LOB apps. C: The device must have connectivity to Microsoft Intune for the management extension to communicate.

E: The device must be Azure AD joined or hybrid Azure AD joined to support Intune management. Option A is incorrect because the app is deployed in system context, not user context. Option D is incorrect because co-management with Configuration Manager is not required for deploying LOB apps via Intune Management Extension.

Practice this question →
66
Multi-Selecteasy

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Select 2 answers
A.Works offline without internet connectivity.
B.Enables deployment of custom operating system images.
C.Allows IT to provision devices remotely without physical access.
D.Reduces the need for manual imaging and configuration.
E.Eliminates the need for any user interaction during setup.
AnswersC, D

Users can self-deploy from anywhere.

Why this answer

Windows Autopilot leverages cloud-based services to provision new devices, eliminating the need for IT staff to be physically present. Option C is correct because Autopilot allows IT to deploy a device by simply providing the user with the hardware; the device automatically joins Azure AD, enrolls in Intune, and applies policies over the internet. This remote provisioning capability is a core benefit, as it enables zero-touch deployment for remote workers or distributed offices.

Exam trap

The trap here is that candidates often assume Autopilot eliminates all user interaction (Option E) because of the term 'zero-touch,' but in user-driven mode the user must still sign in, while self-deploying mode (for kiosks or shared devices) can be truly zero-touch—the question does not specify the mode, so Option E is too absolute and incorrect.

Practice this question →
67
MCQhard

You run the above PowerShell script to change the Windows Autopilot group tag for devices currently tagged as 'Sales' to 'Marketing'. You have assigned different deployment profiles to the 'Sales' and 'Marketing' group tags. After running the script, you check the Autopilot devices in Intune and see that the group tag for the devices has changed. However, the devices still apply the 'Sales' deployment profile during OOBE. What is the most likely reason?

A.The deployment profile is assigned to the device by device ID, not group tag.
B.The deployment profile assignment is based on the group tag at the time of enrollment; existing devices retain the original profile.
C.The script needs to include a step to remove the device from Autopilot and re-import it.
D.The script did not sync the device details to Intune after changing the group tag.
AnswerB

Autopilot profiles are assigned at enrollment, and changing the tag does not reassign profiles for already-enrolled devices.

Why this answer

The group tag is evaluated at the time of enrollment to determine which deployment profile to assign. Changing the group tag on an already-enrolled device does not retroactively change the profile assignment; the device retains the profile that was applied during its original OOBE. This is by design in Windows Autopilot, as the profile is bound to the device record at enrollment.

Exam trap

The trap here is that candidates assume updating the group tag in Intune will immediately change the deployment profile for already-enrolled devices, but Microsoft's Autopilot design evaluates the tag only at enrollment time, not retroactively.

How to eliminate wrong answers

Option A is wrong because deployment profiles are assigned based on group tags or device serial numbers, not device IDs, and the scenario confirms the tag changed but the profile didn't, ruling out a device ID assignment. Option C is wrong because removing and re-importing the device is unnecessary; the group tag change is sufficient for new enrollments, but existing devices are not affected. Option D is wrong because the script likely synced the change (the tag updated in Intune), but syncing does not retroactively reassign the deployment profile to an already-enrolled device.

Practice this question →
68
MCQhard

Your organization is deploying Windows Autopilot self-deploying mode for kiosk devices. The devices will be used in a public area and must not require user interaction during the initial setup. What is the prerequisite for this deployment?

A.A user must be assigned to the device in Microsoft Entra ID.
B.The device must have a TPM 2.0 chip.
C.An enrollment profile must be assigned to the user.
D.The device must be added to Microsoft Entra ID manually.
AnswerB

TPM 2.0 is required for hardware attestation in self-deploying mode.

Why this answer

Windows Autopilot self-deploying mode relies on the device's TPM 2.0 chip to cryptographically attest its identity to Microsoft Entra ID without any user interaction. The TPM 2.0 provides hardware-bound keys that enable the device to authenticate itself and automatically enroll, which is essential for kiosk devices in public areas where no user credentials can be supplied during initial setup.

Exam trap

The trap here is that candidates often confuse self-deploying mode with user-driven mode, mistakenly thinking a user assignment or manual Entra ID addition is required, when in fact TPM 2.0 is the critical hardware prerequisite for unattended, zero-touch enrollment.

How to eliminate wrong answers

Option A is wrong because assigning a user to the device in Microsoft Entra ID is not required for self-deploying mode; in fact, self-deploying mode is specifically designed for scenarios where no user interaction is needed, and the device operates without a user context. Option C is wrong because an enrollment profile must be assigned to the device, not to the user; self-deploying mode uses a device-targeted profile that is applied during the out-of-box experience without any user sign-in. Option D is wrong because the device must be added to Microsoft Entra ID automatically via Autopilot registration (using hardware hash upload), not manually; manual addition would defeat the purpose of zero-touch deployment.

Practice this question →
69
MCQhard

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

A.Endpoint Protection
B.Windows Update policies
C.Resource access
D.Client apps
AnswerD

Correct. Client apps workload includes the policy to automatically enroll devices to Intune when the Configuration Manager client is installed.

Why this answer

The 'Client apps' workload in Configuration Manager co-management is responsible for synchronizing client applications and enabling automatic enrollment of devices to Intune after the Configuration Manager client is installed. Option A (Endpoint Protection) is incorrect because it manages endpoint protection policies, not enrollment. Option B (Windows Update policies) is incorrect because it governs Windows Update for Business policies, not Intune enrollment.

Option C (Resource access) is incorrect because it configures resource access policies like certificates and VPN, not automatic enrollment.

Practice this question →
70
MCQhard

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

A.The Conditional Access policy is set to 'Block' instead of 'Grant'.
B.The Conditional Access policy applies only to users in a specific group.
C.The compliance policy is not assigned to the users' devices.
D.The Conditional Access policy does not include the email application as a target.
AnswerD

Conditional Access must target specific cloud apps.

Why this answer

A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it.

Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.

Practice this question →
71
MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

A.Enable lost mode on the device via Apple Business Manager.
B.Configure a device compliance policy to wipe the device on non-compliance.
C.Initiate a remote assistance session to lock the device.
D.Use the remote lock action in Intune and provide a custom message.
AnswerD

Remote lock allows locking and displaying a message.

Why this answer

The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Exam trap

The trap here is that candidates confuse Apple Business Manager's enrollment capabilities with Intune's remote management actions, or they assume a compliance policy can be used for immediate lock scenarios, when in fact only the remote lock action supports a custom lock screen message.

How to eliminate wrong answers

Option A is wrong because Apple Business Manager is used for device enrollment and app distribution, not for remote lock actions; lost mode is a feature of Apple's Find My app, not Intune. Option B is wrong because a device compliance policy can trigger a wipe on non-compliance, but it does not provide a custom lock screen message and is not designed for immediate remote lock scenarios. Option C is wrong because remote assistance sessions require user interaction and cannot lock a device or display a custom message without user consent.

Practice this question →
72
MCQmedium

Refer to the exhibit. You run the PowerShell cmdlet shown and get the output. You need to investigate why Laptop-02 is non-compliant. Which additional cmdlet should you run to get the non-compliance reasons?

A.Get-MgDeviceManagementManagedDeviceCompliancePolicyState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc
B.Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -DeviceCompliancePolicyId <id>
C.Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc
D.Get-MgDeviceManagementDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc
AnswerA

Correct. This cmdlet retrieves the compliance policy state and reasons for a specific device, allowing you to see why Laptop-02 is non-compliant.

Why this answer

Get-MgDeviceManagementManagedDeviceCompliancePolicyState retrieves the compliance policy state for a specific managed device, including the non-compliance reasons. This cmdlet returns compliance policy state details per device, which allows you to investigate why Laptop-02 is non-compliant. Option B is incorrect because Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary provides a summary of settings across devices, not per-device reasons.

Option C is incorrect because Get-MgDeviceManagementManagedDeviceConfigurationState retrieves device configuration state, not compliance policy state. Option D is incorrect because Get-MgDeviceManagementDeviceConfigurationState retrieves device configuration state, not compliance reasons.

Practice this question →
73
MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically receive the latest feature updates from the Windows 11 servicing channel. You configure a Windows 10 feature update policy targeting the devices. However, after 24 hours, devices still show Windows 10 version 22H2. What is the most likely cause?

A.Windows Update for Business is disabled in group policy.
B.The policy is a Windows 10 feature update policy, but devices need a Windows 11 feature update policy to upgrade to Windows 11.
C.The policy is not assigned to a device group containing the devices.
D.Devices have not been restarted after policy assignment.
AnswerB

Windows 10 feature update policies only apply to Windows 10 devices for feature updates within Windows 10. To upgrade to Windows 11, a Windows 11 feature update policy must be used.

Why this answer

A Windows 10 feature update policy is designed to move devices between Windows 10 feature versions (e.g., 22H2 to 23H2). To upgrade devices from Windows 10 to Windows 11, you must use a Windows 11 feature update policy, which specifically targets the Windows 11 servicing channel. Since the policy targets Windows 10 feature updates, it will not trigger the OS upgrade to Windows 11, leaving devices on Windows 10 22H2.

Exam trap

The trap here is that candidates assume a 'feature update policy' generically applies to any OS upgrade, but Microsoft Intune strictly separates Windows 10 and Windows 11 feature update policies, and using the wrong one will not trigger the OS version upgrade.

How to eliminate wrong answers

Option A is wrong because disabling Windows Update for Business via group policy would block all Windows Updates, not just feature updates, and the question states the policy is configured in Intune, which overrides local GP if properly set. Option C is wrong because the policy is described as targeting the devices, and if it were not assigned to a device group, the devices would not receive the policy at all, but the issue is that the policy type is incorrect for the desired upgrade. Option D is wrong because restarting devices does not change the policy type; a Windows 10 feature update policy will never upgrade to Windows 11 regardless of reboots.

Practice this question →
74
Multi-Selecthard

Which THREE components are required for a successful Windows Autopilot self-deploying mode deployment?

Select 3 answers
A.A local administrator account created on the device.
B.Windows Autopilot device registration using the hardware hash.
C.A Microsoft 365 E3 license assigned to the user.
D.Microsoft Entra ID Premium P1 or P2 license.
E.A Windows Autopilot deployment profile assigned to the device.
AnswersB, D, E

The device must be registered in Autopilot to be recognized.

Why this answer

B is correct because Windows Autopilot self-deploying mode requires the device to be registered with Microsoft using its hardware hash. This registration links the device to an Azure AD tenant and enables the deployment profile to be downloaded automatically during the out-of-box experience, without user interaction.

Exam trap

The trap here is that candidates often assume a user license or local admin account is required, but self-deploying mode is specifically designed for userless scenarios and relies solely on device registration and a Microsoft Entra ID Premium license.

Practice this question →
75
MCQmedium

Refer to the exhibit. You have configured a Windows Update for Business policy in Intune. Based on the JSON, what is the effect on devices?

A.Devices will not receive any updates from June 1 to July 15
B.Devices will receive all updates normally until July 15
C.Quality updates are paused from June 1 to June 30, and feature updates are paused from July 1 to July 15
D.The policy is invalid because pause dates cannot overlap
AnswerC

The pause start and expiry dates define the pause periods.

Why this answer

The JSON policy specifies 'qualityUpdatesPauseStartDate': '2023-06-01' and 'qualityUpdatesPauseEndDate': '2023-06-30', meaning quality updates are paused during that period. Similarly, 'featureUpdatesPauseStartDate': '2023-07-01' and 'featureUpdatesPauseEndDate': '2023-07-15' pause feature updates from July 1 to July 15. Option A is incorrect because devices will still receive feature updates before July 1.

Option B is incorrect because quality updates are paused starting June 1. Option D is incorrect because pause dates for different update types can overlap; only pause dates for the same type cannot overlap.

Exam trap

Candidates often misinterpret the pause date fields, thinking that a single pause applies to all updates, or that overlapping dates are invalid. The correct understanding is that quality and feature updates have separate pause configurations.

Practice this question →
Page 1 of 4 · 237 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Prepare infrastructure for devices questions.

Start 20-question session