Knowledge + Practice

CCNA Prepare infrastructure for devices Questions

75 of 237 questions · Page 2/4 · Prepare infrastructure for devices · Answers revealed

Practice these questions Domain overview All questions

76

Multi-Selecthard

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Select 3 answers

A.Join devices to on-premises Active Directory.

B.Configure a BitLocker policy in Intune that enables key escrow to Azure AD.

C.Configure a Group Policy to escrow BitLocker keys to Active Directory.

D.Enroll devices in Microsoft Intune.

E.Ensure devices are Azure AD joined.

AnswersB, D, E

Key escrow stores recovery keys in Azure AD.

Why this answer

Intune's BitLocker policy includes a setting to automatically store recovery keys in Azure AD, which is essential for key escrow. This integration ensures that if a device is lost or stolen, administrators can retrieve the recovery key from Azure AD to access encrypted data or perform a remote wipe. Without this policy, BitLocker keys would not be escrowed to Azure AD even if the device is enrolled in Intune.

Exam trap

The trap here is that candidates might think Group Policy (Option C) is sufficient for Azure AD-joined devices, but Group Policy only works with on-premises AD and cannot escrow keys to Azure AD, while Intune's BitLocker policy is the correct cloud-native approach.

Practice this question →

77

Multi-Selecteasy

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Select 2 answers

A.Create a conditional access policy that blocks devices not marked as corporate.

B.Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.

C.Create a conditional access policy that requires compliant devices.

D.Create a device compliance policy that marks personal devices as non-compliant.

E.Configure enrollment device platform restrictions to block personally owned devices.

AnswersB, E

This directly blocks personal device enrollment.

Why this answer

Setting 'Allow personally owned devices' to 'No' in enrollment restrictions explicitly blocks users from enrolling personal devices while still allowing corporate-owned device enrollment. This setting is enforced at the time of enrollment, preventing personal devices from being added to Intune management entirely.

Exam trap

The trap here is that candidates confuse post-enrollment controls (conditional access, compliance policies) with pre-enrollment controls (enrollment restrictions), leading them to select options that only block access after enrollment rather than preventing enrollment itself.

Practice this question →

78

Multi-Selectmedium

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Select 2 answers

A.Ensure the device has a Windows 10/11 Pro or Education license

B.Enter a MAK key

C.Configure a KMS host key

D.Join the device to Microsoft Entra ID or hybrid Microsoft Entra ID

E.Install the Azure AD Connect tool

AnswersA, D

Subscription Activation works only on Pro and Education editions.

Why this answer

Subscription activation requires a qualifying base license of Windows 10/11 Pro or Education. These editions support the subscription activation feature, which upgrades the device to Windows 10/11 Enterprise without requiring a separate product key. Without this base license, the device cannot be upgraded via subscription activation.

Exam trap

The trap here is that candidates often confuse subscription activation with traditional volume activation methods (KMS or MAK) and select options B or C, or mistakenly think Azure AD Connect is required for device join, when in fact only Microsoft Entra ID or hybrid join is needed.

Practice this question →

79

Multi-Selecteasy

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Select 2 answers

A.Assign to individual users directly.

B.Assign to a distribution group.

C.Assign to a dynamic group using device attributes.

D.Assign to a device group.

E.Assign to a Microsoft Entra ID user group.

AnswersD, E

Device groups allow targeting based on device membership.

Why this answer

Microsoft Intune supports assigning Microsoft 365 Apps for enterprise directly to device groups, which ensures the application is installed on the specified devices regardless of which user signs in. This method is useful for shared or kiosk devices where user-based assignment would not apply. Option E is correct because assigning to a Microsoft Entra ID user group is the standard method for user-based deployment, allowing the apps to be provisioned based on user identity.

Exam trap

The trap here is that candidates often confuse distribution groups with security groups, assuming any group type can be used for Intune assignments, but only security groups (including Microsoft Entra ID groups) are supported for application targeting.

Practice this question →

80

Multi-Selecteasy

Which TWO are valid methods to enroll iOS/iPadOS devices into Microsoft Intune?

Select 2 answers

A.Apple Configurator 2

B.Automated Device Enrollment (ADE)

C.Company Portal enrollment

D.Windows Autopilot

E.Android Zero Touch enrollment

AnswersB, C

Apple's DEP-based enrollment.

Why this answer

Options B and C are correct. Automated Device Enrollment (ADE) is the modern, automated method for enrolling corporate-owned iOS/iPadOS devices, while Company Portal enrollment allows users to enroll their personally owned devices. Option A is incorrect because Apple Configurator 2 is a tool for manually preparing devices, not a primary enrollment method.

Option D is incorrect because Windows Autopilot is for Windows devices, not iOS/iPadOS. Option E is incorrect because Android Zero Touch enrollment is for Android devices.

Practice this question →

81

Multi-Selecteasy

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Select 2 answers

A.Request the hardware hash from the device manufacturer (OEM)

B.Extract the hardware hash from the device BIOS

C.Run a PowerShell script on a device that is already running Windows 10 or later

D.Use Microsoft Intune to generate the hardware hash from the device serial number

E.Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

AnswersA, C

OEMs can provide the hardware hash.

Why this answer

OEMs can provide the hardware hash for devices they manufacture, which can be uploaded to Microsoft Intune or the Autopilot deployment service. This method is commonly used for new devices ordered directly from the manufacturer, as the hash is generated during the manufacturing process and included in the device's packaging or accessible via the OEM's portal.

Exam trap

The trap here is that candidates often assume the hardware hash can be extracted from BIOS or generated by Intune from a serial number, but the hash requires a running Windows OS to compute and must be collected via PowerShell or provided by the OEM.

Practice this question →

82

Multi-Selecthard

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Select 3 answers

A.A device compliance policy assigned to the device

B.MDM enrollment enabled in Microsoft Entra ID

C.Azure AD Premium P1 license

D.A valid Microsoft Intune license assigned to the user

E.Internet connectivity to Microsoft Intune service

AnswersB, D, E

Must be enabled to allow enrollment.

Why this answer

Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Exam trap

The trap here is that candidates often confuse post-enrollment requirements (like compliance policies or Azure AD Premium P1) with prerequisites for enrollment, leading them to select options that are only needed after the device is already enrolled.

Practice this question →

83

MCQeasy

You need to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. The deployment must be available to users in the company portal. Which app type should you select?

A.Windows 10/11 (Microsoft 365 Apps)

B.Microsoft 365 (Web link)

C.Microsoft Store app (new)

D.Windows app (Win32)

AnswerA

This app type is specifically for Office deployment.

Why this answer

The 'Windows 10/11 (Microsoft 365 Apps)' app type in Intune is specifically designed to deploy Microsoft 365 Apps (formerly Office 365 ProPlus) with built-in support for the Office Deployment Tool (ODT) and XML configuration. This app type automatically handles the installation, updates, and licensing via the Microsoft 365 Apps for enterprise channel, and it appears in the Company Portal for user-initiated installation. Other app types lack the native integration for Microsoft 365 Apps deployment or do not support user-visible installation in the Company Portal.

Exam trap

The trap here is that candidates often choose 'Windows app (Win32)' because they think any desktop app must be deployed as a Win32 app, overlooking the dedicated Microsoft 365 Apps app type that provides built-in ODT integration and automatic update management.

How to eliminate wrong answers

Option B (Microsoft 365 (Web link)) is wrong because it only creates a shortcut to a web URL in the Company Portal, not an actual app installation, so it cannot deploy Microsoft 365 Apps locally. Option C (Microsoft Store app (new)) is wrong because it is used for deploying apps from the Microsoft Store, not for deploying Microsoft 365 Apps via the Office Deployment Tool. Option D (Windows app (Win32)) is wrong because while it can deploy any Win32 app, it requires manual packaging of the Office installation files and does not provide the built-in ODT integration, update management, or automatic licensing that the dedicated Microsoft 365 Apps app type offers.

Practice this question →

84

MCQhard

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data is protected when users access Microsoft 365 apps. Which policy should you configure?

A.Use a Mobile App Configuration policy to enforce app settings.

B.Deploy an Intune App Protection Policy (APP) for Microsoft 365 apps.

C.Create a Device Compliance policy for iOS devices.

D.Configure a Conditional Access policy to require compliant devices.

AnswerB

APP protects corporate data in apps, such as preventing copy-paste or requiring PIN.

Why this answer

Intune App Protection Policies (APP) protect corporate data at the app level for Microsoft 365 apps, without requiring device enrollment or management. Option A is incorrect because Mobile App Configuration policies enforce app settings but do not protect data. Option C is incorrect because Device Compliance policies ensure devices meet compliance criteria but do not protect data within apps.

Option D is incorrect because Conditional Access policies control access based on conditions but do not directly protect data within apps.

Practice this question →

85

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a compliance policy requiring devices to have BitLocker enabled. Some devices report as non-compliant even though BitLocker appears to be on. You discover these devices are using software-based encryption instead of hardware-based encryption. What should you do to resolve the compliance failure?

A.Modify the compliance policy to include 'BitLocker hardware encryption' as 'not configured' or set to 'allow software encryption'.

B.Configure the compliance policy to require TPM attestation.

C.Upgrade the devices to Windows 10 Enterprise edition.

D.Change the compliance policy setting from 'require' to 'allow' for BitLocker.

AnswerA

This accommodates both encryption types.

Why this answer

The compliance policy can be configured to accept both hardware and software encryption. By setting 'BitLocker hardware encryption' to 'not configured' or 'allow software encryption', the policy will consider software-based encryption as compliant. Option B is incorrect because TPM attestation is not required for this issue; the problem is the encryption type, not TPM presence.

Option C is incorrect because BitLocker is available on Windows 10 Pro and Enterprise, so upgrading to Enterprise does not resolve the compliance failure. Option D is incorrect because changing 'require' to 'allow' for BitLocker would still require some form of encryption, but the policy currently requires it; the issue is that software encryption is not being recognized, so allowing it directly addresses the problem.

Practice this question →

86

MCQhard

You manage devices with Microsoft Intune. Some Windows devices are not receiving required security updates despite being assigned to an update ring for Windows 10. You verify that the devices are active and connected to the internet. What is the most likely cause?

A.The devices have a compliance policy requiring a specific version that is not yet met.

B.The update ring has a deferral period configured that delays updates for 30 days.

C.The devices are not connected to a corporate VPN.

D.Delivery Optimization is disabled on the devices.

AnswerB

Deferral periods can significantly delay update delivery.

Why this answer

The most likely cause is that the update ring has a deferral period configured that delays updates for 30 days. In Microsoft Intune, update rings for Windows 10 allow administrators to set deferral periods for quality and feature updates. A deferral period of 30 days means that even if the device is active and connected, it will not install the update until the specified number of days after Microsoft releases it.

This explains why the devices are not receiving the updates despite being compliant and online.

Exam trap

The trap here is that candidates often assume connectivity or compliance issues are the root cause, overlooking the fact that update rings can intentionally delay updates via deferral periods, which is a core configuration in Intune for staged rollouts.

How to eliminate wrong answers

Option A is wrong because a compliance policy requiring a specific version would not prevent updates from being offered; it would instead mark the device as non-compliant if the version is not met, but updates would still be available and installable. Option C is wrong because Windows Update for Business does not require a corporate VPN to receive updates; devices can download updates directly from Microsoft's update servers over the internet. Option D is wrong because Delivery Optimization is a peer-to-peer caching mechanism that speeds up update downloads but is not required for updates to be received; disabling it would not block updates entirely.

Practice this question →

87

Multi-Selecthard

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Select 3 answers

A.The Microsoft Intune agent installed on the Linux device.

B.A supported Linux distribution such as Ubuntu 20.04 or later.

C.The device must be joined to an on-premises Active Directory domain.

D.Network connectivity to Microsoft Intune service endpoints.

E.An Azure Active Directory Premium P2 license for each user.

AnswersA, B, D

The agent enables management and compliance reporting.

Why this answer

The Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Exam trap

The trap here is that candidates often assume Linux devices must be domain-joined or require premium Azure AD licensing, but Intune manages Linux as a standalone mobile device class with only basic licensing and network connectivity prerequisites.

Practice this question →

88

Multi-Selectmedium

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Select 2 answers

A.An on-premises Active Directory environment.

B.A Group Policy object to enable automatic MDM enrollment.

C.A Microsoft Intune subscription must be active.

D.Azure AD Connect must be configured.

E.Devices must be Azure AD hybrid joined.

AnswersA, B

Group Policy is used to configure automatic enrollment.

Why this answer

Options A and B are correct. Group Policy enrollment into Intune requires an on-premises Active Directory environment (A) to target devices via Group Policy, and a Group Policy object (B) configured with the MDM enrollment settings to enable automatic enrollment. Option C is incorrect because an Intune subscription is necessary but not a prerequisite specific to Group Policy enrollment—it is a general requirement.

Option D is incorrect because Azure AD Connect is needed for hybrid identity, but Group Policy enrollment works with on-premises AD only. Option E is incorrect because hybrid Azure AD join is not required for Group Policy enrollment; devices can be on-premises joined and still enroll.

Practice this question →

89

MCQhard

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

A.The OMA-URI setting is invalid.

B.The device is not enrolled.

C.The device's group membership is still being processed, so policies are not yet applied.

D.The device is not compliant.

AnswerC

Pending status indicates group membership processing.

Why this answer

When a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet.

The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Exam trap

The trap here is that candidates see 'Enrolled' and 'Compliant' and assume the device is fully healthy, but they overlook that policy application is asynchronous and depends on group membership processing, which can lag behind enrollment and compliance evaluation.

How to eliminate wrong answers

Option A is wrong because if the OMA-URI setting were invalid, the policy would show an error or 'Not applicable' status in Intune, not a missing application while the device remains compliant. Option B is wrong because the device explicitly shows enrollment state 'Enrolled', so the device is enrolled and this contradicts the premise. Option D is wrong because the device shows compliance state 'Compliant', so non-compliance is not the reason the policy is not applied.

Practice this question →

90

Multi-Selectmedium

Which TWO prerequisites are required for Windows Autopilot self-deploying mode?

Select 2 answers

A.Device is registered in Windows Autopilot

B.A user account with Intune license

C.Windows 11/10 Pro, Enterprise, or Education edition

D.Microsoft Entra ID P1 or P2 license

E.TPM 2.0 chip on the device

AnswersA, E

Correct. Device registration in Windows Autopilot is essential for identifying the device.

Why this answer

For Windows Autopilot self-deploying mode, the two key prerequisites are that the device must be registered in Windows Autopilot (A) and have a TPM 2.0 chip (E) for hardware-based attestation. A supported Windows edition (C) is also needed, but it is a general requirement for any Autopilot mode and not specific to self-deploying. Options B and D are not required because this mode is device-driven and does not need a user account or premium licensing.

Exam trap

Candidates often assume that a supported Windows edition is the additional prerequisite for self-deploying mode, but the specific requirement that distinguishes it from user-driven mode is TPM 2.0. Also, licensing and user accounts are common distractors.

Practice this question →

91

Multi-Selectmedium

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Select 2 answers

A.Microsoft Defender for Endpoint license assigned to the user or device

B.macOS device enrollment in Microsoft Intune

C.Microsoft Intune management extension installed on the device

D.Onboarding to Microsoft Defender for Cloud

E.A VPN connection to the corporate network

AnswersA, B

A license is required.

Why this answer

The correct prerequisites are: A and B. For A: Microsoft Defender for Endpoint requires a valid license assigned to the user or device. For B: The macOS device must be enrolled in Microsoft Intune to receive the configuration profile and policies for Defender.

Option C is incorrect because the Microsoft Intune management extension is for Windows only, not macOS. Option D is incorrect because onboarding to Microsoft Defender for Cloud is not a prerequisite; Defender for Endpoint can be deployed independently. Option E is incorrect because a VPN connection is not required for Defender for Endpoint to function on macOS.

Practice this question →

92

MCQeasy

You have deployed the above Endpoint Protection configuration profile to Windows 10 devices. Some users report that their devices are not encrypted. You verify that the devices have TPM 2.0 and meet hardware requirements. What is the most likely cause?

A.The policy does not configure recovery key escrow to Azure AD.

B.The policy disables encryption for the OS drive.

C.The devices do not have a TPM chip.

D.The encryption method is not supported by the devices.

AnswerA

BitLocker requires a recovery password to be escrowed; without it, encryption may not start.

Why this answer

When BitLocker encryption is enabled via an Endpoint Protection configuration profile in Microsoft Intune, the policy must include recovery key escrow to Azure AD for encryption to proceed. Without this setting, BitLocker will not encrypt the drive, even if the device meets TPM and hardware requirements. The policy in question likely has the 'Require BitLocker recovery key to be stored in Azure AD' option set to 'Not configured' or 'No', which prevents encryption from starting.

Exam trap

The trap here is that candidates assume meeting hardware requirements (TPM 2.0) is sufficient for BitLocker encryption, overlooking the mandatory recovery key escrow configuration in the Intune policy that is required to initiate encryption.

How to eliminate wrong answers

Option B is wrong because the policy does not disable encryption for the OS drive; the issue is that encryption fails to initiate due to missing recovery key escrow, not because the OS drive encryption is explicitly disabled. Option C is wrong because the question explicitly states that the devices have TPM 2.0 and meet hardware requirements, so the absence of a TPM chip is not the cause. Option D is wrong because the encryption method (e.g., XTS-AES 128-bit or 256-bit) is supported by Windows 10 devices with TPM 2.0, and the problem is not related to encryption method incompatibility.

Practice this question →

93

Multi-Selectmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices to authenticate to a corporate Wi-Fi network. Which TWO methods can you use to deploy the certificate?

Select 2 answers

A.Create a SCEP certificate profile in Intune.

B.Create a device compliance policy that includes the certificate.

C.Create a Wi-Fi profile and embed the certificate in the profile.

D.Create a VPN profile that includes the certificate.

E.Create a PKCS certificate profile in Intune.

AnswersA, E

SCEP profiles request and install certificates from a CA.

Why this answer

A SCEP certificate profile in Intune allows iOS/iPadOS devices to request a certificate from a Simple Certificate Enrollment Protocol (SCEP) server, which can then be used for Wi-Fi authentication. This method supports automated enrollment and renewal of certificates without manual intervention, making it suitable for large-scale deployments.

Exam trap

The trap here is that candidates often confuse a Wi-Fi profile's ability to reference a certificate with the ability to embed the certificate directly, leading them to select option C, but Intune requires the certificate to be deployed separately via a certificate profile.

Practice this question →

94

MCQeasy

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

A.Microsoft 365 Apps for Windows

B.Web link

C.Windows app (MSI)

D.Line-of-business app

AnswerA

Dedicated type for Office deployment.

Why this answer

The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Exam trap

The trap here is that candidates often confuse the 'Microsoft 365 Apps for Windows' app type with the 'Windows app (MSI)' or 'Line-of-business app' types, mistakenly thinking they can upload an Office installer manually, but Intune requires the dedicated app type to properly handle the Click-to-Run installation and licensing integration.

How to eliminate wrong answers

Option B is wrong because a web link app type only creates a shortcut to a URL on the device's Start menu or desktop, not an actual software installation. Option C is wrong because Windows app (MSI) is used for deploying traditional MSI-based applications, but Microsoft 365 Apps is not distributed as a single MSI file; it uses the Office Deployment Tool (ODT) and Click-to-Run technology. Option D is wrong because the line-of-business (LOB) app type is intended for sideloading app packages (e.g., .intunewin, .msi, .appx) that are not available in the public store, but it does not provide the specialized configuration options for Microsoft 365 Apps, such as channel selection or exclusion of specific apps.

Practice this question →

95

MCQmedium

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

A.The device is not enrolled in Intune correctly.

B.The password policy is conflicting with Secure Boot.

C.The virtual machine does not have Secure Boot enabled in its firmware settings.

D.The device does not have BitLocker enabled, which is required for Secure Boot.

AnswerC

VMs often have Secure Boot disabled; enabling it in the VM settings resolves the issue.

Why this answer

Secure Boot is a hardware-based feature that ensures the system boots using only software trusted by the PC manufacturer. In virtual machines, Secure Boot is often not enabled by default or may not be supported by the hypervisor. For Intune compliance, if the VM does not have Secure Boot enabled, it will report as non-compliant.

Option C is correct because the VM's firmware settings likely have Secure Boot disabled. Option A is incorrect because the device may still be enrolled correctly. Option B is incorrect because password policy is unrelated to Secure Boot.

Option D is incorrect because BitLocker is a separate encryption feature not required for Secure Boot.

Practice this question →

96

MCQeasy

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

A.Update rings

B.Configuration profiles

C.Device enrollment profiles

D.Compliance policies

AnswerB

Configuration profiles apply settings to devices.

Why this answer

Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Exam trap

The trap here is that candidates often confuse compliance policies with configuration profiles, mistakenly thinking that compliance policies can apply settings, when in fact compliance policies only evaluate and report on settings that must already be configured by a profile or other means.

How to eliminate wrong answers

Option A (Update rings) is wrong because update rings manage the rollout and deferral of Windows updates, not the configuration of security settings like encryption or firewall rules. Option C (Device enrollment profiles) is wrong because enrollment profiles control the enrollment process and initial device setup (e.g., user affinity, enrollment restrictions), not ongoing security configurations. Option D (Compliance policies) is wrong because compliance policies define conditions that devices must meet to be considered compliant (e.g., requiring encryption), but they do not actually apply the settings; they only mark devices as non-compliant if the settings are missing, whereas configuration profiles actively enforce the settings.

Practice this question →

97

MCQmedium

A user reports that their Windows 11 device fails to enroll in Microsoft Intune. The device is Microsoft Entra joined and the user has a valid Intune license. What should you check first?

A.Verify that BitLocker is enabled on the device.

B.Check the Enrollment Status Page (ESP) profile configuration in Intune.

C.Ensure that the device has a local administrator password set.

D.Review the Windows Autopilot deployment profile assigned to the device.

AnswerB

ESP profiles can cause enrollment failures if they are not configured correctly or if they are blocked.

Why this answer

Enrollment Status Page (ESP) profiles can block enrollment if misconfigured, and checking the Intune console is the first step to see errors. Option A is wrong because BitLocker is not related to enrollment. Option C is wrong because the local admin password is not required for enrollment.

Option D is wrong because the Autopilot profile is only relevant for Autopilot deployments, not general enrollment.

Practice this question →

98

MCQhard

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

A.The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

B.One of the required apps failed to install.

C.The user attempted to retry the setup and it was blocked.

D.The device reset on failure is enabled, causing a reset loop.

AnswerB

The ESP waits for app installation, and if it fails without reset, it hangs.

Why this answer

The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Exam trap

The trap here is that candidates often assume the ESP hangs due to a network issue or user error, but Microsoft explicitly designs the ESP to block on required app failures, making this the primary troubleshooting focus for 'Installing apps' hangs.

How to eliminate wrong answers

Option A is wrong because the ESP policy is explicitly assigned to an Autopilot deployment, and the device is using Autopilot (the user is in provisioning). Option C is wrong because the ESP does not block retry attempts; the user can retry, but if the app continues to fail, the hang persists. Option D is wrong because 'device reset on failure' is a separate setting that triggers a full reset only after a timeout or explicit failure, not a reset loop; the device would not hang indefinitely.

Practice this question →

99

MCQeasy

You need to configure Microsoft Intune to automatically retire a device if it has not checked in for 30 days. Where would you configure this setting?

A.Intune device cleanup rules

B.Conditional access policy

C.Device compliance policy

D.Device configuration profile

AnswerA

Cleanup rules can automatically retire inactive devices.

Why this answer

Intune device cleanup rules allow you to automatically retire or delete devices that have not checked in for a specified period, such as 30 days. Option B is incorrect because conditional access policies control access to resources based on conditions, not device cleanup. Option C is incorrect because device compliance policies evaluate device compliance based on conditions, not retirement from inactivity.

Option D is incorrect because device configuration profiles enforce settings and configurations, not cleanup rules.

Practice this question →

100

MCQeasy

Your organization is planning to deploy Microsoft Entra hybrid joined devices. What is a prerequisite for this configuration?

A.Azure AD Premium P1 license is required.

B.Microsoft Intune must be enabled for auto-enrollment.

C.Microsoft Defender for Endpoint must be deployed.

D.Microsoft Entra Connect must be installed and configured.

AnswerD

Entra Connect synchronizes on-premises AD to Entra ID, which is required for hybrid identity.

Why this answer

Microsoft Entra hybrid joined devices require synchronization of on-premises Active Directory identities to Microsoft Entra ID. Microsoft Entra Connect (or Microsoft Entra Connect Sync) is the tool that performs this identity synchronization, making it a mandatory prerequisite. Without it, the on-premises AD objects cannot be linked to Entra ID for hybrid join.

Exam trap

The trap here is that candidates often confuse licensing requirements (Premium P1) or optional management tools (Intune, Defender) with the core prerequisite of identity synchronization, which is the foundational step for hybrid join.

How to eliminate wrong answers

Option A is wrong because Azure AD Premium P1 is not a prerequisite for hybrid join; it is required for features like Conditional Access or self-service password reset, but hybrid join itself works with any Azure AD license, including Free. Option B is wrong because Microsoft Intune auto-enrollment is optional for managing hybrid joined devices but not a prerequisite for the join process itself. Option C is wrong because Microsoft Defender for Endpoint is a security solution that can be deployed on hybrid joined devices but is not required for the hybrid join configuration.

Practice this question →

101

MCQeasy

Your organization uses Microsoft Intune for device management. You need to ensure that only corporate-owned devices can enroll in Intune. Which configuration should you use?

A.Use Device Enrollment Manager (DEM) accounts to enroll devices.

B.Assign a compliance policy that requires the device to be corporate-owned.

C.Create a device category for corporate devices and instruct users to select it during enrollment.

D.Configure enrollment restrictions to block personally owned devices.

AnswerA

DEM accounts allow enrollment of corporate-owned devices without pre-designation.

Why this answer

Device Enrollment Manager (DEM) accounts allow designated administrators to enroll devices on behalf of other users, and these devices are automatically marked as corporate-owned. Option B is incorrect because a compliance policy can require corporate ownership as a condition, but it does not block personal devices from enrolling; it only marks them noncompliant after enrollment. Option C is incorrect because device categories are for organizational grouping, not for enforcing corporate-only enrollment.

Option D is incorrect because enrollment restrictions can block personally owned devices, but they do not automatically designate devices as corporate-owned; DEM is the appropriate method for ensuring only corporate-owned devices enroll.

Practice this question →

102

MCQhard

Refer to the exhibit. You execute this PowerShell script to wipe noncompliant Windows devices. After running, you find that some compliant devices were also wiped. What is the most likely reason?

A.The filter 'operatingSystem eq 'Windows'' does not match any devices, so the script wiped all devices.

B.The script wipes only noncompliant devices, but some compliant devices had a null compliance state.

C.The script uses the wrong Graph API endpoint, causing all devices to be wiped.

D.The script does not check the device's compliance state before wiping.

AnswerC

The cmdlet Invoke-MgDeviceManagementManagedDevice does not exist; the correct cmdlet is Invoke-MgDeviceManagementManagedDeviceAction with proper parameters. The incorrect cmdlet might have unexpected behavior or default to wiping all devices.

Why this answer

The script uses the wrong Graph API endpoint. The correct endpoint for wiping a device is `/deviceManagement/managedDevices/{deviceId}/wipe`, but the script likely uses an incorrect or generic endpoint (e.g., `/devices/{deviceId}/wipe` or a non-existent path), which causes the API to misinterpret the request or apply the wipe action to all devices in the tenant, including compliant ones. This is a common misconfiguration when targeting the Microsoft Graph API for Intune device actions.

Exam trap

The trap here is that candidates assume the script logic is correct and focus on the compliance filter, but the real issue is the Graph API endpoint, which is a common misconfiguration that causes unintended mass actions.

How to eliminate wrong answers

Option A is wrong because the filter 'operatingSystem eq 'Windows'' would match Windows devices, not cause a mismatch that wipes all devices; if no devices matched, the script would simply not process any devices. Option B is wrong because a null compliance state is treated as noncompliant in Intune, so wiping devices with null compliance would be expected behavior, not an error that wipes compliant devices. Option D is wrong because the script explicitly checks compliance state with the filter 'complianceState eq 1' (noncompliant), so it does check compliance before wiping; the issue is the endpoint, not the absence of a compliance check.

Practice this question →

103

MCQmedium

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

A.A device with OS version 10.0.16299.0 (build 1709).

B.A device with OS version 10.0.17134.1 (build 1803).

C.A device with OS version 10.0.17134.2 (build 1803).

D.A device with OS version 10.0.15063.0 (build 1703).

AnswerA, D

This device has build 16299.0 (version 1709), which is below the minimum OS version of 10.0.17134.1 (build 1803). Therefore, it is non-compliant.

Why this answer

The compliance policy specifies a minimum OS version of 10.0.17134.1 (build 1803). Devices with an OS version lower than this minimum are marked non-compliant. Options A (build 16299.0, version 1709) and D (build 15063.0, version 1703) are both below the minimum, so they are non-compliant.

Option B matches exactly and is compliant. Option C has a higher build (17134.2), which exceeds the minimum, making it compliant.

Exam trap

The key trap is that this policy sets a *minimum* OS version (10.0.17134.1). Many candidates assume compliance policies only enforce a *maximum* version, so a higher build might be incorrectly deemed non-compliant. But with a minimum, any build below 17134.1 is non-compliant, while builds at or above are compliant.

How to eliminate wrong answers

Option A is wrong because OS version 10.0.16299.0 (build 1709) is lower than the policy's minimum version (1803), so it would be non-compliant, but the question asks which device will be marked non-compliant, and the correct answer is C. Option B is wrong because OS version 10.0.17134.1 (build 1803) exactly matches the policy's specified version, so it is compliant. Option D is wrong because OS version 10.0.15063.0 (build 1703) is lower than the minimum version, making it non-compliant, but again the correct answer is C.

Practice this question →

104

MCQhard

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

A.The device has not been successfully registered in Windows Autopilot.

B.The Autopilot profile is not assigned to the device group.

C.The device was previously manually imaged.

D.The device is not connected to the internet during OOBE.

AnswerA

RegistrationStatus should be 'Registered'.

Why this answer

'NotRegistered' indicates the device is not properly registered in Autopilot. Option B is incorrect because if the profile were not assigned, it would show 'NotAssigned' but still registered. Option C is incorrect because the diagnostics show registration status.

Option D is incorrect because the device can still be registered even if it has been imaged.

Practice this question →

105

MCQhard

Your organization uses Microsoft Intune to manage devices. You have a compliance policy that requires devices to have a password of at least 6 characters. Some users report that their devices are marked as non-compliant even though they have a password set. What is the most likely cause?

A.The password length setting is set to '6' but the device requires a minimum of 8.

B.The compliance policy is assigned to device groups, but the devices are user-enrolled.

C.The compliance policy is assigned to a user group that does not include the affected users.

D.The device uses a PIN instead of a password, which is not evaluated.

AnswerC

If the policy is not assigned to the user or device group containing the users, they won't receive the policy and may be non-compliant by default.

Why this answer

The most likely cause is that the compliance policy is assigned to a user group that does not include the affected users. In Microsoft Intune, compliance policies are evaluated based on user or device group assignments. If a user is not a member of the assigned user group, the policy will not apply to their enrolled devices, and those devices will not be evaluated for compliance, often resulting in a non-compliant status or no status at all.

Exam trap

The trap here is that candidates often assume compliance policies apply to all devices automatically, overlooking the fact that policy assignment to specific user or device groups is required for evaluation to occur.

How to eliminate wrong answers

Option A is wrong because if the policy requires a minimum of 6 characters and the device has a password set, the device would be compliant; the issue is not about a higher device-level requirement, as Intune enforces the policy setting, not a device-imposed minimum. Option B is wrong because compliance policies can be assigned to either device groups or user groups; user-enrolled devices are still evaluated when the policy is assigned to a user group that includes the enrolling user, so this is not a fundamental limitation. Option D is wrong because Intune evaluates PINs and passwords equivalently for compliance; a PIN is considered a form of password, and the policy's password length requirement applies to both.

Practice this question →

106

MCQeasy

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

A.Ensure the device is Azure AD joined.

B.Create a separate Windows Hello for Business policy and assign it to the device group.

C.Configure the Enrollment Status Page to show Hello setup.

D.Set 'Enable Windows Hello for Business' in the Autopilot profile.

AnswerD

The profile includes a setting to enable Hello during OOBE.

Why this answer

The Windows Autopilot profile includes a setting called 'Enable Windows Hello for Business' that, when enabled, automatically configures the device to prompt the user to set up Windows Hello for Business during the out-of-box experience (OOBE). This setting is part of the Autopilot profile itself and does not require a separate policy or additional configuration to trigger the Hello setup prompt.

Exam trap

The trap here is that candidates often assume a separate Windows Hello for Business policy (Option B) is required to trigger the OOBE prompt, not realizing that the Autopilot profile itself has a dedicated toggle that directly controls this behavior during the initial setup flow.

How to eliminate wrong answers

Option A is wrong because ensuring the device is Azure AD joined is a prerequisite for Windows Hello for Business, but it does not by itself cause the OOBE prompt to appear; the Autopilot profile must explicitly enable the Hello setting. Option B is wrong because creating a separate Windows Hello for Business policy and assigning it to the device group will enforce Hello after the device is provisioned, but it will not trigger the interactive setup prompt during OOBE; the Autopilot profile's built-in setting is required for that. Option C is wrong because the Enrollment Status Page (ESP) controls the provisioning progress display and can block setup until policies are applied, but it does not contain a setting to enable or prompt for Windows Hello for Business; the Hello prompt is controlled solely by the Autopilot profile's Hello toggle.

Practice this question →

107

MCQhard

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

A.The Intune service is experiencing an outage

B.The device is powered off or not connected to the internet

C.The device has conflicting policies from another MDM

D.The device's enrollment certificate has expired

AnswerB

Prevents MDM check-in.

Why this answer

If the device is powered off or not connected to the internet, it cannot check in with Intune to receive new policies. Option A is wrong because an Intune service outage would affect multiple devices, not just one. Option C is wrong because conflicting policies would not prevent check-in; the device would still check in and report conflicts.

Option D is wrong because an expired enrollment certificate would prevent enrollment or cause immediate issues, not just a delayed check-in after three days.

Practice this question →

108

MCQeasy

Your organization is deploying Microsoft Intune for the first time. You need to ensure that devices can enroll in Intune. Which of the following is a prerequisite for Intune enrollment?

A.A Microsoft Intune license assigned to the user

B.A VPN connection to the corporate network

C.An on-premises Active Directory domain

D.A Configuration Manager infrastructure

AnswerA

An Intune license is required for enrollment and management.

Why this answer

A Microsoft Intune license assigned to the user is a prerequisite because Intune uses Azure Active Directory (Azure AD) for identity and access management. Without an Intune license (e.g., Microsoft 365 E3, E5, or standalone Intune license) assigned to the user, the device cannot authenticate and enroll via the Intune enrollment service, as the license is required to authorize the enrollment request and apply device management policies.

Exam trap

The trap here is that candidates often confuse on-premises prerequisites (like AD or VPN) with cloud-only requirements, mistakenly thinking corporate network connectivity or legacy infrastructure is needed for Intune enrollment, when in fact only an Azure AD identity and an Intune license are required.

How to eliminate wrong answers

Option B is wrong because a VPN connection to the corporate network is not required for Intune enrollment; Intune uses internet-based enrollment over HTTPS (port 443) to the Microsoft Intune service, and devices can enroll from anywhere without a VPN. Option C is wrong because an on-premises Active Directory domain is not a prerequisite; Intune enrollment relies on Azure AD for identity, and while hybrid Azure AD join can be used, a standalone on-premises AD domain is not required for basic Intune enrollment. Option D is wrong because a Configuration Manager infrastructure is not a prerequisite; Intune is a cloud-only MDM solution, and while co-management with Configuration Manager is possible, it is optional and not required for enrollment.

Practice this question →

109

MCQeasy

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

A.Trigger a sync from Intune to force the device to check in.

B.Re-enroll the device.

C.Delete the device from Intune and re-register.

D.Assign a new compliance policy to the device.

AnswerA

Last sync is old; syncing may resolve.

Why this answer

The PowerShell command shown likely runs a compliance evaluation or sync action, but the device remains noncompliant because the evaluation results haven't been reported back to Intune. Triggering a sync from Intune forces the device to check in, upload its latest compliance status, and update the portal, which is the first troubleshooting step before considering re-enrollment or policy changes.

Exam trap

The trap here is that candidates assume noncompliance means a policy misconfiguration or enrollment failure, rather than recognizing that the device simply hasn't reported its latest compliance evaluation, making a sync the correct first action.

How to eliminate wrong answers

Option B is wrong because re-enrolling the device is unnecessary; the device is already enrolled and the issue is likely a stale compliance status, not a broken enrollment. Option C is wrong because deleting and re-registering the device is a drastic step that should only be taken if the device cannot sync or has a corrupted enrollment record, not as a first action for noncompliance. Option D is wrong because assigning a new compliance policy won't resolve noncompliance if the device hasn't reported its status; the existing policy is already assigned, and the device needs to sync to evaluate and report compliance.

Practice this question →

110

MCQmedium

You are reviewing an ARM template for Intune device configuration. The exhibit shows a snippet. What will be the effect on Windows 10 devices?

A.Automatic updates will be disabled.

B.Users can sideload trusted apps.

C.Devices will receive updates from WSUS.

D.Developer unlock is allowed.

AnswerC

Correct. The 'UpdateNotificationLevel' setting to 1, combined with other WSUS configuration, causes devices to receive updates from the configured WSUS server.

Why this answer

The ARM template sets 'UpdateNotificationLevel' to 1, which configures Windows Update to suppress notifications and directs devices to receive updates from a local WSUS server.

Exam trap

Candidates may mistakenly think that 'UpdateNotificationLevel' to 1 disables automatic updates, but it only affects notifications. The actual effect is directing updates to WSUS.

How to eliminate wrong answers

Option B is wrong because sideloading trusted apps is controlled by the 'ApplicationManagement' CSP, specifically the 'AllowAllTrustedApps' setting, which is not present in the template. Option C is wrong because receiving updates from WSUS requires the 'UpdateServiceUrl' or 'UpdateServiceUrlAlternate' setting to point to a WSUS server, which is not configured in the snippet. Option D is wrong because developer unlock is governed by the 'ApplicationManagement' CSP's 'AllowDeveloperUnlock' setting, which is not included in the template.

Practice this question →

111

Multi-Selecthard

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Select 3 answers

A.Users must have an Intune license assigned.

B.Devices must be connected via VPN.

C.Devices must run Windows 10/11.

D.Tenant must have Azure AD Premium P2.

E.Devices must be Intune enrolled.

AnswersA, C, E

License required for remote help.

Why this answer

Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Exam trap

The trap here is that candidates often assume a VPN or premium Azure AD license is necessary for remote help, but Microsoft designed the feature to work over standard internet connectivity with only Intune licensing and device enrollment.

Practice this question →

112

MCQeasy

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

A.Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.

B.Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

C.Set 'Update deferral period (days)' to 7.

D.Set 'Update deferral period (days)' to 30.

AnswerA

No deferral, immediate deadline.

Why this answer

Setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Exam trap

The trap here is that candidates often confuse 'Update deferral period' with 'Feature update deferral' or think that setting a deferral to 0 is unnecessary, but the question specifically requires immediate installation, which mandates both deferral and deadline to be 0.

How to eliminate wrong answers

Option B is wrong because setting 'Feature update deferral' to 7 introduces a 7-day delay for feature updates, which does not affect critical updates but indicates a misunderstanding that feature update deferral applies to critical updates. Option C is wrong because setting 'Update deferral period (days)' to 7 introduces a 7-day delay before critical updates are offered, preventing immediate installation. Option D is wrong because setting 'Update deferral period (days)' to 30 introduces a 30-day delay, which is the opposite of the required immediate installation.

Practice this question →

113

MCQeasy

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

A.Windows app (Win32)

B.Microsoft 365 Apps

C.Web link

D.Microsoft Store app

AnswerB

Dedicated app type for Office.

Why this answer

The Microsoft 365 Apps app type in Intune is specifically designed to deploy Office 365 ProPlus (now Microsoft 365 Apps) suites, including Word, Excel, PowerPoint, and others, as a managed suite. This app type automatically configures the installation to use the Office Deployment Tool (ODT) with built-in settings for update channels, architecture (32-bit/64-bit), and language packs, and it makes the suite available in Company Portal for user-initiated installation. Unlike Win32 or other types, it handles the complex licensing and activation requirements for Microsoft 365 Apps without additional scripting.

Exam trap

The trap here is that candidates often choose 'Windows app (Win32)' because they think any desktop app must be deployed as a Win32 app, but they overlook that Intune has a dedicated app type for Microsoft 365 Apps that simplifies licensing, update management, and Company Portal integration, making it the correct and intended choice.

How to eliminate wrong answers

Option A is wrong because Windows app (Win32) is used for deploying traditional desktop applications (e.g., .exe or .msi files) via Intune, but it does not natively support the integrated licensing, update channel management, or suite-level configuration that Microsoft 365 Apps require; using Win32 would require manually packaging the Office Deployment Tool and scripts, which is unnecessary and error-prone. Option C is wrong because a Web link app type only creates a shortcut to a URL in Company Portal and does not perform any software installation, so users cannot install Microsoft 365 Apps from it. Option D is wrong because Microsoft Store app type is intended for deploying apps from the Microsoft Store (UWP or Store-licensed Win32 apps), and Microsoft 365 Apps is not distributed through the Microsoft Store for enterprise deployment via Intune.

Practice this question →

114

MCQmedium

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

A.Shared iPad enrollment using Apple Business Manager and Intune.

B.Automated Device Enrollment with user affinity.

C.User Enrollment

D.Device Enrollment (DEP) without user affinity.

AnswerA

Shared iPad supports multiple users with separate data.

Why this answer

Shared iPad enrollment using Apple Business Manager and Intune is the correct method because it enables multiple users to sign in with Managed Apple IDs on a single device, keeping their apps and data separate. This meets the requirement of providing each student access to their own apps and data on shared iPads. Option B (Automated Device Enrollment with user affinity) assigns the device to a single user and is not suitable for shared use.

Option C (User Enrollment) is intended for personally owned devices (BYOD), not organization-owned shared devices. Option D (Device Enrollment without user affinity) allows shared use but does not provide per-user data separation unless combined with Shared iPad mode, which is specifically option A.

Practice this question →

115

Multi-Selecteasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Select 1 answer

A.Disable screen capture.

B.Disable copy and paste.

C.Disable camera.

D.Disable Bluetooth.

E.Disable Wi-Fi.

AnswersA

Correct: Disable screen capture uses FLAG_SECURE to block screenshots at the OS level.

Why this answer

To restrict screenshots on Android Enterprise devices, only the 'Disable screen capture' setting directly prevents the device from taking screenshots by using the FLAG_SECURE window flag. Options B and C ('Disable copy and paste' and 'Disable camera') do not prevent screen capture; they restrict clipboard operations and camera usage respectively. Therefore, the only correct setting is A.

Exam trap

Candidates might mistakenly think that 'Disable copy and paste' or 'Disable camera' can prevent screenshots, but they do not. Only 'Disable screen capture' effectively blocks screenshots.

Practice this question →

116

MCQmedium

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

A.The device name template is invalid.

B.The device does not have a TPM 2.0 chip.

C.The profile requires a user to sign in during deployment.

D.The language settings are not configured.

AnswerB

TPM 2.0 is required for self-deploying mode attestation.

Why this answer

Windows Autopilot self-deploying mode requires a TPM 2.0 chip to perform hardware-based attestation and automatically enroll the device without user interaction. If the device lacks TPM 2.0, the provisioning process will fail because the required cryptographic keys for attestation cannot be generated, preventing the device from completing the self-deploying profile.

Exam trap

The trap here is that candidates assume any Autopilot mode can work without TPM 2.0, but Microsoft explicitly requires TPM 2.0 for self-deploying and pre-provisioning modes, while user-driven mode can proceed with software-based attestation if TPM is unavailable.

How to eliminate wrong answers

Option A is wrong because the device name template is validated during profile creation and would cause a profile creation error, not a provisioning failure after assignment. Option C is wrong because the exhibit shows a self-deploying mode profile, which explicitly does not require user sign-in; requiring user sign-in would contradict the mode's purpose. Option D is wrong because language settings are optional in Autopilot profiles and their absence does not prevent provisioning; the device will use default language settings.

Practice this question →

117

Multi-Selectmedium

You are planning to deploy Microsoft Intune for device management. Which ONE of the following is a prerequisite for enrolling Windows 10 devices in Intune?

Select 1 answer

A.Microsoft Entra ID (Azure AD) Premium P1 or P2.

B.Microsoft Intune license assigned to the user.

C.A Microsoft account (MSA) for each user.

D.Microsoft 365 E3 subscription.

E.Azure Information Protection license.

AnswersB

Each user must have an Intune license assigned to enroll devices; this is a core prerequisite.

Why this answer

Option B is the correct prerequisite: a Microsoft Intune license must be assigned to the user enrolling the device. Option A (Microsoft Entra ID Premium P1/P2) is not required; Microsoft Entra ID Free is sufficient for Intune enrollment. Option C (Microsoft account) is not needed for corporate devices.

Option D (Microsoft 365 E3) is a bundled subscription but not a standalone prerequisite. Option E (Azure Information Protection) is unrelated to device enrollment. Therefore, only one option is correct.

Exam trap

Candidates may mistakenly select multiple options, but the stem clearly asks for only one prerequisite, and only Option B is correct.

Practice this question →

118

Multi-Selectmedium

Which TWO actions should you take to prepare infrastructure for devices running macOS in your organization? (Select two.)

Select 2 answers

A.Deploy the Company Portal app to macOS devices.

B.Enroll macOS devices in Microsoft Intune.

C.Configure Windows Autopilot for macOS devices.

D.Join macOS devices to Microsoft Entra ID.

E.Use Group Policy to manage macOS settings.

AnswersA, B

Company Portal provides self-service app installation.

Why this answer

The Company Portal app is the primary interface for users to enroll macOS devices in Microsoft Intune, access corporate resources, and manage compliance. Deploying it ensures users can initiate enrollment and receive policies. Option B is correct because enrolling macOS devices in Intune is the foundational step to apply management policies, deploy apps, and enforce compliance settings via MDM.

Exam trap

The trap here is that candidates may confuse Windows-centric technologies like Autopilot and Group Policy as being cross-platform, when in fact macOS management relies on Apple-specific protocols and tools such as MDM, APNs, and Apple Business Manager.

Practice this question →

119

MCQmedium

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

A.Create an app protection policy for Windows 365 app.

B.Configure the Cloud PC provisioning policy to allow only compliant devices.

C.Assign a device compliance policy to all users.

D.Create a Conditional Access policy requiring device to be marked as compliant.

AnswerD

Conditional Access enforces compliance requirement.

Why this answer

A Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Exam trap

The trap here is that candidates often confuse provisioning policies (which configure Cloud PCs) with access control policies (Conditional Access), leading them to select Option B, but provisioning policies do not enforce compliance-based access restrictions.

How to eliminate wrong answers

Option A is wrong because app protection policies (MAM) manage data protection within apps and do not evaluate device compliance; they are designed for unmanaged devices and cannot block access based on device compliance status. Option B is wrong because a Cloud PC provisioning policy defines the configuration and assignment of Cloud PCs (e.g., image, network, user assignments) but does not enforce access controls or compliance checks at the time of connection. Option C is wrong because assigning a device compliance policy to all users defines the compliance requirements (e.g., encryption, OS version) but does not enforce access restrictions; it only marks the device as compliant or non-compliant—a separate Conditional Access policy is needed to block non-compliant devices.

Practice this question →

120

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 feature update using the Windows 10 Update Rings feature. However, the deployment fails and devices show error 0x800f0905. What is the most likely cause?

A.The device does not have enough free disk space.

B.The device is not set to the correct language for the update.

C.The feature update package is missing prerequisite updates.

D.The update ring is configured with a maintenance window that is too short.

AnswerC

Correct. Error 0x800f0905 indicates missing installation files, typically caused by prerequisite updates not being installed before attempting the feature update.

Why this answer

Error 0x800f0905 indicates missing installation files for the feature update. This typically occurs when prerequisite updates are not installed. Therefore, the most likely cause is that the feature update package is missing prerequisite updates (Option C).

Option A is incorrect because insufficient disk space would result in a different error. Option B is incorrect because the update ring does not involve language settings. Option D is incorrect because a maintenance window would not cause this error.

Practice this question →

121

MCQeasy

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

A.Require Hybrid Azure AD joined device.

B.Require multi-factor authentication.

C.Require approved client app.

D.Require device to be marked as compliant.

AnswerD

Compliance policies can be configured for corporate devices.

Why this answer

Conditional Access grant control 'Require device to be marked as compliant' ensures that only devices enrolled in Microsoft Intune and meeting your compliance policies (e.g., encryption, OS version, threat level) can access Microsoft 365 apps. This directly enforces the requirement that only corporate-owned devices are allowed, as compliance status is tied to managed devices. In contrast, other options either don't restrict to corporate-owned devices or address different security concerns.

Exam trap

The trap here is that candidates often confuse 'Hybrid Azure AD joined' (Option A) with device compliance, not realizing that a device can be joined to Azure AD without being compliant, and that compliance is the granular control needed to enforce corporate ownership and security posture.

How to eliminate wrong answers

Option A is wrong because requiring a Hybrid Azure AD joined device only ensures the device is domain-joined and registered with Azure AD, but it does not enforce compliance policies or distinguish corporate-owned from personal devices; a personal device could be Hybrid Azure AD joined if it is domain-joined. Option B is wrong because multi-factor authentication (MFA) is an identity-based control that verifies user identity, not device ownership; a user on a personal device could still satisfy MFA. Option C is wrong because requiring an approved client app (e.g., Microsoft Outlook) controls the application used, not the device itself; a user could install the approved app on an unmanaged personal device and still access corporate data.

Practice this question →

122

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

A.Configure a device configuration profile with 'Windows Update for Business' settings.

B.Deploy a feature update policy to install the latest quality updates.

C.Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.

D.Create a device compliance policy that requires devices to have the latest updates.

AnswerC

Update rings centrally manage Windows Update settings and enforce installation.

Why this answer

Update rings are the primary policy in Microsoft Intune for controlling how and when Windows 10 and later devices receive updates from Windows Update. Setting 'Automatic update behavior' to 'Auto install and reboot' ensures that critical and security updates are automatically downloaded and installed without user intervention, meeting the requirement for all Windows 11 devices.

Exam trap

The trap here is that candidates confuse device configuration profiles (which are for settings like BitLocker or Wi-Fi) with update rings, or they mistakenly think compliance policies can enforce update installation, when in fact only update rings control the automatic update behavior.

How to eliminate wrong answers

Option A is wrong because a device configuration profile with 'Windows Update for Business' settings is a legacy approach that has been deprecated in favor of update rings; it does not provide the granular control over update installation behavior required for automatic installation of critical and security updates. Option B is wrong because a feature update policy is used to move devices to a specific Windows version (e.g., from Windows 10 to Windows 11) or to defer feature updates, not to control the installation of critical and security quality updates. Option D is wrong because a device compliance policy can only report on whether devices have the latest updates installed and can trigger conditional access actions, but it cannot enforce the automatic installation of updates; it is a reporting and remediation tool, not an update deployment mechanism.

Practice this question →

123

MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that corporate data in managed apps is encrypted at rest. Which setting should you configure?

A.Device compliance policy – Require data encryption.

B.App protection policy – Data protection – Encrypt app data.

C.Enrollment restrictions – Require encrypted backup.

D.Device configuration profile – Encryption settings.

AnswerB

Encrypts app data at rest.

Why this answer

App Protection Policies (APP) in Microsoft Intune include a 'Data Protection' setting called 'Encrypt app data' that enforces encryption of corporate data at rest on iOS/iPadOS devices. This setting uses hardware-backed file-level encryption (Data Protection class) to protect data in managed apps, ensuring that even if the device is lost or stolen, the data remains inaccessible without the user's passcode.

Exam trap

The trap here is that candidates often confuse device-level encryption (which is always on for iOS with a passcode) with app-level encryption, and incorrectly choose a Device Compliance Policy or Configuration Profile, not realizing that only App Protection Policies can enforce encryption specifically for corporate data within managed apps.

How to eliminate wrong answers

Option A is wrong because Device Compliance Policies can require device-level encryption (e.g., FileVault on macOS or BitLocker on Windows), but on iOS/iPadOS, encryption is always enabled by default when a passcode is set; compliance policies cannot granularly encrypt data within managed apps at rest. Option C is wrong because Enrollment Restrictions control which devices can enroll and whether backups are encrypted, but they do not encrypt corporate data within apps on the device itself. Option D is wrong because Device Configuration Profiles can enforce passcode policies or VPN settings, but they do not include a specific setting to encrypt app data at rest; that capability is exclusive to App Protection Policies.

Practice this question →

124

MCQmedium

Your organization plans to deploy Windows 11 to 500 devices using Microsoft Intune. You need to ensure that each device receives the correct language pack and regional settings based on the user's location. Which configuration method should you use?

A.Configure Windows Autopilot with enrollment profile specifying language and region

B.Deploy a PowerShell script via Intune to set language after enrollment

C.Use Configuration Manager task sequence with language packs

D.Create a provisioning package (PPKG) with language settings and apply via USB

AnswerA

Allows per-device language and region during OOBE, cloud-native.

Why this answer

Windows Autopilot with an enrollment profile allows you to specify language and region settings that are applied during the out-of-box experience (OOBE). This ensures each device receives the correct configuration based on the user's location without requiring post-enrollment scripts or manual intervention, making it the most efficient and scalable method for 500 devices managed by Intune.

Exam trap

The trap here is that candidates often assume post-enrollment scripts or provisioning packages are more flexible, but the exam tests the understanding that Autopilot's OOBE settings are the intended method for applying language and region during initial provisioning in a cloud-native Intune deployment.

How to eliminate wrong answers

Option B is wrong because deploying a PowerShell script via Intune to set language after enrollment introduces a delay and potential failure point, as language packs must already be present on the device; it also violates the principle of applying settings during OOBE for a seamless user experience. Option C is wrong because Configuration Manager task sequences are designed for on-premises, co-managed environments and are not the primary method for cloud-only Intune-managed devices; they also require additional infrastructure and are less efficient for a pure Intune deployment. Option D is wrong because creating a provisioning package (PPKG) with language settings and applying via USB is a manual, device-by-device process that does not scale to 500 devices and bypasses the automated, user-driven provisioning that Autopilot provides.

Practice this question →

125

MCQeasy

Your organization plans to use Windows Autopilot for device provisioning. You need to ensure devices are automatically registered in Microsoft Entra ID when they are powered on for the first time. Which prerequisite must be met?

A.Devices must be pre-registered in Intune via an OEM or partner

B.Devices must have a TPM 2.0 chip for self-deploying mode

C.An on-premises Active Directory domain must be available

D.Users must have Microsoft Entra ID P1 or P2 licenses assigned

AnswerD

Entra ID P1 or P2 is required for Autopilot's automatic registration and device management.

Why this answer

Microsoft Entra ID P1 or P2 licenses are required because Windows Autopilot relies on Microsoft Entra ID features such as dynamic device groups, conditional access policies, and automatic enrollment policies, which are only available with these license tiers. Without these licenses, devices cannot be automatically registered in Microsoft Entra ID during the first power-on, as the Autopilot profile assignment and device registration process depend on these premium capabilities.

Exam trap

The trap here is that candidates often confuse the hardware prerequisites (like TPM 2.0) with licensing requirements, or assume that on-premises Active Directory is still needed for device registration, when in fact Microsoft Entra ID P1/P2 licensing is the critical prerequisite for automatic registration in a cloud-native Autopilot deployment.

How to eliminate wrong answers

Option A is wrong because pre-registering devices in Intune via an OEM or partner is a method to import device hashes for Autopilot, but it is not a prerequisite for automatic registration in Microsoft Entra ID; devices can also be registered manually or via CSV upload. Option B is wrong because a TPM 2.0 chip is required specifically for self-deploying mode (which uses Windows Hello for Business and automatic MDM enrollment), but the question does not specify self-deploying mode, and other Autopilot modes (user-driven) do not mandate TPM 2.0. Option C is wrong because an on-premises Active Directory domain is not required for Windows Autopilot; Autopilot is designed for cloud-native device provisioning using Microsoft Entra ID, and hybrid Azure AD join is optional and not a prerequisite for automatic registration.

Practice this question →

126

MCQmedium

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

A.Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.

B.Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

C.Set a device compliance policy that requires device name prefix 'CORP-'.

D.Modify the Enrollment Status Page (ESP) policy to require device naming.

AnswerA

This directly configures enrollment and naming.

Why this answer

A Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Exam trap

The trap here is that candidates often confuse device configuration profiles (OMA-URI) or compliance policies as capable of setting device names, when in fact only the Autopilot deployment profile's device name template can enforce naming during the initial enrollment process.

How to eliminate wrong answers

Option B is wrong because a device configuration profile with a custom OMA-URI cannot rename a device during Autopilot enrollment; device naming is only supported via the Autopilot deployment profile's device name template. Option C is wrong because a device compliance policy can only report or block non-compliant devices based on naming, not enforce or apply a name prefix during enrollment. Option D is wrong because the Enrollment Status Page (ESP) policy controls the blocking of device setup until required apps or policies are installed, but it has no capability to set or enforce a device name prefix.

Practice this question →

127

MCQmedium

Your organization is planning to deploy Windows 11 to 5000 devices using Microsoft Intune. The devices are currently a mix of Windows 10 and Windows 11 eligible hardware. You need to ensure that only devices meeting the Windows 11 hardware requirements can be upgraded. What is the most efficient way to achieve this using Intune?

A.Use Windows Autopilot to reset each device and manually verify hardware compatibility.

B.Create a Windows feature update profile targeting Windows 11 and assign it to all devices; Intune will automatically skip ineligible devices.

C.Create a dynamic device group based on TPM version and assign a Windows 10 update ring to non-compliant devices.

D.Create a compliance policy requiring TPM 2.0 and Secure Boot, then assign a Windows 11 update ring to compliant devices.

AnswerB

Intune checks hardware requirements before applying the feature update.

Why this answer

A Windows feature update profile in Intune automatically checks device hardware eligibility before applying the Windows 11 upgrade. Intune queries the Windows Update for Business service, which evaluates TPM 2.0, Secure Boot, CPU generation, and RAM requirements; devices that do not meet the minimum hardware requirements are skipped without any manual intervention or additional configuration.

Exam trap

The trap here is that candidates confuse compliance policies (which only report or block access) with feature update profiles (which natively enforce hardware gating), leading them to choose Option D, which would still attempt the upgrade on non-compliant devices and cause deployment failures.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot is designed for device provisioning and resetting, not for hardware compatibility verification; manually checking 5000 devices is inefficient and defeats the purpose of automated management. Option C is wrong because creating a dynamic device group based solely on TPM version is insufficient—Windows 11 requires a combination of TPM 2.0, Secure Boot, CPU, and RAM checks, and assigning a Windows 10 update ring to non-compliant devices does not prevent upgrades on ineligible hardware. Option D is wrong because a compliance policy can report non-compliance but does not block the upgrade; a Windows 11 update ring would still attempt to upgrade non-compliant devices, potentially causing failures, whereas a feature update profile inherently skips ineligible devices.

Practice this question →

128

MCQmedium

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

A.Export the device list from the vendor and import it via CSV in Microsoft Intune.

B.Add the vendor as a global administrator in Microsoft Entra ID.

C.Provide the vendor with a bulk enrollment token and URL.

D.Create a custom device preparation profile with delegated admin privileges.

AnswerC

Providing a bulk enrollment token (Autopilot registration token) and URL is the correct method. It allows the vendor to upload device hardware hashes to your tenant with scoped permissions, without granting them any user accounts or broader access.

Why this answer

Providing the vendor with a bulk enrollment token (also known as an Autopilot registration token) and the associated URL allows the vendor to register devices in your tenant via Autopilot without granting full user privileges. This token is specifically designed for OEMs or resellers to upload device hashes and associate them with your tenant, scoping their permissions to only that action. Option D is incorrect because a 'custom device preparation profile with delegated admin privileges' is not a standard or recognized method for Autopilot device registration by vendors; the correct approach is to use an Autopilot registration token or delegate via Microsoft Partner Center.

Exam trap

The trap here is that candidates may think the vendor needs global administrator rights (Option B) or that importing a CSV via Intune (Option A) is sufficient. However, the correct method is to provide the vendor with a bulk enrollment token (Autopilot registration token) which allows device registration without granting broader permissions.

How to eliminate wrong answers

Option A is wrong because exporting a device list from the vendor and importing it via CSV in Microsoft Intune requires the vendor to have direct access to your tenant or you to manually handle the import, which does not delegate the registration process to the vendor securely. Option B is wrong because adding the vendor as a global administrator in Microsoft Entra ID grants them full administrative access to your entire tenant, which violates the principle of least privilege and is unnecessary for device registration. Option C is wrong because a bulk enrollment token and URL are used for Windows Autopilot self-deploying mode or user-driven mode enrollment, but they do not delegate the ability to register devices on your behalf; the token is for enrolling devices, not for registering them in the Autopilot service.

Practice this question →

129

MCQhard

Your organization uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) and Microsoft Intune. You need to ensure that devices that are deemed 'at risk' by Microsoft Defender for Endpoint are automatically blocked from accessing corporate resources. What should you configure?

A.An app protection policy in Intune that blocks access based on device risk.

B.A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.

C.A conditional access policy that requires device to be compliant, and a compliance policy that uses the Defender for Endpoint device risk level.

D.A device configuration policy that disables network access for at-risk devices.

AnswerB

Correct. This combination allows you to evaluate device risk via Defender for Endpoint in a compliance policy, then use Conditional Access to block noncompliant devices.

Why this answer

To block devices at risk by Microsoft Defender for Endpoint from accessing corporate resources, you need to configure a compliance policy that evaluates the device risk level from Defender for Endpoint (using the 'Require the device to be at or under the Device Threat Level' setting) and marks devices as noncompliant if they exceed the threshold. Then, configure a Conditional Access policy that targets all cloud apps and uses the 'Grant' control to 'Require device to be marked as compliant', which will block noncompliant devices. This combination is exactly described in Option B.

Option A is incorrect because an app protection policy controls access at the app level, not device level. Option C is incorrect because although it describes a similar setup, it does not explicitly state that the conditional access policy blocks noncompliant devices, and the order of configuration is reversed; the standard approach is option B. Option D is incorrect because a device configuration policy does not enforce access control; it configures device settings.

Practice this question →

130

Multi-Selecteasy

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Select 2 answers

A.Devices must be joined to Azure AD.

B.A Microsoft Defender for Endpoint license must be assigned.

C.Devices must be enrolled in Microsoft Intune.

D.Devices must have a third-party antivirus uninstalled.

E.An Azure AD Premium license must be assigned.

AnswersB, C

License is required to use the service.

Why this answer

A Microsoft Defender for Endpoint license is required because it provides the entitlement to use the Defender for Endpoint service, including its advanced threat protection, endpoint detection and response (EDR), and vulnerability management capabilities. Without this license, the service cannot be provisioned or used, even if the devices are properly enrolled and configured.

Exam trap

The trap here is that candidates often confuse the prerequisites for Defender for Endpoint with those for other Microsoft 365 security services, mistakenly thinking Azure AD join or Azure AD Premium licenses are required, when in fact only an Intune enrollment and a Defender for Endpoint license are needed.

Practice this question →

131

Multi-Selecthard

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?

Select 2 answers

A.Set 'Windows Update for Business' to defer feature updates.

B.Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.

C.Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.

D.Enable 'BitLocker' to encrypt the system drive.

E.Configure 'SmartScreen' settings to block untrusted apps.

AnswersC, E

AppLocker can enforce store-only app installation.

Why this answer

AppLocker is a Windows feature that can be configured via Intune device configuration profiles to enforce application control policies. By creating an AppLocker rule for the 'Packaged apps' rule collection and setting the default action to 'Deny' for all users, you can explicitly allow only apps from the Microsoft Store, effectively blocking installation of non-Store apps.

Exam trap

The trap here is that candidates confuse SmartScreen's reputation-based blocking (which warns but can be bypassed) with AppLocker's explicit allow/deny enforcement, or they mistakenly think firewall or encryption policies can control application installation.

Practice this question →

132

MCQeasy

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use Group Policy to configure MDM enrollment. C) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. D) Use a provisioning package (PPKG) to enroll devices. Which option should you choose?

A.Use Windows Autopilot to reset the devices and re-enroll

B.Use Group Policy to configure MDM enrollment

C.Use the 'Switch to Intune' option in the device's 'Access work or school' settings

D.Use a provisioning package (PPKG) to enroll devices

AnswerC

Use a provisioning package (PPKG) to enroll devices. PPKG enrollment typically requires a reset or is used for new devices; it does not support switching from an existing MDM without reset.

Why this answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. This feature is specifically designed for migrating devices from a legacy on-premises MDM to Intune without requiring a device reset. It is available on Windows 10 devices that are already joined to Microsoft Entra ID and enrolled in another MDM.

Option A is incorrect because Windows Autopilot resets the device, which is not desired. Option B (Group Policy) can force enrollment to Intune but does not handle the migration from an existing MDM; it would likely cause a conflict or require manual steps. Option D (provisioning package) is typically used for initial bulk enrollment and may also require a reset or clean installation.

Therefore, Option C is the only non-destructive migration method.

Exam trap

The trap here is that candidates often confuse the 'Switch to Intune' option with a simple enrollment method, assuming any enrollment method (like PPKG or Group Policy) can perform a non-destructive migration, when in fact only the built-in switch option is designed to handle the transition from an existing MDM without a reset.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot resets the device to an out-of-box state, which would wipe all data and settings, contradicting the requirement to migrate without resetting. Option B is wrong because Group Policy can configure MDM enrollment via the MDM enrollment authority policy, but it does not provide a direct 'switch' mechanism; it would require additional configuration and may not cleanly transition from an existing MDM without manual intervention or a reset. Option D is wrong because a provisioning package (PPKG) is used for initial enrollment or re-enrollment, but applying it to an already managed device would likely cause conflicts or require a reset, and it does not support a non-destructive migration from a legacy MDM.

Practice this question →

133

MCQeasy

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

A.Deploy a configuration profile with the Windows 11 installation script.

B.Create a Windows update ring profile targeting Windows 11.

C.Create a Windows feature update profile targeting Windows 11.

D.Configure a device compliance policy requiring Windows 11.

AnswerC

Windows feature update profiles are designed to deploy feature updates like Windows 11 in Intune.

Why this answer

A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Exam trap

The trap here is confusing a Windows update ring profile (which controls update behavior but not the target version) with a Windows feature update profile (which explicitly specifies the target OS version for an upgrade), leading candidates to incorrectly choose Option B.

How to eliminate wrong answers

Option A is wrong because Intune does not support deploying a configuration profile with an installation script for OS upgrades; configuration profiles manage settings, not OS installation or upgrade scripts. Option B is wrong because a Windows update ring profile controls the update deferral, delivery optimization, and restart behavior for quality and feature updates, but it does not specify the target OS version for an upgrade; it only manages how updates are applied, not which feature update is installed. Option D is wrong because a device compliance policy enforces security and configuration requirements (e.g., requiring Windows 11) but does not initiate or deliver the upgrade; it only reports non-compliance if the device is not running the required OS.

Practice this question →

134

MCQeasy

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

A.Assign the app and configure 'Require device compliance' with a filter for minimum OS version.

B.Assign the app with 'Uninstall' intent.

C.Assign the app as 'Available for enrolled devices' without filters.

D.Assign the app as 'Required' to all devices.

AnswerA

Device compliance filters can enforce OS version requirements.

Why this answer

Intune allows you to create a filter based on device properties such as OS version, and apply that filter to app assignments. This ensures the deployment is only available to devices meeting the minimum OS version. Option B is incorrect because 'Uninstall' intent would remove the app, not deploy it with OS filtering.

Option C is incorrect because 'Available for enrolled devices' without filters does not enforce any OS version requirement. Option D is incorrect because assigning as 'Required' to all devices does not filter by OS version.

Practice this question →

135

MCQeasy

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

A.Require device to be marked as compliant

B.Require multi-factor authentication

C.Require hybrid Azure AD joined device

D.Require approved client app

AnswerA

Directly enforces compliance for access.

Why this answer

The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Exam trap

The trap here is that candidates often confuse device compliance with device join type (hybrid Azure AD join) or app-level controls, mistakenly thinking that requiring a specific join type or approved app alone ensures the device is healthy and secure.

How to eliminate wrong answers

Option B is wrong because requiring multi-factor authentication (MFA) addresses identity verification, not device compliance; a compromised but MFA-enabled device could still access email. Option C is wrong because requiring a hybrid Azure AD joined device enforces a specific join type (typically for on-premises AD integration), but a device can be hybrid joined yet still be non-compliant (e.g., missing security updates). Option D is wrong because requiring an approved client app (e.g., Outlook mobile) controls the application used, not the device's compliance state; a non-compliant device could still use an approved app.

Practice this question →

136

MCQmedium

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

A.The device is marked as non-compliant.

B.The device does not have a valid device certificate.

C.The device has not checked in with the Intune service recently.

D.The device enrollment profile has expired.

AnswerC

Devices must check in to receive policy updates.

Why this answer

When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Exam trap

The trap here is that candidates often assume policy delivery failures are due to compliance or certificate issues, but the MD-102 exam specifically tests the understanding that a device must actively check in with the Intune service to receive policies, and a 'Pending' status directly indicates a missed check-in.

How to eliminate wrong answers

Option A is wrong because a non-compliant device still receives policies from Intune; compliance status affects conditional access, not policy delivery. Option B is wrong because while a valid device certificate is required for enrollment, the issue described is about policy retrieval after enrollment, and a missing or expired certificate would typically cause enrollment failure or a different error state, not a 'Not evaluated' status. Option D is wrong because enrollment profiles are used during the enrollment process itself; once a device is enrolled, the profile is no longer relevant for ongoing policy delivery, and an expired profile would prevent enrollment, not cause a 'Pending' state for already-enrolled devices.

Practice this question →

137

Multi-Selecteasy

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Select 2 answers

A.An on-premises Active Directory domain

B.Microsoft Intune licenses

C.Configuration Manager

D.Microsoft Entra ID P1 or P2 licenses

E.TPM 2.0 chip on all devices

AnswersB, D

Intune licenses are required for device management.

Why this answer

And Option D are correct because Autopilot requires Microsoft Entra ID P1/P2 and Intune licenses. Option A is wrong because on-prem AD is not required. Option C is wrong because Configuration Manager is not required.

Option E is wrong because a TPM is only required for self-deploying mode.

Practice this question →

138

MCQhard

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

A.Set the MDM user scope in Microsoft Entra ID to 'All' or 'Some'.

B.Configure the MDM discovery URL in Microsoft Entra ID.

C.Create an enrollment restriction that allows Windows devices.

D.Assign a device compliance policy to the user.

AnswerA

This enables automatic enrollment for Microsoft Entra ID joined devices.

Why this answer

Microsoft Entra ID joined devices automatically enroll in Intune when the MDM user scope is set to 'All' or 'Some'. Option B is incorrect because the MDM discovery URL is configured automatically for Microsoft Entra ID joined devices and does not need manual configuration. Option C is incorrect because enrollment restrictions control which devices can enroll but do not trigger automatic enrollment.

Option D is incorrect because device compliance policies are applied after enrollment, not before.

Practice this question →

139

MCQhard

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

A.The BitLocker recovery key is not escrowed to Microsoft Entra ID

B.BitLocker is only enabled on data drives, not the system drive

C.The device is running a version of Windows that does not support BitLocker

D.The device does not have a TPM chip

AnswerA

The compliance policy checks for recovery key backup; missing escrow causes non-compliance.

Why this answer

The compliance policy is configured to require BitLocker, but Intune's 'Require BitLocker' setting in compliance policies actually checks both that BitLocker is enabled and that the recovery key is escrowed to Microsoft Entra ID. Even if BitLocker is actively encrypting the drive, failure to escrow the key results in non-compliance. This is why the device is marked non-compliant despite BitLocker being turned on.

Exam trap

The trap here is that candidates assume 'BitLocker enabled' only means the drive is encrypted, but Microsoft Intune's compliance policy specifically requires the recovery key to be escrowed to Microsoft Entra ID as part of the compliance check.

How to eliminate wrong answers

Option B is wrong because the compliance policy typically checks for BitLocker on the system drive (operating system drive), and BitLocker on data drives alone does not satisfy the requirement for system drive encryption. Option C is wrong because if the device is managed by Intune and supports BitLocker (which is available on Windows Pro, Enterprise, and Education editions), the version is likely compatible; the issue is not about version support but about key escrow. Option D is wrong because a TPM chip is required for BitLocker to function, and if BitLocker is reported as 'turned on,' the device must have a TPM; the non-compliance stems from missing key escrow, not TPM absence.

Practice this question →

140

MCQmedium

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

A.Create a Conditional Access policy requiring device compliance and blocking access if not compliant.

B.Enable 'Require BitLocker' compliance setting.

C.Deploy a PowerShell script via Intune that checks the Defender service status and reports to Intune custom compliance.

D.Add a compliance policy setting: 'Require the device to be at or under the machine risk score' with a low score.

AnswerD

This setting uses Defender for Endpoint risk score to evaluate compliance. If the device is not reporting, the score is not available, causing non-compliance.

Why this answer

Microsoft Defender for Endpoint integrates with Intune compliance policies via the 'Require the device to be at or under the machine risk score' setting. When a device stops reporting to Defender, its risk score escalates above the 'Low' threshold, causing Intune to mark it as non-compliant. This directly meets the requirement to flag non-reporting devices without additional scripting or conditional access complexity.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces compliance) with the compliance policy setting that actually defines what 'non-compliant' means, leading them to pick Option A instead of the correct risk-score setting.

How to eliminate wrong answers

Option A is wrong because a Conditional Access policy enforces access control based on compliance status but does not itself define or detect non-reporting devices; it relies on an existing compliance policy to flag them. Option B is wrong because 'Require BitLocker' only checks encryption status, not whether the device is actively reporting to Defender for Endpoint. Option C is wrong because while a custom PowerShell script can check Defender service status, it requires custom compliance discovery and is not the native, supported method for integrating Defender risk data into Intune compliance.

Practice this question →

141

MCQhard

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

A.Windows compliance policy

B.Windows 10 and later update ring

C.Windows feature update policy

D.Windows driver update policy

AnswerB

Allows configuring deferral periods.

Why this answer

The Windows 10 and later update ring policy in Intune is specifically designed to configure Windows Update for Business settings, including deferral periods for feature and quality updates. By setting the 'Feature update deferral period (days)' to 60 and 'Quality update deferral period (days)' to 14, you directly control how long updates are postponed after they are released by Microsoft. This policy applies to devices managed via Intune and leverages the Windows Update for Business service to enforce these deferrals.

Exam trap

The trap here is that candidates often confuse the 'Windows feature update policy' (which targets a specific feature update version) with the 'update ring' policy (which controls deferral periods), leading them to select option C instead of B.

How to eliminate wrong answers

Option A is wrong because Windows compliance policy is used to evaluate device compliance against security requirements (e.g., OS version, antivirus status) and does not include settings to defer update installations. Option C is wrong because Windows feature update policy is a separate policy type that targets specific feature update versions (e.g., Windows 11 22H2) and does not control deferral periods for quality updates or general feature update deferral durations. Option D is wrong because Windows driver update policy is dedicated to managing driver updates (e.g., approval, deferral) and does not handle feature or quality update deferral settings.

Practice this question →

142

MCQeasy

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

A.The devices must be registered in Microsoft Intune via the hardware vendor or manually.

B.The organization must have a hybrid Azure AD join configuration in place.

C.BitLocker must be enabled on the devices before they are shipped.

D.A local administrator account must be created on each device prior to deployment.

AnswerA

Autopilot requires device registration in Intune for automatic enrollment.

Why this answer

Autopilot requires the device to be registered in Microsoft Intune (or Entra ID) before it can be automatically enrolled. Option B is incorrect because a hybrid Azure AD join is not a prerequisite for Autopilot enrollment; it is an optional configuration. Option C is incorrect because BitLocker does not need to be enabled before shipment; it can be configured later via policy.

Option D is incorrect because a local administrator account is not required; Autopilot can create accounts during deployment.

Practice this question →

143

MCQeasy

Your organization wants to use Windows Autopilot to deploy new Windows 11 devices. What is required to register a device with Windows Autopilot?

A.The device's product key

B.The device's hardware hash (4K HH)

C.The user's Microsoft account

D.The device's BIOS password

AnswerB

The hardware hash uniquely identifies the device and is required for Autopilot registration.

Why this answer

Windows Autopilot requires the device's hardware hash (4K HH) to uniquely identify the device during the registration process. This hash is generated from the device's hardware components and is uploaded to the Microsoft Intune or Partner portal to associate the device with an Autopilot profile. Without the hardware hash, Autopilot cannot recognize the device as registered and will not apply the deployment profile.

Exam trap

The trap here is that candidates often confuse the hardware hash with the product key, assuming that a license or activation key is needed for Autopilot registration, but Autopilot relies solely on hardware-based identification.

How to eliminate wrong answers

Option A is wrong because the product key is used for Windows activation, not for Autopilot registration; Autopilot uses the hardware hash to identify the device. Option C is wrong because the user's Microsoft account is not required for device registration; Autopilot registration is device-centric and occurs before user sign-in. Option D is wrong because the BIOS password is a security feature for local access control and has no role in Autopilot's device identification or enrollment process.

Practice this question →

144

MCQhard

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

A.Deploy Windows Autopilot for all devices and require Entra ID join

B.Configure Conditional Access policies in Microsoft Entra ID that require compliant devices

C.Configure a VPN profile in Intune and enforce device compliance on the VPN server

D.Create a compliance policy in Intune and assign it to all users

AnswerB

Conditional Access enforces access control based on device compliance status from Intune.

Why this answer

Conditional Access policies in Microsoft Entra ID can require that devices accessing Microsoft 365 services be marked as compliant by Intune. This ensures that only devices meeting your security policies (e.g., encryption, antivirus, OS patch level) are granted access, directly addressing the security team's concern about unmanaged devices on public Wi-Fi.

Exam trap

The trap here is that candidates often confuse creating a compliance policy (which only defines the rules) with enforcing it via Conditional Access (which actually blocks access), leading them to select Option D instead of B.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot and Entra ID join streamline device provisioning and identity, but they do not enforce compliance checks at the point of access to Microsoft 365 services. Option C is wrong because configuring a VPN profile in Intune and enforcing compliance on the VPN server only controls access to the VPN tunnel, not to Microsoft 365 services directly; users could still access those services without going through the VPN. Option D is wrong because creating a compliance policy in Intune and assigning it to users only defines and reports compliance status; it does not enforce access blocking—Conditional Access is required to actually block non-compliant devices from accessing Microsoft 365.

Practice this question →

145

Multi-Selecthard

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Select 3 answers

A.Windows Information Protection (WIP).

B.Windows Defender Application Control (WDAC).

C.Intune application control policies.

D.AppLocker.

E.BitLocker drive encryption.

AnswersB, C, D

WDAC is a code integrity policy to control what apps can run.

Why this answer

Windows Defender Application Control (WDAC) is a code integrity feature that restricts which executables, scripts, and installers can run on Windows 10 devices. It uses a trust-based model where only binaries signed by approved publishers or with specific hash values are allowed, making it a core component for application control in an Intune-managed environment.

Exam trap

The trap here is that candidates often confuse Windows Information Protection (WIP) with application control because both involve 'policies' in Intune, but WIP is strictly for data loss prevention, not for blocking or allowing application execution.

Practice this question →

146

MCQeasy

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

A.Custom

B.Endpoint protection

C.Device restrictions

D.Device features

AnswerB

Endpoint protection profiles include security settings such as FileVault encryption for macOS.

Why this answer

'Endpoint protection' profiles include FileVault settings for macOS. Option A is incorrect because 'Custom' profiles are used for importing custom settings, not for encryption. Option C is incorrect because 'Device restrictions' contain general restrictions but not FileVault.

Option D is incorrect because 'Device features' include settings like wallpaper and lock screen, not encryption.

Practice this question →

147

MCQmedium

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

A.The policy will block access to the Microsoft Store and Cortana.

B.The policy will apply only to the primary user of the device.

C.The policy will prevent users from installing apps from outside the Microsoft Store.

D.The policy will block the camera on all devices.

AnswerA

Both Store and Cortana are set to Block.

Why this answer

The policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device.

Option D is wrong because the policy does not affect app installation from other sources.

Practice this question →

148

MCQeasy

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

A.Join the device to Azure AD hybrid by configuring a domain join profile.

B.Create an Autopilot deployment profile with 'Assign to' set to 'All devices' and ensure the device is registered in Autopilot.

C.Configure the Enrollment Status Page (ESP) to require device enrollment.

D.Manually add the device serial number to Intune via the admin center.

AnswerB

This automatically enrolls the device in Intune during OOBE.

Why this answer

Windows Autopilot requires both a registered device (identified by hardware hash) and an assigned deployment profile to trigger automatic enrollment in Microsoft Intune during the first power-on. Setting 'Assign to' to 'All devices' ensures the profile applies to any registered Autopilot device, and the device registration step links the hardware identity to your tenant. Without this combination, the device will not automatically enroll.

Exam trap

The trap here is that candidates confuse the Enrollment Status Page (ESP) with the enrollment trigger itself, thinking ESP configuration alone enables automatic enrollment, when in fact ESP only manages the post-enrollment provisioning sequence.

How to eliminate wrong answers

Option A is wrong because joining a device to Azure AD hybrid via a domain join profile is a separate configuration for hybrid-joined devices and does not by itself trigger automatic Intune enrollment; Autopilot enrollment requires a deployment profile with enrollment settings. Option C is wrong because the Enrollment Status Page (ESP) controls the end-user experience during enrollment (e.g., blocking use until apps are installed) but does not initiate or enforce device enrollment; enrollment must already be configured via a deployment profile. Option D is wrong because manually adding a device serial number to Intune via the admin center registers the device for management but does not create an Autopilot deployment profile; without a profile assigned, the device will not automatically enroll during first power-on.

Practice this question →

149

Multi-Selectmedium

Your organization is deploying Windows 10 devices using Windows Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are required to set up Windows Hello for Business. Which TWO configurations should you apply?

Select 1 answer

A.Configure a Windows Autopilot deployment profile to require Windows Hello for Business.

B.Enable Azure AD device registration.

C.Configure a Windows Hello for Business policy in Intune device configuration.

D.Configure a Windows Hello for Business enrollment policy in Intune.

E.Deploy a custom script that enables Windows Hello.

AnswersD

The enrollment policy in Intune directly controls whether users must set up Windows Hello during OOBE.

Why this answer

Option D is correct. Configuring a Windows Hello for Business enrollment policy in Intune is sufficient to require users to set up Windows Hello during OOBE. Option C (device configuration policy) is not necessary for OOBE; it enforces settings after enrollment.

Option A is incorrect because Autopilot deployment profiles do not directly enforce Windows Hello; they only configure the OOBE experience. Option B (Azure AD device registration) is a prerequisite but not sufficient alone. Option E (custom script) is not a standard or recommended configuration for OOBE.

Practice this question →

150

MCQmedium

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

A.Apple Automated Device Enrollment (ADE) with user affinity

B.Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs

C.Apple Device Enrollment (ADE) with Shared iPad mode

D.Apple User Enrollment

AnswerB

Supervised devices can allow personal Apple IDs while still being fully managed.

Why this answer

Apple Automated Device Enrollment (ADE) with supervision and allowing personal Apple IDs meets the school's requirements: devices are automatically enrolled in Intune, supervision enables full management control (e.g., blocking activation lock bypass), and allowing personal Apple IDs lets students install apps using their own accounts. This combination ensures devices are managed while preserving user flexibility.

Exam trap

The trap here is that candidates often confuse 'user affinity' with 'personal Apple IDs' or assume that any ADE enrollment requires managed Apple IDs, but ADE with supervision explicitly supports personal Apple IDs while still providing full management control.

How to eliminate wrong answers

Option A is wrong because ADE with user affinity associates the device with a specific user (e.g., using a managed Apple ID), which conflicts with the requirement to allow personal Apple IDs; user affinity typically requires a managed Apple ID for full management. Option C is wrong because Shared iPad mode is designed for multi-user scenarios (e.g., shared devices in a classroom) and does not support personal Apple IDs; it uses managed Apple IDs and caches user data locally. Option D is wrong because Apple User Enrollment is a lightweight enrollment method that does not provide full device supervision or management (e.g., it cannot enforce device-level restrictions like blocking activation lock), and it inherently uses managed Apple IDs, not personal Apple IDs.

Practice this question →

← PreviousPage 2 of 4 · 237 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Prepare infrastructure for devices questions.

Start 20-question session