Knowledge + Practice

CCNA Prepare infrastructure for devices Questions

75 of 237 questions · Page 3/4 · Prepare infrastructure for devices · Answers revealed

Practice these questions Domain overview All questions

151

MCQmedium

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

A.User enrollment

B.Device enrollment (without user affinity)

C.Bring your own device (BYOD) enrollment

D.Automated device enrollment (with user affinity)

AnswerD

This uses Apple Business Manager and prompts for Microsoft Entra ID credentials.

Why this answer

Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Exam trap

The trap here is that candidates often confuse 'Automated device enrollment' with 'Device enrollment (without user affinity)', mistakenly thinking that any automated enrollment method will prompt for user authentication and app installation, but without user affinity, the device is enrolled as a shared device with no user context.

How to eliminate wrong answers

Option A is wrong because User enrollment is designed for personally owned devices and does not support automated installation of the Company Portal app during setup; it requires manual installation and does not enforce supervision. Option B is wrong because Device enrollment (without user affinity) enrolls the device without a specific user, so users cannot authenticate with their Entra ID credentials, and the Company Portal app is not automatically installed. Option C is wrong because Bring your own device (BYOD) enrollment typically uses User enrollment or manual enrollment methods, not automated device enrollment, and does not guarantee the Company Portal app is installed automatically during the setup process.

Practice this question →

152

MCQmedium

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

A.The kiosk profile is not correctly assigned.

B.The device is not assigned to a user.

C.The AUMID for Microsoft Edge is not specified.

D.The device is not running Windows 10/11 Enterprise.

AnswerC

Required for single-app kiosk.

Why this answer

The most likely issue is that the AUMID for Microsoft Edge is not specified in the kiosk profile. For a single-app kiosk on Windows 11, Intune requires the Application User Model ID (AUMID) to launch the app correctly. Without it, the kiosk shell cannot identify which executable to run, resulting in a blank screen instead of the Edge browser.

Exam trap

The trap here is that candidates assume a blank screen means a policy assignment failure or licensing issue, when in fact it is a configuration detail—the missing AUMID—that prevents the kiosk app from launching.

How to eliminate wrong answers

Option A is wrong because the kiosk profile assignment is verified by the device receiving the policy; a blank screen indicates the profile applied but the app failed to launch, not that assignment is missing. Option B is wrong because a kiosk device can be assigned to a device group without a user; user assignment is not required for single-app kiosk mode. Option D is wrong because Windows 11 Pro supports kiosk mode via Intune; only Windows 10/11 Enterprise or Education is required for multi-app kiosk or Assigned Access, but single-app kiosk works on Pro.

Practice this question →

153

Multi-Selecthard

Which TWO components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select two.)

Select 2 answers

A.Enrollment Status Page (ESP) configuration.

B.Device registration in the Autopilot service using hardware hash.

C.On-premises Active Directory domain join.

D.Windows Autopilot deployment profile in Intune.

E.Microsoft Configuration Manager co-management.

AnswersB, D

Device registration is essential to associate the device with the Autopilot service and trigger the deployment profile.

Why this answer

For a user-driven Windows Autopilot deployment with Microsoft Entra ID join, the required components are device registration in the Autopilot service using hardware hash and a Windows Autopilot deployment profile in Intune. The Enrollment Status Page (ESP) is optional and not required for a successful deployment. On-premises Active Directory domain join is not needed because the device joins Microsoft Entra ID, and Configuration Manager co-management is optional.

Exam trap

The trap here is that candidates often confuse the optional Enrollment Status Page with a mandatory component, or they mistakenly believe on-premises Active Directory join is required for user-driven Autopilot, when in fact Microsoft Entra ID join is a separate, cloud-native identity option.

Practice this question →

154

MCQeasy

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

A.Compliance policies in Intune

B.MDM user scope in Microsoft Entra ID

C.Co-management slider in Configuration Manager

D.Enrollment device platform restrictions in Intune

AnswerB

This sets the scope of users who will auto-enroll their devices.

Why this answer

The MDM user scope setting in Microsoft Entra ID (formerly Azure AD) controls which users can automatically enroll their Windows 10 devices into Intune when they join Entra ID. When set to 'All' or 'Some', the device triggers automatic MDM enrollment during the Entra ID join process using the MDM enrollment protocol (MS-MDE), eliminating the need for manual enrollment steps.

Exam trap

The trap here is that candidates often confuse the MDM user scope (which controls the automatic enrollment trigger) with enrollment restrictions or compliance policies, which only apply after the enrollment process has already started.

How to eliminate wrong answers

Option A is wrong because compliance policies in Intune evaluate device compliance after enrollment, not trigger or configure automatic enrollment. Option C is wrong because the co-management slider in Configuration Manager controls workload distribution between ConfigMgr and Intune for already-managed devices, not the initial automatic enrollment of Windows 10 into Intune during Entra ID join. Option D is wrong because enrollment device platform restrictions in Intune block or allow enrollment based on platform or version after the enrollment attempt is initiated, but do not enable or configure the automatic enrollment trigger itself.

Practice this question →

155

MCQhard

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

A.Configure a Microsoft Sentinel playbook.

B.Configure a Microsoft Foundry AI model.

C.Configure a Microsoft Purview data loss prevention policy.

D.Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.

AnswerD

The integration between Microsoft Defender for Endpoint and Microsoft Intune allows automatic remediation actions (e.g., patch deployment, device quarantine) when critical vulnerabilities are found.

Why this answer

Microsoft Defender for Endpoint can integrate with Microsoft Intune to automatically trigger remediation actions when critical vulnerabilities are found. Option A is incorrect because Microsoft Sentinel is a SIEM and SOAR platform; while it can automate responses, it is not the direct integration for Intune remediation. Option B is incorrect because Microsoft Foundry is an AI platform, not used for device remediation.

Option C is incorrect because Microsoft Purview focuses on data governance and compliance, not device remediation.

Practice this question →

156

MCQmedium

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

A.Confirm that the Intune Service to Service Connector is configured.

B.Verify that the Company Portal app is installed and updated on the device.

C.Check that the enrollment token has not expired.

D.Ensure Device Administrator enrollment is enabled.

AnswerB

The Company Portal app is required for Android Enterprise work profile enrollment.

Why this answer

In Android Enterprise personally-owned work profiles, the Company Portal app is required to initiate and complete the enrollment process. If the app is missing or outdated, the device cannot receive the management profile, even if enrollment restrictions allow Android Enterprise. Ensuring the Company Portal is installed and updated is the immediate next step after verifying that Android Enterprise is allowed.

Exam trap

The trap here is that candidates often confuse enrollment tokens (used for Android Enterprise dedicated or fully managed devices) with the enrollment method for personally-owned work profiles, leading them to incorrectly check token expiration instead of verifying the Company Portal app.

How to eliminate wrong answers

Option A is wrong because the Intune Service to Service Connector is used for Apple Device Enrollment Program (DEP) or VPP integration, not for Android Enterprise enrollment. Option C is wrong because enrollment tokens are used for Android Enterprise dedicated devices (kiosk mode) or fully managed devices, not for personally-owned work profiles, which use a different enrollment method (Google Play account-based). Option D is wrong because Device Administrator enrollment is a legacy method for Android devices and is not used for Android Enterprise personally-owned work profiles; enabling it would not resolve the issue and could conflict with modern management.

Practice this question →

157

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

A.Ensure the device is running Windows 10 Enterprise.

B.Run the Policy Manager tool on the device.

C.Verify the device is a member of the assigned device group.

D.Check the device's notification area for a policy update prompt.

AnswerC

If the device is not in the group, the policy won't apply. This is the first troubleshooting step.

Why this answer

The most common reason a kiosk mode profile fails to apply is that the device is not a member of the assigned device group. Intune evaluates policy targeting based on group membership; if the device is missing from the group, the profile will never be delivered. Verifying group membership is the first logical troubleshooting step before investigating device-level issues.

Exam trap

The trap here is that candidates often assume the issue is a licensing or edition requirement (Windows 10 Enterprise) when the real problem is almost always a misconfigured or missing group assignment in Intune.

How to eliminate wrong answers

Option A is wrong because Windows 10 Pro also supports kiosk mode via assigned access, so Enterprise is not a strict prerequisite. Option B is wrong because the Policy Manager tool (rsop.msc) is used for Group Policy, not Intune MDM policies; Intune policies are managed via the MDM sync and the device's Settings app. Option D is wrong because Intune does not display a policy update prompt in the notification area; policy sync is silent or triggered manually via Settings > Accounts > Access work or school > Info > Sync.

Practice this question →

158

MCQmedium

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

A.The conditional access policy has the grant control set to 'Require device to be marked as compliant'.

B.All users have the required Microsoft 365 license.

C.The conditional access policy includes all cloud apps.

D.The device platform condition is set to iOS and Android only.

AnswerA

Without this grant, the policy might only apply other controls like MFA, not compliance.

Why this answer

The most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Exam trap

The trap here is that candidates assume device compliance alone is sufficient for access, but they overlook that the conditional access policy must explicitly include the 'Require device to be marked as compliant' grant control to enforce compliance-based access.

How to eliminate wrong answers

Option B is wrong because licensing issues would prevent access to Microsoft 365 services entirely or show a license error, not specifically block OWA while the device is compliant; the scenario describes a compliance-related block, not a licensing one. Option C is wrong because including all cloud apps is not required for OWA access; the policy should target the specific app (e.g., Office 365 Exchange Online) to avoid unintended blocks on other services, and including all cloud apps could cause broader access issues unrelated to the reported symptom. Option D is wrong because restricting the device platform to iOS and Android only would block access from Windows, macOS, or other platforms, but the users are reporting issues with OWA access, and the policy should match the platforms in use; the problem is not platform-specific but rather the grant control setting.

Practice this question →

159

MCQeasy

Your company deploys Microsoft Defender for Endpoint to Windows devices managed by Microsoft Intune. You need to ensure that all devices send diagnostic data at the 'Optional diagnostic data' level. Which configuration profile type should you use?

A.Administrative templates

B.Device restrictions

C.Endpoint protection

D.Custom

AnswerB

Correct. Device restrictions includes the 'Diagnostic data' setting under Windows 10 and later > General, allowing you to set the level to 'Optional diagnostic data'.

Why this answer

The correct configuration profile type is 'Device restrictions' (Option B). In Microsoft Intune, the Device restrictions profile for Windows 10/11 includes the 'Diagnostic data' setting under the General category, which allows you to configure the level of diagnostic data sent to Microsoft, including 'Optional diagnostic data'. Option A (Administrative templates) is used for ADMX-backed policies but is not the simplest method for this specific setting.

Option C (Endpoint protection) focuses on security settings like Microsoft Defender Antivirus and does not contain diagnostic data settings. Option D (Custom) could be used but is not the recommended or simplest approach.

Practice this question →

160

Multi-Selecteasy

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Select 2 answers

A.Change the primary user of the device

B.Reinstall Windows 11 from scratch

C.Retain the Autopilot registration

D.Remove personal files and apps

E.Remove the device from Microsoft Intune

AnswersC, D

The device remains registered for Autopilot.

Why this answer

Options C and D are correct. Windows Autopilot reset retains the device's Autopilot registration (option C) and removes personal files and apps (option D). Option A is incorrect because Autopilot reset does not change the primary user; that requires a different process.

Option B is incorrect because Autopilot reset does not reinstall Windows from scratch; it refreshes the existing OS. Option E is incorrect because Autopilot reset does not remove the device from Microsoft Intune; that would require a manual action.

Practice this question →

161

MCQhard

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

A.Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.

B.Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

C.Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

D.Configure Windows Autopilot for existing devices and redeploy them.

AnswerA

This step allows Entra ID join and automatic Intune enrollment during OSD.

Why this answer

Using a 'Provision Microsoft Entra ID' step with a bulk token in a Configuration Manager task sequence directly enables automatic Microsoft Entra ID join and Intune enrollment during OSD. The bulk token, generated from Microsoft Entra ID, allows devices to be joined without user interaction, which is essential for unattended, large-scale deployments.

Exam trap

The trap here is that candidates often confuse the 'Provision Microsoft Entra ID' step with a provisioning package (PPKG), but the step is a native task sequence action that correctly handles bulk tokens during OSD, whereas a PPKG is applied outside the task sequence flow.

How to eliminate wrong answers

Option B is wrong because a provisioning package (PPKG) with a bulk enrollment token is typically applied during the initial Windows setup (OOBE) or via a script, not as a step within a Configuration Manager task sequence; the task sequence requires the dedicated 'Provision Microsoft Entra ID' step to handle the token. Option C is wrong because Group Policy for automatic MDM enrollment relies on a discovered AAD token from a user sign-in, which does not work in an unattended OSD scenario where no interactive user logs in to discover the token. Option D is wrong because Windows Autopilot for existing devices is designed for re-provisioning or resetting devices that are already registered in Autopilot, not for deploying 500 new devices from scratch via a Configuration Manager task sequence.

Practice this question →

162

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can access company resources, while allowing users to enroll personal devices for limited access. You plan to use enrollment restrictions and compliance policies. What should you configure?

A.Set enrollment device platform restrictions to block personally owned devices, and create a compliance policy to mark personal devices as noncompliant.

B.Configure enrollment restrictions to block all devices from enrolling.

C.Configure a compliance policy that requires devices to be corporate-owned.

D.Create a conditional access policy that requires devices to be marked as compliant.

AnswerA

Enrollment restrictions prevent personal devices from enrolling, and compliance policies enforce the corporate ownership requirement.

Why this answer

Enrollment device platform restrictions can block personally owned devices from enrolling, while a compliance policy can mark personal devices that do enroll as noncompliant. This combination ensures corporate-owned devices get full access, and personal devices are either blocked or flagged for limited access via conditional access policies.

Exam trap

The trap here is that candidates often confuse compliance policies with enrollment restrictions, thinking a compliance policy alone can block enrollment, when in fact compliance policies only evaluate devices after they are enrolled and cannot prevent enrollment itself.

How to eliminate wrong answers

Option B is wrong because blocking all devices from enrolling would prevent both corporate and personal devices from accessing company resources, which does not meet the requirement to allow personal devices limited access. Option C is wrong because compliance policies can evaluate device ownership (e.g., via the 'Device ownership' setting), but they cannot enforce enrollment restrictions; they only mark devices as compliant or noncompliant after enrollment, so personal devices could still enroll and then be marked noncompliant, but the requirement to block personal devices from enrolling is not achieved. Option D is wrong because a conditional access policy that requires devices to be marked as compliant does not control enrollment; it only controls access after enrollment, so personal devices could still enroll and then be blocked from access, but the requirement to block personal devices from enrolling is not met.

Practice this question →

163

Multi-Selectmedium

Which TWO of the following are required to configure Windows Autopilot for existing devices?

Select 2 answers

A.A Windows product key.

B.A local administrator account on the device.

C.An Azure AD Premium P1 license.

D.A hardware hash (4K HH) from the device.

E.A device group that has an Autopilot deployment profile assigned.

AnswersD, E

The hardware hash is used to uniquely identify the device and register it in Autopilot.

Why this answer

The hardware hash (4K HH) is the unique identifier that Windows Autopilot uses to associate a device with an Autopilot deployment profile. This hash must be harvested from the existing device (e.g., via a PowerShell script or a provisioning package) and uploaded to the Autopilot service to register the device. Without the hardware hash, the device cannot be recognized as an Autopilot device during the out-of-box experience (OOBE).

Exam trap

The trap here is that candidates often confuse the licensing requirement (Azure AD Premium P1) with the technical prerequisite for device registration, but the hardware hash and a device group with an assigned profile are the only two mandatory components for configuring Autopilot on existing devices.

Practice this question →

164

MCQhard

Refer to the exhibit. You have configured the above enrollment restriction in Microsoft Intune. A user attempts to enroll a personal Windows 11 device. What will be the outcome?

A.The device will be blocked from enrolling.

B.The device will be prompted to confirm enrollment.

C.The device will enroll but will be marked as non-compliant.

D.The device will enroll successfully because it meets the OS requirements.

AnswerA

The restriction blocks personal Windows devices from enrolling.

Why this answer

The enrollment restriction is configured to block personally owned Windows devices. Since the user is trying to enroll a personal Windows 11 device, enrollment will be blocked regardless of OS version. Option B is incorrect because no prompt is shown; it's a block, not a prompt.

Option C is incorrect because enrollment is blocked, so the device never becomes non-compliant. Option D is incorrect because the restriction specifically blocks personal devices, so OS version does not matter; enrollment fails.

Practice this question →

165

MCQmedium

You need to deploy Microsoft 365 Apps to 500 Windows 10 devices managed by Intune. The deployment must be automatic and should not require user interaction. What is the best method?

A.Create a Configuration Manager application and deploy to the devices.

B.Use the Office Deployment Tool (ODT) to create a package and deploy via Intune as a line-of-business (LOB) app.

C.Create a Win32 app in Intune with the installation command for Microsoft 365 Apps.

D.Assign the Microsoft 365 Apps from the Microsoft Store for Business.

AnswerC

Win32 apps allow silent deployment and can be assigned to devices.

Why this answer

Creating a Win32 app in Intune allows you to use the Office Deployment Tool (ODT) with a custom configuration.xml to install Microsoft 365 Apps silently. This method supports automatic, unattended deployment to 500 Windows 10 devices managed by Intune, as Win32 apps can be assigned with required intent and run in system context without user interaction.

Exam trap

The trap here is that candidates confuse the Office Deployment Tool (ODT) with the line-of-business (LOB) app method, not realizing that LOB apps cannot handle the multi-file ODT package and require a single installer file, making Win32 app the only viable Intune-native option for silent, automated Office deployment.

How to eliminate wrong answers

Option A is wrong because Configuration Manager is a separate on-premises management tool, not the best method for devices already managed solely by Intune; it introduces unnecessary complexity and requires additional infrastructure. Option B is wrong because deploying via Intune as a line-of-business (LOB) app is not suitable for Microsoft 365 Apps; LOB apps are intended for single-file installers (e.g., .msi or .exe) and do not support the multi-file ODT package or the required detection and installation logic for Office. Option D is wrong because the Microsoft Store for Business is deprecated and does not support deploying Microsoft 365 Apps to Windows 10 devices managed by Intune; it was designed for Universal Windows Platform (UWP) apps, not Win32 Office installations.

Practice this question →

166

MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Mail app that is required for corporate email. What configuration should you apply?

A.Deploy the Mail app as a required volume-purchased app using Apple Business Manager.

B.Configure a Managed App Configuration with the key 'preventManagedAppRemoval' set to true.

C.Set a device restriction policy to hide the Mail app from the home screen.

D.Assign an app protection policy that blocks the removal of corporate data.

AnswerB

A Managed App Configuration with the 'preventManagedAppRemoval' key set to true prevents users from removing the managed Mail app on iOS/iPadOS devices.

Why this answer

A Managed App Configuration with the 'preventManagedAppRemoval' key set to true prevents users from removing the Mail app from their device. Option A is incorrect because deploying the Mail app as a required volume-purchased app via Apple Business Manager only ensures the app is installed but does not prevent users from deleting it. Option C is incorrect because hiding the Mail app from the home screen does not prevent uninstall; it only removes the icon.

Option D is incorrect because an app protection policy that blocks removal of corporate data applies to data within the app, not to the app itself.

Practice this question →

167

MCQhard

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown on a new Windows 11 device. The cmdlet completes successfully, but the device does not appear in Intune under Windows Autopilot devices. What is the most likely cause?

A.The user running the cmdlet does not have the required permissions in Intune.

B.The device does not have internet access.

C.The device is already registered in Autopilot, so the cmdlet does nothing.

D.The group tag 'Marketing' is invalid.

AnswerA

The cmdlet requires Intune Administrator or similar role to upload the hash.

Why this answer

The Get-WindowsAutopilotInfo cmdlet uploads the device's hardware hash to the Microsoft Intune service. If the user lacks the necessary Intune role permissions (e.g., 'Intune Administrator' or a custom role with 'Enroll and assign devices' permission), the upload succeeds locally but the device hash is rejected by the Intune service, so the device never appears in the Windows Autopilot device list.

Exam trap

The trap here is that candidates assume a successful cmdlet execution means the device is registered, but Microsoft deliberately separates the local upload success from the service-side permission check, testing whether you understand that Intune role-based access control governs the final enrollment.

How to eliminate wrong answers

Option B is wrong because the cmdlet completed successfully, which requires internet connectivity to reach the Intune enrollment endpoint; without internet, the cmdlet would fail with a connection error. Option C is wrong because if the device were already registered in Autopilot, the cmdlet would still upload the hash and either overwrite the existing record or return a success status, but the device would still appear in the Autopilot devices list. Option D is wrong because the group tag 'Marketing' is a free-form string and has no validation at upload time; an invalid group tag would not prevent the device from appearing in Autopilot devices, though it might affect profile assignment later.

Practice this question →

168

MCQhard

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

A.Device type is restricted in enrollment restrictions

B.Apps are assigned to devices instead of users

C.VPP token is not configured for user enrollment

D.User Enrollment does not support app distribution

AnswerB

User Enrollment requires user-based assignments; device-based assignments fail.

Why this answer

Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Exam trap

The trap here is that candidates confuse enrollment restrictions (which block enrollment) with app assignment scope (which blocks app installation after enrollment), and assume User Enrollment cannot distribute apps at all, when in fact it only requires user-based assignment.

How to eliminate wrong answers

Option A is wrong because enrollment restrictions (like device type or OS version) block enrollment itself, not app installation after enrollment; the users are already enrolled, so restrictions are not the cause. Option C is wrong because a VPP token is required for volume-purchased apps, but User Enrollment supports app distribution without a VPP token if apps are free or assigned via user-based assignment; the token issue would affect all apps, not just company-recommended ones. Option D is wrong because User Enrollment does support app distribution—it supports managed app configuration and assignment, but only when apps are assigned to users, not devices.

Practice this question →

169

MCQmedium

Your organization uses Microsoft Defender for Endpoint. You need to ensure that devices onboarding to Microsoft Defender for Endpoint are automatically assigned to a specific device group based on their operating system version. What should you use?

A.Manually tag each device in the Microsoft 365 Defender portal.

B.Configure device group rules in Microsoft Defender for Endpoint using OS version condition.

C.Use Microsoft Entra ID dynamic groups based on device OS.

D.Create a Microsoft Intune compliance policy that tags devices by OS version.

AnswerB

Device group rules can automatically assign devices based on criteria.

Why this answer

Device group rules in Microsoft Defender for Endpoint allow you to automatically assign devices to groups based on conditions such as operating system version. This is the correct approach because it uses the built-in grouping engine that evaluates device attributes during onboarding, ensuring consistent and automated assignment without manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID dynamic groups (which are for identity and access management) with Defender for Endpoint device group rules (which are for security operations and automation), leading them to choose Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because manually tagging each device in the Microsoft 365 Defender portal is not automated and does not scale for large environments; it also does not use OS version as a condition. Option C is wrong because Microsoft Entra ID dynamic groups are based on Azure AD device attributes and are used for identity-based access control, not for Defender for Endpoint device group assignment, which requires Defender-specific grouping rules. Option D is wrong because Microsoft Intune compliance policies are used to enforce device health and compliance settings, not to tag devices for Defender for Endpoint grouping; they do not create device groups in Defender.

Practice this question →

170

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to configure FileVault disk encryption for all devices. After deploying the policy, some devices report that encryption is pending. What is the most likely reason?

A.The user has not approved the recovery key escrow.

B.The devices are enrolled using user enrollment.

C.The devices require a PIN to be set for recovery.

D.The devices are not supervised.

AnswerA

User must approve escrow when prompted.

Why this answer

For FileVault encryption via Intune, the user must approve the escrow of the personal recovery key. If the user has not approved it, encryption may remain pending. Option B is incorrect: user enrollment does support FileVault policy, as long as the device is managed.

Option C is incorrect: FileVault does not require a PIN; it uses a password set during encryption. Option D is incorrect: FileVault encryption is available on both supervised and unsupervised macOS devices when managed by Intune.

Practice this question →

171

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant are blocked from accessing corporate resources. Which configuration should you use?

A.Create a device compliance policy and assign it to users.

B.Create a device configuration profile that restricts access.

C.Create a Conditional Access policy that requires compliant devices.

D.Configure enrollment restrictions to block non-compliant devices.

AnswerC

Conditional Access enforces access based on compliance.

Why this answer

Conditional Access policies in Azure AD are the correct mechanism to enforce access controls based on device compliance status. By creating a policy that requires devices to be marked as compliant, you ensure that only compliant devices can access corporate resources, while non-compliant devices are blocked at the authentication level. This integrates with Intune compliance policies to evaluate device health before granting access.

Exam trap

The trap here is that candidates often confuse the role of a compliance policy (which only evaluates and reports) with the enforcement mechanism (Conditional Access), leading them to select Option A as the answer.

How to eliminate wrong answers

Option A is wrong because a device compliance policy alone only reports compliance status and can trigger actions like sending notifications or marking devices as non-compliant, but it does not block access to corporate resources; it requires a Conditional Access policy to enforce the block. Option B is wrong because a device configuration profile is used to configure device settings (e.g., password policies, restrictions) and does not enforce access control or block non-compliant devices from resources. Option D is wrong because enrollment restrictions control which devices can enroll in Intune, not whether already enrolled devices that become non-compliant are blocked from accessing corporate resources.

Practice this question →

172

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

A.Recreate the Wi-Fi profile in Intune with new settings

B.Run the 'netsh wlan show profiles' command on affected devices

C.Check the Intune console for Wi-Fi profile assignment and conflict status

D.Review Microsoft Entra ID sign-in logs for authentication failures

AnswerC

Directly shows profile deployment and conflicts.

Why this answer

Checking the Intune console for Wi-Fi profile assignment and conflict status is the fastest way to identify deployment issues, such as the profile not being assigned to the affected devices or conflicts with other profiles. Option A is wrong because recreating the profile may not address the root cause and could be time-consuming without first verifying the current assignment. Option B is wrong because running 'netsh wlan show profiles' only lists profiles stored locally and does not show Intune deployment status.

Option D is wrong because reviewing Microsoft Entra ID sign-in logs does not show Wi-Fi profile status or assignment conflicts.

Practice this question →

173

MCQeasy

Your organization is implementing Microsoft Entra ID join for Windows devices. You need to ensure that when users sign in with their Microsoft Entra ID credentials, they automatically get access to company resources without additional authentication. Which feature should you enable?

A.Device compliance policies

B.Windows Hello for Business

C.Conditional Access policies

D.Primary Refresh Token (PRT)

AnswerD

PRT is obtained upon sign-in and provides SSO to cloud resources.

Why this answer

Primary Refresh Tokens (PRTs) are used on Microsoft Entra ID joined devices to enable single sign-on (SSO). When a user signs in with their Microsoft Entra ID credentials, the PRT is cached and automatically used to authenticate against company resources without prompting for credentials again. Option A is incorrect because device compliance policies enforce security requirements but do not handle authentication.

Option B is incorrect because Windows Hello for Business provides passwordless sign-in but is not required for automatic resource access. Option C is incorrect because Conditional Access policies evaluate access conditions but do not provide automatic authentication.

Practice this question →

174

Multi-Selectmedium

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Select 3 answers

A.Check that Secure Boot is enabled.

B.Check that the processor is at least 1GHz with 1 core.

C.Check that the device has TPM 2.0 enabled.

D.Check that the device has at least 4GB of RAM.

E.Check that the device has at least 32GB of storage.

AnswersA, C, D

Secure Boot is required.

Why this answer

Options A, C, and D are correct. Windows 11 requires TPM 2.0, Secure Boot, and at least 4GB of RAM. Option B is incorrect because the processor must be at least 1 GHz with 2 cores, not 1 core.

Option E is incorrect because the storage requirement is at least 64GB, not 32GB.

Practice this question →

175

MCQmedium

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

A.The policy has not been assigned to the device or its user group.

B.The BitLocker setting is not supported on Windows 11.

C.The policy was not saved correctly due to a syntax error.

D.The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

AnswerA

Unless assigned, the policy does not evaluate.

Why this answer

The most likely reason is that the compliance policy was created but never assigned to the device or its user group. In Microsoft Intune, a compliance policy must be assigned to a security group that contains the device or its user; otherwise, the policy is not evaluated against the device, and the device will default to a compliant status. The PowerShell cmdlet shown only creates the policy object; it does not assign it.

Exam trap

The trap here is that candidates assume creating a policy with PowerShell automatically applies it to all devices, but Intune requires explicit assignment to a group before the policy is evaluated.

How to eliminate wrong answers

Option B is wrong because BitLocker is fully supported on Windows 11 Pro, Enterprise, and Education editions; the compliance policy setting for BitLocker is valid on these editions. Option C is wrong because if there were a syntax error, the New-IntuneCompliancePolicy cmdlet would have returned an error and the policy would not have been created; the fact that the policy exists indicates it was saved correctly. Option D is wrong because while a TPM chip is required for BitLocker to function, the compliance policy setting 'Require BitLocker' checks whether BitLocker is enabled on the device, not whether a TPM is present; if BitLocker is not enabled, the device should be marked noncompliant regardless of TPM status.

Practice this question →

176

MCQmedium

You are responsible for deploying Microsoft 365 Apps for enterprise to Windows 10 devices using Microsoft Intune. You want to ensure that users receive the Current Channel with updates delivered directly from the Office Content Delivery Network (CDN). You also want to minimize bandwidth usage on your network. What should you configure?

A.Configure a local update server using BranchCache.

B.Set the update path to the Office CDN and enable Office automatic updates.

C.Use a configuration profile to disable peer-to-peer distribution.

D.Enable delivery optimization and set the Office update channel to Current Channel.

AnswerD

Delivery optimization with peer-to-peer reduces bandwidth.

Why this answer

To minimize bandwidth when deploying Office updates from the CDN, you need to enable delivery optimization with peer-to-peer distribution. This allows devices to share update content locally, reducing downloads from the internet. Setting the update channel to Current Channel ensures users receive the latest features.

Therefore, option D is correct because it combines delivery optimization and the appropriate update channel. Option A is incorrect because BranchCache is not used for Office updates. Option B is incorrect because while the CDN is the default update source, it alone does not minimize bandwidth.

Option C is incorrect because disabling peer-to-peer (as in disabling delivery optimization) would increase bandwidth usage.

Practice this question →

177

MCQeasy

You need to deploy Microsoft 365 Apps to 1000 devices using Microsoft Intune. The devices are a mix of Windows 10 and Windows 11. Which app deployment method should you use to ensure the latest version is always installed?

A.Deploy a line-of-business app from the installation file.

B.Deploy a Win32 app with the Office Deployment Tool.

C.Deploy Microsoft 365 Apps for enterprise as a built-in app type in Intune.

D.Deploy a custom script that installs Office from a network share.

AnswerC

Built-in type ensures automatic updates from CDN.

Why this answer

The Microsoft 365 Apps for enterprise built-in app type in Intune is specifically designed to deploy and manage Office with automatic updates from the Office Content Delivery Network (CDN). This method ensures that devices always receive the latest version of Microsoft 365 Apps without requiring manual intervention or custom configuration, as Intune handles the deployment policy and update channel settings natively.

Exam trap

The trap here is that candidates often choose Option B (Win32 app with ODT) because they know ODT is the standard tool for Office deployment, but they overlook that the built-in app type in Intune provides a simpler, more reliable method that automatically handles update channel configuration and ensures the latest version is always installed without custom scripting.

How to eliminate wrong answers

Option A is wrong because deploying a line-of-business (LOB) app from an installation file requires manual packaging and does not support automatic updates to the latest version; it also lacks the built-in update channel management that Microsoft 365 Apps require. Option B is wrong because while deploying a Win32 app with the Office Deployment Tool (ODT) can install Office, it requires custom configuration of the update channel and does not inherently ensure the latest version is always installed unless you manually configure the CDNBaseUrl and update settings; it also adds unnecessary complexity compared to the built-in app type. Option D is wrong because deploying a custom script that installs Office from a network share relies on a static source that must be manually updated, and it does not integrate with Intune's update management or the Office CDN, making it impossible to guarantee the latest version is always installed across all devices.

Practice this question →

178

MCQeasy

Refer to the exhibit. An Autopilot device registration JSON. What does the '%RAND:5%' placeholder do?

A.It inserts the device's model name.

B.It generates a random 5-character string.

C.It inserts the device's serial number.

D.It inserts the user's principal name.

AnswerB

This ensures unique names.

Why this answer

The placeholder %RAND:5% generates a random 5-character string, ensuring unique device names during Autopilot deployment. Options A, C, and D are incorrect; %RAND:5% does not use the device model, serial number, or user principal name.

Practice this question →

179

MCQeasy

Your company plans to deploy Microsoft 365 Apps to 500 devices using Microsoft Intune. You want to ensure that the Office suite is installed with only Word, Excel, and PowerPoint. Which approach should you use?

A.Use Microsoft Intune to deploy Office by selecting the built-in Office 365 app type and then modify the installation options.

B.Use the Microsoft 365 admin center to assign licenses and then have users install from the portal.

C.Use Microsoft Intune to deploy Office by configuring a Win32 app with the Office Deployment Tool and a custom XML.

D.Use Microsoft Configuration Manager to deploy Office with a task sequence.

AnswerC

ODT with XML allows selecting specific Office apps.

Why this answer

The Office Deployment Tool (ODT) with a custom XML allows you to specify exactly which Office applications (Word, Excel, PowerPoint) are installed, and deploying it as a Win32 app via Microsoft Intune gives you full control over the installation parameters, including exclusion of other apps like Outlook or OneNote. The built-in Office 365 app type in Intune does not support granular selection of individual applications; it only allows you to choose the update channel and language, not a custom subset of apps.

Exam trap

The trap here is that candidates often assume the built-in Office 365 app type in Intune can customize which apps are installed, but it only supports channel and language settings, not application-level exclusions, which requires the ODT with a custom XML.

How to eliminate wrong answers

Option A is wrong because the built-in Office 365 app type in Microsoft Intune does not provide the ability to select individual applications like Word, Excel, and PowerPoint; it installs the entire Office suite based on the selected update channel. Option B is wrong because assigning licenses from the Microsoft 365 admin center and having users install from the portal gives users the full suite of available apps (e.g., Outlook, OneNote, Publisher) and does not allow an administrator to restrict installation to only Word, Excel, and PowerPoint. Option D is wrong because Microsoft Configuration Manager is a separate on-premises management tool, not the cloud-native approach specified in the question (Microsoft Intune), and using a task sequence would be unnecessarily complex for this requirement.

Practice this question →

180

MCQhard

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work profile apps are encrypted and that the device owner cannot uninstall the Company Portal app. Which configuration profile should you deploy?

A.Device configuration profile with custom OMA-URI

B.Device restrictions for Android Enterprise fully managed

C.Device restrictions for Android Enterprise work profile

D.Compliance policy for Android Enterprise

AnswerC

This profile can enforce encryption and block removal of apps.

Why this answer

The 'Device restrictions for Android Enterprise work profile' profile includes settings to enforce encryption of work profile apps and to prevent the uninstallation of the Company Portal app. Specifically, the 'Require work profile encryption' setting ensures that work profile data is encrypted, and the 'Block uninstall of Company Portal' setting prevents the device owner from removing the Company Portal app. These settings are only available within the work profile restrictions profile, not in other profile types.

Exam trap

The trap here is that candidates often confuse 'Device restrictions for Android Enterprise work profile' with 'Device restrictions for Android Enterprise fully managed' or assume that a compliance policy can enforce configuration settings, when in fact the work profile restrictions profile is the only one that combines both encryption enforcement and app uninstall prevention for personally owned devices with work profiles.

How to eliminate wrong answers

Option A is wrong because custom OMA-URI profiles are used for settings not available in the Intune UI, but the required encryption and uninstall prevention settings are natively available in the work profile restrictions profile, making a custom OMA-URI unnecessary and less precise. Option B is wrong because 'Device restrictions for Android Enterprise fully managed' applies to corporate-owned devices with a single user, not to work profiles on personally owned devices; it lacks the specific settings to block uninstallation of the Company Portal app from the work profile. Option D is wrong because compliance policies evaluate device compliance (e.g., encryption status) but cannot enforce configuration settings like preventing app uninstallation; they are reactive, not proactive.

Practice this question →

181

Multi-Selectmedium

Your company is deploying iOS devices using Apple Business Manager and Intune. You need to ensure that devices are automatically configured with Wi-Fi settings, email profiles, and a list of required apps during the initial setup. Which THREE configurations should you create in Intune?

Select 3 answers

A.A device configuration profile for Wi-Fi settings.

B.A Windows configuration designer provisioning package.

C.A device compliance policy for iOS.

D.A device configuration profile for email settings.

E.An iOS app configuration policy for required apps.

AnswersA, D, E

Wi-Fi profile configures wireless settings.

Why this answer

Options A, D, and E are correct. Device configuration profiles (A) can deploy Wi-Fi settings to iOS devices. Device configuration profiles (D) can also deploy email settings.

An iOS app configuration policy (E) can be used to require specific apps during enrollment. Option B is incorrect because Windows Configuration Designer provisioning packages are for Windows devices, not iOS. Option C is incorrect because a device compliance policy is for compliance checking, not initial configuration.

Practice this question →

182

MCQhard

You manage devices with Microsoft Intune. A user reports that their Windows 11 device is not receiving updates from Windows Update for Business. The device shows as compliant in Intune. You verify that update rings are assigned to the device. What should you check next?

A.Check if the device has a compliance policy that blocks updates.

B.Ensure that the device is not configured for dual scan.

C.Check the device's delivery optimization settings.

D.Verify that the update ring is assigned to the correct Azure AD group.

AnswerC

Delivery optimization can prevent updates if misconfigured.

Why this answer

Delivery optimization settings control how Windows Update for Business downloads updates, and misconfigured settings (e.g., peer caching or bandwidth throttling) can prevent updates from being received even when update rings are properly assigned. Since the device is compliant and update rings are assigned, the next logical step is to verify that delivery optimization is not blocking or delaying the download. This aligns with Intune's troubleshooting workflow for Windows Update for Business issues.

Exam trap

The trap here is that candidates assume compliance or group assignment is the root cause, but Microsoft Intune's update delivery relies on delivery optimization as a prerequisite, and the exam tests the understanding that update rings only define the deferral policy, not the download mechanism.

How to eliminate wrong answers

Option A is wrong because compliance policies in Intune do not block updates; they enforce device configuration requirements (e.g., encryption, OS version) and mark devices non-compliant if unmet, but they do not prevent Windows Update from receiving updates. Option B is wrong because dual scan (configuring both Windows Update for Business and WSUS) is a potential issue, but it is not the next check after verifying update ring assignment and compliance; dual scan typically causes update conflicts, not a complete failure to receive updates. Option D is wrong because the question already states that update rings are assigned to the device, so verifying the Azure AD group assignment is redundant and not the next logical step.

Practice this question →

183

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a custom security baseline that includes blocking PowerShell scripts from running unless they are signed by a trusted publisher. Which configuration should be applied?

A.Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.

B.Create a Windows Defender Application Control (WDAC) policy that blocks unsigned scripts.

C.Enable BitLocker with Secure Boot to validate script integrity.

D.Configure AppLocker rules to deny execution of PowerShell scripts.

AnswerA

This policy requires all scripts to be signed by a trusted publisher before running.

Why this answer

Setting the PowerShell Execution Policy to 'AllSigned' via Administrative Templates in Intune ensures that PowerShell scripts can only run if they are signed by a trusted publisher. This policy is enforced through Group Policy or Intune's Settings Catalog, directly controlling the PowerShell execution policy at the machine level, which meets the requirement for a custom security baseline.

Exam trap

The trap here is that candidates often confuse AppLocker or WDAC with PowerShell Execution Policy, thinking they achieve the same granular control over script signing, but only the PowerShell Execution Policy directly enforces the 'AllSigned' requirement for PowerShell scripts.

How to eliminate wrong answers

Option B is wrong because Windows Defender Application Control (WDAC) controls which executables, scripts, and drivers can run based on code integrity policies, but it does not specifically enforce a signature requirement for PowerShell scripts in the same granular way as the PowerShell Execution Policy; WDAC can block unsigned scripts but is broader and not the targeted configuration for PowerShell execution policy. Option C is wrong because BitLocker with Secure Boot validates the integrity of the boot process and system files, not script execution policies; it does not control whether PowerShell scripts must be signed. Option D is wrong because AppLocker rules can deny execution of PowerShell scripts, but they do not enforce a signature requirement from a trusted publisher; AppLocker can block or allow based on path, publisher, or hash, but the specific requirement for scripts to be signed by a trusted publisher is best achieved via the PowerShell Execution Policy set to 'AllSigned'.

Practice this question →

184

Multi-Selecteasy

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Select 2 answers

A.Set 'Defer quality updates (days)' to 0.

B.Set 'Feature update channel' to 'Semi-Annual Channel'.

C.Set 'Update notification level' to 'Turn off notifications'.

D.Set 'Defer quality updates (days)' to 60.

E.Set 'Defer feature updates (days)' to 60.

AnswersA, E

0 days means immediate installation of quality updates.

Why this answer

To receive quality updates immediately, set 'Defer quality updates (days)' to 0 (option A). To defer feature updates for 60 days, set 'Defer feature updates (days)' to 60 (option E). Option B is incorrect because 'Feature update channel' is a channel selection, not a deferral setting.

Option C is about notification level, unrelated to update timing. Option D would defer quality updates, which is the opposite of the requirement.

Practice this question →

185

Multi-Selecthard

You are troubleshooting an issue where Windows 10 devices are not receiving policies from Microsoft Intune. The devices are enrolled and show as 'active' in the console. Which THREE steps should you take to diagnose the problem?

Select 3 answers

A.Verify the last sync time in Intune console.

B.Re-register the device in Azure AD.

C.Check the device's local firewall rules for Intune ports.

D.Re-enroll the device by removing and re-adding it in Intune.

E.Collect MDM diagnostic logs from the device.

AnswersA, D, E

If last sync is old, the device may not be communicating.

Why this answer

Options A, D, and E are correct. Verifying the last sync time (A) helps determine if the device has checked in recently and whether policies should have been applied. Re-enrolling the device (D) can resolve enrollment or communication issues by forcing a fresh registration and policy download.

Collecting MDM diagnostic logs (E) provides detailed error information from the device side. Option B is unnecessary because the device is already enrolled and active; re-registering in Azure AD would not address policy delivery issues. Option C is not a standard troubleshooting step for Intune policy problems, as Intune uses HTTPS (port 443) which is typically allowed by default firewalls.

Practice this question →

186

MCQmedium

Refer to the exhibit. The JSON shows a managed device's properties retrieved from Microsoft Graph. The device's complianceState is 'noncompliant'. Which step should you take next to investigate why the device is noncompliant?

A.Verify the last sync time to ensure the device is communicating.

B.Query the device's compliance policy status via Graph API or Intune console.

C.Check if the device is properly enrolled by verifying azureADRegistered.

D.Check if the device is jailbroken or rooted.

AnswerB

The compliance policy details will reveal the failing policy.

Why this answer

The compliance policy details will show which specific policy is failed. Option A is incorrect because the device is already enrolled. Option C is incorrect because last sync time is recent.

Option D is incorrect because jailbreak is not applicable to Windows.

Practice this question →

187

MCQeasy

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

A.Increase passwordMinimumLength to 10.

B.Set passwordExpirationDays to 0 to never expire.

C.Ensure the password includes characters from at least 3 character sets.

D.Set passwordRequiredType to 'alphanumeric' (it is already set).

AnswerC

The policy requires 3 character sets.

Why this answer

PasswordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers.

Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Practice this question →

188

MCQhard

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

A.Enrollment restrictions are blocking personal devices.

B.The device is not registered in Autopilot.

C.The user account lacks an Intune license.

D.TPM attestation failed due to hardware incompatibility.

AnswerC

Common cause of this error.

Why this answer

Error code 0x80180014 during Intune enrollment specifically indicates a licensing issue. Even though the device is registered in Windows Autopilot and has internet connectivity, the user account performing the enrollment must have a valid Intune license assigned (e.g., Microsoft 365 E3, E5, or standalone Intune). Without the license, the Intune service rejects the enrollment request, returning this error.

Exam trap

The trap here is that candidates often confuse enrollment restrictions or TPM issues with licensing errors, but Microsoft specifically uses error code 0x80180014 to isolate license assignment as the root cause.

How to eliminate wrong answers

Option A is wrong because enrollment restrictions for personal devices apply to the device's ownership type (corporate vs. personal), not to licensing; the error 0x80180014 is not related to ownership restrictions. Option B is wrong because the question explicitly states the device is registered in Autopilot, so this cannot be the cause. Option D is wrong because TPM attestation failure would produce a different error code (e.g., 0x80070520 or 0x80090016) and is unrelated to the 0x80180014 licensing error.

Practice this question →

189

Multi-Selecthard

You are configuring Windows Information Protection (WIP) in Microsoft Intune. You want to protect corporate data from being accidentally shared to personal locations while still allowing the user to work productively. Which THREE settings should you configure?

Select 3 answers

A.Configure a device configuration profile to enable WIP.

B.Set the 'Share over' data transfer policy to 'Block'.

C.Define network boundaries (corporate IP ranges, DNS suffixes).

D.Configure the data recovery agent certificate.

E.Add protected apps that are allowed to access corporate data.

AnswersC, D, E

Network boundaries help identify corporate data.

Why this answer

Options C, D, and E are correct. To protect corporate data with Windows Information Protection (WIP) in Intune, you must define network boundaries (C) to identify corporate network locations, configure a data recovery agent certificate (D) to allow encrypted data recovery, and add protected apps (E) that are allowed to access corporate data. Option A is incorrect because WIP is enabled through a Windows Information Protection policy, not a device configuration profile.

Option B is incorrect because setting 'Share over' to 'Block' would prevent all sharing, which is not productive; WIP uses data transfer policies to allow controlled sharing.

Practice this question →

190

MCQeasy

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

A.Self-deploying mode where no user interaction is required.

B.User-driven deployment with Microsoft Entra ID join.

C.Hybrid Microsoft Entra ID join with on-premises domain controller.

D.On-premises Active Directory domain join only.

AnswerB

User-driven Entra ID join is the standard scenario.

Why this answer

The enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Exam trap

The trap here is that candidates often confuse 'azureAdJoined' with self-deploying mode (option A) because both result in Microsoft Entra ID join, but the key differentiator is that self-deploying mode requires additional profile settings (like a device enrollment manager account) and is intended for kiosk or shared devices, not user-driven scenarios.

How to eliminate wrong answers

Option A is wrong because self-deploying mode uses enrollmentType 'azureADJoined' but with a different profile setting (selfDeployingMode = true) and requires no user interaction; the question specifies only enrollmentType as 'azureAdJoined', which does not imply self-deploying mode. Option C is wrong because hybrid Microsoft Entra ID join requires an on-premises domain controller and uses enrollmentType 'azureADHybridJoined' or a profile configured for hybrid join, not 'azureAdJoined'. Option D is wrong because on-premises Active Directory domain join is not supported by Windows Autopilot; Autopilot only supports Microsoft Entra ID join or hybrid Microsoft Entra ID join, and 'azureAdJoined' explicitly targets cloud-only join.

Practice this question →

191

MCQhard

You have deployed the compliance policy shown in the exhibit. A Windows 10 device reports as non-compliant. The device has Windows 10 version 21H2 (build 19044.1288), password is set with 8 characters and includes numbers only, firewall is active, Defender is enabled, and BitLocker is on. Which setting is causing non-compliance?

A.passwordMinimumLength

B.passwordRequiredType

C.osMinimumVersion

D.activeFirewallRequired

AnswerB

The password is numbers only, not alphanumeric.

Why this answer

The compliance policy requires an alphanumeric password (letters and numbers), but the device uses a password with numbers only. Option A is incorrect because a password length of 8 meets the minimum length requirement. Option C is incorrect because the device's OS build (19044.1288) falls within the allowed range (19042.0 to 19045.999).

Option D is incorrect because the firewall is active.

Practice this question →

192

MCQhard

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

A.The device is not compliant with Intune compliance policies.

B.The device is not enrolled in Microsoft Intune.

C.The device does not have Microsoft Defender Antivirus enabled.

D.The Microsoft Defender for Endpoint sensor is not connected to the cloud service.

AnswerD

Inactive status typically indicates a communication issue between the sensor and the cloud.

Why this answer

The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Exam trap

The trap here is that candidates assume a running service equals full functionality, but the exam tests the distinction between the local service state and the cloud connectivity required for the sensor to report as 'active' in the console.

How to eliminate wrong answers

Option A is wrong because Intune compliance policies govern device configuration and access control, not the reporting status of Defender for Endpoint; a non-compliant device can still be active in Defender XDR. Option B is wrong because enrollment in Microsoft Intune is not a prerequisite for Defender for Endpoint; devices can be onboarded via Group Policy, local script, or other methods without Intune. Option C is wrong because Microsoft Defender Antivirus is a separate component; the Defender for Endpoint sensor can function and report events even if the antivirus is disabled or replaced by a third-party solution.

Practice this question →

193

MCQmedium

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

A.The device is connected through a VPN that blocks Intune traffic.

B.The device has not checked in for more than 7 days, causing Intune to mark it as inactive.

C.The device has been unenrolled from Intune.

D.The Intune Connector for Active Directory is not configured.

AnswerA

Correct. A VPN that blocks Intune traffic can prevent the device from communicating with the Intune service, causing the device to appear enrolled but not receive policies. The last check-in being 5 days ago suggests a persistent connectivity issue.

Why this answer

The most likely cause is that the device is connected through a VPN that blocks Intune traffic. Intune requires direct internet access to communicate with its service. If the VPN restricts or filters this traffic, the device may remain enrolled but unable to check in or receive policies.

Option B is incorrect because the device last checked in 5 days ago, which is within the 7-day window, so it would not be marked inactive. Option C is incorrect because the device shows as 'Enrolled'. Option D is incorrect because the Intune Connector for Active Directory is used for hybrid Azure AD join scenarios, not for direct policy delivery to enrolled devices.

Exam trap

Do not assume that a check-in time of 5 days automatically means the device is within the acceptable range; the issue here is connectivity, not inactivity.

Practice this question →

194

MCQeasy

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

A.Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.

B.Re-enroll the device in Intune.

C.Ensure the device has internet connectivity.

D.Assign a compliance policy to the device.

AnswerA

Incorrect MDM configuration can prevent policy delivery.

Why this answer

The device is hybrid Azure AD joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Exam trap

The trap here is that candidates assume a successfully enrolled device will always receive policies, but Microsoft Entra ID's MDM configuration acts as a gatekeeper that must be correctly set for policy delivery to function.

How to eliminate wrong answers

Option B is wrong because re-enrolling the device would not fix a configuration issue with the MDM discovery URL or enrollment scope; it would only repeat the same enrollment process that already succeeded. Option C is wrong because internet connectivity is already implied by the device being enrolled and showing in Intune; without connectivity, enrollment itself would fail. Option D is wrong because assigning a compliance policy assumes the device can receive policies, but the core issue is that the device is not receiving any policies at all, so a compliance policy would not be delivered either.

Practice this question →

195

MCQhard

You are troubleshooting an Intune enrollment issue on a Windows 10 device. The device is Microsoft Entra joined, but the enrollment status shows 'Pending'. What is the most likely cause?

A.The device is not compliant with a conditional access policy.

B.The device does not have BitLocker enabled.

C.The Enrollment Status Page (ESP) profile is not assigned to the device.

D.The MDM authority is not set to Intune.

AnswerC

ESP profiles can cause the enrollment to hang in 'Pending' if not configured or if there is a timeout.

Why this answer

The Enrollment Status Page (ESP) tracks the installation of profiles, policies, and apps during enrollment. If the ESP profile is not assigned to the device, the enrollment process may hang in a 'Pending' state waiting for the ESP configuration. Option A is incorrect because conditional access policies are evaluated after enrollment, not during.

Option B is incorrect because BitLocker is a disk encryption feature unrelated to enrollment status. Option D is incorrect because the MDM authority is set at the tenant level; if it were not set to Intune, enrollment would fail entirely, not just show 'Pending'.

Practice this question →

196

Multi-Selectmedium

Your organization plans to use Microsoft Intune to manage macOS devices. Which TWO prerequisites are required for macOS enrollment?

Select 2 answers

A.An Apple Push Notification service (APNs) certificate.

B.A user enrollment certificate from a public CA.

C.A Volume Purchase Program (VPP) token.

D.Microsoft Entra ID join or registration.

E.A Microsoft Configuration Manager connector.

AnswersA, D

APNs certificate is required for all Apple device management in Intune.

Why this answer

An Apple Push Notification service (APNs) certificate is required for macOS enrollment because it establishes a persistent, secure connection between Microsoft Intune and Apple's servers. This certificate enables Intune to send management commands, policies, and app installations to macOS devices. Without a valid APNs certificate, Intune cannot communicate with enrolled devices, making enrollment impossible.

Exam trap

The trap here is that candidates often confuse optional post-enrollment features (like VPP tokens or Configuration Manager connectors) with mandatory enrollment prerequisites, or mistakenly think a public CA certificate is needed when Intune handles certificate provisioning internally.

Practice this question →

197

MCQeasy

You need to deploy a line-of-business (LOB) app to 100 Windows 10 devices managed by Intune. The app is packaged as an .msi file. Which app type should you choose in Intune?

A.Windows app (Win32)

B.Line-of-business app

C.Web link

D.Microsoft Store app

AnswerB

Intune supports .msi as a line-of-business app.

Why this answer

For deploying a line-of-business (LOB) app packaged as an .msi file to Windows 10 devices managed by Intune, the correct app type is 'Line-of-business app'. This app type is specifically designed for sideloading enterprise internal apps that are not distributed via the Microsoft Store, and it supports .msi, .appx, and .appxbundle file formats. It allows direct upload of the .msi file to Intune and assigns it to users or devices without requiring complex Win32 app preparation.

Exam trap

The trap here is that candidates often confuse 'Line-of-business app' with 'Windows app (Win32)' because both support .msi files, but the Win32 app type requires additional packaging steps and is intended for complex installations, while LOB app is the simpler, direct upload option for enterprise internal apps.

How to eliminate wrong answers

Option A is wrong because 'Windows app (Win32)' is intended for .exe or .msi files that require complex installation logic, such as detection rules, dependencies, and custom return codes; it is overkill for a simple .msi LOB app and requires additional preparation like converting to .intunewin format. Option C is wrong because 'Web link' is used to deploy a shortcut to a web application, not to install a local .msi file on the device. Option D is wrong because 'Microsoft Store app' is used to deploy apps from the Microsoft Store catalog, not to upload and sideload a custom .msi file.

Practice this question →

198

MCQhard

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

A.The user does not have an Intune license assigned

B.The DNS CNAME record for enrollment is missing or incorrect

C.The MDM authority is not set to Intune

D.The device firewall is blocking traffic to manage.microsoft.com

AnswerB

Auto-discovery requires correct DNS record.

Why this answer

The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Exam trap

The trap here is that candidates often confuse a DNS discovery failure with a connectivity or licensing issue, but the specific wording 'auto-discover a management endpoint' is a direct clue that DNS CNAME resolution is the root cause, not firewall or license problems.

How to eliminate wrong answers

Option A is wrong because an Intune license is required for enrollment, but the error message specifically points to auto-discovery failure, not a licensing issue; a missing license would typically result in a 'not authorized' or 'license not found' error. Option C is wrong because the MDM authority being set to Intune is a prerequisite for enrollment, but the error here is about DNS resolution, not authority configuration; if the authority were misconfigured, the error would occur later in the process (e.g., after endpoint discovery). Option D is wrong because a firewall blocking traffic to manage.microsoft.com would cause a connection timeout or 'cannot reach server' error, not a discovery failure; the error occurs before any HTTPS traffic is attempted, during the DNS lookup phase.

Practice this question →

199

Multi-Selecteasy

Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Select 2 answers

A.VPN connection

B.Cloud Management Gateway

C.Azure AD join

D.Bulk enrollment using provisioning package

E.Windows Autopilot

AnswersD, E

Bulk enrollment token method.

Why this answer

Windows provisioning packages (PPKG) created with Windows Configuration Designer allow bulk enrollment of Windows devices into Intune without user interaction. This method is ideal for large-scale deployments where devices are not yet Azure AD joined or Autopilot-registered, as the PPKG contains the enrollment credentials and settings to automatically join the device to Azure AD and enroll it in Intune during the out-of-box experience (OOBE).

Exam trap

The trap here is confusing prerequisites or supporting technologies (like VPN, CMG, or Azure AD join) with actual enrollment methods, leading candidates to select options that are necessary for enrollment but do not themselves perform the enrollment action.

Practice this question →

200

MCQmedium

Your company has 200 iOS devices that are enrolled in Microsoft Intune via Apple Business Manager. The devices are used by field sales representatives who need access to the corporate CRM app and email. You need to ensure that if a device is lost or stolen, the corporate data can be removed without affecting personal data. The devices are configured with user affinity. What should you do?

A.Perform a full wipe on the device from Intune.

B.Retire the device from Intune.

C.Perform a selective wipe (corporate data removal) from Intune.

D.Create a device compliance policy to mark the device as noncompliant.

AnswerC

Selective wipe removes only managed corporate data.

Why this answer

Performing a selective wipe (corporate data removal) from Intune removes only corporate data while leaving personal data intact on devices with user affinity. Option A is incorrect because a full wipe removes all data, including personal data. Option B is incorrect because retiring the device removes it from management but does not remove corporate data.

Option D is incorrect because a compliance policy marks the device as noncompliant but does not remove data.

Practice this question →

201

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to ensure that devices are enrolled automatically without user interaction and that the enrollment status page (ESP) is configured to block device use until required apps are installed. What should you configure?

A.Configure a Group Policy to auto-enroll devices into Intune

B.Configure a device enrollment manager (DEM) account

C.Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile

D.Configure co-management with Microsoft Configuration Manager

AnswerC

Correct. Windows Autopilot self-deploying mode enables zero-touch enrollment without user interaction. The Enrollment Status Page (ESP) can be configured to block device use until required apps are installed, meeting both requirements.

Why this answer

Windows Autopilot with self-deploying mode allows zero-touch enrollment, and the Enrollment Status Page (ESP) can be configured to block device use until required apps are installed. Option A is wrong because Group Policy does not provide automatic enrollment into Intune. Option B is wrong because a device enrollment manager (DEM) account is used for bulk enrollment but does not provide automatic zero-touch enrollment.

Option D is wrong because co-management with Microsoft Configuration Manager does not provide zero-touch enrollment without additional configuration.

Practice this question →

202

MCQmedium

You manage a fleet of 2,000 iOS devices for a healthcare organization. The devices are used by clinicians and must be enrolled in Intune. Due to security requirements, you must ensure that devices are supervised and that the Company Portal app is installed automatically. You have Apple Business Manager (ABM) set up with Intune. You need to configure the enrollment process so that when a new device is unboxed and turned on, it automatically enrolls and receives the required configuration. Which enrollment method should you use?

A.Device enrollment (without user affinity)

B.Company Portal enrollment

C.Automated Device Enrollment (ADE) with user affinity

D.User enrollment (BYOD)

AnswerC

This provides supervision and automatic app installation.

Why this answer

Automated Device Enrollment (ADE) with user affinity is the correct method because it leverages Apple Business Manager (ABM) to supervise devices automatically during the initial setup, enforces the required supervision state, and installs the Company Portal app via a mandatory VPP app assignment. User affinity ensures that each device is associated with a specific clinician, enabling user-based policies and conditional access. This meets the healthcare organization's security requirements for supervised devices and automatic app deployment.

Exam trap

The trap here is that candidates often choose Device enrollment without user affinity (Option A) thinking it is sufficient for supervised devices, but they overlook the requirement for user-specific policies and conditional access that only user affinity can provide.

How to eliminate wrong answers

Option A is wrong because Device enrollment (without user affinity) does not associate devices with a specific user, which is required for clinician-specific policies and conditional access in a healthcare environment. Option B is wrong because Company Portal enrollment requires the user to manually install the Company Portal app and initiate enrollment, which does not guarantee automatic supervision or zero-touch deployment. Option D is wrong because User enrollment (BYOD) is designed for personally owned devices and does not support supervision or automated configuration via ABM, failing the security requirement for supervised devices.

Practice this question →

203

MCQhard

You need to configure Windows 10 devices to automatically encrypt their drives using BitLocker when they enroll in Microsoft Intune. You have created a BitLocker policy in Endpoint Security. However, after enrollment, some devices are not encrypted. You verify that the devices have a TPM 2.0 and meet hardware requirements. What is the most likely reason for the failure?

A.The devices do not have Secure Boot enabled.

B.The TPM is not enabled in the BIOS.

C.The BitLocker policy does not require a recovery password to be saved to Azure AD.

D.The devices are not compliant with the BitLocker compliance policy.

AnswerC

Without recovery key escrow, BitLocker may not encrypt.

Why this answer

BitLocker requires a recovery key to be escrowed to Azure AD before encryption can proceed when managed via Intune. If the policy does not mandate saving the recovery password to Azure AD, the encryption process will fail silently on devices that meet all hardware prerequisites, including TPM 2.0. This is a common configuration oversight in Endpoint Security BitLocker policies.

Exam trap

The trap here is that candidates assume hardware readiness (TPM, Secure Boot) is sufficient for automatic encryption, but Intune requires explicit recovery key escrow to Azure AD as a gating condition.

How to eliminate wrong answers

Option A is wrong because Secure Boot is not a prerequisite for BitLocker; it is recommended for system integrity but BitLocker can function without it. Option B is wrong because the TPM is already confirmed as present and meeting hardware requirements (TPM 2.0), so it must be enabled in the BIOS for the devices to be recognized. Option D is wrong because compliance policies evaluate device settings after encryption; non-compliance with a BitLocker compliance policy would be a result of encryption failure, not the root cause.

Practice this question →

204

MCQeasy

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

A.Set the install context to system.

B.Set the install context to user.

C.Assign the app as required for all users.

D.Use a line-of-business app type instead.

AnswerA

System context runs with admin rights.

Why this answer

Setting the install context to 'system' runs the Win32 app installer with the SYSTEM account, which has the highest privileges on a Windows device. This ensures the installer can perform actions requiring admin rights, such as writing to Program Files or modifying system registry keys, without user interaction or credential prompts. In Intune, the system context is the only way to silently deploy apps that demand elevated permissions.

Exam trap

The trap here is that candidates often confuse 'install context' with 'assignment scope' (required vs. available), mistakenly thinking that marking an app as 'required for all users' automatically grants admin privileges, when in fact the install context must be explicitly set to 'system' for elevated installations.

How to eliminate wrong answers

Option B is wrong because setting the install context to 'user' runs the installer under the logged-on user's account, which lacks admin privileges unless the user is a local administrator, and it cannot perform system-level changes silently. Option C is wrong because assigning the app as required for all users does not change the install context; it only controls targeting, and if the install context is set to user, the app will still fail to install for non-admin users. Option D is wrong because using a line-of-business (LOB) app type does not inherently provide admin privileges; LOB apps are typically for single-file installers (e.g., .msi or .intunewin) and still require the correct install context to be set to system for elevated installations.

Practice this question →

205

MCQmedium

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

A.Add the device to Microsoft Entra ID before shipping.

B.Obtain the hardware hash from the device manufacturer or reseller.

C.Use Microsoft Configuration Manager to collect the hardware hash.

D.Run a PowerShell script on each device to capture the hardware hash.

AnswerB

OEMs and resellers can upload hashes to Intune via the OEM API.

Why this answer

The hardware hash can be obtained from the device manufacturer or reseller (OEM) before the device is shipped. This is the recommended approach for new devices as it allows the hardware hash to be uploaded to Intune without needing to power on the device. Option A is wrong because adding the device to Microsoft Entra ID does not upload the hardware hash.

Option C is wrong because Configuration Manager can collect hashes but requires the device to be on the network and is typically used for existing devices. Option D is wrong because running a PowerShell script on each device requires the device to be powered on and manually executed, which is less efficient for new devices.

Practice this question →

206

Multi-Selecteasy

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Select 2 answers

A.Devices enrolled in Microsoft Intune

B.Configuration Manager current branch

C.On-premises Active Directory

D.Public Key Infrastructure (PKI)

E.Hybrid Microsoft Entra ID joined devices

AnswersA, B

Correct. Devices must be enrolled in Intune to receive policies and apps from Intune, enabling co-management.

Why this answer

Devices must be enrolled in Microsoft Intune to be co-managed; Intune enrollment is the mechanism that enables cloud-based management. Option B is correct because co-management requires Configuration Manager current branch (version 1606 or later) as a minimum. Option E is not strictly required: co-management supports both hybrid and pure Azure AD joined devices, though hybrid is common.

Options C and D are not prerequisites; on-premises AD and PKI are optional.

Exam trap

The trap is that candidates may think hybrid Azure AD join is mandatory for co-management, but both hybrid and pure Azure AD join are supported. They may also overlook that Configuration Manager current branch is a prerequisite, not just an optional upgrade.

Practice this question →

207

MCQhard

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

A.The devices have TPM version 1.2 instead of 2.0.

B.The devices are not joined to Microsoft Entra ID.

C.The BitLocker policy is configured only for Windows 11 Enterprise devices.

D.The devices are running Windows 10 instead of Windows 11.

AnswerA

Windows 11 requires TPM 2.0 for BitLocker.

Why this answer

The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Exam trap

The trap here is that candidates may assume the issue is OS version (Windows 10 vs 11) or Entra ID join status, but the core requirement is TPM 2.0, which is a hardware prerequisite for Windows 11 and BitLocker TPM protector enforcement in Intune.

How to eliminate wrong answers

Option B is wrong because devices do not need to be joined to Microsoft Entra ID for BitLocker to be enabled via Intune; they can be hybrid joined or managed via co-management, and the policy can still apply. Option C is wrong because the BitLocker policy in Intune is not limited to Windows 11 Enterprise; it can be configured for Windows 11 Pro, Education, and Enterprise editions. Option D is wrong because Windows 10 devices also support BitLocker with TPM 2.0, and the policy would still apply if the TPM version is 2.0; the issue is specifically TPM version, not the OS version.

Practice this question →

208

MCQeasy

A company uses Microsoft Intune to manage iOS devices. They need to ensure that only devices with a passcode of at least 6 characters can access corporate email. Which type of policy should they create?

A.App protection policy

B.Enrollment restriction

C.Device configuration policy

D.Device compliance policy

AnswerD

Device compliance policies can require a passcode length for conditional access.

Why this answer

Device compliance policies enforce security requirements like passcode length at the device level. Option A (App protection policy) is incorrect because it targets app-level data protection, not device settings. Option B (Enrollment restriction) is incorrect because it controls which devices can enroll but does not enforce passcode requirements.

Option C (Device configuration policy) is incorrect because it configures device settings but does not enforce compliance with policies.

Practice this question →

209

MCQeasy

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

A.The user does not have an Intune license assigned.

B.The device is not enrolled in Intune.

C.The compliance policy is stale and needs to be re-assigned.

D.The device has no network connectivity.

AnswerA

Correct. Without an Intune license, compliance policies cannot be applied to the device, even if it is enrolled. The device appears as 'Not compliant' because the policies are not being evaluated.

Why this answer

The device showing as 'Not compliant' in the Intune console indicates it is enrolled in Intune. The most likely cause for compliance policies not being applied is that the user does not have a valid Intune license assigned. Without a license, the device can be enrolled but compliance policies will not be evaluated or enforced.

Option B is incorrect because the device is enrolled (as evidenced by its appearance in the console). Option C is incorrect because a stale policy would still apply if the device is enrolled and licensed. Option D is incorrect because network connectivity would affect policy retrieval but the device would still be enrolled and licensed.

Practice this question →

210

Multi-Selecthard

Your organization uses Microsoft Intune and you need to configure Windows Autopilot for hybrid Microsoft Entra ID join. Which THREE components are required?

Select 3 answers

A.A domain join profile (configured in Intune).

B.A device compliance policy.

C.An Autopilot deployment profile.

D.An MDM push certificate.

E.An enrollment status page profile.

AnswersA, C, E

Specifies on-premises AD domain for hybrid join.

Why this answer

A domain join profile is required for hybrid Microsoft Entra ID join because it provides the on-premises Active Directory domain information that the device needs during Autopilot provisioning. Without this profile, the device cannot complete the domain join step, which is essential for establishing the hybrid identity state.

Exam trap

The trap here is that candidates often confuse the requirement for a device compliance policy with the need for a domain join profile, not realizing that compliance policies are applied after enrollment and are not prerequisites for the Autopilot hybrid join process.

Practice this question →

211

MCQeasy

Refer to the exhibit. A detection script for a Win32 app in Intune uses a WMI query. The script is expected to detect if BitLocker is not enabled. What will the script return if BitLocker is enabled on the device?

A.It returns the protection status as 1.

B.It returns the drive letter of the protected volume.

C.It returns no results, indicating that BitLocker is enabled.

D.It returns an error because the query is invalid.

AnswerC

No volumes match the condition when BitLocker is on.

Why this answer

The WMI query in the detection script uses the `SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter = 'C:' AND ProtectionStatus = 0` condition. When BitLocker is enabled, `ProtectionStatus` is 1, so no volumes match the query. The script returns no results, which Intune interprets as the application not being detected (i.e., BitLocker is enabled, so the detection condition is not met).

Exam trap

The trap here is that candidates mistakenly think the script returns a value (like 1 or the drive letter) when BitLocker is enabled, rather than understanding that the query's WHERE clause filters for unprotected volumes, so a successful detection (non-empty result) only occurs when BitLocker is off.

How to eliminate wrong answers

Option A is wrong because `ProtectionStatus = 1` indicates BitLocker is enabled, but the script specifically queries for `ProtectionStatus = 0`; returning a status of 1 would require a different query or output logic. Option B is wrong because the query does not return the drive letter; it returns the entire WMI object only when the condition is met, and if BitLocker is enabled, no objects are returned. Option D is wrong because the WMI query is syntactically valid and will execute without error; it simply returns an empty result set when no volumes match the `ProtectionStatus = 0` condition.

Practice this question →

212

MCQmedium

Refer to the exhibit. You create a new update ring policy for Windows 10 devices. You assign the policy to a test group. After a week, you notice that no devices have installed any quality updates. Devices are online and enrolled. What is the most likely reason?

A.Devices are assigned a different update ring policy that defers quality updates.

B.The feature update deferral period is too long.

C.The quality update pause start date is set to a future date.

D.The policy requires a restart to take effect.

AnswerA

Conflicting policies can cause no updates to apply.

Why this answer

The most likely reason is that devices are assigned a different update ring policy that defers quality updates. In Microsoft Intune, if multiple update ring policies are assigned to a device, the policy with the most restrictive settings (i.e., the highest deferral or pause) takes precedence. Even though the new policy sets QualityUpdateDeferralInDays to 0, an existing policy with a positive deferral would delay installation.

Option B is incorrect because feature update deferral does not affect quality updates. Option C is incorrect because the pause start date is not set; a null value means no pause. Option D is incorrect because the policy takes effect without requiring a restart; updates install based on deferral settings.

Practice this question →

213

MCQmedium

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

A.Add a shell script under Devices > Scripts

B.Use Company Portal to distribute the script

C.Add a PowerShell script under Devices > Scripts

D.Create a custom configuration profile with Bash script

AnswerA

Intune supports shell scripts for macOS.

Why this answer

In Microsoft Intune, shell scripts for macOS are managed under Devices > Scripts, where you can add a script with a specific shell (e.g., bash, sh, zsh) and configure its execution frequency, run context, and notifications. This is the correct method because Intune natively supports deploying and running shell scripts on macOS devices via the Intune management agent, without requiring additional infrastructure.

Exam trap

The trap here is that candidates confuse the ability to run PowerShell scripts on Windows with macOS, or mistakenly think a configuration profile can execute arbitrary code, when in fact Intune strictly separates script deployment (Devices > Scripts) from configuration profiles (Devices > Configuration profiles).

How to eliminate wrong answers

Option B is wrong because Company Portal is a client application for end-user self-service tasks like installing available apps or enrolling devices, not a mechanism for deploying and executing scripts on macOS devices. Option C is wrong because PowerShell scripts are not natively supported on macOS in Intune; Intune's script deployment for macOS only supports shell scripts (e.g., bash, sh, zsh), not PowerShell. Option D is wrong because custom configuration profiles are used to apply settings (e.g., preferences, restrictions) via property lists, not to execute scripts; scripts require the dedicated 'Scripts' blade under Devices.

Practice this question →

214

MCQhard

A multinational organization uses Microsoft Entra ID joined devices with Intune. The security team wants to block enrollment of devices from non-corporate networks unless they have a compliant certificate. Which enrollment restriction should you configure?

A.Device platform restrictions

B.Conditional Access policy requiring hybrid Azure AD join

C.Compliance policy for device health

D.Enrollment device restrictions with certificate requirement

AnswerD

This allows only devices presenting a valid certificate to enroll.

Why this answer

Enrollment device restrictions in Intune allow you to block enrollment from non-corporate networks unless a compliant certificate is present. This is configured under 'Enrollment device restrictions' where you can set a 'Block' action for devices not on trusted networks and require a certificate for compliance, ensuring only authenticated devices can enroll from untrusted locations.

Exam trap

The trap here is confusing post-enrollment controls (compliance policies, Conditional Access) with pre-enrollment controls (enrollment restrictions), leading candidates to select options that manage devices after they are already enrolled rather than blocking enrollment itself.

How to eliminate wrong answers

Option A is wrong because device platform restrictions control which operating systems (e.g., Windows, iOS, Android) can enroll, not network-based certificate requirements. Option B is wrong because a Conditional Access policy requiring hybrid Azure AD join applies to access to cloud apps after enrollment, not to the enrollment process itself, and it does not enforce certificate-based network restrictions. Option C is wrong because compliance policies evaluate device health (e.g., encryption, jailbreak status) after enrollment, not during the enrollment flow, and cannot block enrollment from specific networks.

Practice this question →

215

MCQhard

A user reports that their Windows 11 device is not receiving a required security baseline policy from Microsoft Intune. The device appears as compliant in the Microsoft Intune admin center. Other devices in the same group receive the policy. You verify that the policy is assigned to the correct group and that the user is a member. What is the most likely cause?

A.The device has not checked in with Intune recently or has a policy conflict

B.The user is not a member of the Azure AD group that the policy is assigned to

C.The policy is not assigned to any group

D.The device is marked as non-compliant and has been blocked

AnswerA

If the device hasn't checked in or has a conflict, it may not apply the policy.

Why this answer

The most likely cause is that the device has not checked in with Intune recently or has a policy conflict. Even though the device appears compliant in the admin center, compliance status is based on the last check-in data; if the device hasn't synced recently, it won't receive new or updated policies. Policy conflicts, such as overlapping settings from multiple baselines or configuration profiles, can also prevent a specific security baseline from applying, even when the device is otherwise compliant.

Exam trap

The trap here is that candidates assume compliance status directly correlates with policy delivery, but Intune separates compliance evaluation from policy assignment—a device can be compliant yet still fail to receive policies due to sync issues or conflicts.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that the user is a member of the correct Azure AD group, so group membership is not the issue. Option C is wrong because the policy is verified to be assigned to the correct group, so the policy is indeed assigned. Option D is wrong because the device is reported as compliant in the Intune admin center, and a non-compliant device would be blocked from receiving policies only if a conditional access policy enforces that block; compliance status alone does not prevent policy delivery.

Practice this question →

216

Multi-Selecthard

Which THREE of the following are valid methods to enroll Android devices into Microsoft Intune?

Select 3 answers

A.Android Device Administrator

B.Android Legacy

C.Android Enterprise work profile

D.Android Open Source Project (AOSP)

E.Android Enterprise fully managed

AnswersC, D, E

Work profile is for BYOD scenarios, separating work and personal data.

Why this answer

Android Enterprise work profile is a supported enrollment method in Microsoft Intune that allows users to keep their personal apps and data separate from corporate data on the same device. Intune manages the work profile using the Android Enterprise platform, which provides containerization and policy enforcement without requiring full device control.

Exam trap

The trap here is that candidates confuse 'Android Device Administrator' (a deprecated method) with 'Android Enterprise work profile' (a modern method), or mistakenly think 'Android Legacy' is a valid enrollment option when it is not a recognized Intune enrollment type.

Practice this question →

217

Multi-Selectmedium

Which TWO are valid methods to deploy Windows 10/11 using Microsoft Intune?

Select 2 answers

A.Windows Autopilot

B.Provisioning packages (PPKG)

C.PXE boot from a distribution point

D.Network boot via WDS

E.Bootable USB media with Windows Setup

AnswersA, B

Cloud-native deployment method.

Why this answer

Windows Autopilot is a valid Intune deployment method because it uses cloud-based configuration to transform a new or existing device into a business-ready state without manual imaging. It leverages hardware hashes uploaded to Intune, which then applies policies, apps, and settings during the out-of-box experience (OOBE). This eliminates the need for traditional imaging infrastructure.

Exam trap

The trap here is that candidates confuse on-premises deployment tools (WDS, PXE, USB media) with cloud-native Intune methods, forgetting that Intune is a cloud-only MDM service that does not support direct imaging or network boot protocols.

Practice this question →

218

MCQeasy

You need to ensure that all corporate-owned Windows devices automatically receive security updates as soon as they are released by Microsoft. Which update ring policy setting should you configure in Microsoft Intune?

A.Set the 'Microsoft product updates' setting to 'Allow'.

B.Set 'Defer quality updates' to 0 days.

C.Select the 'Windows Insider' channel for quality updates.

D.Select the 'Semi-Annual Channel' for feature updates.

AnswerB

0-day deferral means updates are installed immediately.

Why this answer

Setting 'Defer quality updates' to 0 days in a Microsoft Intune update ring policy ensures that quality (security) updates are applied immediately upon release by Microsoft, with no deferral period. This configuration forces Windows devices to download and install security updates as soon as they are available from Windows Update, meeting the requirement for automatic and immediate security patching.

Exam trap

The trap here is that candidates often confuse 'Defer quality updates' with 'Microsoft product updates' or 'Semi-Annual Channel', mistakenly thinking those settings control the speed of security update delivery, when in fact they address unrelated update categories or release channels.

How to eliminate wrong answers

Option A is wrong because 'Microsoft product updates' controls whether updates for other Microsoft products (like Office) are included during Windows updates, not the timing of security update delivery. Option C is wrong because selecting the 'Windows Insider' channel is for pre-release testing builds, not for receiving released security updates immediately; it would expose devices to unstable preview code. Option D is wrong because the 'Semi-Annual Channel' for feature updates controls the deferral of feature updates (new OS versions), not the timing of quality (security) updates, and does not address immediate security patching.

Practice this question →

219

Multi-Selecthard

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Select 3 answers

A.Microsoft Intune tenant

B.Configuration Manager current branch

C.Service connection point (Cloud Attach)

D.Public key infrastructure (PKI) certificates

E.Microsoft Entra ID (Azure AD)

AnswersA, B, E

Intune is the cloud management side.

Why this answer

Options A, B, and E are correct. Co-management requires Microsoft Intune tenant (A) for cloud enrollment, Configuration Manager current branch (B) for on-premises management, and Microsoft Entra ID (E) for identity synchronization and hybrid join. Option C is not a requirement; the service connection point is used for cloud attach but is not mandatory for co-management.

Option D is not required; PKI certificates are optional for co-management, as Intune can handle certificate enrollment via SCEP or PKCS if needed.

Practice this question →

220

Multi-Selecthard

You are planning device management for a corporate environment with Windows 10, iOS, and Android devices. You need to implement a solution that allows users to access corporate email and documents securely on their personal devices without IT managing the entire device. Which THREE components should you include?

Select 3 answers

A.Azure AD application proxy for on-premises apps

B.Device enrollment into Intune

C.Microsoft Intune app protection policies (MAM)

D.Azure AD conditional access policies

E.Device compliance policies

AnswersA, C, D

Provides secure remote access without VPN.

Why this answer

Options A, C, and D are correct. Microsoft Intune app protection policies (MAM) protect corporate data at the application level without requiring full device management, allowing personal devices to remain unenrolled. Azure AD Conditional Access policies enforce access controls based on user, location, and app risk, ensuring only authorized users can access corporate resources.

Azure AD Application Proxy provides secure remote access to on-premises web applications, such as corporate email and intranet sites, without a VPN. Option B (Device enrollment into Intune) is not required because the goal is to avoid managing the entire device; MAM provides app-level protection instead. Option E (Device compliance policies) is also not needed as they apply to managed devices, which are not used in this scenario.

Practice this question →

221

MCQhard

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

A.Assign an Autopilot deployment profile to the device group in Intune.

B.Export the hardware hash from each device and upload it manually to Intune.

C.Use a provisioning package (PPKG) to reset the device and register it for Autopilot.

D.Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

AnswerC

PPKG allows reset and registration with minimal user disruption.

Why this answer

Using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Exam trap

The trap here is that candidates often confuse the registration step (exporting the hardware hash) with the actual conversion process, failing to recognize that a reset or provisioning package is required to complete the Autopilot enrollment without disrupting users.

How to eliminate wrong answers

Option A is wrong because assigning an Autopilot deployment profile to a device group in Intune only applies after the device is already registered with Autopilot; it does not convert an existing device or register its hardware hash. Option B is wrong because manually exporting and uploading the hardware hash is a prerequisite for registration but does not perform the conversion or reset; it requires additional steps to actually deploy Autopilot, causing more disruption. Option D is wrong because performing a full device wipe and reimage using traditional methods contradicts the goal of minimizing user disruption, as it erases all data and settings, and then registering with Autopilot adds unnecessary overhead.

Practice this question →

222

MCQeasy

You are configuring Windows Autopilot for new devices. The devices need to be automatically enrolled in Intune and assigned to a specific group based on their serial number. What is the required step before the devices can be recognized by Autopilot?

A.Configure Intune enrollment for all users using device enrollment managers.

B.Register the devices using their hardware hash in the Microsoft Intune admin center.

C.Join the devices to Microsoft Entra ID manually before shipping.

D.Upload a CSV file with device serial numbers to Microsoft Entra ID.

AnswerB

Hardware hash registration is the standard method.

Why this answer

Before Windows Autopilot can recognize and automatically enroll devices, they must be registered as Autopilot devices. This is done by uploading their hardware hash (a unique identifier derived from the device's TPM and other hardware) into the Microsoft Intune admin center. Once registered, the device is associated with an Autopilot profile and can be automatically enrolled in Intune and assigned to a group based on its serial number during the out-of-box experience.

Exam trap

The trap here is that candidates often confuse device registration (uploading the hardware hash) with device enrollment (assigning users or policies), or mistakenly think that simply listing serial numbers in a CSV is sufficient for Autopilot recognition.

How to eliminate wrong answers

Option A is wrong because configuring Intune enrollment for all users using device enrollment managers does not register the device with Autopilot; it only allows a delegated user to enroll devices manually, bypassing the Autopilot registration requirement. Option C is wrong because manually joining devices to Microsoft Entra ID before shipping defeats the purpose of Autopilot's zero-touch provisioning; Autopilot handles the join automatically during OOBE. Option D is wrong because uploading a CSV file with device serial numbers to Microsoft Entra ID is not a supported method for Autopilot registration; Autopilot requires the hardware hash (or other identifiers like PKID or TPM hash) to be uploaded via Intune or a CSP, not just serial numbers.

Practice this question →

223

MCQeasy

You are troubleshooting an Autopilot deployment where devices are not receiving the expected configuration policies after enrollment. The devices show as enrolled in Intune but are stuck in a 'pending' state for policy application. What is the most likely cause?

A.The device is not registered in Autopilot.

B.The user does not have an assigned Intune license.

C.The device has a slow internet connection.

D.The Autopilot profile is set to 'offline' mode.

AnswerB

Without license, policies are not applied.

Why this answer

When a device is enrolled in Intune but stuck in a 'pending' state for policy application, the most common cause is that the user account lacks an assigned Intune license. Without a license, the user cannot synchronize policies from the Intune service, even though the device itself appears in the console. This is a prerequisite for policy delivery and is often overlooked during troubleshooting.

Exam trap

The trap here is that candidates often assume a device showing as 'enrolled' means all prerequisites are met, overlooking that user license assignment is a separate requirement for policy delivery in user-driven Autopilot scenarios.

How to eliminate wrong answers

Option A is wrong because if the device were not registered in Autopilot, it would not appear as enrolled in Intune at all; the 'pending' state specifically indicates enrollment succeeded but policy application is blocked. Option C is wrong because a slow internet connection would cause timeouts or partial downloads, not a persistent 'pending' state; the device would eventually either apply policies or fail with a connectivity error. Option D is wrong because an 'offline' Autopilot profile is not a valid setting; Autopilot profiles are either 'user-driven' or 'self-deploying' modes, and 'offline' refers to offline enrollment (using a provisioning package), which still applies policies normally once the device connects to Intune.

Practice this question →

224

MCQmedium

You need to configure device compliance for devices that are not running Windows. The devices include iOS, iPadOS, Android, and macOS. Which compliance settings are common across all platforms?

A.Require device password and not allow simple passwords.

B.Require minimum OS version.

C.Device must not be jailbroken/rooted.

D.Require BitLocker encryption.

AnswerB

All platforms support a minimum OS version compliance rule.

Why this answer

Requiring a minimum OS version is a compliance setting supported on all major platforms including iOS, iPadOS, Android, and macOS. Option B is correct. Option A is incorrect because while requiring a device password is common, the setting 'not allow simple passwords' is not universally available across all platforms (e.g., Android and iOS have password complexity but not a simple password toggle).

Option C is incorrect because jailbreak/root detection is not available on all platforms; for example, Android and iOS support it but macOS does not have a native 'rooted' detection. Option D is incorrect because BitLocker is a Windows-specific encryption technology and is not available on iOS, iPadOS, Android, or macOS.

Practice this question →

225

MCQeasy

Your organization wants to use Microsoft Intune to manage Windows devices that are joined to an on-premises Active Directory domain. The devices will be hybrid Azure AD joined. Which tool should you use to configure automatic enrollment into Intune?

A.Group Policy

B.Windows Autopilot

C.System Center Updates Publisher (SCUP)

D.Configuration Manager Cloud Management Gateway (CMG)

AnswerA

Group Policy can configure the 'Enable automatic MDM enrollment using default Azure AD credentials' setting.

Why this answer

For hybrid Azure AD joined devices, automatic enrollment into Intune is configured via Group Policy. Specifically, you deploy the 'Enable automatic MDM enrollment using default Azure AD credentials' policy setting, which triggers the MDM enrollment process using the user's Azure AD credentials during sign-in. This is the only supported method for bulk, automatic enrollment of hybrid Azure AD joined Windows devices without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse Windows Autopilot with automatic enrollment, but Autopilot is a provisioning tool for new devices, not a configuration mechanism for existing hybrid domain-joined devices.

How to eliminate wrong answers

Option B (Windows Autopilot) is wrong because Autopilot is designed for new, out-of-box device provisioning and does not handle automatic enrollment of existing domain-joined devices; it requires a fresh OS deployment or reset. Option C (System Center Updates Publisher, SCUP) is wrong because SCUP is a tool for managing third-party software updates via Configuration Manager, not for configuring MDM enrollment. Option D (Configuration Manager Cloud Management Gateway, CMG) is wrong because CMG provides internet-based management for Configuration Manager clients, but it does not configure automatic Intune enrollment; enrollment is handled separately via Group Policy or co-management settings.

Practice this question →

← PreviousPage 3 of 4 · 237 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Prepare infrastructure for devices questions.

Start 20-question session