CCNA Prepare infrastructure for devices Questions — Page 4 of 4

226

MCQmedium

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

A.Create an app protection policy that restricts data transfer between work and personal apps.

B.Create a device configuration policy that disables clipboard sharing.

C.Create a device compliance policy that requires a work profile.

D.Create a conditional access policy that blocks personal apps.

AnswerA

MAM policies can prevent copy/paste across profiles.

Why this answer

App protection policies (MAM) can restrict data transfer between work and personal apps, preventing copy/paste of corporate data. Option B is incorrect because device configuration policies do not control data transfer between apps; they configure device settings. Option C is incorrect because device compliance policies enforce device health and security requirements, not app-level data protection.

Option D is incorrect because conditional access policies control access to resources based on conditions, not app data transfer.

Practice this question →

227

MCQeasy

You need to deploy a custom Windows 10 image to 100 new devices using Microsoft Intune. The devices are not yet enrolled. Which method should you use to deploy the image and enroll the devices?

A.Use PXE boot to deploy the image and then enroll via a provisioning package.

B.Create a bootable USB with the image and manually enroll each device.

C.Use Microsoft Configuration Manager to deploy the image and enroll via co-management.

D.Use Windows Autopilot to deploy a custom image and automatically enroll the devices.

AnswerD

Autopilot supports custom images (with Windows 11 21H2+) and auto-enrollment.

Why this answer

Windows Autopilot is the correct method because it can deploy a custom Windows 10 image and automatically enroll devices into Intune, providing a zero-touch deployment experience. Option A is incorrect because PXE boot is not natively supported by Intune and a provisioning package alone cannot deploy an image. Option B is incorrect because creating a bootable USB and manually enrolling each device is not scalable for 100 devices and does not leverage Intune's automated enrollment.

Option C is incorrect because while Configuration Manager can deploy images, co-management is an additional configuration and not the simplest approach for this scenario; Windows Autopilot is the recommended method for modern deployment with Intune.

Practice this question →

228

MCQmedium

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

A.Skip privacy settings

B.Windows Hello for Business

C.Device name template

D.Language (Region)

AnswerB

This setting enables Hello enrollment during OOBE.

Why this answer

The 'Windows Hello for Business' setting in the Autopilot profile directly controls whether users are prompted to configure biometric or PIN-based authentication during the out-of-box experience (OOBE). When enabled, this setting triggers the Windows Hello for Business enrollment flow immediately after user authentication, ensuring the device is provisioned with strong credential protection before the user reaches the desktop.

Exam trap

The trap here is that candidates often confuse 'Windows Hello for Business' with 'Skip privacy settings' or 'Language (Region)' because they assume any OOBE customization setting might affect the Hello prompt, but only the dedicated Windows Hello toggle controls this specific behavior.

How to eliminate wrong answers

Option A is wrong because 'Skip privacy settings' controls whether the privacy settings screens (e.g., location, Find My Device) are displayed during OOBE; it has no impact on Windows Hello for Business prompts. Option C is wrong because 'Device name template' defines the naming convention for the device (e.g., using serial number or random characters) and does not influence authentication method configuration. Option D is wrong because 'Language (Region)' sets the default language and regional format for the device during OOBE, which is unrelated to biometric or PIN enrollment.

Practice this question →

229

MCQmedium

A user has an Android Enterprise fully managed device. The device is enrolled in Microsoft Intune and all policies are applied. However, the user cannot install a required app from the managed Play Store. The app appears in the company portal but fails to install. What should you check first?

A.Ensure that the device has a policy to allow installation of unapproved apps.

B.Check if the device's enrollment token is still valid.

C.Check if the app is available in the unmanaged Play Store.

D.Verify that the app has been approved in the managed Google Play store.

AnswerD

Apps must be approved before deployment.

Why this answer

The correct first step is to verify that the app has been approved in the managed Google Play store. For Android Enterprise fully managed devices, apps from the managed Play Store must be approved by the IT admin before they can be installed. Even if the app appears in Company Portal, if it is not approved, installation will fail.

Therefore, checking approval status is the most likely cause.

Practice this question →

230

MCQmedium

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

A.FileVault encryption is not enabled on the device.

B.The recovery key type should be 'Institutional recovery key'.

C.The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.

D.Personal recovery key rotation is enabled, causing a conflict.

AnswerC

User must be prompted to escrow.

Why this answer

If the 'Show recovery key' setting is not configured (set to 'Not configured'), the user is not prompted to escrow the recovery key during encryption. FileVault encryption is enabled on the device (option A is incorrect). The recovery key type is personal, not institutional (option B is incorrect).

Personal recovery key rotation does not cause a conflict (option D is incorrect).

Practice this question →

231

MCQhard

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

A.Use a compliance policy with custom settings to enforce BitLocker.

B.Create a new security baseline from scratch and include the BitLocker settings.

C.Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.

D.Edit the built-in Windows security baseline and add the BitLocker settings.

AnswerC

Intune allows you to duplicate a baseline and modify settings.

Why this answer

Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Exam trap

The trap here is that candidates assume baselines can be edited directly like other Intune policies, but Microsoft intentionally locks built-in baselines to enforce consistency, requiring a copy for customization.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device compliance after configuration and cannot enforce settings like BitLocker; they only report non-compliance and trigger remediation actions, not deploy configurations. Option B is wrong because Intune does not allow creating a security baseline from scratch; you must start from a built-in baseline template and customize a copy. Option D is wrong because editing the built-in Windows security baseline directly is not supported; Intune baselines are read-only templates, and modifications require creating a copy.

Practice this question →

232

MCQhard

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. Some devices running Windows 10 22H2 (build 19045.3803) are marked as noncompliant. What is the most likely reason?

A.The device has a password length of 6 characters, not meeting the minimum of 8.

B.The policy requires a firewall, but Windows Defender Firewall is disabled on the device.

C.The device is not enrolled in Microsoft Intune.

D.The device is running a build outside the allowed OS version range specified in the policy.

AnswerA

The policy requires a minimum password length of 8, so a device with a shorter password would be noncompliant.

Why this answer

The compliance policy specifies a minimum password length of 8 characters, and devices with a password length of 6 characters fail this requirement. In Microsoft Intune, compliance policies evaluate device settings against defined rules, and a password length below the minimum is a common reason for noncompliance. The devices are running Windows 10 22H2 (build 19045.3803), which is within the allowed OS version range, so the issue is specifically the password policy.

Exam trap

The trap here is that candidates may assume the noncompliance is due to a missing firewall or OS version mismatch, but the exhibit clearly shows only password policy settings, so the focus should be on the password length requirement.

How to eliminate wrong answers

Option B is wrong because the policy does not include a firewall requirement; the exhibit shows only password-related settings, so a disabled firewall would not cause noncompliance. Option C is wrong because the devices are already managed by Intune (they are marked as noncompliant, which requires enrollment), so the issue is not lack of enrollment. Option D is wrong because the devices are running build 19045.3803, which is within the allowed OS version range specified in the policy (Windows 10 22H2), so the build is not outside the allowed range.

Practice this question →

233

MCQhard

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app to iOS devices. The app is signed with an enterprise certificate. Some devices report installation failure with error code 0x87D13B9F. What is the most likely cause?

A.The app package is not signed.

B.The app is not available in the Apple App Store.

C.The enterprise signing certificate is not trusted on the device.

D.The device does not have enough storage space.

AnswerC

Error 0x87D13B9F indicates that the app's signing certificate is not trusted, often because the certificate profile is missing.

Why this answer

Error code 0x87D13B9F in Microsoft Intune typically indicates a signing certificate trust issue. Since the app is signed with an enterprise certificate, the device must have that certificate installed and trusted in its trusted root store. If the certificate is not trusted, iOS will reject the installation, producing this specific error.

Exam trap

The trap here is that candidates may confuse a signing error (missing certificate trust) with a packaging error (unsigned app), but the error code 0x87D13B9F specifically points to trust, not signature absence.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the app is signed with an enterprise certificate, so the package is signed. Option B is wrong because line-of-business (LOB) apps are deployed directly via Intune and do not require availability in the Apple App Store. Option D is wrong because insufficient storage space would generate a different error (e.g., 0x87D13B9E or a storage-specific code), not 0x87D13B9F.

Practice this question →

234

MCQhard

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

A.The quality update deferral of 7 days has not yet elapsed since the last update.

B.The quality update pause has expired, but quality updates are still blocked.

C.Quality updates are paused until March 15, 2025.

D.Feature updates are deferred for 30 days, preventing all updates.

AnswerC

The pause is active, blocking quality updates.

Why this answer

The JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Exam trap

The trap here is that candidates often confuse 'deferral' with 'pause' and assume a short deferral period is the cause, overlooking that an active pause overrides all deferral settings for that update type.

How to eliminate wrong answers

Option A is wrong because the 7-day quality update deferral is irrelevant while a pause is active; the pause explicitly blocks updates until its expiry date. Option B is wrong because the pause has not expired (it expires on March 15, 2025), so updates are still blocked by the pause, not by an expired pause. Option D is wrong because feature update deferral settings do not affect quality updates; quality and feature update policies are independent in Windows Update for Business.

Practice this question →

235

MCQmedium

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

A.A conditional access policy requires compliant devices.

B.The Apple MDM push certificate is not configured.

C.The enrollment restrictions are set to block personally owned devices.

D.The users have not accepted the terms of use.

AnswerC

Correct. The enrollment restrictions are likely set to block personally owned devices, causing the error when users attempt to enroll their personal iOS devices.

Why this answer

The error 'This device is not allowed to enroll' typically occurs when enrollment restrictions block the device type or ownership. In this scenario, although iOS enrollment is allowed, the restriction likely blocks personally owned devices. If users are trying to enroll personal iOS devices, the restriction preventing personally owned devices would cause this error.

Option A is incorrect because a conditional access policy requiring compliant devices blocks access to resources after enrollment, not the enrollment itself. Option B is incorrect because the Apple MDM push certificate is required for Intune to communicate with iOS devices, but a missing certificate would cause a different error related to certificate setup. Option D is incorrect because terms of use appear after the enrollment attempt and would not prevent the initial enrollment.

Practice this question →

236

MCQeasy

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

A.Apple Configurator enrollment

B.Device Enrollment Manager (DEM) account

C.Apple Automated Device Enrollment (ADE)

D.User-initiated enrollment via Company Portal

AnswerC

ADE enables zero-touch deployment where devices enroll automatically when the user signs in with a work account.

Why this answer

Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Exam trap

The trap here is that candidates often confuse Apple Configurator enrollment (a manual, wired method) with ADE (an automated, over-the-air method), or they think user-initiated enrollment via Company Portal can be automated, but it requires manual steps by the user.

How to eliminate wrong answers

Option A is wrong because Apple Configurator enrollment is a manual, wired method intended for small-scale or shared device scenarios, not for automatic enrollment at scale when users sign in. Option B is wrong because the Device Enrollment Manager (DEM) account is used to enroll multiple devices using a single shared account, not to trigger automatic enrollment per user sign-in. Option D is wrong because user-initiated enrollment via Company Portal requires the user to manually download the app and enroll, which does not meet the requirement for automatic enrollment when signing in with a work account.

Practice this question →

237

MCQeasy

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

A.Disables the Windows Firewall for all network profiles

B.Enables the Windows Firewall for the public network profile

C.Enables Microsoft Defender Antivirus real-time protection

D.Disables the Windows Firewall for the domain network profile

AnswerB

The setting enables firewall on public profile.

Why this answer

The setting shown in the exhibit configures the Windows Firewall to enable the firewall for the public network profile. In Intune, the 'Windows Firewall' configuration policy allows administrators to define per-profile firewall states. Enabling the firewall for the public profile is a common security baseline requirement to protect devices on untrusted networks.

Exam trap

The trap here is that candidates confuse the 'Windows Firewall' setting with Microsoft Defender Antivirus real-time protection, or assume the setting disables all profiles when it actually enables a specific profile; the exhibit's focus on a single profile (public) is the key detail to avoid misinterpreting the scope.

How to eliminate wrong answers

Option A is wrong because the setting specifically enables the firewall for the public profile, not disables it for all profiles; disabling all profiles would be a separate configuration. Option C is wrong because this setting controls Windows Firewall, not Microsoft Defender Antivirus real-time protection, which is managed under a different policy category (Endpoint Protection). Option D is wrong because the setting targets the public profile, not the domain profile; disabling the domain profile firewall would be a distinct policy choice and is not what is shown.

Practice this question →