Scenario practice questions

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

Trap 1: Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as'…

Self-deploying mode doesn't require user sign-in.

Trap 2: Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to…

Hybrid join requires on-premises AD and a different flow.

Trap 3: Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to…

White Glove is for pre-provisioning, not user-driven OOBE.

A
Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.
Why wrong: Self-deploying mode doesn't require user sign-in.
B
Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.
Why wrong: Hybrid join requires on-premises AD and a different flow.
C
Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.
Why wrong: White Glove is for pre-provisioning, not user-driven OOBE.
D
Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.
This requires user sign-in and enrolls device in Intune.

Question 2easymultiple choice

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

Trap 1: Select the device and choose 'Retire'.

Retire only removes company data and apps.

Trap 2: Select the device and choose 'Reset'.

Reset is for re-enrollment, not data removal.

Trap 3: Select the device and choose 'Delete'.

Delete removes the device from management without a wipe.

A
Select the device and choose 'Retire'.
Why wrong: Retire only removes company data and apps.
B
Select the device and choose 'Wipe'.
Wipe performs a factory reset, removing all data.
C
Select the device and choose 'Reset'.
Why wrong: Reset is for re-enrollment, not data removal.
D
Select the device and choose 'Delete'.
Why wrong: Delete removes the device from management without a wipe.

Question 3easymultiple choice

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices that have a BitLocker encryption status of 'fully encrypted' are allowed to access corporate resources. They create a device compliance policy that requires BitLocker. However, some devices are still accessing resources even though they are not fully encrypted. What should you check?

Trap 1: The devices are running Windows 10 Home edition, which does not…

If BitLocker is not supported, the device would be marked non-compliant, but the policy might not be assigned.

Trap 2: The compliance policy is set to 'Report non-compliant' instead of…

Compliance policies do not have a report-only mode; they are either assigned or not.

Trap 3: The compliance policy has a grace period configured that allows…

A grace period would allow access, but the policy might still be assigned; the issue is that non-compliant devices are accessing resources, so the policy might not be assigned.

A
The devices are running Windows 10 Home edition, which does not support BitLocker.
Why wrong: If BitLocker is not supported, the device would be marked non-compliant, but the policy might not be assigned.
B
The compliance policy is not assigned to the user or device groups.
Without assignment, the policy does not apply, and non-compliant devices can still access resources.
C
The compliance policy is set to 'Report non-compliant' instead of 'Block non-compliant'.
Why wrong: Compliance policies do not have a report-only mode; they are either assigned or not.
D
The compliance policy has a grace period configured that allows access for non-compliant devices.
Why wrong: A grace period would allow access, but the policy might still be assigned; the issue is that non-compliant devices are accessing resources, so the policy might not be assigned.

Question 4mediummatching

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

User-owned devices enrolled with user affinity

Company-owned devices assigned to a specific user

Shared or kiosk devices not tied to a user

Zero-touch deployment for new Windows devices

Enroll multiple devices using a shared account

Question 5hardmultiple choice

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

Trap 1: Add a PowerShell script that runs during Autopilot to set language…

PowerShell scripts cannot modify provisioning settings during the out-of-box experience.

Trap 2: Assign an Intune Language Pack policy to the device group.

Language packs are installed via Intune but not during initial provisioning automatically.

Trap 3: Create a Group Policy Object that sets language and region, and…

Group Policy is not applied during the provisioning process before the device is joined to the domain.

A
Add a PowerShell script that runs during Autopilot to set language and region.
Why wrong: PowerShell scripts cannot modify provisioning settings during the out-of-box experience.
B
Include the 'Language' and 'RegionalSettings' settings in the PPKG.
Windows Configuration Designer allows embedding language and regional settings directly.
C
Assign an Intune Language Pack policy to the device group.
Why wrong: Language packs are installed via Intune but not during initial provisioning automatically.
D
Create a Group Policy Object that sets language and region, and link it to the device OU.
Why wrong: Group Policy is not applied during the provisioning process before the device is joined to the domain.

Question 6hardmultiple choice

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

Trap 1: Devices must have VPN connectivity to Azure.

Not required.

Trap 2: An Intune connector for Active Directory must be installed.

This connector is for device enrollment, not hybrid join.

Trap 3: Azure AD Connect must be configured with password hash sync.

Not a prerequisite for Autopilot hybrid join.

A
Devices must have line-of-sight to an on-premises domain controller.
Required to join the domain during Autopilot.
B
Devices must have VPN connectivity to Azure.
Why wrong: Not required.
C
An Intune connector for Active Directory must be installed.
Why wrong: This connector is for device enrollment, not hybrid join.
D
Azure AD Connect must be configured with password hash sync.
Why wrong: Not a prerequisite for Autopilot hybrid join.

Question 7easymultiple choice

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Trap 1: Require multi-factor authentication

MFA is for user authentication, not device compliance.

Trap 2: Require hybrid Azure AD joined device

Device join status, not compliance.

Trap 3: Require approved client app

App-level policy, not device compliance.

A
Require device to be marked as compliant
Directly enforces compliance for access.
B
Require multi-factor authentication
Why wrong: MFA is for user authentication, not device compliance.
C
Require hybrid Azure AD joined device
Why wrong: Device join status, not compliance.
D
Require approved client app
Why wrong: App-level policy, not device compliance.

Question 8hardmultiple choice

You manage devices with Microsoft Intune and have enabled co-management with Configuration Manager. You need to ensure that Windows Update policies are managed by Intune for all co-managed Windows 10 devices. Which workload slider should you set in Configuration Manager?

Trap 1: Endpoint Protection

Incorrect. This workload controls antivirus and firewall.

Trap 2: Client Apps

Incorrect. This workload controls app management.

Trap 3: Device Configuration

Incorrect. This workload controls configuration settings.

A
Endpoint Protection
Why wrong: Incorrect. This workload controls antivirus and firewall.
B
Windows Update Policies
Correct. This workload controls update management.
C
Client Apps
Why wrong: Incorrect. This workload controls app management.
D
Device Configuration
Why wrong: Incorrect. This workload controls configuration settings.

Question 9mediummultiple choice

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are no longer receiving compliance policies. You verify that the devices are enrolled and show as active in Intune. What should you check first?

Trap 1: Check if the devices can connect to the Intune service.

If connectivity were the issue, other management actions would also fail.

Trap 2: Ensure the users are members of the correct Azure AD group.

Compliance policies are assigned to groups, but if they were receiving them before, group membership is likely fine.

Trap 3: Re-enroll the devices in Intune.

Re-enrollment is unnecessary; the devices are already enrolled and active.

A
Verify that the compliance policy is assigned to the correct Windows version.
The update may have changed the OS version, and the policy might not target that version.
B
Check if the devices can connect to the Intune service.
Why wrong: If connectivity were the issue, other management actions would also fail.
C
Ensure the users are members of the correct Azure AD group.
Why wrong: Compliance policies are assigned to groups, but if they were receiving them before, group membership is likely fine.
D
Re-enroll the devices in Intune.
Why wrong: Re-enrollment is unnecessary; the devices are already enrolled and active.

Question 10hardmultiple choice

You manage Windows 11 devices with Microsoft Intune. Some users report that their device is marked as noncompliant even though it meets all compliance rules. You discover that the devices have not checked in with Intune for over 30 days. What should you do to prevent this issue?

Trap 1: Configure a device configuration profile to set the MDM enrollment…

This does not address the check-in interval.

Trap 2: Create a Conditional Access policy to block devices that haven't…

Conditional Access cannot enforce check-in intervals.

Trap 3: Enable automatic re-enrollment for Windows devices in Intune.

Automatic re-enrollment is not a feature that prevents noncompliance due to missed check-ins.

A
Configure a device configuration profile to set the MDM enrollment URL.
Why wrong: This does not address the check-in interval.
B
Create a Conditional Access policy to block devices that haven't checked in.
Why wrong: Conditional Access cannot enforce check-in intervals.
C
In the device compliance policy, set the 'Days until device is considered noncompliant' option to 30.
This setting marks devices as noncompliant if they haven't checked in within the specified days.
D
Enable automatic re-enrollment for Windows devices in Intune.
Why wrong: Automatic re-enrollment is not a feature that prevents noncompliance due to missed check-ins.

Question 11hardmultiple choice

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Trap 1: Add the device to a hybrid Azure AD join profile.

Hybrid join is for on-premises AD integration, not needed here.

Trap 2: Modify the Autopilot deployment profile to set 'Join to Azure AD…

That would cause the issue.

Trap 3: Modify the enrollment restrictions to block personally owned…

This does not affect the join type.

A
Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.
This setting controls whether the device is joined or registered.
B
Add the device to a hybrid Azure AD join profile.
Why wrong: Hybrid join is for on-premises AD integration, not needed here.
C
Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.
Why wrong: That would cause the issue.
D
Modify the enrollment restrictions to block personally owned devices.
Why wrong: This does not affect the join type.