MD-101 Microsoft Intune Device Configuration Profiles 3

Question 1

Which protocol does Intune use to deploy certificates to devices using a Certificate Authority integration?

Accepted Answer

SCEP (Simple Certificate Enrollment Protocol)

Answer

LDAP

Answer

Kerberos

Answer

OCSP

Question 2

What must be configured in Intune before deploying a SCEP certificate profile to devices?

Accepted Answer

A Trusted certificate profile with the root CA certificate

Answer

A Wi-Fi profile must be deployed first

Answer

An email profile with S/MIME enabled

Answer

A compliance policy must already be satisfied

Question 3

Which Intune profile type delivers per-app VPN configuration on Windows 10/11 devices?

Accepted Answer

VPN profile with per-app VPN rules

Answer

Device restrictions

Answer

App protection policy

Answer

Custom OMA-URI only

Question 4

A Windows device shows 'Error' status for a configuration profile. Where should an administrator look first to diagnose the issue?

Accepted Answer

Intune — Device > Configuration profiles > select device and view profile details with error codes

Answer

Azure AD sign-in logs

Answer

Event Viewer on the local device only

Answer

Microsoft 365 admin center

Question 5

Which Intune setting prevents users from adding personal Microsoft accounts to a corporate Windows device?

Accepted Answer

Block personal Microsoft account under Device restrictions > Accounts

Answer

Conditional Access block policy for personal accounts

Answer

Identity protection — block MSA sign-in

Answer

Azure AD — Guest access restriction

Question 6

What is the purpose of Intune's 'Scope tags' in configuration profiles?

Accepted Answer

To restrict which Intune administrator roles can view and manage specific profiles

Answer

To filter which devices receive a profile based on hardware properties

Answer

To apply profiles only during certain hours

Answer

To tag profiles for compliance reporting