Mixed Deck — All MD-102 Topics Flashcards

You plan to deploy Windows 11 Pro to 200 new computers by using the Microsoft Deployment Toolkit (MDT) and Windows Deployment Services (WDS). The company has a Volume Licensing Agreement and uses a product key to activate Windows 11. You need to ensure that the new computers will be configured to have the correct product key during the installation. What should you configure?

Answer: an MDT task sequence

When deploying Windows with MDT, the product key for activation is configured within the MDT task sequence. The task sequence orchestrates all steps of the deployment, including operating system installation, driver injection, application installation, and crucially, the entry of the product key for volume licensing. This ensures that all 200 new computers are correctly activated during the automated deployment process.

A Windows device fails to install a cumulative update and shows error code 0x800705b4. What does this typically indicate?

Answer: The Windows Update service timed out or was interrupted

Error 0x800705b4 typically indicates a timeout or interruption in the Windows Update service, often caused by the service not running, network issues, or conflicting processes.

An admin configured an app protection policy for Android but users can still copy corporate data to personal apps. What is the most likely cause?

Answer: The app is not an Intune-managed app (SDK integrated or wrapped)

App protection policies only control data transfer for apps that include the Intune SDK or have been wrapped with the Intune App Wrapping Tool; unsupported apps are unaffected.

An administrator wants to deploy a PowerShell script to Windows 10 devices using Intune. Which feature should be used?

Answer: Intune PowerShell scripts

Intune PowerShell scripts allow administrators to deploy and execute PowerShell scripts on Windows 10/11 devices managed by Intune.

Which Windows tool allows administrators to service an offline Windows image by adding drivers, updates, or language packs before deployment?

Answer: DISM (Deployment Image Servicing and Management)

DISM can mount a Windows image offline and add or remove drivers, cumulative updates, features, and language packs without booting the image.

In Microsoft Intune, which profile type is used to configure Wi-Fi settings and push them to managed Windows devices?

Answer: Device configuration profile

Device configuration profiles in Intune are used to push settings such as Wi-Fi networks, VPN connections, email, and certificates to managed devices.

What is Windows Information Protection (WIP) designed to do?

Answer: Separate and protect corporate data from personal data on Windows devices without requiring full MDM enrollment

Windows Information Protection (WIP) provides data separation on Windows devices, tagging corporate data and restricting how it can be shared or copied to non-corporate apps, without requiring full MDM enrollment.

Which Intune policy can prevent users from modifying Microsoft Defender Antivirus settings on their Windows 10 devices?

Answer: Tamper protection setting in Antivirus policy

Tamper protection, configured through the Intune Antivirus policy, prevents users and malware from modifying Microsoft Defender Antivirus security settings.

Your network contains an Active Directory domain named contoso.com. The domain contains 25 computers that run Windows 11. You have a Microsoft 365 subscription You have an Azure AD tenant that syncs with contoso.com. You configure hybrid Azure AD join and discover that some of the computers have a registered state of Pending. You need to ensure that the computers complete the join successfully. What should you ensure?

Answer: that each computer has a line of sight to a domain controller

For hybrid Azure AD join to complete successfully, the computers need to be able to communicate directly with an on-premises Active Directory domain controller. This 'line of sight' is crucial for the device registration process, as the domain controller is responsible for syncing the device object to Azure AD. Without this connectivity, the device registration can remain in a 'Pending' state.

An administrator wants to ensure that Microsoft 365 Apps are installed on all managed Windows 10 devices. Which Intune app type should be used?

Answer: Microsoft 365 Apps (Windows 10 and later)

The Microsoft 365 Apps deployment type in Intune provides a simplified wizard-based interface to deploy and configure Microsoft 365 Apps (Office) on Windows 10/11 devices.

Which Windows feature allows administrators to remotely troubleshoot a user device through Intune without requiring VPN, integrated with Azure AD for access control?

Answer: Intune Remote Help

Intune Remote Help is a cloud-based remote assistance solution that allows IT administrators to view and control managed devices, integrated with Intune and Azure AD for access control.

What are some of the more commonly used device compliance settings? Choose 2 Options

Answer: Maximum OS version allowed

Device compliance policies in Intune are crucial for ensuring devices meet organizational security standards. Two commonly used settings are "Maximum OS version allowed," which prevents devices running outdated or unsupported operating systems from accessing corporate resources, and "Whether the device is jail-broken or rooted," which identifies and restricts access for devices that have had their security protections bypassed. These settings help maintain a secure and manageable endpoint environment.

An administrator wants to trigger an immediate policy sync on a Windows 10 device managed by Intune without waiting for the next scheduled check-in. What should the admin do?

Answer: Use the Sync action from the device in Intune portal

The Sync remote action in the Intune portal sends a notification to the device to check in immediately and pull down any pending policy or app updates.

In Azure AD, If you’re in a federated domain, you’re redirected to your on-premises Secure Token Service (STS) server.

Answer: True

In a federated Azure AD environment, user authentication is handled by an on-premises Secure Token Service (STS), typically ADFS. When a user attempts to access an Azure AD-protected resource, Azure AD redirects the authentication request to the configured on-premises STS. The STS then authenticates the user against the local Active Directory and issues a security token back to Azure AD, confirming the user's identity.

An administrator wants to block USB drives on corporate Windows 10 devices using Intune. Which policy type should be used?

Answer: Endpoint security – Attack surface reduction

Attack surface reduction policies in Intune include removable storage device controls that can block USB drives and other removable media on managed Windows devices.

A company needs to ensure sensitive files on Windows 10 are encrypted and access is restricted to corporate apps only. Which feature should be configured?

Answer: Windows Information Protection (WIP)

Windows Information Protection (WIP) encrypts corporate data and restricts access to designated enterprise apps, protecting data without interfering with personal data.

What is the Enrollment Status Page (ESP) used for in Windows Autopilot?

Answer: Blocking device use until required apps and policies are applied

The Enrollment Status Page blocks the user from accessing the desktop until all required applications and policies assigned in Intune have been successfully applied.

Which Azure AD feature can automatically detect risky sign-in events and prompt for MFA or block access based on a risk score?

Answer: Identity Protection

Azure AD Identity Protection evaluates sign-in risk using machine learning and can automatically enforce MFA or block access based on the detected risk level.

An admin wants to use Microsoft Intune reporting to understand how effectively Windows security updates are being applied. Which report type is most relevant?

Answer: Windows Update compliance reports

Windows Update compliance reports provide detailed information on the status of security update deployments, including which devices have applied specific patches and which have failed.

Which Azure AD (Entra ID) feature allows an administrator to immediately revoke all active sessions across devices when a security incident is detected?

Answer: Revoke user sign-in sessions action

The Revoke sessions action in Azure AD immediately invalidates all refresh tokens and active sessions for a user, forcing re-authentication on all devices and apps.