Free Microsoft MD-102 Practice Questions

Correct answer: D. the App2 deployment configurations

In Microsoft Intune, app dependency relationships are configured in the deployment settings of the dependent app. To ensure App1 is installed before App2, you must configure App2's deployment to add App1 as a dependency. This is done in the App2 deployment configurations, not in App1 or through device groups or detection rules.

Why the other options are wrong

• A. App1 deployment configurations do not define what must happen before other apps are installed; the dependent app specifies its prerequisites.
• B. A dynamic device group is used to target devices for deployment but does not control installation order or dependencies.
• C. A detection rule is used to verify whether an app is installed but does not establish installation sequencing or dependencies.

Correct answer: B. .ipa

iOS apps in Intune use the .ipa (iOS App Package) file format. This is the standard package extension for iOS applications that can be deployed through Intune to enrolled iOS devices.

Why the other options are wrong

• A. .intunemac is used for macOS app packages, not iOS.
• C. .apk is the Android package format, not used for iOS devices.
• D. .appx is the Windows app package format, not applicable to iOS.

Correct answer: E. Client apps

To block only legacy authentication requests while allowing modern authentication, you must add a Client apps condition to the Conditional Access policy. The Client apps condition allows you to specify whether the policy applies to legacy authentication clients or modern authentication clients, enabling granular control over authentication protocols.

Why the other options are wrong

• A. Filter for devices filters based on device properties but does not distinguish between legacy and modern authentication protocols.
• B. Device platforms condition targets operating systems but does not differentiate authentication methods.
• C. User risk is based on user behavior analysis and compromised credentials, not authentication protocol type.
• D. Sign-in risk evaluates the risk of a specific sign-in event, not the authentication method being used.

Correct answer: D. From the Microsoft Intune admin center, add an app.

To deploy Microsoft 365 Apps for enterprise to Windows 10 MDM-enrolled devices, you add an app from the Microsoft Intune admin center. This is the standard method for deploying Microsoft 365 Apps and other applications to Intune-managed devices.

Why the other options are wrong

• A. A device profile is used for configuration settings, not for deploying applications.
• B. An app registration in Azure AD is for authentication and API access, not for application deployment.
• C. An enterprise application in Azure AD is for SSO and access management, not for deploying software to devices.

Correct answer: B. a Retire action

A Retire action removes a device from Intune management and removes only Intune-provisioned apps and data. When the device checks in again, Intune-managed apps and corporate data are removed, but user-installed apps, personal data, and OEM-installed apps are retained, which matches the requirement exactly.

Why the other options are wrong

• A. A Delete action removes the device record but does not clean up provisioned apps and data when the device reconnects.
• C. Fresh Start removes all user-installed apps and personal data, which violates the requirement to retain user-installed apps.
• D. Autopilot Reset is designed for device redeployment and removes all user data and apps, not just Intune-provisioned items.

Correct answer: D. Endpoint analytics

Endpoint analytics is the Microsoft Intune feature specifically designed to measure and report on device startup times and restart frequencies. It provides insights into device performance and user experience metrics.

Why the other options are wrong

• A. Azure Monitor is a general-purpose monitoring service but is not the dedicated Intune solution for device startup and restart metrics.
• B. Intune Data Warehouse is used for reporting on device management data but does not specifically focus on startup times and restart frequencies.
• C. Microsoft Defender for Endpoint provides security-focused monitoring and threat detection, not device performance metrics like startup times.

Correct answer: D. Device experience

In Intune's device restrictions profile for Android Enterprise devices, kiosk mode settings are configured under Device experience. This section allows you to specify single-app kiosk mode to lock devices to run only one designated application.

Why the other options are wrong

• A. Users and Accounts settings control user management and account policies, not kiosk mode.
• B. General settings cover basic device configuration but not kiosk-specific features.
• C. System security settings focus on security policies and restrictions, not dedicated kiosk mode functionality.

Correct answer: C. Install Defender for Endpoint on the macOS devices.

To apply Microsoft Defender for Endpoint antivirus policies to macOS devices in Intune, you must first install Defender for Endpoint on those devices. Once installed, Intune can then manage and apply antivirus policies to the devices through Intune management interfaces.

Why the other options are wrong

• A. Onboarding to the Microsoft Purview compliance portal does not enable Defender for Endpoint antivirus policy management.
• B. Creating a security baseline applies general security configurations but does not install or enable Defender for Endpoint specifically.
• D. Creating a configuration profile alone cannot apply Defender for Endpoint policies; the software must be installed first for Intune to manage it.

Correct answer: C, E. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings; To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings.

For Azure AD joined devices managed by Intune, the best practice to minimize administrative effort is to use device configuration profiles rather than GPOs. Option C is correct for configuring Microsoft Defender Antivirus through a device configuration profile's Endpoint protection settings. Option E is correct for configuring Microsoft Defender Firewall through a device configuration profile's Endpoint protection settings. Using Intune profiles ensures cloud-based management without requiring on-premises GPO infrastructure, which minimizes administrative effort for cloud-native Azure AD joined devices.

Why the other options are wrong

• A. GPOs require on-premises infrastructure and are not optimal for Azure AD joined devices managed by Intune.
• B. Device restrictions settings do not contain firewall configuration options; Endpoint protection settings are required.
• D. Device restrictions settings do not contain antivirus configuration options; Endpoint protection settings are required.
• F. GPOs are not the optimal solution for Intune-managed devices; Intune profiles minimize administrative effort.

Correct answer: D. Applicability Rules

Applicability Rules allow you to create conditional logic that filters which devices within an assigned group actually receive a profile. By using Applicability Rules, you can specify that Profile1 applies only to Device1 based on device properties like device name, model, or OS version. This is the correct feature for device-level filtering within a group assignment, whereas Assignments determine which groups/users receive the profile, Settings are the policy content, and Scope Tags control administrative access.

Why the other options are wrong

• A. Assignments control which groups receive the profile, not which individual devices within a group.
• B. Settings are the configuration options within the profile itself, not filtering mechanisms.
• C. Scope Tags control administrative permissions and access, not device applicability.

Correct answer: C. an update policy for iOS/iPadOS

An update policy for iOS/iPadOS is the correct mechanism to defer iOS updates for a specified number of days. This policy allows you to set deferral periods (such as 30 days) for software updates on enrolled iOS devices. App provisioning profiles are for app distribution; device features and device restrictions templates are for general device configuration but not specifically for update deferral timing.

Why the other options are wrong

• A. iOS app provisioning profiles are used for app deployment and code signing, not for deferring system updates.
• B. Device features templates configure specific device capabilities but do not provide update deferral controls.
• D. Device restrictions templates control various device settings but are not the appropriate mechanism for deferring OS updates with specific timelines.

Correct answer: D. Microsoft Power BI

Microsoft Power BI is the tool used to create custom reports and visualizations using data from Intune Data Warehouse. Power BI connects to the data warehouse and allows creation of comprehensive device inventory reports. The Company Portal app is for end users, Endpoint Analytics provides built-in reports but is separate from Data Warehouse reporting, and the Azure portal is for management but not for creating Data Warehouse reports.

Why the other options are wrong

• A. The Company Portal app is for end users to access corporate resources, not for creating reports.
• B. Endpoint Analytics provides built-in reports but is not the tool for creating custom Data Warehouse reports.
• C. The Azure portal is for management but does not provide Data Warehouse report creation capabilities.

Correct answer: D. a Monitored Object

In Azure Monitor, a Data Collection Rule (DCR) must be associated with a Monitored Object, which can be a virtual machine, scale set, or other resource that needs monitoring. The DCR defines what data to collect and where to send it, and it operates at the resource level. A Log Analytics workspace is a destination for data, not what the DCR is associated with; Azure Network Watcher is a different monitoring service; and Device1 alone is not sufficient, it must be properly registered as a monitored object.

Why the other options are wrong

• A. Azure Network Watcher is a separate monitoring service for network diagnostics, not the target for DCR associations.
• B. Device1 itself is not the association point; the device must be associated as a Monitored Object within Azure Monitor.
• C. A Log Analytics workspace is the destination for collected data, not what the DCR is associated with.

Correct answer: A. Endpoint analytics

Endpoint analytics is the Intune feature designed to provide visibility into device startup processes and restart frequency. It delivers proactive insights into device performance and health, including detailed startup performance data and device restart patterns. Device Management (B) is a general tool for managing enrolled devices but lacks specific analytics capabilities. Azure Monitor (C) is a broader monitoring solution not specifically configured for Intune endpoint analytics. Intune Data Warehouse (D) provides raw data exports but requires custom queries and is not the primary tool for monitoring startup and restart metrics.

Why the other options are wrong

• B. Device Management provides enrollment and management functions, not startup and restart analytics.
• C. Azure Monitor is broader infrastructure monitoring, not Intune-specific endpoint analytics.
• D. Data Warehouse provides raw data requiring custom analysis, not pre-built startup and restart insights.

Correct answer: A. an enrollment status page (ESP)

To configure Out-of-box experience (OOBE) settings for Windows Autopilot, you create an Enrollment Status Page (ESP) in the Microsoft Intune admin center. The ESP controls what users see during device provisioning, including which apps and policies are installed before the user reaches the desktop, customizing the OOBE experience. A deployment profile (B) is for Autopilot device assignment but doesn't configure OOBE settings. Compliance policies (C) enforce device compliance post-enrollment. PowerShell scripts (D) are for executing tasks but aren't the primary OOBE configuration mechanism. Configuration profiles (E) apply settings after enrollment, not OOBE specifically.

Why the other options are wrong

• B. A deployment profile assigns Autopilot devices and applies settings but is not the OOBE configuration mechanism.
• C. Compliance policies enforce rules after enrollment, not OOBE settings.
• D. PowerShell scripts can run during provisioning but are not the primary OOBE configuration tool.
• E. Configuration profiles apply post-enrollment settings, not OOBE experience settings.

Correct answer: A. the Compliance policy settings

Enhanced jailbreak detection is a tenant-wide setting found under Devices, Compliance policies, Compliance policy settings. Turning it on makes enrolled iOS devices evaluate jailbreak status more often and with location services, supplementing the jailbroken check in the compliance policy.

Why the other options are wrong

• B. The individual compliance policy contains the jailbroken device check but not the Enhanced jailbreak detection toggle.
• C. Network locations are used by Conditional Access and have nothing to do with jailbreak detection.
• D. Configuration profiles apply device settings and do not contain the Enhanced jailbreak detection option.

Correct answer: C. sysprep

Sysprep removes system-specific information (SID, computer name, drivers) and generalizes the Windows installation, making the captured image deployable to multiple computers. Dism is a servicing tool but doesn't generalize the system, wpeinit initializes Windows PE, and bcdedit modifies boot configuration but doesn't prepare an image for multicomputer deployment.

Why the other options are wrong

• A. Dism is used for image servicing and modification, not for preparing a system for image capture.
• B. Wpeinit initializes the Windows PE environment during boot, not for image preparation.
• D. Bcdedit modifies boot configuration data, not for system generalization before capture.

Correct answer: A. Configure an Apply MDM push certificate.

Before enrolling iPads using Apple Configurator, you must first configure an Apple MDM push certificate in Intune. This certificate is required for Intune to communicate with Apple's servers and manage the enrolled devices. Without the MDM push certificate, the enrollment process cannot proceed. Device enrollment manager roles, enrollment restrictions, and device identifiers are configured after the certificate is in place.

Why the other options are wrong

• B. Adding a DEM is helpful but not required first; the MDM push certificate is the prerequisite.
• C. Modifying enrollment restrictions is secondary to establishing the MDM push certificate.
• D. Uploading device identifiers is done as part of the Apple Configurator setup, but the MDM certificate must be configured first.

Correct answer: D. From Computer1, configure the Remote Desktop Connection settings.

From Computer1, you must configure the Remote Desktop Connection settings to enable local drive redirection. The Remote Desktop Connection client on the connecting computer is where you specify which local drives should be available within the Remote Desktop session.

Why the other options are wrong

• A. Configuring Remote Desktop settings on Computer2 does not control which local drives are shared to the session.
• B. Firewall settings on Computer1 do not control local drive access within Remote Desktop sessions.
• C. File and Printer Sharing firewall rules on Computer2 do not affect local drive redirection in Remote Desktop.

Correct answer: D. an app configuration policy

An app configuration policy is the correct tool for delivering bookmarks and other app-specific settings to managed applications like Chrome on Android Enterprise devices. This policy allows administrators to configure managed app settings without modifying the app itself. Compliance policies verify device compliance status, configuration profiles handle device-level settings rather than app-specific settings, and app protection policies enforce security restrictions rather than delivering configuration data.

Why the other options are wrong

• A. Compliance policies assess whether devices meet security standards but do not configure application settings.
• B. Device configuration profiles manage device-level settings, not application-specific configurations like Chrome bookmarks.
• C. App protection policies enforce security restrictions and data protection but do not configure app-specific features like bookmarks.

Correct answer: B. an account protection policy

Account protection policies in Microsoft Intune are specifically designed to manage local group memberships and security settings on Windows devices. This policy type allows administrators to remove users from local administrator groups across enrolled devices. Device compliance policies verify device state but don't enforce configuration changes, and app configuration policies manage app-specific settings only.

Why the other options are wrong

• A. Device compliance policies are for verifying device compliance status, not for configuring local group membership changes.
• C. App configuration policies manage application settings and behavior, not local administrative group membership on devices.

Correct answer: D. the Microsoft 365 Apps admin center

The Microsoft 365 Apps admin center is the correct location to create customization files for the Office Deployment Tool (ODT). This portal provides the Office Customization Tool interface where administrators can configure XML-based customization files that define installation options, language packs, and other deployment preferences for Office Professional Plus. The Microsoft 365 admin center manages tenant-wide settings, the Intune admin center manages device deployment, and the Purview compliance portal handles governance and compliance.

Why the other options are wrong

• A. The Microsoft 365 admin center manages organizational settings and subscriptions but not Office deployment customization.
• B. The Intune admin center deploys applications to devices but is not the tool for creating ODT customization files.
• C. The Purview compliance portal handles data governance and compliance but not Office deployment configuration.

Correct answer: B. Information URL

When a Microsoft Store app is added in Intune admin center, the Information URL is visible in the Company Portal app. This URL provides users with additional information about the application. Privacy URL (A) is configured but typically not displayed as a primary information type in Company Portal. Developer (C) and Owner (D) are not standard visible app information fields in Company Portal for Microsoft Store apps.

Why the other options are wrong

• A. Privacy URL is configured but not typically displayed as a primary visible information type in Company Portal.
• C. Developer information is not a standard visible field for Microsoft Store apps in Company Portal.
• D. Owner information is not displayed in the Company Portal app information.

Correct answer: A. a configuration profile

A configuration profile is the correct Intune tool to configure Delivery Optimization settings on enrolled devices. Configuration profiles allow you to set Delivery Optimization to download from internet and local network peers, and to limit bandwidth usage to 50%. While Group Policy settings can configure Delivery Optimization on hybrid Azure AD joined devices, using Intune configuration profiles is the modern, cloud-based approach that works across all enrolled devices. Windows Update for Business and Peer-to-Peer Networking Services Group Policies are legacy on-premises methods.

Why the other options are wrong

• B. Windows Update for Business Group Policy is a legacy on-premises approach, not optimal for Intune-managed devices.
• C. Microsoft Peer-to-Peer Networking Services Group Policy is an on-premises legacy method, not the Intune approach.
• D. Update rings configure Windows Update settings, not Delivery Optimization bandwidth and source preferences.

Correct answer: D. Subscription Activation

Subscription Activation allows Windows 10 Pro devices with Microsoft 365 E5 licenses to upgrade to Windows 11 Enterprise through a simple licensing change, minimizing administrative effort. This is the most straightforward approach compared to MDT or ConfigMgr imaging, and Autopilot is designed for new device deployments rather than in-place upgrades.

Why the other options are wrong

• A. MDT requires more administrative effort and custom image creation for an in-place upgrade scenario.
• B. Configuration Manager also requires more administrative effort and custom imaging than subscription-based activation.
• C. Windows Autopilot is designed for new device provisioning, not in-place upgrades of existing devices.

Correct answer: A. Azure AD registered

Azure AD Registered is the correct method for personal BYOD (Bring Your Own Device) scenarios. It allows users to sign in with their personal accounts while enabling Intune management of company data through conditional access and mobile application management. Azure AD Joined is for corporate-owned devices requiring organizational account sign-in. Hybrid Azure AD Join is for on-premises Active Directory scenarios, not personal cloud-only devices.

Why the other options are wrong

• B. Hybrid Azure AD join requires on-premises Active Directory integration, inappropriate for personal devices.
• C. Azure AD joined devices typically require corporate account sign-in, conflicting with the personal account requirement.

Correct answer: D. Unattend.xml

Unattend.xml is the Windows answer file that controls Windows Setup behavior, including post-installation script execution. You can specify scripts to run after feature updates through the Unattend.xml file using RunSynchronous or RunAsynchronous settings. LiteTouch.wsf is for MDT lite touch installations; SetupConfig.ini is for Windows Setup configuration but doesn't handle post-update scripts; Unattend.bat is not a standard Windows file for this purpose.

Why the other options are wrong

• A. LiteTouch.wsf is an MDT deployment script, not the mechanism for running scripts after Windows feature updates.
• B. SetupConfig.ini is used to configure Windows Setup behavior but is not the primary file for post-update script execution.
• C. Unattend.bat is not a standard Windows configuration file for scheduling post-update script execution.

Correct answer: A. Preinstall

The Preinstall phase is where disk partitioning, formatting, and preparation tasks occur. This is where you configure UEFI support and create recovery partitions before Windows 11 is installed. The PostInstall phase occurs after the OS installation, the Install phase is when Windows is being installed, and Initialization is the first phase for basic setup, not disk configuration.

Why the other options are wrong

• B. PostInstall occurs after Windows installation is complete, too late for disk formatting.
• C. The Install phase is for Windows OS installation, not disk preparation.
• D. Initialization is the setup phase, not where disk formatting and partitioning occur.

Correct answer: D. Microsoft Deployment Toolkit (MDT)

Microsoft Deployment Toolkit (MDT) is the appropriate recommendation for an organization without existing deployment infrastructure. MDT provides a free, comprehensive deployment solution for Windows upgrades that minimizes licensing costs. Windows Autopilot requires cloud infrastructure and is designed for new device provisioning; Configuration Manager requires significant infrastructure investment; and subscription activation is not a deployment method.

Why the other options are wrong

• A. Windows Autopilot is designed for new device provisioning and cloud-based scenarios, not for upgrading existing on-premises devices without deployment infrastructure.
• B. Configuration Manager requires substantial infrastructure setup and investment, making it not the minimal-cost solution.
• C. Subscription activation is a licensing method, not a deployment infrastructure or upgrade strategy.

Correct answer: B, D, E. a custom Windows image; Windows Autopilot; provisioning packages

To meet all requirements (install Windows 11 Enterprise, install MSI app, add certificate, join Azure AD), you need options that support these capabilities. A custom Windows image (B) can include Windows 11 Enterprise, App1, and Certificate1 before deployment. Windows Autopilot (D) can deploy Windows 11 Enterprise and execute scripts to install apps and certificates via Intune policies during enrollment. Provisioning packages (E) can contain Windows 11 Enterprise, app installations, certificates, and Azure AD join settings in an PPKG file. Subscription activation (A) only upgrades licensing, not the OS or applications. In-place upgrade (C) would upgrade from Pro to Enterprise but cannot install MSI packages or certificates as part of the upgrade process.

Why the other options are wrong

• A. Subscription activation only changes the license edition, not the OS or application installation.
• C. In-place upgrade upgrades the OS edition but cannot install MSI packages or certificates as part of the upgrade.

Correct answer: D. Install the Azure Monitor Agent.

Installing the Azure Monitor Agent on Computer1 is required to enable data collection and transmission to the Log Analytics workspace. The agent collects events and performance data from the local computer and forwards it to Log Analytics for querying. Azure AD enrollment is not required for workgroup computers using the Monitor Agent, firewall configuration alone does not enable data collection, and event subscriptions are for local event forwarding not cloud integration.

Why the other options are wrong

• A. Azure AD join is not required for workgroup computers to use the Azure Monitor Agent with Log Analytics.
• B. Firewall configuration alone does not enable data collection and transmission to Log Analytics.
• C. Local event subscriptions do not automatically send data to Azure Log Analytics without the Monitor Agent.

Correct answer: D. the first Tuesday of the next month

When you select Uninstall for feature updates in an update ring, the uninstall action does not immediately occur. Instead, it will be processed according to the update ring's schedule settings. Since UpdateRing1 is configured with automatic behavior in the first week of the month on Tuesday at 3 AM, the uninstall will begin on the first Tuesday of the next month at 3 AM, following the established maintenance window.

Why the other options are wrong

• A. User approval is not required for uninstall actions triggered by update rings; they are automatic based on policy.
• B. The policy is received immediately, but the uninstall action is not executed until the scheduled maintenance window.
• C. The uninstall will not occur on just any Tuesday; it follows the first week of month schedule.

Correct answer: B. Perform a Windows Autopilot reset on the devices.

Windows Autopilot reset is the solution that minimizes administrative effort while removing all data and applications. It performs a clean reset of the devices, removing user data and applications while keeping the devices enrolled in Intune, allowing them to be quickly repurposed for new users with minimal manual intervention.

Why the other options are wrong

• A. A configuration profile does not remove existing data and applications.
• C. An in-place upgrade would not remove all previous user data and applications.
• D. Clean installation requires manual intervention on each of 100 devices, which does not minimize administrative effort.

Correct answer: A. Windows Autopilot

Windows Autopilot is the best solution because it upgrades Windows 10 Pro to Enterprise, joins devices to Azure AD, installs Microsoft Store apps, retains user applications, and requires minimal user intervention. Autopilot is specifically designed for this scenario of transforming retail-purchased devices into enterprise-managed devices while preserving user data and applications.

Why the other options are wrong

• B. MDT requires more user intervention and rebuilds the system, not preserving existing applications.
• C. Windows Configuration Designer provisioning packages cannot upgrade OS editions from Pro to Enterprise.
• D. WDS is a deployment infrastructure tool that requires more manual configuration and user intervention than Autopilot.

Correct answer: A. From the Deployment Shares node, update the deployment share.

After modifying WinPE settings in Deployment Workbench, you must update the deployment share from the Deployment Shares node. This process generates new WinPE boot image files that incorporate the changes you made, such as adding PowerShell support.

Why the other options are wrong

• B. Creating new media is done after updating the deployment share, not before or instead of it.
• C. Importing a new operating system package does not regenerate WinPE boot images.
• D. Importing a new operating system does not regenerate WinPE boot images with the updated settings.

Correct answer: D. the Settings app

To add a workgroup Windows 11 computer to an Azure AD tenant, you should use the Settings app. Navigate to System > About > Advanced system settings and use the 'Access work or school' option to join the device to Azure AD using the Azure AD join functionality.

Why the other options are wrong

• A. dsregcmd.exe is a diagnostic tool for checking device registration status, not for joining devices to Azure AD.
• B. Computer Management is for local machine administration and cannot join a computer to Azure AD.
• C. netdom.exe is for managing domain relationships in traditional Active Directory, not for Azure AD joining.

Correct answer: D. Apps, and then Monitor

Under Apps, then Monitor, the App protection status report lists users and devices that have app protection policies assigned, including devices that are not enrolled in Intune. That report can be exported and downloaded.

Why the other options are wrong

• A. Device compliance reports cover enrolled devices only, not unenrolled devices with app protection.
• B. Apps, then App protection policies is where policies are created and assigned, not where the status report is downloaded.
• C. Devices, then Monitor covers enrolled device reports and does not report unenrolled app protection devices.

Correct answer: A. Yes

Configuring automatic MDM enrollment in Azure AD and then setting Windows Hello for Business enrollment options in Intune allows you to enforce PIN requirements during device join. Through Intune's Windows Hello for Business policies, you can specify that a six-digit PIN is required during enrollment, which will prompt users to set up the longer PIN when joining devices to contoso.com.

Why the other options are wrong

• B. This solution does address the correct configuration methods needed to enforce PIN requirements during Azure AD join.

Correct answer: A. Microsoft Defender Exploit Guard

Controlled folder access lets only a list of trusted apps write to protected folders such as D:\Folder1. It is part of Microsoft Defender Exploit Guard and is configured in the endpoint protection settings of a device configuration profile.

Why the other options are wrong

• B. Application Guard isolates untrusted websites or Office files in a container and does not control folder write access.
• C. SmartScreen warns about malicious sites and downloads and does not restrict which apps write to folders.
• D. Application Control decides which apps may run at all, not which apps may write to a particular folder.

Correct answer: B. From the Microsoft Intune admin center, create a custom device profile.

To make Intune policy win over Group Policy you set the ControlPolicyConflict/MDMWinsOverGP setting from the Policy CSP. This is delivered with a custom device profile using an OMA-URI. Once applied, MDM settings take precedence over the equivalent Group Policy settings.

Why the other options are wrong

• A. Changing the Default Domain Policy only alters Group Policy settings and does not make Intune settings take precedence.
• C. An Administrative Templates profile deploys ADMX-backed settings but does not by itself change the precedence between MDM and Group Policy.
• D. Editing User Configuration in the Default Domain Policy still leaves Group Policy winning over Intune.

Correct answer: D. an Intune data collection policy

Startup performance is reported through Endpoint analytics in the Intune admin center. To capture it, you enable data collection for Windows devices with an Intune data collection policy, which sends the boot and sign-in performance data needed for the reports.

Why the other options are wrong

• A. The Azure Monitor agent collects data from Azure and Arc-enabled resources, not Endpoint analytics startup data for Intune.
• B. A device compliance policy evaluates device settings and does not collect startup performance data.
• C. A Conditional Access policy controls access to resources and does not gather performance telemetry.

Correct answer: B. No

Modifying only User settings and Device settings in the Microsoft Entra admin center is insufficient to enforce a six-digit PIN requirement. PIN policy configuration for Azure AD joined devices requires configuring device restriction policies through Microsoft Intune, specifically the Windows Hello PIN settings, not just general user and device settings.

Correct answer: E. Windows 10, Android, and iOS

Microsoft Intune supports VPN profile creation for Windows 10, Android, and iOS devices. VPN profiles can be configured and deployed across all three platforms through the Intune admin center, allowing organizations to enforce VPN connectivity policies across diverse device types.

Why the other options are wrong

• A. VPN profiles are supported on multiple platforms, not Windows 10 alone.
• B. VPN profiles are also supported on iOS, not just Windows 10 and Android.
• C. VPN profiles are also supported on Android, not just Windows 10 and iOS.
• D. VPN profiles are also supported on Windows 10, not just Android and iOS.

Correct answer: A, D, E. failure events from the Security log; error events from the System log; third-party application logs stored as text files

Log Analytics can collect various types of data from Windows computers. It can collect failure events from the Security log (A), error events from the System log (D), and third-party application logs stored as text files (E). These are all standard log types that the Log Analytics agent can ingest and forward to the workspace. Process execution times (B) and average processor utilization (C) require specific agents or performance counters and are not basic log collection capabilities.

Why the other options are wrong

• B. Process execution times require the dependency agent or performance monitoring, not basic Log Analytics log collection.
• C. Average processor utilization requires performance counter collection through a specific configuration, not basic log analytics.

Correct answer: C. Security Administrator

Security Administrator is the role that provides the least privilege while granting the ability to manage both security defaults and create Conditional Access policies. This role has permissions to configure security-related policies without the extensive permissions of a Global Administrator, adhering to the principle of least privilege.

Why the other options are wrong

• A. Global Administrator has excessive permissions beyond what is needed.
• B. Conditional Access Administrator can only create Conditional Access policies, not manage security defaults.
• D. Intune Administrator focuses on device management, not security policy configuration.

Correct answer: C. Preinstall

The Preinstall phase of the task sequence includes disk partitioning and formatting steps. This is where you would modify the task sequence to configure disk partitions, creating both a system volume and a data volume before the operating system is installed.

Why the other options are wrong

• A. The Initialization phase prepares the environment but does not handle disk partitioning.
• B. The State Restore phase is for restoring user data and settings after OS installation.
• D. The Postinstall phase occurs after OS installation and is not the appropriate place for disk partitioning.

Correct answer: D. Link your managed Google Play account to Intune.

Before deploying apps to Android Enterprise devices, you must link your managed Google Play account to Intune. This integration enables Intune to manage Android Enterprise devices and access approved apps from Google Play. Without this linkage, Intune cannot deploy or manage Android Enterprise apps. Creating a configuration profile (A) applies settings after the enterprise setup is complete. Adding a certificate connector (B) is for certificate deployment, not Android Enterprise enablement. Configuring Partner device management settings (C) relates to device management partnerships, not Android Enterprise setup.

Why the other options are wrong

• A. Configuration profiles apply settings after Android Enterprise is set up, not a prerequisite.
• B. Certificate connectors are for deploying certificates, not enabling Android Enterprise.
• C. Partner device management settings are unrelated to Android Enterprise deployment preparation.

Correct answer: B. 10

Windows 10 allows a 10-day rollback window to remove a feature update after installation. After 10 days, the previous Windows installation is deleted and rollback becomes impossible. This timeframe provides administrators and users sufficient time to identify compatibility issues and revert if necessary. Five days is insufficient, 14 days and 30 days exceed the actual rollback window.

Why the other options are wrong

• A. 5 days is insufficient for the Windows 10 rollback window.
• C. 14 days exceeds the actual 10-day rollback period for feature updates.
• D. 30 days exceeds the actual 10-day rollback period for feature updates.

Correct answer: B. Create a selection profile.

To configure the Inject Drivers task to use PnP detection for specific hardware models, you must first create a selection profile. The selection profile filters which drivers are injected based on hardware characteristics detected via Plug and Play, allowing the task sequence to target specific hardware models.

Why the other options are wrong

• A. Importing an OS package is necessary before the task sequence but not specifically required before configuring PnP driver injection.
• C. A Gather task collects system information but is not required before configuring the Inject Drivers task.
• D. A Validate task verifies deployment conditions but is not required before configuring the Inject Drivers task.

Correct answer: B. No

A device restrictions profile does not control the Windows Hello for Business PIN length that users set up when joining devices. The PIN requirements used at join are set through the Windows Hello for Business settings under Intune device enrollment. This solution therefore does not produce a six-digit PIN.

Why the other options are wrong

• A. Device restrictions profiles contain no setting for the Windows Hello for Business PIN length used during Azure AD join, so the goal is not met.

Correct answer: B. Enable-PSRemoting

The Enable-PSRemoting cmdlet performs all the required configurations in a single operation: it enables the WinRM service with Automatic startup type, creates a listener accepting requests from any IP address, and enables firewall exceptions for WS-Management communications.

Why the other options are wrong

• A. Connect-WSMan is used to connect to existing WinRM services, not to enable and configure them.
• C. Invoke-WSManAction is used to invoke operations on remote WinRM services, not to configure them locally.
• D. Enable-PSSessionConfiguration enables specific session configurations but does not set up WinRM service or firewall rules.

Correct answer: A. 2

Windows 10/11 Enterprise E3 per-user subscription activation lets a licensed user activate Windows Enterprise on up to five devices. User1 has already activated three devices, so two more can be activated.

Why the other options are wrong

• B. Three is the number of devices already activated, not the number remaining.
• C. Seven assumes a ten-device limit, but the per-user limit is five devices.
• D. Eight does not match the five-device limit for Windows Enterprise subscription activation.

Correct answer: B. Enable Network Level Authentication (NLA)

Network Level Authentication (NLA) ensures that the device connecting via Remote Desktop is authenticated before the Remote Desktop session is fully established and the sign-in page appears. NLA performs user authentication at the network level before establishing the remote session, providing an additional security layer.

Why the other options are wrong

• A. Reputation-based protection is not a Remote Desktop security feature.
• C. Network Discovery is used for finding devices on the network, not for Remote Desktop authentication.
• D. The Remote Desktop Configuration service manages Remote Desktop settings but does not specifically authenticate devices before the sign-in page appears.

Correct answer: A. Connect from anywhere

In the Remote Desktop Connection client, RD Gateway settings are configured on the Advanced tab under Connect from anywhere. Selecting Settings there lets you enter the gateway server name and logon method.

Why the other options are wrong

• B. Server authentication controls certificate verification of the remote computer, not the gateway.
• C. Connection settings on the Experience or General tabs do not hold the RD Gateway configuration.
• D. Local devices and resources controls redirection of printers, drives and clipboard, not gateway routing.

Correct answer: A. a provisioning package

A provisioning package is the correct tool for connecting workgroup devices to corporate networks and enrolling them in Intune. Provisioning packages can configure Wi-Fi settings and trigger MDM enrollment without requiring domain membership or GPO infrastructure. This is ideal for workgroup devices that need both network connectivity and Intune enrollment.

Why the other options are wrong

• B. GPO requires Active Directory domain membership, which workgroup devices do not have.
• C. MDM automatic enrollment relies on existing network connectivity and Azure AD join, not ideal for initial onboarding of workgroup devices.
• D. Device configuration policy manages settings for already-enrolled devices, not initial enrollment or network connectivity for unenrolled devices.

Correct answer: A. On Computer2, run the Enable-PSRemoting cmdlet.

Before using Invoke-Command to execute commands on a remote computer, you must first enable PowerShell remoting on the target computer (Computer2) using Enable-PSRemoting. This cmdlet configures the WinRM service, creates listeners, and sets up the necessary firewall rules to allow remote PowerShell connections.

Why the other options are wrong

• B. Adding Computer1 to Remote Management Users is not the first step; remoting must be enabled first.
• C. Trusted for Delegation is not necessary for basic PowerShell remoting between computers in the same domain.
• D. New-PSSession cannot be run on Computer1 until remoting is already enabled on Computer2.

Correct answer: A. a device configuration profile

To make Intune settings override Group Policy, you deploy the ControlPolicyConflict/MDMWinsOverGP setting from the Policy CSP. This is delivered in a device configuration profile, such as a custom OMA-URI or settings catalog profile.

Why the other options are wrong

• B. A device compliance policy only evaluates device state and cannot change policy precedence.
• C. A security baseline applies a set of recommended settings but does not make Intune win over Group Policy.
• D. A GPO configures Group Policy settings and cannot make Intune settings take precedence.

Correct answer: C. Subscription Activation

Subscription Activation allows Windows 10 Pro devices to upgrade to Windows 10 Enterprise by simply signing in with a Microsoft 365 E5 account, with no deployment required. This minimizes administrative effort as it requires no reimaging, MDT deployment, or Autopilot setup, just user authentication. Windows Autopilot requires device registration, MDT requires deployment infrastructure, and in-place upgrades require manual media distribution and installation.

Why the other options are wrong

• A. Windows Autopilot requires device pre-registration and setup processes, adding administrative complexity.
• B. MDT lite-touch deployment requires infrastructure setup and manual task sequence execution.
• D. In-place upgrades require distributing and running installation media on each device.

Correct answer: C. Custom

The Custom profile type template is specifically designed for configuring OMA-URI settings in Microsoft Intune. Custom profiles allow administrators to input specific OMA-URI paths and values to configure device settings that may not have dedicated UI controls in standard profile templates.

Why the other options are wrong

• A. Device restrictions for Windows 10 Team is a predefined template for specific device restrictions, not for custom OMA-URI configuration.
• B. Identity protection is a specific security profile type focused on identity and credential protection, not OMA-URI settings.
• D. Device restrictions is a template for standard device restriction settings, not for custom OMA-URI configuration.

Correct answer: A. Yes

Configuring Authentication methods in the Microsoft Entra admin center does meet the goal. This is where you can set the PIN length requirements for Windows Hello for Business and other authentication policies. You can adjust the PIN complexity settings, including changing from a four-digit PIN to a six-digit PIN requirement for Azure AD joined devices.

Correct answer: A, B, F. Deploy the Remote Help app to Device1; Assign the Help Desk Operator role to User1; Assign the Remote Help add-on license to User1.

Remote Help requires the Remote Help app on the device, a Remote Help license (included with the Intune Suite add-on) assigned to the helper, and an Intune RBAC role with Remote Help permissions. The built-in Help Desk Operator role includes the Remote Help app permissions needed to start a session from the Intune admin center.

Why the other options are wrong

• C. The Intune Administrator role would work but grants far more access than needed, so Help Desk Operator is the appropriate role.
• D. A Microsoft 365 E5 license does not include Remote Help, so assigning it does not enable the feature.
• E. Device1 is already enrolled in Intune, so rerunning onboarding is not required.

Correct answer: B. Connectors and tokens

To establish a service-to-service connection between Microsoft Intune and Microsoft Defender for Endpoint, you must configure Connectors and tokens in the Microsoft Intune admin center. This setting enables the integration between the two services, allowing data sharing and unified management capabilities.

Why the other options are wrong

• A. Premium add-ons manage subscription features but do not establish the service-to-service connection.
• C. Tenant enrollment settings manage device enrollment, not service-to-service connections.
• D. Microsoft Tunnel Gateway is for VPN connectivity, not for integrating Intune with Defender for Endpoint.

Correct answer: D. Remote Management Users

The Remote Management Users group is the correct group for granting PowerShell remoting access with least privilege. This group is specifically designed for Windows PowerShell remoting and provides the minimum necessary permissions without granting additional administrative capabilities that other groups would provide.

Why the other options are wrong

• A. Access Control Assistance Operators is used for managing Group Policy and other administrative tasks, not PowerShell remoting.
• B. Remote Desktop Users is for RDP connections, not PowerShell remoting.
• C. Power Users provides broader administrative privileges than necessary, violating the principle of least privilege.

Correct answer: B. Enable-PSRemoting –SkipNetworkProfileCheck

Enable-PSRemoting with the –SkipNetworkProfileCheck parameter is the correct command for a workgroup computer on a public network. The SkipNetworkProfileCheck flag allows remoting to be enabled on public networks and restricts access appropriately. Set-PSSessionConfiguration with Local mode restricts to local only, not subnet. Enable-PSRemoting without parameters won't work on public networks. Set-NetFirewallRule with RemoteAddress Any opens to all addresses, defeating the subnet-only requirement.

Why the other options are wrong

• A. Set-PSSessionConfiguration with Local mode restricts access to local sessions only, not to the local subnet as required.
• C. Enable-PSRemoting without SkipNetworkProfileCheck will fail on public networks and doesn't restrict to local subnet.
• D. Setting RemoteAddress to Any explicitly allows connections from anywhere, violating the local subnet-only requirement.

Correct answer: A, C. a device restrictions device configuration profile; a Windows 10 and later security baseline

Both a device restrictions device configuration profile (Option A) and a Windows 10 and later security baseline (Option C) can prevent Windows Insider Program enrollment. Device restrictions profiles can disable the Insider Program setting directly, and security baselines include pre-configured security settings that prevent participation in the Insider Program. App configuration policies manage app settings not OS features, custom profiles are less efficient than built-in options, and update rings manage feature/quality updates rather than Insider enrollment.

Why the other options are wrong

• B. App configuration policies apply to managed applications, not operating system features like the Insider Program.
• D. Custom device configuration profiles are less efficient and maintainable than using built-in device restrictions or security baselines.
• E. Windows 10 update rings manage the scheduling of updates but not enrollment in the Windows Insider Program.

Correct answer: B. Microsoft Secure Score

Microsoft Secure Score is the tool that assesses your security posture and compares your configuration against Microsoft-recommended security baselines. It provides recommendations, benchmarks, and comparisons of your current Microsoft Defender for Endpoint configuration against industry standards and Microsoft best practices.

Why the other options are wrong

• A. The Power BI app provides analytics and dashboards but is not designed for baseline configuration comparison.
• C. Endpoint Analytics focuses on device performance and health, not security configuration baseline assessment.
• D. The Microsoft 365 Defender portal provides threat detection and incident investigation but is not the primary tool for baseline comparison.

Correct answer: A. From the Microsoft Entra admin center, review the Conditional Access Insights and Reporting workbook.

The Conditional Access Insights and Reporting workbook in the Microsoft Entra admin center specifically tracks conditional access policy activities, including blocked access attempts. This is the correct location to identify which noncompliant devices attempted to access OneDrive for Business and were blocked by Policy1.

Why the other options are wrong

• B. Device compliance report shows overall device compliance status but does not track specific access attempts to applications.
• C. Noncompliant devices report lists noncompliant devices but does not correlate them with specific conditional access policy blocks or OneDrive access attempts.
• D. Setting compliance report shows compliance with specific settings configurations, not conditional access policy enforcement or application access attempts.

Correct answer: A, E. Create a device configuration profile; Enroll the devices in Microsoft Intune by using Apple Business Manager.

To deploy a specific iOS update to unmanaged iPad devices and prevent manual installation of newer versions, you must first enroll the devices in Microsoft Intune using Apple Business Manager (E), which provides Mobile Device Management (MDM) capabilities for iOS devices. Then, you create a device configuration profile (A) to specify the iOS version to deploy and enforce it, preventing users from manually updating to newer versions. Apple Business Manager enrollment is required for managing unmanaged devices, and the configuration profile enforces the update policy.

Why the other options are wrong

• B. Intune Company Portal is for user-initiated enrollment and does not provide the same level of control over unmanaged devices as Apple Business Manager.
• C. Compliance policy validates device settings but does not deploy OS updates or prevent manual installation.
• D. iOS app provisioning profiles are for app deployment, not OS update management.

Correct answer: B. Standard Client Replace Task Sequence

The Standard Client Replace Task Sequence template is designed specifically for replacing computers. It backs up user state from old devices and restores it on new devices, meeting both requirements of backing up user state and minimizing administrative effort through an automated process.

Why the other options are wrong

• A. Standard Client Task Sequence is for new deployments without user state backup/restore.
• C. Litetouch OEM Task Sequence is for OEM deployments, not device replacement scenarios.
• D. Sysprep and Capture is for creating reference images, not for device replacement operations.

Correct answer: B. Run the Enable-PSRemoting cmdlet.

Running Enable-PSRemoting on Computer2 configures PowerShell Remoting and WinRM, which is the underlying protocol Windows Admin Center uses to communicate with remote computers. This cmdlet enables the WinRM service, creates firewall rules, and sets up the necessary listeners. While updating TrustedHosts or adding firewall rules might seem relevant, Enable-PSRemoting is the single comprehensive command that sets up all necessary requirements for remote management.

Why the other options are wrong

• A. Updating TrustedHosts is a WinRM configuration but Enable-PSRemoting handles this automatically.
• C. Enable-PSRemoting creates the necessary firewall exceptions, making manual firewall configuration redundant.
• D. Enable-PSRemoting configures inbound firewall rules automatically, making manual rule addition unnecessary.

Correct answer: B. Onboard 10 devices to Endpoint analytics.

Onboarding devices to Endpoint Analytics should be done first to establish baseline metrics. A minimum number of devices (typically 10 or more for practical baselines) must be onboarded and reporting data before meaningful baseline comparisons can be created. Modifying thresholds requires baselines to exist first, Log Analytics workspace creation is typically done before onboarding but endpoint analytics can use its own workspace, and workbooks are created after data is available.

Why the other options are wrong

• A. The baseline regression threshold is modified after baseline data exists, not before creating initial baselines.
• C. While Log Analytics workspaces may be created, Endpoint Analytics can function without explicit workspace creation as a prerequisite.
• D. Azure Monitor workbooks are created and viewed after baseline data has been collected and analyzed.

Correct answer: C. an endpoint detection and response (EDR) policy

To onboard Windows 11 devices to Microsoft Defender for Endpoint in Intune, you should create an endpoint detection and response (EDR) policy. This policy specifically handles the onboarding configuration and agent deployment for Defender for Endpoint. ASR policies manage attack surface reduction rules, security baselines provide security configurations, account protection policies focus on identity protection, and antivirus policies manage antivirus settings, none of these are the primary onboarding mechanism for Defender for Endpoint.

Why the other options are wrong

• A. ASR policies manage attack surface reduction rules, not Defender for Endpoint onboarding.
• B. Security baselines provide general security configurations, not specific Defender for Endpoint onboarding.
• D. Account protection policies focus on identity and credential protection, not Defender for Endpoint onboarding.
• E. Antivirus policies configure antivirus settings, not Defender for Endpoint platform onboarding.

Correct answer: A. groups that have dynamic membership rules in Azure AD

To target Intune policies based on Android or iOS device versions, you should first configure dynamic membership groups in Azure AD. These groups can use dynamic rules to filter devices based on device properties, including operating system version, allowing you to create version-specific device groups that policies can then target.

Why the other options are wrong

• B. Device categories in Intune are user-assigned tags and are not dynamically based on OS version.
• C. Corporate device identifiers are used for enrollment tracking, not for policy targeting based on OS version.
• D. Device settings in Azure AD do not provide the filtering mechanism needed to group by OS version for policy targeting.

Correct answer: C. a device configuration profile

To configure Delivery Optimization for Windows 10 devices in Intune, you create a device configuration profile containing Delivery Optimization settings. This allows you to enable peer-to-peer caching and optimize update downloads across your managed devices. Device compliance policies (A) enforce compliance rules, not update delivery settings. Windows 10 update rings (B) manage update deployment scheduling and deferrals, not the underlying delivery mechanism. App protection policies (D) protect data in managed apps, not OS update delivery.

Why the other options are wrong

• A. Compliance policies enforce compliance requirements, not delivery optimization settings.
• B. Update rings manage deployment timing and deferrals, not the delivery optimization mechanism itself.
• D. App protection policies protect application data, not Windows update delivery.

Correct answer: C. an app protection policy

An app protection policy is the correct tool to prevent printing of corporate data from managed apps on iOS devices. App protection policies include data leak prevention controls such as restricting printing, copying, and saving of corporate data managed by Intune-protected applications.

Why the other options are wrong

• A. App configuration policy manages app settings and functionality, not data protection or printing restrictions.
• B. Security baseline provides OS-level security settings, not app-specific data protection controls like printing restrictions.
• D. iOS app provisioning profile is used for app deployment and signing, not for data protection or printing policy enforcement.

Correct answer: B. December 6

When a Windows update ring is paused, the pause lasts 35 days and then expires automatically. A pause started on November 1 therefore ends on December 6, when devices next attempt to update.

Why the other options are wrong

• A. December 1 is only 30 days after the pause, but the pause lasts 35 days.
• C. November 15 is well inside the 35-day pause period.
• D. November 22 is still inside the 35-day pause period.

Correct answer: D. Device settings in Azure AD

Device settings in Azure AD control whether users are added to the local Administrators group when they join their devices to Azure AD. Specifically, the 'Users may register their devices with Azure AD' and related device registration settings control this behavior. Windows Autopilot is for device provisioning, provisioning packages are for OS configuration, and Security defaults protect against identity-based attacks but don't control local admin group membership.

Why the other options are wrong

• A. Windows Autopilot is for automated device provisioning and setup, not for controlling local administrator group membership.
• B. Provisioning packages are used for OS configuration during device setup, not for managing post-join administrator group assignments.
• C. Security defaults in Azure AD protect against common identity-based attacks but do not control local administrator group membership policies.

Correct answer: C. 90 days

The Device compliance trends report in Microsoft Intune displays trend data for 90 days. This allows administrators to review compliance patterns and trends over a three-month period. The other options represent different reporting windows that are not standard for the compliance trends report.

Why the other options are wrong

• A. The compliance trends report displays data for longer than 30 days.
• B. The compliance trends report displays data for longer than 60 days.
• D. The compliance trends report does not retain 365 days of trend data; it is limited to 90 days.

Correct answer: B. a Group Policy object (GPO)

A Group Policy Object (GPO) is the most efficient method to automatically register and enroll 2,000 existing Windows 10 computers in hybrid Azure AD and Intune. GPO can be applied domain-wide to trigger automatic device registration and MDM enrollment without user intervention, minimizing administrative effort across the large computer base.

Why the other options are wrong

• A. Autodiscover address record is used for email configuration in Exchange, not device enrollment.
• C. Service connection point (SCP) is used to direct devices to Azure AD endpoints but requires manual configuration on devices and is less scalable than GPO for 2,000 computers.
• D. Windows Autopilot is designed for new devices and new device scenarios, not for automatic registration of existing computers already in Active Directory.

Correct answer: B, C. Sync App1 with Intune; From the Managed Google Play Store, approve App1.

To deploy an app to fully managed Android devices in Intune, you must first approve the app from the Managed Google Play Store (option C), which makes it available for Intune management. Then you must sync the app with Intune (option B) to add it to your Intune tenant so it can be deployed to the enrolled devices. The Intune Company Portal is for end-users to install apps, not for preparation, and OEMConfig profiles are for device-specific settings, not app deployment.

Why the other options are wrong

• A. The Intune Company Portal is where users download apps after deployment, not where admins prepare apps for deployment.
• D. OEMConfig profiles are used for device configuration and settings, not for preparing apps for deployment.

Correct answer: A. Microsoft Authenticator

Microsoft Authenticator is the authentication method that supports number matching for passwordless sign-in. When a user attempts to sign in, they receive a notification on their Authenticator app and must match the number displayed on their screen with the number shown in the app, providing an additional verification layer beyond traditional passwords.

Why the other options are wrong

• B. Voice calls do not support number matching verification.
• C. FIDO2 security keys use biometric or PIN verification, not number matching.
• D. Text messages do not provide number matching as a verification method.

Correct answer: D. a device configuration profile

To upgrade Windows 11 Pro to Windows 11 Enterprise on Intune-enrolled devices, you configure a device configuration profile with the Edition Upgrade policy. This profile can specify the target edition (Enterprise) and optionally a product key, triggering the upgrade on managed devices. Device compliance policies (A) enforce compliance rules post-upgrade. Device cleanup rules (B) remove devices from management. Device enrollment policies (C) control enrollment conditions, not OS edition upgrades.

Why the other options are wrong

• A. Device compliance policies enforce rules on devices, not upgrade the OS edition.
• B. Device cleanup rules remove inactive devices, not upgrade the OS.
• C. Device enrollment policies control enrollment conditions, not OS edition upgrades.

Correct answer: D. an app protection policy from the Microsoft Intune admin center

An app protection policy from Microsoft Intune is the correct solution because it enforces security requirements on mobile apps without requiring device enrollment. It can require PIN authentication for accessing email and, critically, can restrict data transfer to prevent copying corporate email data to unauthorized cloud storage services like personal cloud storage while allowing OneDrive for Business. Device configuration profiles don't apply to unenrolled personal devices, DLP policies are for data classification and governance but don't enforce app-level controls on personal devices, and insider risk management is for detecting risky user behavior rather than preventing it.

Why the other options are wrong

• A. Device configuration profiles cannot be deployed to personal devices that are not enrolled in Intune.
• B. DLP policies work with enrolled devices and Microsoft 365 services but cannot enforce app-level restrictions on unenrolled personal iOS and Android devices.
• C. Insider risk management detects and investigates risky user behavior but does not prevent data exfiltration at the application level.

Correct answer: A, B. From Platform Settings, set Android device administrator Personally Owned to Block; From Platform Settings, set Android Enterprise (work profile) to Allow.

To allow only Android work profiles (Android Enterprise) while blocking personal Android device administrator devices, you need to: (A) Block Android device administrator Personally Owned devices to prevent personal Android devices from enrolling, and (B) Allow Android Enterprise (work profile) to enable work profile enrollment. This combination ensures only managed work profile devices can enroll. Options C and D would allow personal devices or incorrect configurations.

Why the other options are wrong

• C. Allowing Android device administrator Personally Owned would permit personal devices to enroll, contradicting the requirement.
• D. Blocking all Android device administrator devices alone does not allow Android Enterprise work profiles.

Correct answer: A. Prepare the contents of App1 by using the Microsoft Win32 Content Prep Tool.

The Microsoft Win32 Content Prep Tool should be used first to prepare and package the application contents into the required .intunewin format for Intune deployment. This tool compresses the installation files and creates the necessary package format that Intune requires. APKs are for Android applications, not Windows, direct upload occurs after packaging, and MDT is for OS deployment rather than application packaging.

Why the other options are wrong

• B. APK files are for Android applications, not Windows 11 devices.
• C. The contents must be packaged with the Win32 Content Prep Tool before uploading to Intune.
• D. The Microsoft Deployment Toolkit is for operating system deployment, not application packaging in Intune.

Correct answer: B. From the Microsoft 365 Defender portal, enable tamper protection.

Tamper protection, enabled from the Microsoft 365 Defender portal, prevents users and malware from making changes to Microsoft Defender Antivirus settings, including disabling it. This is the specific feature designed to lock down Defender settings. Security baselines provide overall security recommendations but don't specifically prevent Defender disabling; account protection policies focus on identity protection; and EDR policies are for detection and response, not prevention of Defender disabling.

Why the other options are wrong

• A. Security baselines provide configuration guidance but don't specifically prevent users from disabling Microsoft Defender Antivirus.
• C. Account protection policies focus on protecting user identities and accounts, not preventing antivirus disabling.
• D. EDR policies are designed for detection and response to threats, not for preventing users from disabling Defender.

Correct answer: C. the enrollment status page (ESP) profile

The Enrollment Status Page (ESP) profile is where deployment logs and troubleshooting information are collected and displayed when Windows Autopilot deployments fail. The ESP allows support engineers to view detailed deployment logs and diagnostic information from failed deployments.

Why the other options are wrong

• A. Automatic enrollment settings control which devices are enrolled but not log collection.
• B. The Windows Autopilot deployment profile configures deployment settings but not log collection mechanism.
• D. Device configuration profiles manage device settings but are not where deployment logs are collected.

Correct answer: B, C, F. Enable the Allow remote server management through WinRM setting; Set the Startup Type of the Windows Remote Management (WS-Management) service to Automatic; Enable the Windows Defender Firewall: Allow inbound remote administration exception setting.

To enable WinRM via Group Policy: (B) Enable "Allow remote server management through WinRM" which is the primary WinRM policy setting, (C) Set the WinRM service startup to Automatic to ensure it runs at boot, and (F) Enable the Windows Defender Firewall inbound remote administration exception to allow WinRM traffic through the firewall. Option A (Allow Remote Shell access) is for Remote Shell specifically, not WinRM. Option D is for Remote Desktop, not WinRM. Option E (Remote Registry) is unrelated to WinRM.

Why the other options are wrong

• A. Allow Remote Shell access enables Remote Shell, a different service than WinRM.
• D. Remote Desktop exceptions are for RDP traffic, not WinRM management.
• E. Remote Registry service startup is unrelated to Windows Remote Management.

Correct answer: C. Windows Deployment Services (WDS)

Windows Deployment Services (WDS) is required to support multicast deployments in MDT. WDS provides the multicast capability that allows MDT to efficiently deploy images to multiple computers simultaneously over the network.

Why the other options are wrong

• A. Multipath I/O (MPIO) is for storage redundancy and failover, not multicast deployment.
• B. Multipoint Connector is for multi-user remote sessions, unrelated to multicast deployment.
• D. Windows Server Update Services (WSUS) manages software updates, not multicast deployments.

Correct answer: C. an account protection policy

Adding users to local groups such as Remote Desktop Users is done with the Local user group membership profile. This profile sits under Endpoint security as an account protection policy, and can add User1 to the group on all 75 marketing devices.

Why the other options are wrong

• A. App configuration policies configure managed app settings, not local group membership.
• B. Device compliance policies only evaluate device state and cannot change local group membership.
• D. The Local user group membership template is delivered as an account protection policy, not a general device configuration profile.