Prepare infrastructure for devices
Domain 1 of MD-102 accounts for 20-25% of the exam. EarnYourCert has 194 original questions for this domain, all with explanations: 129 multiple choice, 30 yes/no and 35 completion or ordering items, like the real exam.
Domain 1 sample questions
8 questions from our 194-question bank for this domain. Try to answer before revealing the solution.
1. Which Microsoft Entra ID device attribute indicates the device's compliance level with Intune policies?
- device.isManaged
- device.isCompliant
- device.complianceState
- device.intuneStatus
Show answer
Correct answer: B. device.isCompliant is the boolean Microsoft Entra ID attribute indicating whether the device meets Intune compliance policies. It is used in Conditional Access rules with 'Require compliant device'.
2. You want that when a user enrolls a personal iOS device in Intune (BYOD mode), the device is registered but not supervised. Which enrollment method is appropriate for this iOS BYOD scenario?
- ADE enrollment with Apple Business Manager configured to manage personal iOS devices as if they were supervised corporate devices
- Enrollment via the Intune Company Portal (installing the app from the App Store and following instructions)
- Apple Configurator 2 enrollment via USB cable connection for personal iOS devices not supervised by the organization
- Dedicated device enrollment for personal-use iOS devices with automated setup without manual user intervention
Show answer
Correct answer: B. For iOS BYOD, the user downloads the Intune Company Portal from the App Store and follows the enrollment process. The device is registered with a basic management profile, not as a supervised device.
3. Android devices from several manufacturers are bought from an authorized reseller and must enroll as fully managed on first boot. Which option fits?
- Apple Configurator with a USB enrollment profile
- Google zero-touch enrollment linked to Intune
- Bulk enrollment with a provisioning package
- Device registration in Microsoft Entra ID only
Show answer
Correct answer: B. Google zero-touch enrollment, configured with the Intune DPC extras, provisions supported Android devices bought from zero-touch resellers into Intune automatically on first boot.
4. You need to assign the Intune administrator role only to help desk team members without granting them access to other parts of Microsoft 365. Which Intune feature should you use?
- Microsoft Entra ID built-in roles with direct assignment to help desk team members
- Intune Role-Based Access Control (RBAC) with custom or built-in roles
- Intune compliance policies with restricted access settings for the help desk team
- Microsoft Entra groups with delegated permissions and conditional administrative access
Show answer
Correct answer: B. Intune RBAC allows assigning specific Intune roles (like 'Help Desk Operator') to user groups, restricting access to only the necessary Intune functions.
5. You want to create a compliance policy in Intune requiring Windows 11 devices to have BitLocker encryption enabled. Where do you create this policy in the Intune admin center?
- Endpoint security > Disk encryption
- Devices > Compliance policies > Create policy
- Device configuration > Profiles > Create profile
- Apps > App configuration policies
Show answer
Correct answer: B. Compliance policies in Intune are created under Devices > Compliance policies. There you can define requirements like BitLocker, minimum OS version, PIN, etc.
6. You need to create a custom Intune role that allows support technicians to view devices and restart them remotely, but without the ability to wipe them or change policies. Where do you create this role in the Intune admin center?
- Microsoft Entra ID > Roles and administrators
- Tenant administration > Roles > Create
- Endpoint security > Security roles
- Devices > Conditional Access > Roles
Show answer
Correct answer: B. Custom Intune roles are created under Tenant administration > Roles > Create. You can select specific permissions for each action available in Intune.
7. What is the default grace period in Intune for a non-compliant device before non-compliance actions (such as access blocking) take effect?
- Immediately (0 days): access blocking is applied as soon as non-compliance is detected
- 1 day default grace period before non-compliance actions take effect
- There is no default grace period; it is configured in the non-compliance actions of each policy
- 30 days default grace period for all new Intune compliance policies
Show answer
Correct answer: C. The grace period is manually configured in the non-compliance actions of each compliance policy. There is no universal default value; the administrator defines it based on organizational needs.
8. Which passwordless authentication protocol does Windows Hello for Business support when integrated with Microsoft Entra ID?
- SAML 2.0 with bearer tokens signed by the Microsoft Entra ID identity provider
- FIDO2 and the Microsoft WebAuthn protocol using asymmetric keys bound to device hardware (TPM)
- OAuth 2.0 with persistent refresh tokens stored in the Windows Web Account Manager
- Kerberos V5 exclusively, with tickets issued by the on-premises Active Directory domain controller
Show answer
Correct answer: B. Windows Hello for Business uses public key cryptography (WebAuthn/FIDO2) with the key pair stored in the device TPM. The private key never leaves the hardware, preventing credential theft.