Endpoint Administrator Free Sample Questions

Intune compliance policies for BitLocker do not automatically adapt for devices without a TPM. The best practice for this scenario is to create two distinct policies and use dynamic device groups to target them appropriately. One group can be created with a rule like (device.deviceTrustType -eq "TPM") for TPM-enabled devices, and another for devices without a TPM or with an older version. This ensures that all devices are evaluated for compliance correctly based on their hardware capabilities.

Endpoint Privilege Management rules require more than just a file path for validation to prevent spoofing. A robust rule must include a file hash, a certificate signature, or both. If only the file path is defined, EPM will not trust the rule and will not elevate the application, resulting in the standard User Account Control (UAC) prompt. The most secure and reliable method is to include the file hash, which ensures the exact version of the executable is being elevated.

This setting is the core of the ESP's function. By setting it to 'Yes', you ensure the user is held at the ESP screen until the specified configurations are complete.

This allows you to define a subset of required applications that must be installed before the user can proceed. Other applications assigned as 'Required' but not on this blocking list will continue to install in the background after the user reaches the desktop.

The 'Guest account' option within the multi-app kiosk configuration is specifically designed for shared device scenarios. It creates a temporary local account for each session. When the user signs out or the session ends, this temporary account and all associated data are deleted, ensuring a clean and secure environment for the next user.

The statement is false. The 'Save copies of org data' policy setting controls where users can save corporate data. When set to 'Block', it prevents saving to any non-policy managed location, which includes both personal cloud storage apps AND the local device storage. To allow saving to a specific corporate location like OneDrive, you must configure policy-managed locations.

With the correct permissions (such as Cloud Device Administrator or Intune Administrator), the LAPS password for a Microsoft Entra joined device can be retrieved from both the Microsoft Entra admin center and the Microsoft Intune admin center. On the device's object page in either portal, there is a 'Local administrator password' blade or option to view the password. This is the primary location for administrative retrieval.

The correct syntax for an Intune filter rule uses the device or user prefix, followed by the property name. The -eq operator is used for equality checks, and the -and operator combines multiple conditions. Therefore, (device.deviceOwnership -eq "Corporate") -and (device.department -eq "Marketing") correctly targets devices that meet both criteria.

Download mode 2, 'Group', is the most effective choice. It restricts peer sharing to devices within the same group. When you configure the 'Select the source of group IDs' setting to use the AD Site or a DHCP option, devices in the same physical location (branch office) can form a peer group and share content efficiently over the LAN, significantly reducing WAN bandwidth consumption.

For dedicated devices (kiosk mode), enrollment using a QR code is ideal for on-site, bulk provisioning by non-technical staff. From the factory reset screen, tapping the screen multiple times initiates the QR code scanner. Scanning the QR code generated from the Intune enrollment profile automates the Wi-Fi connection, agent download, and enrollment process into dedicated device mode.

The 'Dependencies' feature for Win32 apps in Intune is designed for this exact scenario. You must first package and upload the .NET Framework 4.8 as a separate Win32 app. Then, when configuring the main application, you can add the .NET Framework app as a dependency and configure it to automatically install. Intune will then process the dependency chain, ensuring the framework is installed before the main application.