How many VPN connections does User1 get on Device1 and Device2?

MD-102 By islever Editorial Last updated

Plan and implement device configuration profiles

Short answer

Device1: 2 VPN connections (VPN1 and VPN2). Device2: 3 VPN connections (VPN1, VPN2, and VPN3).

Question

HOTSPOT
Case study
Overview
ADatum Corporation is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
ADatum has a Microsoft 365 E5 subscription.
Environment
Network Environment
The network contains an on-premises Active Directory domain named adatum.com. The domain contains the servers shown in the following table.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
ADatum has a hybrid Azure AD tenant named adatum.com.
Users and Groups
The adatum.com tenant contains the users shown in the following table.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
All users are assigned a Microsoft Office 365 license and an Enterprise Mobility + Security E3 license.
Enterprise State Roaming is enabled for Group1 and GroupA.
Group1 and Group2 have a Membership type of Assigned.
Devices
ADatum has the Windows 10 devices shown in the following table.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
The Windows 10 devices are joined to Azure AD and enrolled in Microsoft Intune.
The Windows 10 devices are configured as shown in the following table.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
All the Azure AD joined devices have an executable file named C:\AppA.exe and a folder named D:\Folder1.
Microsoft Intune Configuration
Microsoft Intune has the compliance policies shown in the following table.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
The Automatic Enrollment settings have the following configurations:
• MDM user scope: GroupA
• MAM user scope: GroupB
You have an Endpoint protection configuration profile that has the following Controlled folder access settings:
• Name: Protection1
• Folder protection: Enable
• List of apps that have access to protected folders: C:\*\AppA.exe
• List of additional folders that need to be protected: D:\Folder1
• Assignments:
  • Included groups: Group2, GroupB
Windows Autopilot Configuration
ADatum has a Windows Autopilot deployment profile configured as shown in the following exhibit.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?
Currently, there are no devices deployed by using Windows Autopilot.
The Intune connector for Active Directory is installed on Server1.
Requirements
Planned Changes
ADatum plans to implement the following changes:
• Purchase a new Windows 10 device named Device6 and enroll the device in Intune
• New computers will be deployed by using Windows Autopilot and will be hybrid Azure AD joined.
• Deployed a network boundary configuration profile that will have the following settings:
  • Name: Boundary1
  • Network boundary: 192.168.1.0/24
  • Scope tags: Tag1
  • Assignments:
  • Included groups: Group1, Group2
• Deploy two VPN configuration profiles named Connection1 and Connection2 that will have the following settings:
  • Name: Connection1
  • Connection name: VPN1
  • Connection type: L2TP
  • Assignments:
  • Included groups: Group1, Group2, GroupA
  • Excluded groups: --
  • Name: Connection2
  • Connection name: VPN2
  • Connection type: IKEv2
  • Assignments:
  • Included groups: GroupA
  • Excluded groups: GroupB
Technical Requirements
ADatum must meet the following technical requirements:
• Users in GroupA must be able to deploy new computers.
• Administrative effort must be minimized.
You implement the planned changes for Connection1 and Connection2.
How many VPN connections will there be for User1 when the user signs in to Device1 and Device2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit: How many VPN connections does User1 get on Device1 and Device2?

Key Takeaways

The question tests how device-scoped and user-scoped VPN profiles combine with pre-existing connections, and the trap is counting configuration profile objects instead of the actual VPN connection names presented to the user.

In Microsoft Intune, a VPN configuration profile's administrative name (Connection1, Connection2) is not what the user sees; the connection name inside the profile (VPN1, VPN2) is. Because Connection1 defines the connection name VPN1 that already exists on Device1 and Device2, and Connection2 adds VPN2 to User1 through GroupA, User1 ends up with 2 VPN connections on Device1 and 3 on Device2.

Common mistake: Counting Connection1 and Connection2 as two brand-new connections on top of the existing ones (3 and 4). Intune profiles are labeled separately in the console, but a profile whose connection name matches an existing VPN1 does not create a duplicate, so the correct count is lower.

Expert Analysis

Why the Answer Is Correct

Device1 already has the preconfigured VPN1, and Connection1 (connection name VPN1) is assigned to Group1, Group2 and GroupA, so Device1 receives it — but because the connection name is identical to the existing VPN1, it resolves to a single VPN1 entry. Connection2 carries connection name VPN2 and is assigned to GroupA, and User1 is a member of GroupA, so the user-scoped profile adds VPN2 to Device1. That yields exactly two visible connections for User1 on Device1: VPN1 and VPN2. Device2 already carries VPN1 and VPN3, so adding the GroupA-delivered VPN2 produces VPN1, VPN2 and VPN3 — three connections.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Before adding anything up, write down each device's preconfigured connection names and each new profile's connection name side by side. Then only add the connection names that are genuinely new for that user-device pair, since matching names collapse into one entry.

Frequently Asked Questions

Do two Intune VPN profiles with the same connection name create duplicate connections?

No. If a profile's connection name matches a connection already provisioned on the device, the user still sees a single VPN1 entry rather than two separate ones.

Why does User1 receive the Connection2 VPN on Device1 if the profile targets GroupA?

GroupA is a user group, so Connection2 applies per user: User1's GroupA membership adds the VPN2 connection on every enrolled device the user signs in to.

More MD-102 FAQ →

Discussion 18 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 18

  1. TestTest284 👍 18
    what is the question?
  2. yosry 👍 9
    The Question is: Hotspot Question You implement the planned changes for Connection1 and Connection2. How many VPN connections will there be for User1 when the user signs in to Device1 and Device2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point
  3. RazielLycas 👍 6
    what a mess ^_^ anyway the question is how many VPN device 1 and device 2 will have after implementing the connection changes. DEV1 is in GROUP1 and already have VPN1. DEV2 is in GROUP1 and GROUP2 and already have VPN1 and VPN3, after implementing the new VPNs , DEV1 and DEV2 will both receive CONNECTION1 so the answer is correct 2 and 3
  4. 0e1a556 👍 6
    Shouldn't it be Device 1: 3 Device 2: 4 Device 1: VPN1 (Preconfigured), Connection1 (Part of Group A), Connection2 (Part of Group A) Device 2: VPN1 & VPN3 (Preconfigured), Connection1 (Part of Group A), Connection2 (Part of Group A)
  5. Merrybob 👍 3
    Question: You implement the planned changes for Connection1 and Connection2. How many VPN connections will there be for User1 when the user signs in to Device1 and Device2? Answers: Given: User1 is in Group A 2 VPN connections on Device1: VPN1 (pre-configured) and VPN2 (added by Group A) 3 VPN connections on Device2: VPN1 and VPN3 (pre-configured), VPN2 (added by Group A) Ref: a public discussion thread on this question
Show 13 more comments
  1. Pisces225 👍 3
    Correct. User is a member of Group A and clearly Group A gets two new connections: Connection 1 and Connection 2. So add those to the existing connections and you get 3 for Device 1 and 4 for Device 2. Any other answer is wrong because people can't count. 1 (existing) +2 (newly assigned) = 3. 2 (existing) + 2 (newly assigned) = 4.
  2. Besxp 👍 3
    Correct! Device 1: VPN1 connection from device + VPN2 connection from user1(member of group A) Device 2: VPN1 & VPN3 connection from device + VPN2 connection from user1(member of group A)
  3. Robin_Cegeka 👍 3
    Please provide question
  4. ThomasE 👍 1
    I think this depends upon if the existing VPN1 and VPN2 are configured the same as those you are implementing or deploying, correct? If we are assuming that they are, shouldn't it be: Device 1 has 2 VPN connections: VPN1 and VPN2 Device 2 has 3 VPN connections: VPN1, VPN2 and VPN3 If the configs are different, will that create duplicate names.....I think so. Device 1 now has 3 VPN connections: VPN1, VPN1 and VPN2 Device 2 now has 4 VPN connections: VPN1, VPN1, VPN2 and VPN3 ???
  5. sergioandreslq 👍 1
    Box 1: 2 Given: User1 is in Group A and group A is in scope for VPN1 and VPN2 2 VPN connections on Device1: VPN1 (pre-configured) and VPN2 (added by Group A) BOX 3: 2 Given: Device 2 is in group 1 and group 2, these 2 groups are not in scope for the VPN1 or VPN2. In the info table associated with Bitlocker and VPN connection, this device has VPN1 and VPN3 So, the answer is: 2 VPN connections on Device2: VPN1 and VPN3 (pre-configured)
  6. Krayzr 👍 1
    <p><b>Question</b></p> <p>You implement the planned changes for Connection1 and Connection2.</p> <p>How many VPN connections will there be for User1 when the user signs in to Device1 and Device2?</p> <p>To answer, select the appropriate options in the answer area.</p>
  7. oopspruu 👍 1
    Connection1 and 2 are just name of the Config Profiles. The user actually sees the VPN Names defined. Since VPN1 and VPN2 are already configured on some devices, you won't see duplicate for them. Given answers are correct.
  8. sergioandreslq 👍 1
    My mistake: Device 2: 3 VPN profile Pre-configured: VPN1, VPN3 VPN2 because User1 is member of group A which is in scope for VPN2 So, dev2 will have the profiles: VPN1, VPN2 and VPN3
  9. BestSumy 👍 1
    check the name, connection 1 includes VPN1 and connection 2 includes VPN2
  10. Murad01 👍 1
    no question stated, But answers are correct
  11. kay000001 👍 1
    The answer is correct hahahah.
  12. _WTH_ 👍 1
    the question is missing
  13. yosry 👍 1
    answer: seems correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide