MD-102 Practice Test 10 — 10 Questions

Question 1

Arrange the steps to perform a Windows 10 feature update using Windows Update for Business in Intune.

Accepted Answer

Create ring, then set version and rollout, then assign, then monitor.. The correct sequence for performing a Windows 10 feature update using Windows Update for Business in Intune starts with creating a deployment ring, then configuring the feature update version and rollout settings, followed by assigning the ring to the target devices or groups, and finally monitoring the update deployment to track success and issues. This order ensures that the ring is properly configured before being applied, and that monitoring captures the actual deployment activity.

Answer

Create ring, then assign, then set version and rollout, then monitor.

Answer

Set version and rollout, then create ring, then assign, then monitor.

Answer

Create ring, then set version and rollout, then monitor, then assign.

Question 2

A company applies the above BitLocker policy to Windows 10 devices via Intune. An administrator discovers that some devices are not encrypting. The administrator checks a device and finds that it has no TPM chip. Which setting in the policy will cause encryption to fail?

Accepted Answer

requireTpm. The 'requireTpm' setting enforces that BitLocker will only start encryption if a Trusted Platform Module (TPM) chip is present on the device. If a device lacks a TPM, this policy setting causes the encryption process to fail outright, as BitLocker cannot meet the mandatory hardware requirement.

Answer

recoveryKeyRotation

Answer

encryptionMethod

Answer

requireStartupPin

Question 3

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

Accepted Answer

Apps are assigned to devices instead of users. Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Answer

Device type is restricted in enrollment restrictions

Answer

VPP token is not configured for user enrollment

Answer

User Enrollment does not support app distribution

Question 4

Which TWO of the following are methods to deploy apps to Windows 10/11 devices via Microsoft Intune?

Accepted Answer

Microsoft Store app. The correct answers are C and E. Option C is correct because Microsoft Intune supports deploying Microsoft Store apps (including Store for Business and the new Microsoft Store experience) to Windows 10/11 devices. Intune can synchronize apps from the Microsoft Store and assign them to users or devices. Option E is correct because Intune also supports deploying Win32 apps (traditional .exe and .msi applications) to Windows devices using the Win32 app management feature, which allows packaging and deploying line-of-business applications. Options A, B, and D are incorrect: iOS and Android apps are platform-specific and cannot be deployed to Windows devices via Intune; a web link is not an app deployment method but a shortcut.

Answer

iOS app

Answer

Web link

Answer

Android app

Question 5

An organization uses Microsoft Defender for Endpoint (MDE) with Microsoft Intune for device management. The security team wants to automatically remediate risks detected by MDE on Windows devices. Which Intune feature should be used to trigger remediation actions based on MDE alerts?

Accepted Answer

Conditional Launch policy for MDE. The Conditional Launch policy in Microsoft Defender for Endpoint (MDE) allows you to define automatic remediation actions (e.g., running a scan, isolating a device) triggered by specific MDE threat alerts. This policy is configured within the MDE security settings managed by Intune, enabling a direct, automated response to risks without manual intervention.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

Windows Update rings

Question 6

You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?

Accepted Answer

OS version is above the maximum allowed. The compliance policy in the exhibit specifies a maximum OS version of 10.0.22621.1000, but the Windows 11 device is running build 10.0.22621.1500, which is above that maximum. Intune compares the device's OS version against the configured maximum OS version setting; if the device's version exceeds the maximum, it is marked as noncompliant. This setting is used to prevent devices with newer, potentially untested builds from accessing corporate resources.

Answer

Password minimum length is not met

Answer

Device threat protection level is below medium

Answer

TPM is not present

Question 7

You manage Windows 10 devices with Intune. You need to collect diagnostic logs from a remote device that is experiencing application crashes. Which Intune feature should you use?

Accepted Answer

Collect diagnostics. The 'Collect diagnostics' feature in Intune allows you to remotely gather diagnostic logs from Windows 10 devices without user interaction. This is the correct tool for troubleshooting application crashes because it collects system logs, event logs, and crash dumps directly from the device via the Intune management channel, enabling analysis of the failure.

Answer

Company Portal app

Answer

Autopilot Reset

Answer

Windows Update for Business

Question 8

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

Accepted Answer

Use the 'Update Immediately' setting in the Windows Update for Business policy.. The 'Update Immediately' setting in the Windows Update for Business policy forces devices to check for and install updates immediately, overriding the configured deadline. Option A is incorrect because restarting alone does not trigger installation of pending updates. Option B is incorrect because reassigning the update ring does not affect the urgency of already applied policies. Option D is incorrect because increasing the deadline would allow more delay, not cause immediate installation.

Answer

Ask users to restart their devices.

Answer

Reassign the update ring to a broader device group.

Answer

Increase the 'Quality update deadline' to 3 days.

Question 9

A company uses Microsoft 365 E3 licenses. They need to enforce that all users must use the Microsoft Authenticator app for MFA instead of SMS or phone call. What should the administrator configure?

Accepted Answer

Authentication methods policy. The Authentication methods policy (B) is the correct configuration because it allows administrators to control exactly which authentication methods users can register and use for MFA. By targeting the policy to all users and disabling SMS and voice call while enabling Microsoft Authenticator (push notifications or OTP), the requirement is met. This policy supersedes legacy MFA settings and provides granular control over modern authentication methods.

Answer

MFA service settings in the legacy portal

Answer

Security defaults

Answer

Conditional Access policy

Question 10

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Accepted Answer

Microsoft Intune tenant. Options A, B, and E are correct. Co-management requires Microsoft Intune tenant (A) for cloud enrollment, Configuration Manager current branch (B) for on-premises management, and Microsoft Entra ID (E) for identity synchronization and hybrid join. Option C is not a requirement; the service connection point is used for cloud attach but is not mandatory for co-management. Option D is not required; PKI certificates are optional for co-management, as Intune can handle certificate enrollment via SCEP or PKCS if needed.

Answer

Service connection point (Cloud Attach)

Answer

Public key infrastructure (PKI) certificates