MD-102 Practice Test 10 — 10 Questions

Question 1

You are configuring Microsoft Entra Conditional Access for a company that requires all employees to use multi-factor authentication (MFA) when accessing the Azure portal. The company also wants to block access from devices that are not compliant. You create a Conditional Access policy. Which two assignments must you configure to meet these requirements? (Choose two.)

Accepted Answer

Grant access, require multi-factor authentication. Option C is correct because the requirement to enforce multi-factor authentication (MFA) for Azure portal access is met by configuring the 'Grant' control to 'Require multi-factor authentication'. Option D is correct because blocking access from non-compliant devices is achieved by selecting 'Require device to be marked as compliant' under Grant controls, which ensures only devices that meet compliance policies (e.g., Intune-managed) are allowed. Both assignments are necessary to satisfy the two distinct requirements.

Answer

Grant access, require Microsoft Entra hybrid joined device

Answer

Grant access, block access for non-compliant devices

Question 2

A user reports that their Windows 11 device fails to enroll in Microsoft Intune. The device is Microsoft Entra joined and the user has a valid Intune license. What should you check first?

Accepted Answer

Check the Enrollment Status Page (ESP) profile configuration in Intune.. Option B is correct because Enrollment Status Page (ESP) profiles can block enrollment if misconfigured, and checking the Intune console is the first step to see errors. Option A is wrong because BitLocker is not related to enrollment. Option C is wrong because the local admin password is not required for enrollment. Option D is wrong because the Autopilot profile is only relevant for Autopilot deployments, not general enrollment.

Answer

Verify that BitLocker is enabled on the device.

Answer

Ensure that the device has a local administrator password set.

Answer

Review the Windows Autopilot deployment profile assigned to the device.

Question 3

Which THREE conditions must be met for a Windows device to be able to enroll in Microsoft Intune using Microsoft Entra ID join? (Choose three.)

Accepted Answer

The device must be running Windows 10 or later. Option A is correct because Microsoft Entra ID join requires a minimum of Windows 10 (any edition) to support the modern authentication and device registration protocols. Devices running earlier versions like Windows 8.1 or Windows 7 lack the necessary components (e.g., the Device Registration Service client) to complete the join process. This requirement ensures the device can communicate using OAuth 2.0 and the Microsoft Entra ID device registration endpoint.

Answer

The device must have a TPM 2.0 chip

Answer

The device must be joined to an on-premises Active Directory domain

Question 4

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. The user has confirmed that the device is enrolled and connected to the internet. Which is the most likely cause?

Accepted Answer

The Intune Management Extension is not installed or not running.. Option B is correct because when a device shows 'Not evaluated,' it typically means the Intune Management Extension is missing or not running, which is required for compliance evaluation. Option A is wrong because the device is enrolled. Option C is wrong because Windows 10/11 licenses are not required for compliance. Option D is wrong because Device Lock policies are not related to compliance evaluation.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device has a Device Lock policy applied that blocks evaluation.

Answer

The user does not have a Microsoft 365 E3 license assigned.

Question 5

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Microsoft Entra ID join with automatic MDM enrollment.. Option A is correct because Windows Autopilot is a valid enrollment method. Option E is correct because Microsoft Entra ID join with automatic Intune enrollment is valid. Option B is wrong because Apple Business Manager is for Apple devices. Option C is wrong because Android Zero Touch is for Android devices. Option D is wrong because Samsung Knox Mobile Enrollment is for Samsung Android devices.

Answer

Android Zero Touch.

Answer

Apple Business Manager.

Answer

Samsung Knox Mobile Enrollment.

Question 6

You need to deploy a custom Windows 11 feature update to a pilot group of 50 devices before rolling out to the entire organization. The devices are managed by Intune and are in a 'Pilot' Azure AD group. What is the best approach?

Accepted Answer

Create a feature update profile for Windows 11 and assign to the pilot group. Option C is correct because Intune's feature update profiles are specifically designed to deploy Windows 11 feature updates to targeted Azure AD groups, such as the 'Pilot' group. This approach allows you to control the exact feature update version (e.g., Windows 11 23H2) and assign it only to the pilot devices, enabling a controlled rollout before expanding to the entire organization.

Answer

Configure a Windows Update for Business deferral policy for all devices

Answer

Create a custom configuration profile with update settings

Answer

Use Group Policy to configure Windows Update settings for the pilot group

Question 7

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

Accepted Answer

The Conditional Access policy does not include the email application as a target.. Option C is correct because Conditional Access policies require a cloud app to be targeted. Option A is incorrect because the policy would block access if applied. Option B is incorrect because compliance policy is separate from Conditional Access. Option D is incorrect because the policy would apply to all users if included.

Answer

The Conditional Access policy is set to 'Block' instead of 'Grant'.

Answer

The Conditional Access policy applies only to users in a specific group.

Answer

The compliance policy is not assigned to the users' devices.

Question 8

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

Accepted Answer

The enrollment restrictions are set to block personally owned devices.. Option D is correct because enrollment restrictions must allow personal devices if users are using personal iOS devices. Option A is wrong because Apple MDM push certificate is required for enrollment, but the error message is different. Option B is wrong because terms of use appear after enrollment attempt. Option C is wrong because conditional access policies do not block enrollment but access after enrollment.

Answer

A conditional access policy requires compliant devices.

Answer

The Apple MDM push certificate is not configured.

Answer

The users have not accepted the terms of use.

Question 9

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

Accepted Answer

The OS build is greater than the maximum version specified.. Option C is correct because the policy specifies osMinimumVersion as 10.0.19041.0 (Windows 10 2004) and osMaximumVersion as 10.0.22621.0 (Windows 10 22H2). Since 22621 is equal to the maximum, it should be compliant. However, if the devices have a newer build (e.g., 22631 from an Insider preview), they would exceed the maximum. Option A is incorrect because 22621 is not less than 19041. Option B is incorrect because the maximum is inclusive. Option D is incorrect because the policy does not specify validOperatingSystemBuildRanges.

Answer

The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.

Answer

The OS build is less than the minimum version.

Answer

The policy requires a password but the devices have no password.

Question 10

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

Accepted Answer

Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.. The device is hybrid Azure AD joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Answer

Re-enroll the device in Intune.

Answer

Ensure the device has internet connectivity.

Answer

Assign a compliance policy to the device.