MD-102 Practice Test 10 — 10 Questions

Question 1

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The script references a file path that does not exist on the failing devices.. Error code 0x80070002 translates to 'The system cannot find the file specified' — a classic Windows error indicating a missing file or path. When an Intune-deployed PowerShell script fails with this code on some devices, the most likely cause is that the script references a file path (e.g., an installer, config file, or dependency) that exists on some devices but not on the failing ones. This is a path/dependency issue, not a permissions or policy issue.

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 2

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app to all macOS devices. What app type should you create in Intune?

Accepted Answer

macOS app (line-of-business). To deploy a custom .pkg app to macOS devices via Microsoft Intune, you must create a macOS line-of-business (LOB) app. LOB apps are designed for sideloading custom or in-house applications that are not available in the public app store, and Intune supports .pkg and .dmg formats for macOS LOB deployment. This app type allows you to upload the .pkg file directly and assign it to devices, handling installation through the Intune management agent.

Answer

Windows app (Win32)

Answer

Web link

Answer

iOS app (line-of-business)

Question 3

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

Accepted Answer

The device is powered off or not connected to the internet. If the device is powered off or not connected to the internet, it cannot check in with Intune to receive new policies. Option A is wrong because an Intune service outage would affect multiple devices, not just one. Option C is wrong because conflicting policies would not prevent check-in; the device would still check in and report conflicts. Option D is wrong because an expired enrollment certificate would prevent enrollment or cause immediate issues, not just a delayed check-in after three days.

Answer

The Intune service is experiencing an outage

Answer

The device has conflicting policies from another MDM

Answer

The device's enrollment certificate has expired

Question 4

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

Accepted Answer

The users are not members of the Azure AD group assigned to the required app.. In Microsoft Intune, app deployment is based on Microsoft Entra ID group assignments. Even if a device is compliant and has recently checked in, the required app will not install unless the user or device is a member of the Microsoft Entra ID group that the app is assigned to. Intune evaluates group membership at each check-in to determine which apps should be pushed, so missing group membership is the most likely cause when compliance and connectivity are verified.

Answer

The devices are not connected to a Wi-Fi network configured in Intune.

Answer

The devices are not compliant with the compliance policy.

Answer

The enrollment restrictions are blocking the devices from receiving apps.

Question 5

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

Accepted Answer

A compliance policy was updated requiring a newer OS version or additional security settings.. Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Answer

The user's Intune license has expired.

Answer

The Outlook app is not installed on the device.

Answer

The device is not enrolled in Intune.

Question 6

You configure a Windows 10 device compliance policy in Intune that requires 'Firewall' to be enabled. The device has Windows Defender Firewall enabled, but the device reports as non-compliant. You verify that the firewall is active. What is the most likely cause?

Accepted Answer

The firewall is enabled only on the Domain profile but not on Public or Private profiles. Intune's Firewall compliance setting evaluates Windows Defender Firewall across all three network profiles: Domain, Private, and Public. If the firewall is enabled only on the Domain profile but disabled on Private or Public, the device is reported as non-compliant even though the firewall appears active in some contexts. This is the most common cause of a false non-compliant report when the firewall is 'on'.

Answer

The firewall is configured to allow all inbound connections

Answer

The device uses a third-party firewall that Intune does not recognize

Answer

The device has multiple network adapters and the firewall is disabled on one

Question 7

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

Accepted Answer

Create an app protection policy that restricts data transfer between work and personal apps.. App protection policies (also called MAM policies) in Intune are designed to protect corporate data at the app layer, independent of device enrollment. For Android Enterprise work profiles, an app protection policy can enforce data transfer restrictions such as blocking copy/paste between work and personal apps, restricting save-as, and controlling sharing. This directly addresses the requirement without affecting the personal side of the device.

Answer

Create a device configuration policy that disables clipboard sharing.

Answer

Create a device compliance policy that requires a work profile.

Answer

Create a conditional access policy that blocks personal apps.

Question 8

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Accepted Answer

Multi-factor authentication (MFA). Multi-factor authentication (MFA) (B) is essential because zero trust requires strong, verified identity for every access request, and MFA ensures a user's identity is validated with more than a single factor before granting access to Microsoft 365 resources. Device compliance policies (D) are essential because zero trust assumes no implicit trust based on network location, so access must be gated on the health and compliance state of the endpoint (for example, via Intune compliance policies evaluated by Conditional Access). Conditional Access policies (E) are essential because they are the policy engine that ties signals such as user identity, MFA status, device compliance, location, and risk together to enforce least-privilege, adaptive access decisions in Microsoft 365. Microsoft Entra application proxy (A) is not one of the three required capabilities here; it is a remote-access/publishing solution for on-premises web apps and, while useful, is not a core zero-trust pillar in this scenario. Microsoft Entra Connect sync (C) is also not required; it is a directory synchronization tool for hybrid identity and does not itself enforce zero-trust verification or access control.

Answer

Azure AD Application Proxy

Answer

Azure AD Connect sync

Question 9

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data is separated from personal data on the device. Which management approach should you use?

Accepted Answer

Android Enterprise work profile. Android Enterprise work profile creates a separate container for corporate data, keeping it isolated from personal data on the same device. Android Enterprise fully managed devices are for corporate-owned devices and do not have a personal space. Android Enterprise kiosk mode locks the device to a single app or set of apps, not designed for data separation. Android device administrator is a legacy management method that does not provide data separation.

Answer

Android Enterprise kiosk mode

Answer

Android Enterprise fully managed

Answer

Android device administrator

Question 10

Match each Intune configuration profile type to its purpose.

Accepted Answer

Device restrictions: Controls device settings and features (e.g., camera, Bluetooth). Device restrictions manage device features, Endpoint protection handles security settings, Administrative templates use ADMX, and Custom uses OMA-URI. Common confusions involve swapping the first two.

Answer

Device restrictions: Manages security settings like antivirus and firewall

Answer

Endpoint protection: Controls device settings and features (e.g., camera, Bluetooth)