MD-102 Practice Test 3 — 10 Questions

Question 1

An administrator uses Configuration Manager to manage Windows 10 devices. The administrator wants to deploy a custom Windows application as an Application model deployment type. The application requires a reboot. Which deployment purpose should the administrator use to allow users to control the installation timing?

Accepted Answer

Available. The Available deployment purpose allows users to see the application in Software Center and choose when to install it, including scheduling the required reboot at their convenience. This gives users control over installation timing, which is the stated requirement. Required and Mandatory deployments force installation according to a schedule, removing user choice.

Answer

Mandatory

Answer

Pre-deploy

Answer

Required

Question 2

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

Accepted Answer

%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Answer

%windir%	emp\MdmEnrollment.log

Answer

%windir%\Panther\setupact.log

Answer

Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

Question 3

A technician is troubleshooting a Windows 11 device that is enrolled in Intune. The device reports as 'Not compliant' due to missing required updates. The administrator runs the following command on the device and receives the output shown. What should the administrator do next to resolve the compliance issue?

Accepted Answer

Restart the device.. The command output indicates that the Windows Update service is in a 'Stopped' state, which prevents the device from installing required updates. Restarting the device (Option D) will restart the Windows Update service and trigger a fresh update scan, allowing the device to become compliant on the next Intune check-in. This is the most direct fix for a stopped service that is blocking update installation.

Answer

Check for a policy conflict in Intune.

Answer

Run a manual sync from the Company Portal app.

Answer

Verify network connectivity to Microsoft Update.

Question 4

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices with BitLocker enabled can access corporate email via Exchange Online. Which configuration should the administrator use to enforce this requirement?

Accepted Answer

Create a Conditional Access policy that requires device compliance and assign it to Exchange Online.. Option B is correct because a Conditional Access policy in Azure AD can require that devices accessing Exchange Online be marked as compliant in Intune. By combining a Device Compliance policy that requires encryption (BitLocker) with a Conditional Access policy targeting Exchange Online, only compliant devices with BitLocker enabled will be granted access to corporate email.

Answer

Create a Device Compliance policy for Windows 10 with the 'Require encryption of data storage on device' setting enabled.

Answer

Create an App Protection policy for the Outlook mobile app that requires device encryption.

Answer

Configure Windows Defender Firewall to block non-BitLocker encrypted devices.

Question 5

You are configuring Microsoft Intune to manage Windows 10 devices. Which TWO actions are required to enable BitLocker encryption on devices?

Accepted Answer

Create a device configuration profile for endpoint protection and enable BitLocker settings.. Option A is correct because BitLocker settings are configured via a device configuration profile for endpoint protection in Microsoft Intune. This profile includes policies such as requiring TPM startup PIN or startup key, encryption method, and OS drive encryption. Without this profile, BitLocker cannot be enforced or configured on managed Windows 10 devices.

Answer

Create a compliance policy that requires BitLocker.

Answer

Configure a device cleanup rule.

Answer

Deploy a Windows 10 update ring.

Question 6

Order the steps for configuring a Windows 10 kiosk device using Assigned Access.

Question 7

Order the steps to migrate user profiles from Windows 10 to a new device using User State Migration Tool (USMT).

Question 8

Arrange the steps to deploy Windows 10 using Microsoft Deployment Toolkit (MDT) in the correct order.

Question 9

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Question 10

You are an enterprise administrator for Contoso Ltd. You need to configure Microsoft 365 tenant-wide settings for external collaboration. Which TWO actions should you take to meet the following goals: (1) allow only specific external domains to collaborate with your organization, and (2) ensure that external users are required to sign in with multi-factor authentication (MFA) before accessing shared resources?

Accepted Answer

Configure the SharePoint and OneDrive domain allowlist to include only the approved external domains.. Option B is correct because configuring the SharePoint and OneDrive domain allowlist restricts external sharing to only the approved external domains, meeting the first goal. Option D is correct because a Conditional Access policy in Azure AD can require MFA for all external users, satisfying the second goal by enforcing authentication requirements before access to shared resources.

Answer

Disable external sharing in the Microsoft 365 admin center for all workloads.

Answer

Configure the SharePoint and OneDrive domain blocklist to exclude all external domains except the approved ones.

Answer

Enable B2B direct connect in the cross-tenant access settings for the approved external domains.