MD-102 Practice Test 4 — 10 Questions

Question 1

A company manages 500 Windows 10 devices using Microsoft Intune. They plan to upgrade to Windows 11. The IT team wants to ensure that only devices meeting the Windows 11 hardware requirements are allowed to upgrade. They need to block the upgrade on devices that do not meet the requirements, and provide a clear error message to users. What should the IT team configure?

Accepted Answer

Configure a Windows 11 readiness policy in Intune and assign it to all devices.. Option A is correct because a Windows 11 readiness policy in Intune is specifically designed to evaluate device hardware compatibility against Windows 11 requirements and block the upgrade on non-compliant devices while displaying a custom error message to users. This policy uses the Windows Health Monitoring and the TPM 2.0 attestation checks to enforce the hardware requirements before the upgrade can proceed.

Answer

Configure a feature update policy for Windows 10 and Windows 11 in Intune.

Answer

Create a compliance policy with Windows 11 requirements and assign it to all devices.

Answer

Use a device configuration profile to set the 'TargetReleaseVersion' policy for Windows 11.

Question 2

Match each PowerShell cmdlet to its function in Microsoft 365 management.

Question 3

Match each Microsoft 365 Defender feature to its description.

Question 4

Match each Microsoft Entra ID (Azure AD) join type to its description.

Question 5

Match each Windows 10/11 edition to its applicable Microsoft 365 feature.

Question 6

Match each Microsoft 365 Apps update channel to its description.

Question 7

You are the compliance administrator for a large organization using Microsoft 365 E5 licenses. The company has a hybrid identity configuration with Azure AD Connect syncing on-premises Active Directory to Azure AD. The security team requires that all mobile devices accessing corporate email and documents must be enrolled in Microsoft Intune and compliant with company device policies. Recently, several users reported that they cannot access Outlook on their iOS devices, receiving a message: 'Your organization requires this device to be managed by Intune. Please install the Company Portal app and enroll your device.' However, after installing Company Portal and completing enrollment, they still cannot access Outlook and see the same error. Upon investigation, you find that the devices are showing as 'Compliant' in the Microsoft Intune admin center. You also verify that the Conditional Access policy requiring device compliance is correctly configured and assigned to all users. What should you do to resolve the issue?

Accepted Answer

Verify that the devices are properly registered in Azure AD and, if not, ask users to unenroll and re-enroll their devices.. The issue is that the devices are compliant in Intune but not properly registered in Azure AD, which is a prerequisite for Conditional Access policies to evaluate device compliance. Even after enrollment, if the device registration fails or is incomplete, the Conditional Access policy will still block access. Option D addresses this by verifying and fixing the Azure AD registration, typically requiring unenrollment and re-enrollment to trigger a fresh registration.

Answer

Disable the Conditional Access policy, wait 10 minutes, and then re-enable it.

Answer

Recreate the Conditional Access policy with the same settings and assign it to the affected users.

Answer

Check if the affected users have an Intune license assigned; if not, assign one.

Question 8

You are reviewing a Windows 10 compliance policy in Microsoft Intune. A user with a device running Windows 10 version 20H2 (build 19042.985) reports that the device is marked as non-compliant. The device has a password of length 8, a PIN with 4 characters, Secure Boot enabled, BitLocker enabled, and Windows Defender Firewall active. What is the most likely reason for non-compliance?

Accepted Answer

The device uses a PIN with only 4 characters, which does not meet the minimum password length of 6.. The device uses a PIN with only 4 characters, which does not meet the minimum password length of 6. In Intune compliance policies for Windows 10, the 'Minimum password length' setting applies to both passwords and PINs. A PIN of 4 characters violates this requirement, causing non-compliance even if other settings like BitLocker and Secure Boot are properly configured.

Answer

Windows Defender Firewall is not active.

Answer

Secure Boot is not enabled on the device.

Answer

The OS build number 19042.985 is below the required minimum version 19041.0.

Question 9

A company uses Microsoft Intune to manage Windows 10 devices. A user reports that their device is not receiving critical security updates despite being compliant with all update policies. You verify that the device is online and communicating with Intune. Which action should you take to resolve the issue?

Accepted Answer

Review the Windows Update Rings policy assigned to the device and adjust the deferral settings for quality updates.. The user's device is compliant and online, but not receiving critical security updates. The most likely cause is that the Windows Update Rings policy assigned to the device has a deferral period configured for quality updates, which delays the installation of security patches. Adjusting the deferral settings for quality updates to 0 days ensures that critical security updates are installed immediately upon release, resolving the issue without changing the feature update deferral.

Answer

Verify that the device meets the minimum hardware requirements for the update.

Answer

Force a sync from the device via Intune Company Portal or Settings > Accounts > Access work or school.

Answer

Reassign the device to a different Update Ring policy that has no feature update deferral.

Question 10

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

Accepted Answer

The OMA-URI path is incorrect for an ADMX-backed policy.. Option D is correct because the OMA-URI path for an ADMX-backed policy must follow the exact format: `./Device/Vendor/MSFT/Policy/Config/ADMX_/`. If the path is incorrect—for example, missing the `ADMX_` prefix or using a wrong category name—the policy will fail to apply on Windows 10 devices. Custom configuration policies do support ADMX-backed policies, but the URI must precisely match the ADMX administrative template structure.

Answer

The value must be an integer, not a string.

Answer

The OMA-URI targets the user, not the device.

Answer

Custom configuration policies are not supported on Windows 10.