MD-102 Practice Test 12 — 15 Questions

Question 1

Your organization, Fabrikam, uses Microsoft Intune to manage iOS/iPadOS and Android devices. You need to implement a solution that ensures company email can only be accessed from the Outlook mobile app, and that data from the Outlook app cannot be copied to personal apps. You also need to ensure that when a user leaves the company, the corporate data in Outlook is removed without affecting personal data. You plan to use app protection policies (MAM). The devices are not enrolled in Intune (unmanaged). You configure the app protection policies for Outlook on iOS and Android. However, users report that they can still copy email content to personal apps. What should you check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the 'Cut, copy, and paste' setting in the app protection policy is set to 'No' or 'Policy managed apps'.. The 'Cut, copy, and paste' setting in the app protection policy controls data transfer between apps. To prevent copying email content to personal apps, this setting must be set to 'No' or 'Policy managed apps'. Option A is incorrect because device enrollment is not required for MAM policies on unmanaged devices. Option B is incorrect because device compliance policies are not applicable without enrollment. Option D is incorrect because Outlook is already a managed app; the issue is the policy setting.

Answer

Ensure that the devices are enrolled in Intune.

Answer

Check that the device compliance policy is assigned.

Answer

Confirm that the Outlook app is a managed app in Intune.

Question 2

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

Accepted Answer

The current OS version on the device.. The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Answer

The user's license status.

Answer

The compliance policy is assigned to the device.

Answer

The device is connected to the internet.

Question 3

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Accepted Answer

Windows 10 devices that are domain-joined to the on-premises Active Directory.. Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.

Answer

Active Directory Federation Services (AD FS) deployed.

Answer

Azure AD Premium P1 licenses for all users.

Answer

Windows Hello for Business configured for all users.

Question 4

Which THREE of the following are valid detection rule types for a Win32 app in Microsoft Intune? (Select THREE.)

Accepted Answer

MSI product code. MSI product code detection rules allow Intune to verify the presence of a Win32 app by checking the Windows Installer (MSI) product code in the registry (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall). This is a native detection method that directly confirms the application's installation state without requiring custom scripts.

Answer

Windows feature

Answer

DNS query

Question 5

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Accepted Answer

The Microsoft Intune agent installed on the Linux device.. The Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

An Azure Active Directory Premium P2 license for each user.

Question 6

Which TWO prerequisites are required for Windows Autopilot self-deploying mode?

Accepted Answer

Device is registered in Windows Autopilot. For Windows Autopilot self-deploying mode, the two key prerequisites are that the device must be registered in Windows Autopilot (A) and have a TPM 2.0 chip (E) for hardware-based attestation. A supported Windows edition (C) is also needed, but it is a general requirement for any Autopilot mode and not specific to self-deploying. Options B and D are not required because this mode is device-driven and does not need a user account or premium licensing.

Answer

A user account with Intune license

Answer

Windows 11/10 Pro, Enterprise, or Education edition

Answer

Microsoft Entra ID P1 or P2 license

Question 7

An organization uses Microsoft Intune to manage Windows 11 devices. They want to deploy a custom script that runs during device provisioning (ESP – Enrollment Status Page). Which app type should they use?

Accepted Answer

PowerShell script (Device configuration). PowerShell scripts (Device configuration) are the correct choice because they can be assigned to run during the Enrollment Status Page (ESP) phase of Windows 11 provisioning. Unlike Win32 or LOB apps, PowerShell scripts are executed by the Intune Management Extension before the ESP completes, allowing custom actions like registry modifications or file creation to occur during the critical 'Device setup' stage. This ensures the script runs synchronously with ESP, blocking the provisioning process until completion.

Answer

Line-of-business app

Answer

Win32 app

Answer

Proactive remediations

Question 8

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

Accepted Answer

Verify that the devices can communicate with an on-premises domain controller.. In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Answer

Check the certificate profile assigned to the devices.

Answer

Ensure the devices have a VPN connection to the corporate network.

Answer

Review the conditional access policies for the users.

Question 9

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Accepted Answer

Assign the policy to a user group, which applies to devices enrolled by those users.. Microsoft Intune compliance policies can be assigned to user groups, and when a user in the group enrolls a device, the policy applies to that device. This is the most common deployment method, leveraging user-based targeting to ensure compliance settings are enforced on devices associated with those users.

Answer

Assign the policy directly to individual devices from the Intune console.

Answer

Assign the policy to a device category.

Question 10

Match each Microsoft 365 compliance feature to its description.

Accepted Answer

Data Loss Prevention: Helps prevent accidental sharing of sensitive information.. Compliance features are part of the Microsoft 365 security and compliance center, relevant for endpoint administrators.

Answer

Data Loss Prevention: Allows legal teams to search for content across Microsoft 365.

Answer

Sensitivity Labels: Defines how long content is kept and when it is deleted.

Question 11

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 12

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

Accepted Answer

Security baselines are configured and assigned in Intune endpoint security. Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Answer

Devices are onboarded to Defender for Endpoint

Answer

Group Policy objects are linked to the domain

Answer

Devices are registered in Microsoft 365 Defender portal

Question 13

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

Accepted Answer

uninstallPrevious: true. The `uninstallPrevious` setting in the Microsoft Edge Intune deployment profile forces the removal of any existing version of Edge (e.g., Beta, Dev, or older Stable) before the new version is installed. This ensures a clean installation and prevents conflicts, which is critical when deploying Edge as a required app via Intune for Windows devices.

Answer

appVersion: 96.0.1054.62

Answer

channel: Stable

Answer

intent: required

Question 14

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices. Which TWO conditions must be met?

Accepted Answer

The iOS devices must have the distribution profile installed.. IOS devices require a distribution profile (provisioning profile) to trust and install line-of-business (LOB) apps that are not distributed through the Apple App Store. The distribution profile contains the app ID, device IDs (if not using user enrollment), and the enterprise certificate, enabling the device to validate and run the app. Without this profile, the app will fail to install or launch due to code signing validation failures enforced by iOS.

Answer

The app must be packaged as an .appx file.

Answer

The app must be assigned to devices only, not users.

Answer

The app must be distributed via the Apple App Store.

Question 15

A hospital uses Intune to manage Windows 10 devices used by doctors. The devices should automatically install critical updates from Windows Update for Business. Which type of policy should the administrator create?

Accepted Answer

Update rings for Windows 10. Update rings for Windows 10 are the correct policy type in Intune to manage when and how Windows 10 devices receive updates from Windows Update for Business. This policy allows you to configure deferral periods, pause updates, and set the update behavior (e.g., automatic installation of critical updates) without requiring on-premises WSUS or manual approval.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (Update settings)