MD-102 Practice Test 12 — 15 Questions

Question 1

You need to manage updates for Windows 10 devices using Microsoft Intune. You want to ensure that critical security updates are installed within 7 days of release, while feature updates are deferred for 60 days. Which approach should you use?

Accepted Answer

Create a Windows update ring policy with quality update deferral set to 7 days and feature update deferral set to 60 days.. Option A is correct because Windows update ring policies in Microsoft Intune allow granular control over both quality (security) and feature update deferral periods. Setting quality update deferral to 7 days ensures critical security patches are installed within a week, while feature update deferral of 60 days delays non-security feature updates. This directly meets the requirement without additional profiles or compliance policies.

Answer

Create a Windows feature update profile to deploy the latest feature update after 60 days.

Answer

Create a device compliance policy requiring devices to install updates within 7 days.

Answer

Configure Windows Update for Business settings via a configuration profile.

Question 2

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

Accepted Answer

The administrative template does not configure the update channel; you must use the Office Deployment Tool.. Option A is correct because when you configure the update channel for Microsoft 365 Apps via an Intune administrative template (ADMX), the setting is applied as a Group Policy preference but does not actually trigger the update mechanism. Microsoft 365 Apps updates require the Office Deployment Tool (ODT) or the Office CDN to deliver the correct channel bits. The administrative template only sets the registry key for the channel; without the ODT or a corresponding update policy, devices remain on their current channel and do not receive new updates.

Answer

Devices are not configured for Windows Update for Business.

Answer

Devices need to be in the Semi-Annual Channel (Targeted) to receive updates.

Answer

The Semi-Annual Enterprise Channel is not supported for Microsoft 365 Apps.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Accepted Answer

Windows Defender Application Control (WDAC).. Windows Defender Application Control (WDAC) is a code integrity feature that restricts which executables, scripts, and installers can run on Windows 10 devices. It uses a trust-based model where only binaries signed by approved publishers or with specific hash values are allowed, making it a core component for application control in an Intune-managed environment.

Answer

Windows Information Protection (WIP).

Answer

BitLocker drive encryption.

Question 4

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

Accepted Answer

Create a Conditional Access policy requiring device to be marked as compliant.. Option D is correct because a Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Answer

Create an app protection policy for Windows 365 app.

Answer

Configure the Cloud PC provisioning policy to allow only compliant devices.

Answer

Assign a device compliance policy to all users.

Question 5

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

Accepted Answer

Security baselines are configured and assigned in Intune endpoint security. Option C is correct because Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Answer

Devices are onboarded to Defender for Endpoint

Answer

Group Policy objects are linked to the domain

Answer

Devices are registered in Microsoft 365 Defender portal

Question 6

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

Accepted Answer

Include the 'Language' and 'RegionalSettings' settings in the PPKG.. Windows Configuration Designer (WCD) directly supports configuring language and regional settings within a provisioning package (PPKG) through built-in settings. Including the 'Language' and 'RegionalSettings' settings in the PPKG ensures these configurations are applied during the out-of-box experience (OOBE) or provisioning process, without requiring additional scripts or policies. This is the most efficient and supported method for offline or Autopilot pre-provisioning scenarios.

Answer

Add a PowerShell script that runs during Autopilot to set language and region.

Answer

Assign an Intune Language Pack policy to the device group.

Answer

Create a Group Policy Object that sets language and region, and link it to the device OU.

Question 7

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

Accepted Answer

Devices must have line-of-sight to an on-premises domain controller.. For hybrid Azure AD join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Answer

Devices must have VPN connectivity to Azure.

Answer

An Intune connector for Active Directory must be installed.

Answer

Azure AD Connect must be configured with password hash sync.

Question 8

You have deployed the above compliance policy in Microsoft Intune. A Windows 10 device running version 10.0.19042.0 is marked as noncompliant. You verify that the device meets all password, encryption, firewall, and Defender requirements. What is the most likely reason for noncompliance?

Accepted Answer

The device is running a version higher than the maximum OS version.. The compliance policy includes a maximum OS version rule, and the device is running version 10.0.19042.0. Since this version is higher than the configured maximum, the device is marked as noncompliant even though it meets all other requirements. In Intune, OS version rules are evaluated as strict comparisons, so exceeding the maximum triggers noncompliance regardless of other settings.

Answer

The device is running a version lower than the minimum OS version.

Answer

The device's antivirus software is not Microsoft Defender.

Answer

The device does not have a TPM 2.0 chip.

Question 9

Which TWO methods can you use to enroll macOS devices in Microsoft Intune?

Accepted Answer

User-initiated enrollment via Company Portal. Options A and B are correct because Automated Device Enrollment (ADE) and user-initiated enrollment are supported for macOS. Option C is wrong because Windows Autopilot is for Windows. Option D is wrong because Google Zero Touch is for Android. Option E is wrong because Apple Configurator is for iOS only.

Answer

Google Zero Touch Enrollment

Answer

Windows Autopilot

Answer

Apple Configurator

Question 10

A company is planning to use Windows Autopilot to deploy new devices. They want to ensure that devices are automatically enrolled in Microsoft Intune when a user signs in with their Microsoft Entra ID credentials. Which configuration is required?

Accepted Answer

Configure an Enrollment Status Page (ESP) profile in Intune.. Option A is correct because you need to configure an Enrollment Status Page (ESP) policy that allows automatic enrollment. Option B is wrong because MDM auto-enrollment is configured in Microsoft Entra ID, not Intune. Option C is wrong because a compliance policy does not enforce enrollment. Option D is wrong because device enrollment restrictions do not enable automatic enrollment.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Enforce enrollment'.

Answer

Set device enrollment restrictions to allow all device platforms.

Answer

Configure MDM auto-enrollment in Microsoft Intune admin center.

Question 11

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

Accepted Answer

The devices are not connected to the internet.. Option A is correct because Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Answer

The hardware hashes are invalid.

Answer

The devices are not running Windows 11 Pro or Enterprise.

Answer

The user does not have an Intune license.

Question 12

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

Accepted Answer

Upload the hardware hash to Microsoft Intune to register the device.. The device is not yet registered in Autopilot. You need to upload the hardware hash to Intune. Option A is correct. Option B is wrong because even if the device is already registered, the 'Unknown' state indicates it is not. Option C is wrong because using a provisioning package is not needed if Autopilot is desired. Option D is wrong because the script already works; re-running won't help.

Answer

Assign an Autopilot deployment profile to the device group.

Answer

Run the script again with the -Online parameter.

Answer

Use a provisioning package to set up the device manually.

Question 13

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

Accepted Answer

Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.. Option A is correct because setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Answer

Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

Answer

Set 'Update deferral period (days)' to 7.

Answer

Set 'Update deferral period (days)' to 30.

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Accepted Answer

Verify the device is a member of the assigned device group.. Option B is correct because the most common issue is that the assigned user or device group does not contain the target device. Option A is wrong because kiosk mode does not require a specific Windows edition; it works on Pro and Enterprise. Option C is wrong because Policy Manager is not a real Intune feature. Option D is wrong because notification is not required for kiosk mode to apply.

Answer

Ensure the device is running Windows 10 Enterprise.

Answer

Run the Policy Manager tool on the device.

Answer

Check the device's notification area for a policy update prompt.

Question 15

You need to prepare on-premises Windows devices for a migration to Microsoft Intune. Which tool should you use to generate a configuration package that can be deployed via Group Policy or manual installation?

Accepted Answer

Microsoft Intune Management Extension. The Microsoft Intune Management Extension (IME) is the correct tool because it generates a configuration package (a .intunewin file) that can be deployed via Group Policy or manual installation to on-premises Windows devices. This package contains the IME agent and a PowerShell script that, when executed, enrolls the device into Intune and applies MDM policies, enabling a seamless migration without requiring direct network connectivity to Intune during the initial deployment.

Answer

Windows Autopilot

Answer

Configuration Manager

Answer

Microsoft Intune Troubleshooting Tool