MD-102 Practice Test 13 — 15 Questions

Question 1

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Accepted Answer

Open GPMC, then edit GPO, then navigate to exclusions, then configure exclusions, then force GP update.. The correct order to configure Windows Defender Antivirus exclusions via Group Policy is to first open the Group Policy Management Console (GPMC), edit the desired Group Policy Object (GPO), navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Exclusions, configure the specific exclusions (e.g., file, folder, or process exclusions), and then force a Group Policy update using gpupdate /force to apply the changes immediately. This sequence ensures that the policy settings are properly accessed and applied, preventing common errors like applying an empty configuration or navigating to a non-edited GPO.

Answer

Open GPMC, then navigate to exclusions, then edit GPO, then configure exclusions, then force GP update.

Answer

Open GPMC, then edit GPO, then configure exclusions, then navigate to exclusions, then force GP update.

Answer

Open GPMC, then edit GPO, then force GP update, then navigate to exclusions, then configure exclusions.

Question 2

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Intune to manage Windows 10 and iOS devices. The company recently experienced a malware outbreak on several Windows 10 devices. The security team wants to implement a solution that can automatically remediate threats on Windows 10 devices by isolating them from the network and running a full antivirus scan. They also want to be alerted when a threat is detected. You have already configured Microsoft Defender for Endpoint (MDE) and devices are onboarded. What should you configure in Intune to meet these requirements?

Accepted Answer

Create a device compliance policy that marks devices with active threats as non-compliant, and configure the non-compliance action to 'Retire device' and 'Send notification'.. It uses Intune's device compliance policy integrated with Microsoft Defender for Endpoint. When MDE detects an active threat on a Windows 10 device, Intune marks it as non-compliant. The configured non-compliance action 'Retire device' will remove the device from management and corporate access, effectively isolating it, while 'Send notification' alerts the security team. This automatically remediates the threat by isolating the device and running a full scan (as part of MDE's response). Option A only blocks resource access without remediation; Option C uses firewall rules which do not provide automated threat response; Option D is incorrect because AppLocker cannot run antivirus scans.

Answer

Configure a device compliance policy to require Device Health Attestation (DHA) and set the action for non-compliance to 'Quarantine device'.

Answer

Enable Windows Defender Firewall with advanced security and create an inbound rule to block all traffic.

Answer

Configure AppLocker to block all apps and set the action to 'Run antivirus scan'.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a minimum OS version can access corporate email via Microsoft Outlook for iOS. Which policy type should you configure?

Accepted Answer

App protection policy (MAM). App Protection Policies (MAM) allow you to target specific apps like Microsoft Outlook for iOS with conditional launch settings, including minimum OS version requirements. This policy applies at the app layer without requiring device enrollment, making it ideal for controlling access to corporate data in Outlook on iOS devices based on OS version.

Answer

Device configuration policy

Answer

Conditional Access policy

Answer

Device compliance policy

Question 4

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Accepted Answer

TPM 2.0 chip. Options D and E are correct. Self-deploying mode requires a physical TPM 2.0 chip for attestation and network connectivity to Microsoft Intune. Option A is wrong because a user account is not required. Option B is wrong because a product key is not needed. Option C is wrong because MDM user affinity is not required.

Answer

A user account with Intune license

Answer

A Windows product key

Answer

MDM user affinity

Question 5

A user on a Windows 11 device managed by Intune reports that a required Win32 app is not installing. The Intune console shows the app assignment is 'Required' and the device status is 'Error'. You review the detection rules and find that the app is detected by file version. The app installs successfully when run manually with admin rights. What is the most likely cause?

Accepted Answer

The detection rule is incorrectly matching an existing file version.. The detection rule uses file version to determine if the app is installed. If an existing file on the device already matches the version specified in the detection rule, Intune will consider the app as already installed and skip the installation, even though the required app is not actually present. This causes a mismatch where the console shows an error because the app assignment is 'Required' but the detection logic falsely reports success, preventing the installation from running.

Answer

The installation script returns a non-zero exit code.

Answer

The Intune Management Extension is not running.

Answer

The installation script fails in system context.

Question 6

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that devices cannot connect to unsecured Wi-Fi networks. Which policy type should you configure?

Accepted Answer

Wi-Fi profile.. A Wi-Fi profile in Microsoft Intune is specifically designed to configure Wi-Fi settings on devices, including security protocols and authentication methods. By configuring a Wi-Fi profile to only allow connections to secured networks (e.g., WPA2-Enterprise or WPA3), you can prevent devices from connecting to unsecured Wi-Fi networks. This policy type directly controls the Wi-Fi connection behavior at the device level.

Answer

Device configuration profile with network settings.

Answer

Compliance policy.

Answer

Certificate profile.

Question 7

A company uses Configuration Manager to deploy Windows 10 to 2000 devices. After deployment, several devices report that the Start menu layout is not applied. The administrator used a provisioning package to configure Start layout. What is the most likely cause of the issue?

Accepted Answer

Group Policy settings are overriding the Start layout configuration.. The most likely cause is that Group Policy settings are overriding the Start layout configuration. Provisioning packages apply settings during OOBE, but Group Policy is applied later and can overwrite those settings. The other options are less likely: Azure AD join is not required for Start layout; signing issues would prevent application, not override; and the timing of first logon is after OOBE, but Group Policy still overrides.

Answer

The devices are not Azure AD joined.

Answer

The provisioning package was not signed properly.

Answer

The provisioning package was applied after user first logon.

Question 8

Your company has iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot remove the Microsoft Intune Company Portal app from their devices. What should you configure?

Accepted Answer

Configure a Required app assignment with removal prevention.. Configuring a Required app assignment with removal prevention in Microsoft Intune ensures that the Company Portal app is installed as a required app and users cannot uninstall it. This setting is specifically designed to prevent removal of managed apps on iOS/iPadOS devices enrolled in Intune, leveraging the MDM channel to enforce the policy.

Answer

Configure an App Configuration policy for Company Portal.

Answer

Configure an App Protection policy for Company Portal.

Answer

Configure a Device Compliance policy to require Company Portal installation.

Question 9

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

Accepted Answer

The device is powered off or not connected to the internet. If the device is powered off or not connected to the internet, it cannot check in with Intune to receive new policies. Option A is wrong because an Intune service outage would affect multiple devices, not just one. Option C is wrong because conflicting policies would not prevent check-in; the device would still check in and report conflicts. Option D is wrong because an expired enrollment certificate would prevent enrollment or cause immediate issues, not just a delayed check-in after three days.

Answer

The Intune service is experiencing an outage

Answer

The device has conflicting policies from another MDM

Answer

The device's enrollment certificate has expired

Question 10

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to ensure that when a device is offboarding, all collected forensic data is deleted from Microsoft 365. What should you do?

Accepted Answer

Use the 'Remove device from organization' action in Microsoft Defender XDR console.. The 'Remove device from organization' action in the Microsoft Defender XDR console triggers a full offboarding workflow that deletes all collected forensic data (including machine-level telemetry, alerts, and investigation packages) from the Microsoft 365 backend. This action also revokes the device's access to the Defender for Endpoint service and removes its sensor registration, ensuring compliance with data retention policies.

Answer

Disable the device's onboarding policy in Intune.

Answer

Run a PowerShell script to execute 'Remove-MpPreference -DisableRealtimeMonitoring $true'.

Answer

Uninstall the Microsoft Defender for Endpoint sensor from the device.

Question 11

Which THREE conditions must be met for a Windows 10 device to be able to use Windows Autopilot self-deploying mode?

Accepted Answer

The device must be Azure AD joined.. Azure AD join is required for self-deploying mode because this mode provisions a device for shared or kiosk scenarios without user interaction. The device must be joined to Azure AD to establish a device identity and allow policy application before any user signs in, which is a core requirement for the zero-touch provisioning flow.

Answer

The device must be Hybrid Azure AD joined.

Answer

A user must be assigned to the device in Autopilot.

Question 12

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Accepted Answer

The virtual machine does not have Secure Boot enabled in its firmware settings.. Secure Boot is a hardware-based feature that ensures the system boots using only software trusted by the PC manufacturer. In virtual machines, Secure Boot is often not enabled by default or may not be supported by the hypervisor. For Intune compliance, if the VM does not have Secure Boot enabled, it will report as non-compliant. Option C is correct because the VM's firmware settings likely have Secure Boot disabled. Option A is incorrect because the device may still be enrolled correctly. Option B is incorrect because password policy is unrelated to Secure Boot. Option D is incorrect because BitLocker is a separate encryption feature not required for Secure Boot.

Answer

The device is not enrolled in Intune correctly.

Answer

The password policy is conflicting with Secure Boot.

Answer

The device does not have BitLocker enabled, which is required for Secure Boot.

Question 13

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully, but the detection rule incorrectly reports the app as not installed, causing Intune to attempt reinstallation repeatedly. Which detection rule method is most likely causing this issue?

Accepted Answer

MSI product code detection uses a product code that does not match the installed app. When an MSI product code detection rule uses a product code that does not match the GUID of the installed application, Intune will always evaluate the app as 'not installed' regardless of the actual installation state. This mismatch causes Intune to repeatedly attempt reinstallation on every check-in cycle, as the detection logic never finds a matching product code in the Windows Installer database.

Answer

File existence detection checks for a file that is installed by the app

Answer

Registry detection checks for a registry key that is created by the app

Answer

Custom script detection returns exit code 0 even if app is not present

Question 14

Which THREE are supported reporting options in Microsoft Intune for device compliance?

Accepted Answer

Export compliance data to CSV. Microsoft Intune allows administrators to export compliance data to a CSV file from the compliance dashboard. This is a supported reporting option that enables offline analysis and archival of device compliance status.

Answer

Real-time compliance dashboard

Answer

Scheduled email reports

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that some required applications are not being installed on their devices. You confirm the applications are assigned as 'Required' to a device group, and the devices are online. What is the most likely cause?

Accepted Answer

The Intune Management Extension is missing. The Intune Management Extension is required to process Win32 app installations. If the extension is missing or not running, required apps will not install even though the device is online and assignment is configured. Option A is wrong because BitLocker encryption status does not affect app installation. Option B is wrong because device-targeted assignments do not require the user to be logged in. Option C is wrong because the enrollment status page does not block required app installations after enrollment is complete.

Answer

BitLocker encryption is pending

Answer

The user is not logged in to the device

Answer

The enrollment status page is blocking installation