MD-102 Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the device is a member of the assigned device group.. The most common reason a kiosk mode profile fails to apply is that the device is not a member of the assigned device group. Intune evaluates policy targeting based on group membership; if the device is missing from the group, the profile will never be delivered. Verifying group membership is the first logical troubleshooting step before investigating device-level issues.

Answer

Ensure the device is running Windows 10 Enterprise.

Answer

Run the Policy Manager tool on the device.

Answer

Check the device's notification area for a policy update prompt.

Question 2

You need to ensure that devices enrolled in Microsoft Intune automatically receive Windows quality updates as soon as they are released. Which update ring setting should you configure?

Accepted Answer

Set 'Quality update deferral period (days)' to 0. In Intune Windows update rings, the 'Quality update deferral period (days)' setting controls how long quality updates (security and reliability fixes) are deferred after release. Setting it to 0 means devices receive quality updates as soon as they are released, satisfying the requirement.

Answer

Set 'Driver update deferral period (days)' to 0

Answer

Set 'Feature update deferral period (days)' to 0

Answer

Set 'Microsoft product updates' to 'Allow'

Question 3

Refer to the exhibit. You run a PowerShell command to check the assignment status of device configuration profiles. The 'BitLocker Policy' shows 'Pending'. What does 'Pending' indicate?

Accepted Answer

The policy has been assigned to the device but not yet applied. In Microsoft Intune, when a device configuration profile shows a status of 'Pending', it means the policy has been successfully assigned to the device in the cloud but has not yet been applied or reported back as compliant. This is a normal transitional state that occurs while the device checks in with the Intune service, downloads the policy, and applies it during the next sync cycle. The 'Pending' status does not indicate failure, conflict, or user approval requirements.

Answer

The policy is waiting for user approval

Answer

The policy assignment failed due to a conflict

Answer

The policy has been successfully applied

Question 4

A company uses Microsoft Intune to manage iOS devices. They want to enforce a policy that requires a passcode of at least 6 characters and auto-lock after 5 minutes. Which configuration profile type should they use?

Accepted Answer

Device restrictions profile.. A Device restrictions profile is the correct configuration profile type because it contains the security settings for iOS devices, including passcode requirements (minimum length, complexity) and device lock timeouts (auto-lock after minutes). This profile type enforces device-level security policies directly managed by Intune, making it the appropriate choice for requiring a 6-character passcode and 5-minute auto-lock.

Answer

Wi-Fi profile.

Answer

VPN profile.

Answer

Email profile.

Question 5

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows devices? (Choose two)

Accepted Answer

View hardware inventory of a device.. The Microsoft Intune admin center provides a hardware inventory view for managed Windows devices, displaying details such as processor, RAM, disk space, and firmware version. This data is collected via the Intune Management Extension and device inventory reports, enabling administrators to assess device compliance and readiness without requiring on-premises tools.

Answer

Reset a user's password.

Answer

Manage on-premises Active Directory objects.

Answer

Assign Microsoft 365 licenses to a user.

Question 6

You are deploying a line-of-business (LOB) app to iOS devices managed by Intune. The app requires a specific configuration to access internal resources. Which approach should you use to deliver the configuration?

Accepted Answer

Create an App Configuration Policy targeting managed devices. An App Configuration Policy targeting managed devices is the correct approach because it allows you to supply XML or JSON settings directly to the LOB app on iOS devices enrolled in Intune. This policy is applied when the app runs, enabling it to access internal resources without requiring a separate device profile or user interaction.

Answer

Assign a custom device configuration profile

Answer

Deploy an App Protection Policy

Answer

Use Apple Volume Purchase Program (VPP) tokens

Question 7

A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?

Accepted Answer

Review the Intune management extension logs on the device.. The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.

Answer

Verify the device compliance policy.

Answer

Check the Company Portal app version.

Answer

Reassign the app to the user.

Question 8

An IT administrator needs to ensure that iOS devices enrolled in Intune require a PIN of at least 6 digits. Where should the administrator configure this setting?

Accepted Answer

Device compliance policy for iOS. Device compliance policies in Intune define the rules and settings that devices must meet to be considered compliant, including password requirements such as minimum PIN length. For iOS devices, the compliance policy includes settings for passcode complexity and length. App protection policies apply to apps, not device-wide settings; Conditional Access policies enforce access based on compliance but do not define the PIN requirement; Enrollment restrictions control which devices can enroll, not security settings.

Answer

App protection policy

Answer

Conditional Access policy

Answer

Enrollment restrictions

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The devices have not checked in with Intune since the policy was assigned.. Intune compliance policies are evaluated only when devices check in with the service. If a device has not performed a check-in since the policy was assigned, it will not have received or evaluated the new policy, and its compliance status will remain based on the previous state. The check-in interval for iOS/iPadOS devices is typically every 8 hours, but can be forced manually by the user. Until the device checks in, it cannot be marked compliant even if it meets the passcode and OS version requirements.

Answer

The devices have multiple compliance policies applied.

Answer

iOS devices do not support compliance policies.

Answer

The policy was assigned to a user group instead of a device group.

Question 10

A user reports that their iOS device is not receiving email on their work account. The device is enrolled in Intune. You verify that the Exchange ActiveSync profile is assigned correctly. What should you check next?

Accepted Answer

Check the device's compliance status in Intune.. When an iOS device enrolled in Intune is not receiving email despite a correctly assigned Exchange ActiveSync profile, the next logical check is the device's compliance status. Conditional Access policies often require compliant devices to access Exchange Online, so a non-compliant device will be blocked from syncing email even if the profile is assigned.

Answer

Ensure the MDM authority is set to Intune.

Answer

Check if an app protection policy is assigned to the user.

Answer

Verify that the device is enrolled in device enrollment manager mode.

Question 11

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device compliance policies.. A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.

Answer

No additional configuration is needed.

Answer

Device configuration policies.

Answer

App protection policies.

Question 12

An Android device running OS version 9.0 with app version 1.5.0 is targeted by the app protection policy in the exhibit. What is the expected behavior when the user tries to access work data?

Accepted Answer

Access is allowed without any warning because minimum requirements are met. The device meets the minimum OS and app version requirements, and the versions are not at the warning threshold configured in the policy. Therefore, access is allowed without any warning.

Answer

Access is blocked because the OS version is below the warning level

Answer

Access is allowed with a warning to update the app and OS

Answer

Access is blocked because the app version is below the warning level

Question 13

Your organization needs to deploy a web app link to users' devices via Microsoft Intune. Which app type should you select?

Accepted Answer

Web link. C is correct because a Web link app type in Microsoft Intune allows you to deploy a shortcut to a web app on users' devices without installing any software. This is ideal for linking to a web app that runs in a browser, as it simply places an icon on the device's app list or home screen that opens the specified URL.

Answer

Windows app (Win32)

Answer

iOS store app

Answer

Managed Google Play app

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile. Windows Autopilot self-deploying mode enrolls devices into Intune with zero user interaction — the device authenticates using its TPM-attested hardware identity, so no credentials are entered. Pairing it with an Enrollment Status Page (ESP) profile blocks the device from being used until required apps and policies are applied, which is exactly what the scenario requires.

Answer

Configure a Group Policy to auto-enroll devices into Intune

Answer

Configure a device enrollment manager (DEM) account

Answer

Configure co-management with Microsoft Configuration Manager

Question 15

Your organization uses Microsoft Intune to manage Android devices. You need to deploy an app that is available in the Managed Google Play store as a required app. What must you do first?

Accepted Answer

Connect Intune to the Managed Google Play store.. To deploy a required app from the Managed Google Play store, you must first establish the connection between Intune and the Managed Google Play store. This connection is a prerequisite because Intune uses it to synchronize apps, manage licenses, and push required apps to Android devices. Without this connection, Intune cannot access or deploy any apps from the Managed Google Play store.

Answer

Enroll the device in Intune.

Answer

Install the Managed Google Play app on the device.

Answer

Upload the app package to Intune.