MD-102 Practice Test 14 — 15 Questions

Question 1

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint sensor on the devices. (Microsoft Defender for Endpoint sensor) is correct. The sensor is the agent installed on devices that collects and reports vulnerability information to Microsoft Defender XDR. If the sensor is misconfigured, missing, or not running, devices will not report vulnerability data. Option A (Microsoft Sentinel workspace) is a SIEM that ingests security data but is not the source of vulnerability data. Option C (Intune MDM authority) manages device compliance and configuration but does not directly collect vulnerability data. Option D (Microsoft Purview compliance portal) handles data governance and compliance, not vulnerability reporting.

Answer

Microsoft Sentinel workspace

Answer

Intune MDM authority

Answer

Microsoft Purview compliance portal

Question 2

You need to ensure that all Windows 10 devices automatically install critical security updates from Windows Update as soon as they are released. Which Windows Update for Business policy setting should you configure?

Accepted Answer

Set 'Quality update deferral period' to 0 days. Setting the 'Quality update deferral period' to 0 days ensures that critical security updates (classified as quality updates in Windows Update for Business) are installed immediately upon release, with no deferral. This policy directly controls the delay before installation, and a value of 0 means updates are applied as soon as they are available from Microsoft.

Answer

Set 'Update notification level' to 'Display notification'

Answer

Configure active hours to allow automatic updates

Answer

Enable 'Pause feature updates'

Question 3

Adventure Works uses Microsoft Intune for device management. You need to deploy a custom PowerShell script to all Windows 10 devices to configure a registry key for security compliance. The script is already uploaded to Intune as a PowerShell script. However, the script is not running on some devices. You have confirmed that the devices are enrolled, have the Intune Management Extension installed, and are online. What should you check first?

Accepted Answer

Verify that the PowerShell execution policy on the devices allows script execution (e.g., RemoteSigned or Bypass).. The script execution policy may block scripts. The Intune Management Extension runs scripts under the system account, which respects the local execution policy. Checking the execution policy is the first step. The script assignment should be verified if it wasn't assigned, but the question states it is uploaded; assignment is a separate step. The user's role does not affect script execution. The device's OS architecture is unlikely the issue.

Answer

Check that the user has administrative privileges on the device.

Answer

Confirm that the device is running a 64-bit version of Windows.

Answer

Ensure the script is assigned to the device group.

Question 4

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

Accepted Answer

Assign the app and configure 'Require device compliance' with a filter for minimum OS version.. Intune allows you to create a filter based on device properties such as OS version, and apply that filter to app assignments. This ensures the deployment is only available to devices meeting the minimum OS version. Option B is incorrect because 'Uninstall' intent would remove the app, not deploy it with OS filtering. Option C is incorrect because 'Available for enrolled devices' without filters does not enforce any OS version requirement. Option D is incorrect because assigning as 'Required' to all devices does not filter by OS version.

Answer

Assign the app with 'Uninstall' intent.

Answer

Assign the app as 'Available for enrolled devices' without filters.

Answer

Assign the app as 'Required' to all devices.

Question 5

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

Accepted Answer

App protection policy (MAM). App protection policies (MAM) protect corporate data in apps like Outlook without requiring device enrollment in MDM. Option A (Device compliance policy) requires MDM enrollment. Option B (Device configuration profile) is for device settings, not data protection. Option C (Conditional Access policy) controls access but does not directly protect data within apps.

Answer

Device compliance policy

Answer

Device configuration profile

Answer

Conditional Access policy

Question 6

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Accepted Answer

Retain the Autopilot registration. Options C and D are correct. Windows Autopilot reset retains the device's Autopilot registration (option C) and removes personal files and apps (option D). Option A is incorrect because Autopilot reset does not change the primary user; that requires a different process. Option B is incorrect because Autopilot reset does not reinstall Windows from scratch; it refreshes the existing OS. Option E is incorrect because Autopilot reset does not remove the device from Microsoft Intune; that would require a manual action.

Answer

Change the primary user of the device

Answer

Reinstall Windows 11 from scratch

Answer

Remove the device from Microsoft Intune

Question 7

Refer to the exhibit. You run the PowerShell command on a Windows 10 device to troubleshoot why a Win32 app did not install. What information does this command provide?

Accepted Answer

The start of an app installation attempt. The PowerShell command `Get-MgDeviceManagementManagedDevice -DeviceId <id> | Select-Object -ExpandProperty LastAppInstallStartTime` retrieves the timestamp of the most recent attempt to start installing an app on the managed device. This is useful for troubleshooting because it tells you when the installation process was initiated, helping to determine if the device is receiving the installation trigger from Intune. A correct start time indicates the policy was delivered and the client began processing, even if the installation later failed.

Answer

The list of assigned policies

Answer

The result of a completed app installation

Answer

Errors from the last sync

Question 8

You have a Windows 11 device enrolled in Intune that is not receiving configuration profiles. The device shows 'Pending' status for all profiles. You confirm the device is connected to the internet and can reach Microsoft's servers. What is the most likely cause?

Accepted Answer

The device is not syncing with Intune.. If the device is not syncing, it will show 'Pending'. Option A is wrong because group membership is for assignment, not sync. Option B is wrong because certificate issues affect authentication, not profile delivery. Option D is wrong because the Intune service health is for global issues, not a single device.

Answer

The device is not in the correct security group for the profile assignment.

Answer

The device has a certificate issue preventing it from receiving profiles.

Answer

The Intune service is experiencing an outage.

Question 9

An organization uses Configuration Manager to deploy software updates to Windows 10 devices. The administrator wants to ensure that devices receive updates from the local distribution point rather than the cloud. Which boundary group option should be configured?

Accepted Answer

Prefer distribution points over cloud sources. The 'Prefer distribution points over cloud sources' boundary group option ensures that clients will attempt to download software updates from a local distribution point before falling back to a cloud-based source. This setting directly controls client behavior to prioritize on-premises distribution points, which aligns with the administrator's goal of keeping traffic local and avoiding cloud egress.

Answer

Enable peer caching

Answer

Use cloud distribution points only

Answer

Fallback to cloud sources

Question 10

You are deploying a new line-of-business (LOB) app to Windows 10 devices managed by Microsoft Intune. The app requires a specific registry key to be set before installation. What is the best approach to ensure the registry key is applied before the app installs?

Accepted Answer

Define a requirement rule in the Win32 app that checks for the registry key; if missing, use a proactive remediation script to create it.. Win32 app deployment in Intune supports requirement rules that can check for prerequisites like registry keys. When the requirement is not met, you can pair the app with a proactive remediation script that creates the missing registry key before the app installation runs, ensuring the dependency is satisfied without manual intervention.

Answer

Create a compliance policy that requires the registry key and mark the app as required.

Answer

Use a device configuration policy to set the registry key, then assign the app as available.

Answer

Include a PowerShell script in the app's installation command that sets the registry key before the main installer runs.

Question 11

Match each Microsoft 365 Apps update channel to its description.

Accepted Answer

Current Channel: Provides users with the newest features as soon as they are released by Microsoft.. Update channels control how Microsoft 365 Apps are updated, relevant for MD-102.

Answer

Current Channel: Provides users with new features twice a year, typically in January and July.

Answer

Monthly Enterprise Channel: Provides users with the newest features as soon as they are released by Microsoft.

Question 12

Which THREE conditions must be met for a device to automatically enroll in Windows Autopilot?

Accepted Answer

The device must be Azure AD joined or Hybrid Azure AD joined. Windows Autopilot requires the device to be either Azure AD joined or Hybrid Azure AD joined to establish a managed identity in the cloud. This identity enables the device to automatically receive a configuration profile that triggers the Autopilot deployment profile during the out-of-box experience (OOBE). Without this join state, the device cannot be recognized as an Autopilot-managed device.

Answer

The device must have BitLocker Drive Encryption enabled

Answer

The user must be a Global Administrator in Azure AD

Question 13

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that requires devices to run Windows version 22H2 or later. When you create the policy, which option must you select for the OS version requirement?

Accepted Answer

Minimum OS version. The requirement for devices to run Windows version 22H2 or later is a minimum version constraint. In Microsoft Intune compliance policies, the 'Minimum OS version' setting enforces that the device's OS version must be equal to or greater than the specified version, which directly matches the '22H2 or later' condition.

Answer

Require OS version

Answer

Maximum OS version

Answer

Exact OS version

Question 14

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Accepted Answer

Allows IT to provision devices remotely without physical access.. Windows Autopilot leverages cloud-based services to provision new devices, eliminating the need for IT staff to be physically present. Option C is correct because Autopilot allows IT to deploy a device by simply providing the user with the hardware; the device automatically joins Azure AD, enrolls in Intune, and applies policies over the internet. This remote provisioning capability is a core benefit, as it enables zero-touch deployment for remote workers or distributed offices.

Answer

Works offline without internet connectivity.

Answer

Enables deployment of custom operating system images.

Answer

Eliminates the need for any user interaction during setup.

Question 15

You need to deploy a Microsoft 365 Apps for enterprise configuration (e.g., exclude specific apps) to Windows 10 devices via Intune. Which tool should you use to generate the configuration XML?

Accepted Answer

Office Customization Tool (OCT). The Office Customization Tool (OCT) is the correct tool because it generates the configuration XML file (configuration.xml) that Intune uses to control Microsoft 365 Apps for enterprise deployments, including excluding specific apps like Access or Publisher. Intune's built-in Office deployment integration relies on this XML to define installation settings, and the OCT is the official Microsoft tool designed for this purpose.

Answer

Group Policy Management Console

Answer

Microsoft 365 admin center

Answer

Microsoft Intune admin center