MD-102 Practice Test 14 — 15 Questions

Question 1

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

Accepted Answer

The device is powered off or not connected to the internet. Option D is correct because the device may be powered off or not connected to the internet, preventing check-in. Option A is wrong because certificate expiry would affect enrollment, not check-in. Option B is wrong because Intune service outage is unlikely for a single device. Option C is wrong because policy conflict would not prevent check-in.

Answer

The Intune service is experiencing an outage

Answer

The device has conflicting policies from another MDM

Answer

The device's enrollment certificate has expired

Question 2

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

Accepted Answer

Apps are assigned to devices instead of users. Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Answer

Device type is restricted in enrollment restrictions

Answer

VPP token is not configured for user enrollment

Answer

User Enrollment does not support app distribution

Question 3

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. Option A is correct because 'Require device to be marked as compliant' is the standard setting for this scenario. Option B is wrong because multi-factor authentication is separate. Option C is wrong because hybrid Azure AD join is for device identity, not compliance. Option D is wrong because app protection policies are for mobile app management, not device compliance.

Answer

Require multi-factor authentication

Answer

Require hybrid Azure AD joined device

Answer

Require approved client app

Question 4

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

Accepted Answer

Enable the TPM in the device's BIOS settings.. Option B is correct because the device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Answer

Replace the device's motherboard.

Answer

Assign a grace period for the device.

Answer

Remove the tpmRequired setting from the compliance policy.

Question 5

Refer to the exhibit. You are reviewing a Win32 app configuration in Microsoft Intune. The app is not installing on some Windows 10 devices. Which is the most likely reason?

Accepted Answer

The devices have an OS version lower than 10.0.19041.. The correct answer is A because the exhibit shows the 'Minimum OS version' requirement set to 10.0.19041 (Windows 10 version 20H1/2004). Devices with an OS build lower than this threshold will fail to install the Win32 app, as Intune enforces this requirement before executing the installation command. This is a common configuration issue when deploying apps to a mixed-OS environment.

Answer

The install command line is missing the /silent switch.

Answer

The detection rule path is incorrect.

Answer

The install experience is set to system, but should be user.

Question 6

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

Accepted Answer

Automated device enrollment (with user affinity). Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Answer

User enrollment

Answer

Device enrollment (without user affinity)

Answer

Bring your own device (BYOD) enrollment

Question 7

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

Accepted Answer

The current OS version on the device.. Option A is correct because the first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Answer

The user's license status.

Answer

The compliance policy is assigned to the device.

Answer

The device is connected to the internet.

Question 8

You are troubleshooting a Windows 10 device that is not receiving Intune policies. The device is enrolled and shows as 'Active' in the Intune admin center. You run the Get-MgDeviceManagementManagedDevice cmdlet and the device's managementAgent is 'mdm'. Which of the following is the most likely cause of the issue?

Accepted Answer

The device's last sync time is more than 24 hours ago.. Option C is correct because the device's last sync time being more than 24 hours ago indicates that the device has not checked in with Intune within the required interval. Intune policies are delivered during a sync cycle, and if the device hasn't synced recently, it will not receive new or updated policies. The managementAgent being 'mdm' confirms the device is MDM-managed, so the sync interval is critical for policy delivery.

Answer

The device is co-managed and the workload is set to Configuration Manager.

Answer

The device's enrollment certificate has expired.

Answer

The device is retired from Intune.

Question 9

Which TWO actions can you perform using Microsoft Intune to manage devices that are not compliant? (Choose two.)

Accepted Answer

Send a push notification to the user.. Option D is correct because Microsoft Intune can send push notifications to noncompliant devices via the Company Portal app, alerting users about compliance issues and required actions. Option E is correct because marking a device as noncompliant in the Intune admin center is a manual action that updates the device's compliance state, which then triggers conditional access policies to block resources. Both actions are available for managing noncompliant devices without requiring user interaction or remote wipe.

Answer

Automatically send an email to the user's manager.

Answer

Remotely wipe the device.

Answer

Block access to corporate resources.

Question 10

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

Accepted Answer

The policy has not been applied to the device yet.. Option D is correct because if the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer

Real-time scanning is set to monitorAllFiles, but the file was an archive.

Answer

The scan type is set to quick, which does not scan downloaded files.

Answer

The cloud block level is set to high, which may block unknown files, but known files might be missed.

Question 11

A company uses Microsoft Intune to manage Windows 10 devices. They want to prevent users from installing unapproved applications. Which approach provides the most granular control?

Accepted Answer

Deploy AppLocker rules via Intune to allow only approved publishers.. Option C is correct because AppLocker allows you to create rules based on file attributes, such as publisher, to allow only approved apps. Option A is wrong because Windows Defender SmartScreen only warns about unknown apps, but does not block installation. Option B is wrong because User Account Control (UAC) does not prevent installation. Option D is wrong because the Microsoft Store for Business only controls store apps, not all applications.

Answer

Use the Microsoft Store for Business to deploy only approved apps.

Answer

Enable Windows Defender SmartScreen to block unknown apps.

Answer

Configure User Account Control (UAC) to always notify.

Question 12

Which THREE components are required for a successful Windows Autopilot self-deploying mode deployment?

Accepted Answer

Windows Autopilot device registration using the hardware hash.. B is correct because Windows Autopilot self-deploying mode requires the device to be registered with Microsoft using its hardware hash. This registration links the device to an Azure AD tenant and enables the deployment profile to be downloaded automatically during the out-of-box experience, without user interaction.

Answer

A local administrator account created on the device.

Answer

A Microsoft 365 E3 license assigned to the user.

Question 13

A user's Windows 11 device is not receiving the Company Portal app after enrollment. The device is enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The device is not connected to the internet.. The Company Portal app is delivered to enrolled devices via Intune, but the initial download and installation require an active internet connection to reach Microsoft's cloud services. If the device is not connected to the internet, the enrollment process may complete locally, but the Company Portal app will not be pushed or installed until connectivity is restored. This is the most likely cause because the question states the device is already enrolled, ruling out licensing or compliance issues that would prevent enrollment itself.

Answer

The device is not compliant with security policies.

Answer

The device is running Windows 10 instead of Windows 11.

Answer

The user does not have an Intune license.

Question 14

Which TWO Windows Update for Business policies can you configure using Microsoft Intune?

Accepted Answer

Feature update version targeting. Intune supports configuring update ring policies for deferral periods and feature update policies for targeting specific versions. Quality update deferral is part of update rings, but the question asks for policies; feature update policy is a separate policy type.

Answer

Driver update deferral period

Answer

Windows Defender definition update schedule

Answer

Microsoft 365 Apps update channel

Question 15

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

Accepted Answer

Assign the device to a different update ring with a 0-day deferral.. The device is assigned to an update ring that defers updates by 30 days, which is why it is not receiving the latest security updates despite being compliant. To immediately receive the latest updates, you must assign the device to a different update ring with a 0-day deferral, as update rings in Microsoft Intune control the deferral period for Windows Update for Business. Changing the ring triggers the device to check for updates based on the new policy, ensuring immediate availability of security updates.

Answer

Change the compliance policy to require immediate updates.

Answer

Run Windows Update manually on the device.

Answer

Re-enroll the device in Intune.