MD-102 Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically receive the latest feature updates from the Windows 11 servicing channel. You configure a Windows 10 feature update policy targeting the devices. However, after 24 hours, devices still show Windows 10 version 22H2. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy is a Windows 10 feature update policy, but devices need a Windows 11 feature update policy to upgrade to Windows 11.. A Windows 10 feature update policy is designed to move devices between Windows 10 feature versions (e.g., 22H2 to 23H2). To upgrade devices from Windows 10 to Windows 11, you must use a Windows 11 feature update policy, which specifically targets the Windows 11 servicing channel. Since the policy targets Windows 10 feature updates, it will not trigger the OS upgrade to Windows 11, leaving devices on Windows 10 22H2.

Answer

Windows Update for Business is disabled in group policy.

Answer

The policy is not assigned to a device group containing the devices.

Answer

Devices have not been restarted after policy assignment.

Question 2

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

Accepted Answer

Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.. It leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Answer

Deploy Windows Autopilot for all new devices and ignore existing devices.

Answer

Purchase a third-party MDM tool to manage non-compliant devices.

Answer

Ask all users to manually enroll their devices using the Company Portal app.

Question 3

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes:
- 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune)
- 1,500 iOS devices (corporate-owned, managed via Intune)
- 500 Android devices (BYOD, managed via Intune with work profile)
- 200 macOS devices (corporate-owned, managed via Intune)

You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.

You have the following requirements:
1. Zero-touch enrollment for new Windows 11 devices.
2. Devices must be automatically configured with security policies and required applications.
3. Conditional access to Microsoft 365 resources based on device compliance.
4. Support for both corporate and BYOD devices.

Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

Accepted Answer

Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.. Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Answer

Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.

Answer

Assign Microsoft Intune licenses to all users who will receive the new devices.

Answer

Create a compliance policy that requires BitLocker encryption and a minimum OS version.

Question 4

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

Accepted Answer

Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.. Configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Azure AD-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Answer

Distribute a script to each user to run manually.

Answer

Deploy Windows Autopilot to reset and re-enroll each device.

Answer

Use the Intune Enrollment Status Page to force enrollment.

Question 5

You manage a fleet of 2,000 iOS devices for a healthcare organization. The devices are used by clinicians and must be enrolled in Intune. Due to security requirements, you must ensure that devices are supervised and that the Company Portal app is installed automatically. You have Apple Business Manager (ABM) set up with Intune. You need to configure the enrollment process so that when a new device is unboxed and turned on, it automatically enrolls and receives the required configuration. Which enrollment method should you use?

Accepted Answer

Automated Device Enrollment (ADE) with user affinity. Automated Device Enrollment (ADE) with user affinity is the correct method because it leverages Apple Business Manager (ABM) to supervise devices automatically during the initial setup, enforces the required supervision state, and installs the Company Portal app via a mandatory VPP app assignment. User affinity ensures that each device is associated with a specific clinician, enabling user-based policies and conditional access. This meets the healthcare organization's security requirements for supervised devices and automatic app deployment.

Answer

Device enrollment (without user affinity)

Answer

Company Portal enrollment

Answer

User enrollment (BYOD)

Question 6

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

Accepted Answer

Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.. Deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Answer

Modify the existing Windows Update for Business policy to set the deferral period to 0 days.

Answer

Create a compliance policy that requires the update to be installed and assign it to all devices.

Answer

Use Configuration Manager to push the update via on-premises WSUS.

Question 7

Your organization wants to use Microsoft Intune to manage Windows devices that are joined to an on-premises Active Directory domain. The devices will be hybrid Azure AD joined. Which tool should you use to configure automatic enrollment into Intune?

Accepted Answer

Group Policy. For hybrid Azure AD joined devices, automatic enrollment into Intune is configured via Group Policy. Specifically, you deploy the 'Enable automatic MDM enrollment using default Azure AD credentials' policy setting, which triggers the MDM enrollment process using the user's Azure AD credentials during sign-in. This is the only supported method for bulk, automatic enrollment of hybrid Azure AD joined Windows devices without requiring additional infrastructure.

Answer

Windows Autopilot

Answer

System Center Updates Publisher (SCUP)

Answer

Configuration Manager Cloud Management Gateway (CMG)

Question 8

You assign a required app to a device group. After the next sync, some devices report a 'Failed' status. What should you check first?

Accepted Answer

The device management log. The device management log (also known as the Intune management extension log or the MDM agent log on the device) provides detailed, real-time error codes and failure reasons for app installation attempts. When a required app shows 'Failed' status after sync, this log is the first place to check because it captures the exact cause—such as a download failure, dependency issue, or script execution error—that the Intune console cannot surface in summary views.

Answer

The device's last sync time

Answer

If a newer version is already installed

Answer

Whether the user is licensed

Question 9

You review the compliance policy JSON for Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.0) with a numeric-only password of 10 characters, BitLocker enabled, firewall enabled, and Microsoft Defender running reports as non-compliant. What is the most likely reason?

Accepted Answer

The password type is not alphanumeric.. The compliance policy JSON for Windows 10 devices specifies a password type requirement of 'alphanumeric'. The device in question uses a numeric-only password (10 characters), which does not meet the alphanumeric requirement, causing it to be reported as non-compliant. All other conditions—BitLocker enabled, firewall enabled, and Microsoft Defender running—are satisfied, so the password type is the sole issue.

Answer

The OS version is outside the allowed range.

Answer

Storage encryption is not enabled.

Answer

Microsoft Defender is not enabled.

Question 10

Match each Co-management workload to its management authority when co-managed.

Accepted Answer

Windows Update for Business: Managed by Intune. In co-management, workloads can be assigned to either Configuration Manager or Intune. Common defaults: Windows Update and Endpoint Protection to Intune; Device Configuration and Resource Access to Configuration Manager.

Answer

Windows Update for Business: Managed by Configuration Manager

Answer

Device Configuration: Managed by Intune

Question 11

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

Accepted Answer

Set 'Enable Windows Hello for Business' in the Autopilot profile.. The Windows Autopilot profile includes a setting called 'Enable Windows Hello for Business' that, when enabled, automatically configures the device to prompt the user to set up Windows Hello for Business during the out-of-box experience (OOBE). This setting is part of the Autopilot profile itself and does not require a separate policy or additional configuration to trigger the Hello setup prompt.

Answer

Ensure the device is Azure AD joined.

Answer

Create a separate Windows Hello for Business policy and assign it to the device group.

Answer

Configure the Enrollment Status Page to show Hello setup.

Question 12

A company uses Intune to manage Android Enterprise devices. The administrator wants to deploy a set of required apps silently to fully managed devices. Which THREE steps are necessary?

Accepted Answer

Create a managed Google Play account. A managed Google Play account is required to bind the Intune tenant to Google's Android Enterprise ecosystem. Without this binding, Intune cannot deploy or manage apps on fully managed Android Enterprise devices. This account enables the administrator to approve, license, and silently push apps from the managed Google Play store to devices.

Answer

Configure a user enrollment profile

Answer

Create an app protection policy for the apps

Question 13

You manage devices at Fabrikam Inc. using Microsoft Intune. You have a Windows 11 device that is not compliant because it is missing a required application. The device shows as 'Not evaluated' in Intune for the compliance policy. The user reports that the device syncs manually but still shows as non-compliant. You have verified that the device is enrolled and policy is assigned. What should you do first to resolve the issue?

Accepted Answer

From the Intune console, select the device and run the 'Sync' action with the option 'Re-evaluate compliance policies'.. Re-evaluating the compliance policy by running a sync with the Intune management extension can trigger a fresh assessment. Creating a new compliance policy is unnecessary. Removing and re-enrolling is disruptive. Checking the user's license is not relevant to compliance evaluation.

Answer

Verify that the user has a valid Microsoft 365 license.

Answer

Create a new compliance policy with the same requirements and assign it to the device.

Answer

Remove the device from Intune and re-enroll it.

Question 14

You are a Microsoft 365 administrator for a school district. You have 2,000 Windows 10 devices used by students. All devices are enrolled in Microsoft Intune. You need to deploy a set of educational apps from the Microsoft Store for Education (now part of Microsoft Store for Business). The apps should be automatically installed on all student devices, and students should not be able to remove them. You have already added the apps to your Microsoft Store for Business inventory and acquired offline licenses. You have also configured Intune to sync the Microsoft Store for Business. Which action should you take in Intune to deploy the apps with the least administrative effort?

Accepted Answer

Create a 'Microsoft Store for Business' app in Intune, select the offline-licensed apps, and assign as 'Required' to a device group containing all student devices.. Using the 'Microsoft Store for Business' app type with offline licenses allows automatic sync and silent installation. Option B is for user-targeted. Option C is for online licenses. Option D is for Win32 apps.

Answer

Use the 'Microsoft Store app (Windows)' type and assign as 'Required' to the device group.

Answer

Create a 'Microsoft Store for Business' app in Intune, select the online-licensed apps, and assign as 'Available' to a user group.

Answer

Download the app packages and deploy as Win32 apps with silent switches.

Question 15

You are a Microsoft Intune administrator for Tailwind Traders. The company has enrolled Windows 11 devices. You need to configure BitLocker encryption on all devices using Intune. You have created an endpoint security policy for BitLocker and assigned it to the correct group. After 24 hours, some devices still show as not encrypted. You verify that the devices are compliant with the policy's prerequisites. What should you do to force the policy to apply?

Accepted Answer

Remotely sync the devices from the Intune console to refresh policy.. Triggering a sync on the devices will force the policy to be applied. Re-creating the policy is unnecessary. Using a local GPO is not managed centrally. Checking the hardware is not relevant.

Answer

Use Group Policy Editor to configure BitLocker locally on each device.

Answer

Check if the devices have TPM version 2.0.

Answer

Re-create the BitLocker policy with a different name.