MD-102 Practice Test 16 — 15 Questions

Question 1

Your company uses Microsoft Intune to manage Windows 10 devices. You have a compliance policy that requires devices to have a minimum of 4GB RAM and 64GB disk space. Several devices are marked non-compliant due to disk space. You check the devices and find they have 60GB free. The compliance policy checks total disk capacity, not free space. You need to allow these devices to be compliant. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the compliance policy to require a minimum of 60GB disk capacity.. The compliance policy in Microsoft Intune checks total disk capacity, not free space. By lowering the minimum required total disk capacity to 60GB, devices with 60GB total disk space will meet the policy requirement and become compliant, without needing hardware changes or scripts.

Answer

Upgrade the disk on these devices to 128GB.

Answer

Change the compliance policy to check free disk space instead of total capacity.

Answer

Create a script to free up disk space on the devices.

Question 2

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

Accepted Answer

The managed Google Play Store app is disabled on the devices.. In a work profile, the managed Google Play Store app must be present and active; if it is disabled, apps cannot be installed. Option A is wrong because the app is already approved. Option B is wrong because VPN is not required. Option C is wrong because there is no app protection policy requirement for installation.

Answer

The app is not approved in managed Google Play for the organization.

Answer

The devices do not have a VPN profile configured.

Answer

The users do not have an app protection policy assigned.

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs during the device provisioning process, before the user signs in. The script should be assigned to a device group containing all Autopilot devices. Which method should you use?

Accepted Answer

Use a device context PowerShell script in Intune and assign it to the device group.. A device context PowerShell script in Intune runs in the system context before the user signs in, making it ideal for provisioning tasks on Autopilot devices. Assigning it to a device group ensures the script executes on the target devices regardless of which user signs in, aligning with the requirement for pre-user-sign-in execution.

Answer

Add the script as a Windows 10 platform script in Intune.

Answer

Assign the script to a user group containing the users.

Answer

Deploy the script as a device configuration profile.

Question 4

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps can be installed on corporate-owned devices. Which configuration profile type should you use?

Accepted Answer

Device restrictions profile with 'Allow app installation from App Store only' set to 'Block'.. The 'Device restrictions profile' in Microsoft Intune includes the 'Allow app installation from App Store only' setting. Setting this to 'Block' prevents users from installing apps from the App Store, effectively restricting installations to only those apps that are deployed through Intune as managed apps or volume-purchased apps. This ensures that only approved apps can be installed on corporate-owned iOS/iPadOS devices.

Answer

Email profile.

Answer

Device features profile.

Answer

Apple Configurator enrollment profile.

Question 5

Which TWO settings can you configure in a Microsoft Intune device compliance policy for Android Enterprise devices?

Accepted Answer

Require a password to unlock the device. Microsoft Intune device compliance policies for Android Enterprise require a password to unlock the device as a configurable setting. This setting enforces a lock screen password, which is a fundamental security requirement for compliance evaluation. It directly controls device access and is a standard compliance check for Android Enterprise work profiles and fully managed devices.

Answer

Encryption

Answer

Disable camera

Answer

Maximum OS version

Question 6

You manage iOS devices with Microsoft Intune. A user reports that a required app is missing from their device. You verify the app is assigned as 'Required' to a user group containing the user, and the device is compliant. What is the most likely reason the app is not installing?

Accepted Answer

The app is configured to require user enrollment, but the device uses device enrollment.. When an iOS app is configured with a 'Require user enrollment' assignment filter, it will only install on devices that use User Enrollment (which creates a per-user management identity). If the device uses Device Enrollment (e.g., via Apple Business Manager or manual device enrollment), the app will not install even if assigned as 'Required' to a user group. This is a common configuration mismatch that prevents app delivery.

Answer

The app is set to 'Available for enrolled devices' instead of 'Required'.

Answer

The device is not enrolled using Apple Device Enrollment Program (DEP).

Answer

The Apple Volume Purchase Program (VPP) token has expired.

Question 7

Users report that their Android Enterprise fully managed devices are not receiving email profiles pushed from Intune. You confirm the devices are enrolled and show as compliant. What is the most likely cause?

Accepted Answer

The 'Android Device Policy' app is not set to 'Required' in the app assignment.. For Android Enterprise fully managed devices, the Android Device Policy app must be deployed as a required app assignment to the device. Without this assignment, the device lacks the necessary app to receive and apply email profiles pushed from Intune. The app configuration policy does not make the app required; instead, the app must be assigned as required via Intune app deployment.

Answer

The devices are using work profile instead of fully managed.

Answer

The devices are not compliant with the compliance policy.

Answer

A device restrictions profile blocks the email app.

Question 8

You need to configure conditional access for managed devices accessing Exchange Online. Which THREE conditions can be used?

Accepted Answer

Device platform (e.g., iOS, Android).. Conditional Access for managed devices can target specific device platforms (e.g., iOS, Android, Windows) to enforce policies like requiring a compliant device. This allows administrators to restrict access based on the operating system, which is a fundamental condition in Conditional Access policies for Exchange Online.

Answer

App protection policy status.

Answer

User location based on IP address.

Question 9

A company uses Microsoft Defender for Endpoint. They want to automatically remediate threats on endpoints using automated investigation and response. They also need to ensure that the remediation actions are approved by the security team before execution. Which configuration should they use?

Accepted Answer

Enable automated investigation and set 'Approval mode' for remediation actions.. Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities include an 'Approval mode' setting that requires security team approval before any remediation action (e.g., isolating a device, removing a file) is executed. This satisfies the requirement for automatic threat detection and investigation while maintaining human oversight over remediation actions.

Answer

Disable automated investigation and use manual response only.

Answer

Enable automated investigation and allow all actions automatically.

Answer

Enable automated investigation and set remediation level to 'Full - remediate threats automatically'.

Question 10

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Accepted Answer

Convert existing devices to Autopilot by uploading hardware hash. Windows Autopilot allows you to import a hardware hash (a unique device identifier) from existing devices into Intune, converting them into Autopilot devices. This enables you to apply Autopilot deployment profiles and customize the OOBE without requiring a full OS reinstall, leveraging the device's existing identity.

Answer

Enforce security baselines on devices

Answer

Deploy third-party applications automatically

Answer

Configure BIOS settings remotely

Question 11

You need to deploy a Microsoft 365 Apps for enterprise configuration that includes Teams and Visio Pro for Microsoft 365. Users should get the full suite with both apps. What is the recommended method?

Accepted Answer

Create a Win32 app with the Office Deployment Tool and a configuration.xml that includes both products.. The Office Deployment Tool (ODT) is the recommended method for deploying customized Microsoft 365 Apps configurations, including Teams and Visio Pro for Microsoft 365, in enterprise environments. By creating a Win32 app with a configuration.xml that specifies both products, you can control installation settings, language, and update channels, which is not possible with the built-in Intune app type for Microsoft 365 Apps.

Answer

Use the built-in Microsoft 365 Apps for enterprise app type in Intune and select the products.

Answer

Instruct users to install from the Office portal.

Answer

Deploy a PowerShell script that runs Setup.exe /configure.

Question 12

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

Accepted Answer

A device compliance policy with a required passcode length of 6.. A device compliance policy in Microsoft Intune evaluates whether devices meet specific security requirements, such as a minimum passcode length. By creating a compliance policy with a required passcode length of 6, Intune marks any iOS device with a shorter passcode as noncompliant. This noncompliant status can then be used by a conditional access policy to block access to corporate email, achieving the stated goal.

Answer

A device configuration profile with a passcode payload.

Answer

An app protection policy for Microsoft Outlook.

Answer

A conditional access policy requiring compliant devices.

Question 13

Which THREE components are required for a successful Windows Autopilot self-deploying mode deployment?

Accepted Answer

Windows Autopilot device registration using the hardware hash.. B is correct because Windows Autopilot self-deploying mode requires the device to be registered with Microsoft using its hardware hash. This registration links the device to an Azure AD tenant and enables the deployment profile to be downloaded automatically during the out-of-box experience, without user interaction.

Answer

A local administrator account created on the device.

Answer

A Microsoft 365 E3 license assigned to the user.

Question 14

A company uses Microsoft Intune to manage Windows 10 devices. They deployed a Win32 app as 'required' but some devices show 'pending install'. The app is configured with a detection rule that checks for a registry key. What should you check first?

Accepted Answer

Check if the detection rule is incorrectly marking the app as installed.. The most common reason for a 'pending install' status when a detection rule is configured is that the rule is incorrectly detecting the app as already installed. Intune evaluates the detection rule before attempting installation; if the rule finds the registry key (even if the app is not fully functional), Intune skips the installation and reports 'pending' or 'installed' without actually deploying the app. This is a frequent misconfiguration where the detection rule is too broad or references a key that exists from a previous installation or unrelated software.

Answer

Increase the app installation timeout.

Answer

Ensure the device has connectivity to Intune.

Answer

Reassign the app to a different security group.

Question 15

You need to deploy a critical security update to 500 Windows 10 devices managed by Intune. The update must be installed by the end of the week. Which deployment method should you use?

Accepted Answer

Create a Windows 10 update ring in Intune and enable expedited quality updates.. Intune's expedited quality updates allow you to bypass standard deferral periods and force-install critical security updates within days, not weeks. This is the only method that guarantees installation by the end of the week for 500 devices managed solely by Intune, as it leverages the Windows Update service with a reduced deadline (e.g., 2 days) and immediate restart behavior.

Answer

Configure a Windows Update for Business deferral policy in Intune.

Answer

Use Windows Autopatch to automatically deploy the update.

Answer

Create a WSUS policy and push it via Group Policy.