MD-102 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. The ComplianceState property in Microsoft Intune reflects the compliance status at the time of the last device check-in. If a device has not synced for 7 days, the stored ComplianceState is stale and may no longer represent the actual compliance posture. The device could have become non-compliant since its last sync due to policy changes, missing updates, or configuration drift, but Intune will not update the state until the next successful sync.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

Question 2

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only users in the Sales department can enroll their devices. What should you configure?

Accepted Answer

Enrollment restrictions that allow only users in the Sales group.. Enrollment restrictions in Intune let you control which users or groups are allowed to enroll devices, so restricting enrollment to the Sales group directly satisfies the requirement. This is the purpose-built control for limiting enrollment by user or group, platform, or device type.

Answer

An Intune role-based access control (RBAC) role for Sales users.

Answer

A device configuration profile assigned to Sales users.

Answer

A Conditional Access policy that requires device compliance.

Question 3

Which THREE of the following are requirements for deploying a Win32 app via Microsoft Intune?

Accepted Answer

The app must be assigned to a group of users or devices.. Option C is correct because a Win32 app in Intune must be assigned to an Microsoft Entra ID user or device group (required, available, or uninstall intent) before it can be delivered to any endpoint. Option D is correct because Intune requires detection rules (file, folder, registry, MSI product code, or custom script) to determine whether the app is already installed and to report installation status. Option E is correct because Win32 apps must be wrapped with the Microsoft Win32 Content Prep Tool into the .intunewin package format before upload to Intune. Option A is not required because the Intune Management Extension is installed automatically on Windows devices when a Win32 app or PowerShell script is assigned, not installed separately by the admin. Option B is not required because the app content is uploaded to and hosted by Intune (or delivered via the CDN), not on an external web server.

Answer

The device must have the Intune Management Extension installed separately.

Answer

The app installation files must be hosted on an external web server.

Question 4

You have a hybrid Microsoft Entra ID joined Windows 10 device that is co-managed with Configuration Manager and Intune. You want Intune to manage Windows Update for Business settings. Which slider setting should you configure in Configuration Manager?

Accepted Answer

Move the slider for 'Windows Update policies' to 'Intune'. In a co-management scenario, workload sliders in Configuration Manager determine which authority manages specific workloads. To have Intune manage Windows Update for Business settings, you must move the slider for 'Windows Update policies' to Intune. This shifts the policy authority from Configuration Manager to Intune, allowing Intune's Update Rings and feature update policies to control Windows Update behavior on the device.

Answer

Move the slider for 'Endpoint protection' to 'Intune'

Answer

Move the slider for 'Resource access' to 'Intune'

Answer

Move the slider for 'Device configuration' to 'Intune'

Question 5

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Accepted Answer

Run a detection script to identify issues.. Proactive remediations in Microsoft Intune are built on a two-part script package, so option A is correct: each remediation includes a detection script that runs first to identify whether a problem exists on the Windows device. Option D is also correct because, when the detection script reports a non-compliant state, the paired remediation script executes to fix the identified issue. Option C is correct as well, since proactive remediations are assigned to device groups and run on a configurable schedule (for example, daily or hourly) rather than only once. Option B is not part of proactive remediations, as Intune does not send email alerts as a built-in remediation action; reporting is surfaced through Intune reports and Endpoint Analytics. Option E is incorrect because proactive remediations do not change device compliance state — compliance is governed separately by compliance policies, and remediation scripts only detect and fix issues.

Answer

Send email alerts when issues are detected.

Answer

Mark devices as non-compliant if remediation fails.

Question 6

You are deploying a Windows 11 device using Windows Autopilot. The device is enrolled in Microsoft Intune and assigned a device group. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and enrolls in Intune without user interaction. Which Autopilot deployment mode should you configure?

Accepted Answer

Self-deploying mode. Self-deploying mode in Windows Autopilot enables a device to join Microsoft Entra ID and enroll in Intune automatically during OOBE, without any user interaction. It is the correct choice when zero-touch provisioning is required and no user credentials are available.

Answer

Autopilot reset

Answer

User-driven mode

Answer

Pre-provisioning mode (White glove)

Question 7

You manage Windows 11 devices with Microsoft Intune. Several devices are failing to check in and receive policy. You review the device list and see the devices are enrolled but show a compliance state of 'Not evaluated'. You need to force the devices to immediately check in with the Intune service from the local device. What should you do?

Accepted Answer

In Settings, navigate to Accounts > Access work or school, select the work account, and click Info > Sync.. Forcing a manual sync from the device is the quickest way to make an enrolled Windows device check in with Intune. Using the Settings app under Access work or school triggers the MDM enrollment client to contact the service immediately, refreshing policies and compliance status. This resolves the 'Not evaluated' state because the device re-evaluates its configuration against assigned compliance policies and reports back.

Answer

Restart the Microsoft Intune Management Extension service.

Answer

Run the command: deviceenroller.exe /c /z /o

Answer

Run the command: dsregcmd /status

Question 8

Which TWO actions are required to deploy a Win32 app using Microsoft Intune? (Choose two.)

Accepted Answer

Upload the .intunewin package file.. Option A is correct because deploying a Win32 app in Intune requires first wrapping the source files with the Microsoft Win32 Content Prep Tool to produce a .intunewin package, which is then uploaded to the Intune admin center as the app's installation source. Option B is correct because Intune must determine whether the app is already installed on a device, so the Win32 app configuration requires detection rules (such as an MSI product code, file/folder path, or registry key) to report installation status and drive the install/uninstall behavior. Option C is incorrect because connecting to Managed Google Play applies to Android Enterprise app deployment, not Win32 apps. Option D is incorrect because assigning a Microsoft Store license relates to Store apps (UWP/MSIX) rather than Win32 packages. Option E is incorrect because a macOS developer certificate is used for signing Apple apps, which is irrelevant to Windows Win32 deployment.

Answer

Connect to Managed Google Play.

Answer

Assign a Microsoft Store license.

Answer

Sign the app with a macOS developer certificate.

Question 9

Your organization wants to use Windows Autopilot for user-driven deployment. Users should be able to self-deploy their devices by signing in with their corporate credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven (Azure AD join). User-driven (Microsoft Entra ID join) deployment mode is correct because it allows users to self-deploy their devices by signing in with their corporate credentials during the out-of-box experience (OOBE). This mode joins the device to Microsoft Entra ID and enrolls it in Microsoft Intune, enabling the user to complete the setup without IT intervention.

Answer

Pre-provisioned deployment

Answer

Hybrid Azure AD join

Answer

Self-deploying (Azure AD join)

Question 10

Which THREE of the following are valid methods to deploy Microsoft 365 Apps for enterprise using Microsoft Intune?

Accepted Answer

Use the built-in Microsoft 365 Apps app type in Intune.. Option A is correct because Intune provides a native Microsoft 365 Apps (Windows 10 and later) app type that lets you configure the Office apps, update channel, and architecture directly from the console without packaging. Option B is correct because you can use the Office Deployment Tool (ODT) with a configuration.xml and run setup.exe via a script (e.g., PowerShell or platform script) deployed through Intune to install Microsoft 365 Apps. Option D is correct because you can wrap the Office installer (using the ODT or a prepared source) into an .intunewin file and deploy it as a Win32 app, which supports custom detection and requirement rules. Option C is not valid because Microsoft Entra ID application registration is for identity/consent of apps, not for deploying Office binaries to devices. Option E is not valid because Microsoft 365 Apps for enterprise is delivered via Click-to-Run, not as an MSI, so there is no supported MSI deployment method for this product through Intune.

Answer

Assign the apps via Azure AD application registration.

Answer

Deploy the MSI version of Office via Intune.

Question 11

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

Accepted Answer

The policy has not been applied to the device yet.. If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer

Real-time scanning is set to monitorAllFiles, but the file was an archive.

Answer

The scan type is set to quick, which does not scan downloaded files.

Answer

The cloud block level is set to high, which may block unknown files, but known files might be missed.

Question 12

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

Accepted Answer

The current OS version on the device.. The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Answer

The user's license status.

Answer

The compliance policy is assigned to the device.

Answer

The device is connected to the internet.

Question 13

A user's iOS device is enrolled in Microsoft Intune. The user reports that they cannot install the Company Portal app from the App Store. What is the most likely reason?

Accepted Answer

The App Store is disabled by a device restriction policy.. A device restriction policy in Microsoft Intune can block access to the App Store on iOS devices. When the App Store is disabled via a configuration profile, users cannot install or update any apps from the App Store, including the Company Portal app. This is a common policy setting used by organizations to control app installation sources.

Answer

The user does not have an Apple ID.

Answer

The device is not enrolled in Intune.

Answer

The device is not supervised.

Question 14

Your company uses Microsoft Intune to manage Windows 11 devices. You need to ensure that when a device is marked as noncompliant, it loses access to Microsoft 365 services within 15 minutes, without affecting compliant devices. You have already created a compliance policy and assigned it to all users. What should you configure next?

Accepted Answer

A conditional access policy in Microsoft Entra ID that requires compliant devices and set the grant control to 'Require device to be marked as compliant'.. Conditional access in Microsoft Entra ID enforces access controls based on conditions such as device compliance. By creating a policy that requires compliant devices for Microsoft 365 apps, noncompliant devices are blocked from accessing those services. This integrates with Intune compliance policies, which evaluate and report device state. The other options do not provide real-time access blocking based on compliance.

Answer

A device compliance policy in Intune with an action for noncompliance that marks the device as noncompliant immediately.

Answer

A configuration profile in Intune that sets the device to block access to Microsoft 365 services when noncompliant.

Answer

A Microsoft Defender for Endpoint device group in Intune with an automated task to restrict access.

Question 15

Which THREE steps are required to configure a Windows 10 device for kiosk mode using Microsoft Intune? (Choose three)

Accepted Answer

Create a device configuration profile with the kiosk settings.. A device configuration profile in Microsoft Intune is the mechanism used to define the specific kiosk settings, such as the user account, app type (e.g., single-app or multi-app kiosk), and browser configuration. This profile applies the kiosk mode configuration to the device via the Windows 10/11 kiosk policy CSP (Policy Configuration Service Provider).

Answer

Configure Autopilot for the device.

Answer

Create a device compliance policy to enforce kiosk mode.