MD-102 Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. An administrator runs this PowerShell command using the Microsoft Graph PowerShell SDK. The output returns no devices. However, the administrator knows that there are non-compliant Windows devices in Intune. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cmdlet requires the -All parameter to return all devices.. The Get-MgDeviceManagementManagedDevice cmdlet from the Microsoft Graph PowerShell SDK, by default, returns only the first 100 devices. When a filter is applied and no devices are returned despite known non-compliant devices existing, the most common cause is that the result set is truncated. Adding the -All parameter forces the cmdlet to page through all results and return the complete set of devices, including those that match the filter.

Answer

The filter string is case-sensitive and should be 'windows' in lowercase.

Answer

The -Filter parameter is not supported for this cmdlet.

Answer

The admin does not have the required permissions to read device compliance.

Question 2

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Accepted Answer

Apple Business Manager: Used for automated enrollment of corporate-owned iOS devices with supervision.. Correct matches: Apple Business Manager automates enrollment of corporate iOS devices; Android Enterprise Work Profile supports BYOD Android with work/personal separation. Common confusions include mistaking Windows Autopilot for Android enrollment and confusing user-driven enrollment with automated methods.

Answer

Windows Autopilot: Used for enrolling corporate-owned Android devices with Zero Touch enrollment.

Answer

User-Driven Enrollment: Used for automatically enrolling devices without user interaction during setup.

Question 3

You need to ensure that all Windows 11 devices in your organization have BitLocker enabled and the recovery key escrowed to Microsoft Entra ID. Which Intune policy should you configure?

Accepted Answer

Endpoint Protection profile. The Endpoint Protection profile in Microsoft Intune contains the BitLocker settings, including the requirement to enable BitLocker and automatically escrow the recovery key to Microsoft Entra ID. This profile is specifically designed for security configurations like disk encryption, firewall, and antivirus, making it the correct choice for this task.

Answer

Compliance Policy

Answer

Device Restrictions profile

Answer

Device Configuration profile

Question 4

You are using Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a preference for a third-party app. Which method should you use?

Accepted Answer

Upload a property list (.plist) file.. Intune for macOS uses property list (.plist) files to deploy custom configuration profiles for app preferences. The .plist format is the native macOS mechanism for storing application settings, and Intune's custom profile type directly accepts a valid .plist file to apply these settings via MDM. This method ensures the preferences are correctly parsed and enforced on managed macOS devices.

Answer

Upload an XML file with the preference settings.

Answer

Upload a DMG file containing the preferences.

Answer

Upload a JSON file with the preference settings.

Question 5

Your organization requires that all Windows 11 devices encrypt their drives with BitLocker. You have configured a BitLocker policy in Intune, but some devices show as 'Not evaluated' for the encryption status. What is the most likely reason?

Accepted Answer

The devices do not have a TPM chip.. The 'Not evaluated' status in Intune indicates that the device has not yet checked in or the policy has not been applied, but the most common root cause for BitLocker policy evaluation failure is the absence of a TPM chip. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 for its default encryption method, and without it, the policy cannot be assessed, resulting in a 'Not evaluated' state rather than a compliance failure.

Answer

The policy is not assigned to the correct group.

Answer

The devices have a conflicting Group Policy.

Answer

Secure Boot is disabled on the devices.

Question 6

You need to deploy Windows updates to a group of devices using Microsoft Intune. Which TWO policies should you configure to ensure updates are applied within a maintenance window?

Accepted Answer

Windows 10 and later update ring. (Windows 10 and later update ring) is correct because update rings in Microsoft Intune allow you to configure a maintenance window by setting the 'Active hours start' and 'Active hours end' values, which define a period during which updates are deferred and applied outside of those hours. This ensures updates are installed only during the specified maintenance window, aligning with the requirement to control update timing.

Answer

Assignment filter

Answer

Device compliance policy

Answer

Windows 10 and later quality update

Question 7

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

Accepted Answer

Assign a Windows 10/11 feature update policy.. A Windows 10/11 feature update policy in Microsoft Intune is specifically designed to manage the upgrade of Windows 10 devices to Windows 11. This policy uses Windows Update for Business to deliver the feature update (e.g., Windows 11 23H2) and automatically applies it to devices that meet the hardware requirements, ensuring a controlled upgrade process.

Answer

Assign a driver update policy.

Answer

Assign a quality update policy.

Answer

Assign an update ring for Windows 10.

Question 8

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs every time a device boots, before the user logs on. The script is signed. What is the correct deployment approach?

Accepted Answer

Deploy the script as a PowerShell script in Intune, configured to run in system context at device startup.. Intune's PowerShell script deployment supports running scripts in the system context at device startup, which executes before user logon. This meets the requirement for a signed script that runs every boot, leveraging the 'Run this script using the logged on credentials' option unchecked and 'Run script in 64-bit PowerShell Host' as needed.

Answer

Use a proactive remediation script set to run at device startup.

Answer

Package the script as a Win32 app and deploy it with installation behavior set to 'System'.

Answer

Add the script as a device configuration profile (OMA-URI).

Question 9

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

Accepted Answer

Check the device's last check-in time with Intune.. The device is already compliant and enrolled, and the email profile is assigned, so the most likely issue is that the device has not recently checked in with Intune to receive the latest policy or profile. Checking the last check-in time is the first troubleshooting step because Intune relies on periodic device check-ins to push configuration profiles, including email profiles. If the device hasn't checked in recently, it won't have the email profile applied, even if it's compliant and enrolled.

Answer

Verify that the device meets the compliance policy for Android.

Answer

Confirm that the user has an Exchange Online license.

Answer

Ensure the device is enrolled in Intune.

Question 10

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Accepted Answer

Non-compliant, because the firewall is disabled.. The compliance policy requires the firewall to be enabled. Since the device has a disabled firewall, it fails that specific requirement, making it non-compliant regardless of meeting other conditions like OS version. In Microsoft Intune, compliance policies evaluate each setting independently; a single non-compliant setting results in an overall non-compliant status.

Answer

Compliant, because the OS version is within the allowed range.

Answer

Compliant, because the policy includes a grace period for firewall.

Answer

Non-compliant, because the OS version is not within the allowed range.

Question 11

An organization uses Microsoft Intune to manage Windows devices. They want to deploy a Win32 app that requires admin rights to install. The app must be installed in the system context and should not require user interaction. Which installation behavior should be configured?

Accepted Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: No specific action, Installation visibility: Hidden. Deploying a Win32 app that requires admin rights and must run without user interaction in the system context requires setting the install behavior to 'System' and the installation purpose to 'Required'. The 'Hidden' installation visibility ensures the installation runs silently in the background, with no user prompts or interaction, which is essential for a non-interactive system-context deployment.

Answer

Install behavior: User, Installation purpose: Required, Device restart behavior: No specific action

Answer

Install behavior: User, Installation purpose: Available

Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: Immediately

Question 12

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved apps can be installed on corporate devices. Which policy type should you configure?

Accepted Answer

App Protection Policy with 'Allow only managed apps' setting.. App Protection Policies (APP) in Microsoft Intune control which apps can access corporate data on iOS devices. The 'Allow only managed apps' setting restricts data transfer and app usage to apps that are managed by Intune, effectively preventing installation of unapproved apps. This is the appropriate policy for enforcing approved app installation on corporate devices.

Answer

Device Configuration Profile with 'Allow app installation only from App Store' setting.

Answer

App Configuration Policy to restrict app installation.

Answer

Device Compliance Policy with 'Require approved apps' setting.

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a VPP (Volume Purchase Program) app that is already purchased and assigned to your tenant. What is the minimum configuration required to make the app available to users?

Accepted Answer

Sync the VPP token, then add the app from the store and assign it.. VPP apps require the VPP token to be synced with Intune first, then the app can be added from the store and assigned to users. Option A is wrong because device enrollment restrictions control device enrollment settings, not app deployment. Option C is wrong because the Company Portal is used for available apps, but the app must first be added and assigned in Intune; it is not automatically available without configuration. Option D is wrong because VPP apps are distributed through the store, not by uploading IPA files.

Answer

Configure a device enrollment restriction to allow the app.

Answer

Distribute the app via the Company Portal without any additional configuration.

Answer

Upload the app IPA file to Intune, then create an app configuration policy.

Question 14

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

Accepted Answer

The users are not members of the Azure AD group assigned to the required app.. In Microsoft Intune, app deployment is based on Azure AD group assignments. Even if a device is compliant and has recently checked in, the required app will not install unless the user or device is a member of the Azure AD group that the app is assigned to. Intune evaluates group membership at each check-in to determine which apps should be pushed, so missing group membership is the most likely cause when compliance and connectivity are verified.

Answer

The devices are not connected to a Wi-Fi network configured in Intune.

Answer

The devices are not compliant with the compliance policy.

Answer

The enrollment restrictions are blocking the devices from receiving apps.

Question 15

A user's iOS device is enrolled in Microsoft Intune. The user reports that they cannot install the Company Portal app from the App Store. What is the most likely reason?

Accepted Answer

The App Store is disabled by a device restriction policy.. A device restriction policy in Microsoft Intune can block access to the App Store on iOS devices. When the App Store is disabled via a configuration profile, users cannot install or update any apps from the App Store, including the Company Portal app. This is a common policy setting used by organizations to control app installation sources.

Answer

The user does not have an Apple ID.

Answer

The device is not enrolled in Intune.

Answer

The device is not supervised.