MD-102 Practice Test 18 — 15 Questions

Question 1

You are troubleshooting a Windows 10 device that is not receiving policy updates from Intune. The device shows 'Pending' status in the Intune console. The device is connected to the internet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Intune management extension service is not running.. The Intune management extension service (IntuneManagementExtension.exe) is responsible for processing policy and app deployment actions on Windows 10 devices. If this service is not running, the device will show a 'Pending' status in the Intune console because it cannot acknowledge or apply incoming policies, even though the device is online and enrolled.

Answer

The device is not connected to the network.

Answer

The device has a pending reboot.

Answer

The device enrollment is expired.

Question 2

You manage devices with Microsoft Intune. You need to ensure that only devices with a specific BIOS serial number can enroll. What should you configure?

Accepted Answer

Enrollment restrictions that block devices by hardware identifier.. Intune's enrollment restrictions allow you to block or allow devices based on hardware identifiers such as the BIOS serial number. By adding the specific BIOS serial numbers to the blocked hardware identifiers list, you can effectively prevent any device that does not match the allowed serials from enrolling. This is the only built-in mechanism in Intune that directly controls enrollment eligibility based on hardware characteristics.

Answer

A device category with a dynamic group based on BIOS serial.

Answer

A device compliance policy that checks BIOS serial number.

Answer

A Conditional Access policy that requires a compliant device.

Question 3

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

Accepted Answer

Windows 10 2004. The exhibit shows a compliance policy with a minimum OS version requirement set to '2004'. In Microsoft Intune, when you specify a minimum OS version for Windows 10 compliance, you must use the four-digit version number (e.g., 2004) rather than the marketing name (e.g., 20H2). Therefore, the minimum OS version required is Windows 10 2004.

Answer

Windows 10 20H2

Answer

Windows 10 1903

Answer

Windows 10 21H2

Question 4

A user reports that a required Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune console shows the app assignment is 'Required' for the user group. The device status shows 'Pending' for over a day. You verify the device is online and checks in regularly. What is the most likely cause?

Accepted Answer

The user does not have a Microsoft 365 license assigned.. Microsoft 365 Apps for enterprise requires a valid license assigned to the user to install and activate. Intune's 'Pending' status indicates the installation is queued but cannot proceed, often due to license validation failure. Even though the device is online and checks in regularly, the app assignment will remain pending until the user has a license, as the Intune management extension waits for license confirmation before downloading and installing the suite.

Answer

The device has not checked in with Intune recently.

Answer

The device does not have enough disk space.

Answer

The app is assigned to the device group instead of the user group.

Question 5

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Accepted Answer

Devices must be enrolled in Microsoft Intune.. Microsoft Defender for Endpoint (MDE) deployment via Intune requires devices to be enrolled in Intune (MDM) to receive the configuration policies and security baselines that enable and manage MDE. Without Intune enrollment, the device cannot process the MDE onboarding policy or the required Windows Security settings pushed through the Microsoft Endpoint Manager console.

Answer

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Answer

Devices must have Microsoft 365 Apps for enterprise installed.

Question 6

You need to configure a Microsoft Intune policy to ensure that only devices with a minimum OS version can access corporate email. Which THREE policy types can enforce this requirement?

Accepted Answer

Device compliance policy. Device compliance policy (A) is correct because it allows you to define rules such as a minimum OS version requirement. When a device is marked as non-compliant due to an outdated OS, you can combine this with a Conditional Access policy to block access to corporate email. This is the primary mechanism for OS version enforcement on managed devices.

Answer

Enrollment restrictions

Answer

Device configuration profile

Question 7

Which THREE features are available in Microsoft Intune's Windows Autopilot for existing devices?

Accepted Answer

Collect hardware hash from the existing device.. The 'Collect hardware hash' step is a core requirement for Windows Autopilot for existing devices. The hardware hash uniquely identifies the device and must be uploaded to the Microsoft Intune Autopilot service to register it for Autopilot deployment. This hash is collected using a PowerShell script (Get-WindowsAutopilotInfo.ps1) or via the Configuration Manager console.

Answer

Automatically convert the device to an Autopilot device without user interaction.

Answer

Apply Autopilot profiles to macOS devices.

Question 8

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom PowerShell script that runs during enrollment to configure network settings. What should you use?

Accepted Answer

PowerShell scripts in Microsoft Intune. Microsoft Intune's built-in PowerShell scripts feature allows you to upload and run PowerShell scripts during device enrollment or on a schedule, which is exactly what is needed to configure network settings on Windows 11 devices. This feature executes scripts in the system context, making it suitable for network configuration tasks that require administrative privileges.

Answer

Device compliance policy

Answer

Device configuration profile with custom OMA-URI

Answer

Endpoint security policy

Question 9

Refer to the exhibit. A PowerShell script is used to check the encryption compliance state of Windows devices managed by Intune. Some devices return a State of 'notApplicable' for the Encryption setting. What does this indicate?

Accepted Answer

The device's operating system edition does not support the encryption setting. In Intune, the 'notApplicable' state for an encryption compliance setting indicates that the device's operating system edition lacks the required encryption capabilities, such as BitLocker support. BitLocker is only available on Windows Pro, Enterprise, and Education editions; Windows Home edition does not support it, so the compliance check returns 'notApplicable' rather than 'compliant' or 'noncompliant'.

Answer

The device has pending actions to enable encryption

Answer

The compliance policy is not assigned to the device

Answer

The device does not require encryption per policy

Question 10

You are configuring Windows Autopilot for new devices. The devices need to be automatically enrolled in Intune and assigned to a specific group based on their serial number. What is the required step before the devices can be recognized by Autopilot?

Accepted Answer

Register the devices using their hardware hash in the Microsoft Intune admin center.. Before Windows Autopilot can recognize and automatically enroll devices, they must be registered as Autopilot devices. This is done by uploading their hardware hash (a unique identifier derived from the device's TPM and other hardware) into the Microsoft Intune admin center. Once registered, the device is associated with an Autopilot profile and can be automatically enrolled in Intune and assigned to a group based on its serial number during the out-of-box experience.

Answer

Configure Intune enrollment for all users using device enrollment managers.

Answer

Join the devices to Microsoft Entra ID manually before shipping.

Answer

Upload a CSV file with device serial numbers to Microsoft Entra ID.

Question 11

An organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. The security team wants to automatically apply an Intune app protection policy (APP) when a user accesses a risky app from an unmanaged device. What should the administrator use?

Accepted Answer

Conditional Access App Control with session control. Conditional Access App Control with session control is the correct solution because it allows the administrator to monitor and control app sessions in real time, applying Intune app protection policies (APP) when a user accesses a risky app from an unmanaged device. This integration uses reverse proxy architecture to intercept traffic and enforce data protection policies, such as blocking downloads or requiring managed apps, directly within the cloud app session.

Answer

Device configuration policy

Answer

App protection policy assignment to users

Answer

Device compliance policy

Question 12

Refer to the exhibit. You are deploying a custom OMA-URI policy to Windows 10 devices. What is the effect of this policy?

Accepted Answer

Device telemetry is set to enhanced.. The OMA-URI policy configured in the exhibit sets the 'System/AllowTelemetry' value to '2', which corresponds to the 'Enhanced' telemetry level in Windows 10. This policy enables Microsoft to collect additional diagnostic data, including how Windows and apps are used, to improve the user experience and device performance. It does not affect Windows Update deferral, Defender state, or Cortana.

Answer

Windows Update is configured to defer updates.

Answer

Windows Defender is disabled.

Answer

Cortana is enabled.

Question 13

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Running a full scan is the first recommended troubleshooting step when macOS devices show a 'Sensor disconnected' status in Microsoft Defender XDR. This status often indicates that the sensor process (e.g., mdatp) is not running or has crashed, and a full scan can trigger the sensor to restart and re-establish communication with the cloud backend. It is a non-disruptive, quick check that validates the agent's core functionality before escalating to more invasive steps.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 14

An organization uses Microsoft Intune to manage iOS devices. They need to deploy an internal line-of-business (LOB) app that is signed with an enterprise certificate. The app must be available to users who are members of a dynamic Microsoft Entra ID group. Which deployment method should you use?

Accepted Answer

Assign the LOB app as 'Available' to the dynamic group. Deploying an internal LOB app signed with an enterprise certificate as 'Available' to a dynamic Microsoft Entra ID group allows users to install the app on demand from the Company Portal, while still targeting the group dynamically. This method supports enterprise-signed apps without requiring a VPP token, and 'Available' assignments are the only way to make the app visible in the Company Portal for optional installation by dynamic group members.

Answer

Use a VPP token to deploy the app

Answer

Configure a managed open-in policy

Answer

Assign the LOB app as 'Required' to the dynamic group

Question 15

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app to all macOS devices. What app type should you create in Intune?

Accepted Answer

macOS app (line-of-business). To deploy a custom .pkg app to macOS devices via Microsoft Intune, you must create a macOS line-of-business (LOB) app. LOB apps are designed for sideloading custom or in-house applications that are not available in the public app store, and Intune supports .pkg and .dmg formats for macOS LOB deployment. This app type allows you to upload the .pkg file directly and assign it to devices, handling installation through the Intune management agent.

Answer

Windows app (Win32)

Answer

Web link

Answer

iOS app (line-of-business)