MD-102 Practice Test 19 — 15 Questions

Question 1

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. Users report that when they attempt to enroll a personally owned Windows device, enrollment is blocked. You need to allow only corporate-owned devices to enroll while still permitting personally owned devices to access email through a browser. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a device enrollment restriction that blocks personally owned Windows devices and allow corporate-owned devices.. Enrollment restrictions in Intune are the mechanism for controlling whether personally owned devices can enroll for a given platform. By blocking personal Windows ownership while allowing corporate ownership, only corporate devices enroll. Because browser-based email access is controlled separately through conditional access, personal devices can still reach email in a browser without being enrolled.

Answer

Configure an Autopilot deployment profile that targets only corporate devices.

Answer

Configure a conditional access policy that requires compliant devices for all cloud apps.

Answer

Create a device compliance policy that requires BitLocker and mark personal devices as noncompliant.

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

Accepted Answer

Use the built-in Windows 10 security baseline in Intune.. The recommended approach is to use the built-in Windows 10 security baseline in Intune (Option C). Intune provides pre-configured security baselines that include settings for BitLocker encryption and Windows Defender Antivirus, which can be customized as needed. Option A is incorrect because custom configuration profiles do not provide the pre-built baseline and are more manual. Option B is incorrect because PowerShell scripts are not a baseline and are less manageable at scale. Option D is incorrect because Group Policy from on-premises AD is not integrated with Intune and requires hybrid infrastructure.

Answer

Create a custom configuration profile using Configuration Manager.

Answer

Deploy a PowerShell script via Intune to configure the settings.

Answer

Apply Group Policy Objects from on-premises Active Directory.

Question 3

Your company uses Microsoft Intune to manage Windows 11 devices. An administrator needs to remotely restart a specific device that is currently online to apply pending updates. Which action should the administrator use in the Intune admin center?

Accepted Answer

Restart. The Restart action is designed specifically to remotely reboot a managed device so that pending updates requiring a restart can complete. Retire, Wipe, and Fresh Start are all destructive or unenrollment actions that remove data or management and are not appropriate when the goal is simply to reboot an online device.

Answer

Wipe

Answer

Fresh Start

Answer

Retire

Question 4

A company uses Microsoft Intune to manage Windows 10 devices. You need to deploy Microsoft 365 Apps to all Windows devices. The deployment must use the Microsoft 365 Apps wizard in Intune. What should you do?

Accepted Answer

Create a new app of type 'Microsoft 365 Apps' and configure the required settings.. In Intune, you can deploy Microsoft 365 Apps by creating an app of type 'Microsoft 365 Apps'. This opens a wizard where you configure settings such as update channel, architecture, and which Office apps to install. This is the dedicated method for deploying Microsoft 365 Apps and is simpler than using the Office Deployment Tool.

Answer

Upload the Office Deployment Tool (ODT) and create a Win32 app.

Answer

Deploy the Microsoft Store version of Office as a required app.

Answer

Create a PowerShell script that downloads and installs Office, and assign it to devices.

Question 5

You are the endpoint administrator for a company that uses Microsoft Intune. The company has a line-of-business iOS app that is not available in the App Store. You need to deploy this app to a group of iOS users. The app must be installed automatically without user interaction. What should you do first?

Accepted Answer

Upload the app package (.ipa file) to Intune as a line-of-business app.. To deploy a custom iOS app, you must first upload the app package (.ipa file) to Intune as a line-of-business app. This makes the app available for assignment. After uploading, you can assign it to groups and set the installation intent to required for automatic installation. The other options do not provide a deployment method for custom apps.

Answer

Add the app to Microsoft Store for Business and sync it with Intune.

Answer

Configure a device configuration profile to install the app.

Answer

Create an app protection policy for the app.

Question 6

You are an administrator for a company that uses Microsoft Intune to manage Windows 10 devices. You need to deploy a new version of an internal line-of-business (LOB) app to all users. The app is packaged as an .msi file. What is the simplest way to deploy this app using Intune?

Accepted Answer

Upload the .msi file as a line-of-business app in Intune.. Intune's line-of-business app type supports direct upload of .msi files, automatically handling installation and detection. This is the simplest and most efficient method for deploying an MSI package, as it requires minimal configuration and leverages Intune's built-in app management capabilities.

Answer

Create a PowerShell script that installs the .msi, and deploy the script as a platform script.

Answer

Convert the .msi to a .intunewin file using the Microsoft Win32 Content Prep Tool, then upload as a Win32 app.

Answer

Package the .msi into an .appx file and deploy as a Microsoft Store app.

Question 7

A company uses Microsoft Intune to manage Windows 10 devices. They deploy a Win32 app as Required to all users. Users report that the app is not installing, and the Intune console shows the app status as 'Not applicable' for all devices. What is the most likely cause?

Accepted Answer

The app's requirement rules are not met by the devices.. The status 'Not applicable' in Intune for a Win32 app indicates that the app's requirement rules are not met by the device. This could be due to OS version, architecture, or other conditions defined in the requirement rules. Adjusting the requirement rules to match the device configuration resolves the issue.

Answer

The app's detection rule is incorrect.

Answer

The Intune Management Extension is not installed on the devices.

Answer

The app is not assigned to any groups.

Question 8

Your organization uses Microsoft Intune to manage 1,000 Windows 10 devices and 500 iOS devices. You need to enforce device compliance policies. For Windows devices, you require BitLocker encryption and Windows Defender Antivirus enabled. For iOS devices, you require a passcode of at least 6 characters and device encryption. Devices that become noncompliant should be marked as such and users should receive a notification email. After 7 days of noncompliance, the device should be blocked from accessing corporate email. You also need to create a report that shows the compliance status of all devices. Which combination of actions should you take?

Accepted Answer

Create Windows and iOS compliance policies with the required settings. Configure actions for noncompliance: send email immediately and block access after 7 days. Use the built-in compliance report.. Intune compliance policies directly enforce device-level settings like BitLocker and passcode length, and they include built-in actions for noncompliance (e.g., send email, block access after a specified number of days). The built-in compliance report in the Intune portal provides an immediate view of all devices' compliance status without requiring manual scripting or additional tools.

Answer

Create app protection policies to require encryption and passcode. Use conditional access to block noncompliant devices.

Answer

Create device configuration profiles for BitLocker and encryption. Use conditional access to block noncompliant devices. Manually generate reports using PowerShell.

Answer

Use Autopilot to enforce encryption and passcode. Use Intune reporting for compliance status.

Question 9

You manage Windows 11 devices with Microsoft Intune. A line-of-business MSI app must install only after a Visual C++ redistributable package is present, and the MSI must run with SYSTEM privileges at every device startup regardless of user sign-in. You need to configure the app deployment in Intune. What should you do?

Accepted Answer

Create a Windows app (Win32) package, add the redistributable as a dependency, and set the install behavior to System.. A Windows app (Win32) package created with the Microsoft Win32 Content Prep Tool supports both dependency relationships and install behavior selection. Adding the redistributable as a dependency forces Intune to install it before the MSI, and choosing System install behavior runs the MSI with SYSTEM privileges. This combination uniquely satisfies the prerequisite and privilege requirements in the scenario.

Answer

Deploy the MSI as a line-of-business app and configure an Intune PowerShell script to install the redistributable first.

Answer

Deploy the MSI as a line-of-business app and set the app to install in user context.

Answer

Create a Windows app (Win32) package, add the redistributable as a supersedence, and set the install behavior to User.

Question 10

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

Accepted Answer

Endpoint security > Disk encryption policy. To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Answer

Compliance policy for Windows 10

Answer

Windows Update for Business policy

Answer

Device configuration profile for Windows 10

Question 11

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

Accepted Answer

Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.. The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates. Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Answer

Change the update ring policy deadline to 7 days to ensure devices have enough time.

Answer

Create a new feature update policy for KB5001234 and assign it to all devices.

Answer

Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.

Question 12

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

Accepted Answer

.intunewin. The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Answer

.msi

Answer

.appx

Answer

.exe

Question 13

You manage Android Enterprise fully managed devices with Microsoft Intune. A critical line-of-business app must be installed silently on all devices, and users must not be able to uninstall it. The app is available as an APK. What should you do?

Accepted Answer

Upload the APK as a line-of-business app, assign it as required, and configure the app to be non-removable.. Android Enterprise fully managed devices support line-of-business APK deployment through Intune. A required assignment ensures silent installation, and the non-removable setting prevents users from uninstalling the app. This combination is the correct way to meet both the silent install and uninstall prevention needs for a proprietary APK.

Answer

Upload the APK as a line-of-business app and assign it as available.

Answer

Deploy the app from the Managed Google Play store and assign it as required.

Answer

Use a mobile app configuration policy to push the APK to devices.

Question 14

You are an endpoint administrator for a company that uses Microsoft Intune to manage Windows 11 devices. You have a device compliance policy that requires BitLocker Drive Encryption to be enabled on the OS drive. A user reports that their device is marked as non-compliant, even though they have BitLocker enabled and the drive is encrypted. You check the device and see that the BitLocker protection status is 'Protection Off' in the BitLocker control panel. The user has not set up a PIN. You need to ensure the device is compliant. What should you do?

Accepted Answer

Instruct the user to open BitLocker Drive Encryption and click 'Resume protection'.. The device is non-compliant because BitLocker protection is suspended, even though the drive is encrypted. The compliance policy checks the protection status, so the user must resume protection to become compliant. Resuming protection re-enables BitLocker and ensures the drive is actively protected, satisfying the policy requirement without compromising security.

Answer

In Intune, create a new configuration profile to enforce BitLocker with a startup PIN.

Answer

In the compliance policy, change the BitLocker requirement to 'Not required'.

Answer

In the compliance policy, set the BitLocker requirement to 'Require' and enable 'Require device encryption'.

Question 15

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Accepted Answer

Enables the Windows Firewall for the public network profile. The setting shown in the exhibit configures the Windows Firewall to enable the firewall for the public network profile. In Intune, the 'Windows Firewall' configuration policy allows administrators to define per-profile firewall states. Enabling the firewall for the public profile is a common security baseline requirement to protect devices on untrusted networks.

Answer

Disables the Windows Firewall for all network profiles

Answer

Enables Microsoft Defender Antivirus real-time protection

Answer

Disables the Windows Firewall for the domain network profile