MD-102 Practice Test 19 — 15 Questions

Question 1

A company uses Microsoft Intune to manage devices. They need to ensure that a critical line-of-business app is updated automatically on all devices. Which assignment type should they use?

Accepted Answer

Required. The Required assignment type in Microsoft Intune automatically installs and updates apps on managed devices without user interaction, making it the correct choice for ensuring a critical line-of-business app is updated automatically. This assignment enforces the app deployment policy by pushing the update to devices during their next check-in with the Intune service, typically within 8 hours.

Answer

End-user notification

Answer

Uninstall

Answer

Available for enrolled devices

Question 2

You are troubleshooting an Autopilot deployment where devices are not receiving the expected configuration policies after enrollment. The devices show as enrolled in Intune but are stuck in a 'pending' state for policy application. What is the most likely cause?

Accepted Answer

The user does not have an assigned Intune license.. When a device is enrolled in Intune but stuck in a 'pending' state for policy application, the most common cause is that the user account lacks an assigned Intune license. Without a license, the user cannot synchronize policies from the Intune service, even though the device itself appears in the console. This is a prerequisite for policy delivery and is often overlooked during troubleshooting.

Answer

The device is not registered in Autopilot.

Answer

The device has a slow internet connection.

Answer

The Autopilot profile is set to 'offline' mode.

Question 3

You need to deploy Microsoft Edge for Business to Windows 10 devices using Microsoft Intune. Which app type should you select in the Intune portal?

Accepted Answer

Built-in app. The 'Built-in app' type in Microsoft Intune is specifically designed for deploying pre-packaged Microsoft applications, including Microsoft Edge for Business. This option automatically handles the installation and configuration of Edge without requiring manual packaging or complex deployment rules, making it the correct choice for this scenario.

Answer

Web link

Answer

Windows app (Win32)

Answer

Microsoft 365 Apps

Question 4

Your company uses Microsoft Defender for Endpoint (Defender XDR). You need to configure an automated investigation and remediation (AIR) rule that automatically quarantines a file when a specific alert is triggered. Which action should you take?

Accepted Answer

Create a new automation rule in the Microsoft 365 Defender portal.. Automated investigation and remediation (AIR) rules in Microsoft 365 Defender allow you to define automated actions—such as quarantining a file—when a specific alert is triggered. This is the native mechanism for orchestrating response actions based on alert conditions, directly supporting the requirement to automatically quarantine a file upon alert generation.

Answer

Add an indicator of compromise for the file.

Answer

Configure a device control policy.

Answer

Create an attack surface reduction rule.

Question 5

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

Accepted Answer

The detection runs in 32-bit context and does not see the 64-bit registry key. Intune Win32 app detection rules run in a 32-bit context by default on 64-bit systems. This means the detection script or rule checks the 32-bit registry view (Wow6432Node) rather than the 64-bit registry view. If the app created the registry key in the 64-bit path (e.g., HKLM\Software\Microsoft\Office), the 32-bit detection will not see it, causing a false 'not detected' state.

Answer

The detection type 'exists' is not supported for registry detection

Answer

The registry key path is incorrect for a 64-bit system

Answer

The app did not create the registry key during installation

Question 6

A user reports that a required line-of-business (LOB) app does not appear on their Windows 11 device enrolled in Microsoft Intune. The app was deployed as a 'Required' assignment to a dynamic device group. The device is compliant and shows as 'Active' in Intune. What is the most likely cause?

Accepted Answer

The device was offline during the last check-in.. The device was offline during the last check-in. Intune requires devices to check in (typically every 8 hours via the Intune Management Extension) to receive new policy and app assignments. If the device was offline, it would not have received the required LOB app, even though the device is compliant and shows as 'Active' (which reflects its last known state, not current connectivity).

Answer

The app requires manual approval from Microsoft Store for Business.

Answer

The user is not a member of the device group.

Answer

The app is assigned to users instead of devices.

Question 7

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Accepted Answer

The device must be enrolled using Android Enterprise work profile. Android Enterprise work profile enrollment is the specific enrollment mode that creates a separate, managed profile on the device, isolating work apps and data from personal apps. This is the only Android Enterprise enrollment type that supports managed Google Play app deployment to work profile devices, as it binds the device to the managed Google Play store without requiring a personal Google account on the device.

Answer

The user must have a Google account

Answer

The device must be personally owned

Answer

The app must be configured as a kiosk app

Question 8

You run the PowerShell command to check the assignment of a Microsoft Store app in Intune. The output shows 'intent: required' and 'target: allDevicesAssignmentTarget'. Which statement is true about this app?

Accepted Answer

The app will install automatically on all enrolled devices.. The output shows 'intent: required' and 'target: allDevicesAssignmentTarget'. In Intune, 'intent: required' means the app is mandatory and will install automatically without user intervention. 'target: allDevicesAssignmentTarget' indicates the assignment applies to all enrolled devices, not a specific group. Therefore, the app will install automatically on every enrolled device, making option B correct.

Answer

The app is assigned to a specific device group named 'All Devices'.

Answer

The app is only assigned to devices that have the Intune Management Extension.

Answer

The app is available for users to install from Company Portal.

Question 9

You have configured the above app protection policy for iOS. What is the effect on managed apps?

Accepted Answer

Users cannot take screenshots within managed apps. The app protection policy for iOS includes a setting to prevent screenshots and screen captures in managed apps. When this policy is configured, the OS restricts the ability to capture the screen within those apps, making option B correct. This is enforced by the iOS MDM framework, which disables the screenshot functionality at the app level.

Answer

Users can use Face ID to unlock apps

Answer

Users can back up app data to iCloud

Answer

Users can print from managed apps

Question 10

Which THREE components are essential for a Microsoft Defender for Endpoint deployment on Windows 10 devices? (Choose three.)

Accepted Answer

Cloud-delivered protection enabled. A is correct because cloud-delivered protection is a core component of Microsoft Defender for Endpoint (MDE) that enables near-instant threat intelligence updates and behavioral analysis. Without it, the endpoint relies solely on local signatures, missing cloud-based machine learning and automated response capabilities. This setting is enforced via Group Policy or Intune to ensure real-time protection against emerging threats.

Answer

Microsoft Intune management agent

Answer

Microsoft 365 Apps for enterprise

Question 11

Your organization uses Microsoft Intune to manage Windows 11 devices. You notice that some devices are not receiving security updates even though update rings are assigned. What is the most likely cause?

Accepted Answer

Update ring policy has a deferral period configured that delays updates. Update ring policies in Microsoft Intune include a deferral period setting that delays the installation of updates for a specified number of days after Microsoft releases them. If a deferral period is configured (e.g., 30 days for feature updates or 7 days for quality updates), devices will not receive security updates until that period expires, even though the update ring is assigned. This is a common configuration to allow testing before broad deployment, but it can mistakenly be overlooked when troubleshooting missing updates.

Answer

Devices are noncompliant and blocked from receiving updates

Answer

Devices are not enrolled in Intune

Answer

Devices are not connected to the internet

Question 12

Your organization uses Microsoft Intune to manage devices. You have a compliance policy that requires devices to have a password of at least 6 characters. Some users report that their devices are marked as non-compliant even though they have a password set. What is the most likely cause?

Accepted Answer

The compliance policy is assigned to a user group that does not include the affected users.. The most likely cause is that the compliance policy is assigned to a user group that does not include the affected users. In Microsoft Intune, compliance policies are evaluated based on user or device group assignments. If a user is not a member of the assigned user group, the policy will not apply to their enrolled devices, and those devices will not be evaluated for compliance, often resulting in a non-compliant status or no status at all.

Answer

The password length setting is set to '6' but the device requires a minimum of 8.

Answer

The compliance policy is assigned to device groups, but the devices are user-enrolled.

Answer

The device uses a PIN instead of a password, which is not evaluated.

Question 13

Your organization uses Windows Defender Application Control (WDAC) to allow only approved apps. After deploying a WDAC policy via Intune, some users report that a critical line-of-business app is blocked. How should you troubleshoot?

Accepted Answer

Review CodeIntegrity/Operational logs in Event Viewer. WDAC blocks or allows applications based on code integrity rules, and when a policy is enforced, blocked execution events are logged in the CodeIntegrity/Operational event log under Event Viewer. Reviewing this log provides specific block events with file details and rule identifiers, enabling you to identify why the LOB app was blocked and adjust the policy accordingly.

Answer

Check AppLocker logs in Event Viewer

Answer

Review Intune device management events for policy errors

Answer

Check Microsoft 365 Defender portal for WDAC alerts

Question 14

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

Accepted Answer

Microsoft 365 Apps. The Microsoft 365 Apps app type in Intune is specifically designed to deploy Office 365 ProPlus (now Microsoft 365 Apps) suites, including Word, Excel, PowerPoint, and others, as a managed suite. This app type automatically configures the installation to use the Office Deployment Tool (ODT) with built-in settings for update channels, architecture (32-bit/64-bit), and language packs, and it makes the suite available in Company Portal for user-initiated installation. Unlike Win32 or other types, it handles the complex licensing and activation requirements for Microsoft 365 Apps without additional scripting.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 15

Refer to the exhibit. You query Microsoft Graph API and receive this JSON for a managed device. App2 installation failed. The app is a Win32 app deployed as required. The device is compliant and enrolled via MDM. What is the most likely reason for the failure?

Accepted Answer

The Intune Management Extension is not installed.. Win32 apps deployed as required require the Intune Management Extension (IME) to be present on the device for installation. Since the device is enrolled via MDM and compliant, but the app installation failed, the most likely cause is that the IME is missing or not functioning. The IME handles Win32 app deployment, detection, and remediation, and without it, required Win32 apps cannot install.

Answer

The app is not assigned to the user.

Answer

The app version is incompatible with the device OS.

Answer

The device is not compliant.