MD-102 Practice Test 2 — 10 Questions

Question 1

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an update ring for Windows 10 with a deadline of 7 days.. Update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Answer

Create a compliance policy for Windows 10 update compliance.

Answer

Create a device configuration profile for Windows 10 updates.

Answer

Configure a Windows Update for Business policy in Group Policy.

Question 2

You are managing devices with Microsoft Intune. You need to ensure that only compliant devices can access corporate email. Which TWO components should you configure?

Accepted Answer

Compliance policy for Microsoft Intune. To ensure only compliant devices can access corporate email, you need a compliance policy (Option B) that defines device health rules and a Conditional Access policy (Option D) that enforces access based on compliance status. Option C is essentially the same concept as Option B and should not be selected as an additional component. Option A (device configuration profile) sets device settings but does not define compliance. Option E (app protection policy) protects app data but does not evaluate device compliance.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

App protection policy

Question 3

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Accepted Answer

iOS/iPadOS app store app. Option B (iOS/iPadOS app store app) is correct because Intune supports deploying apps directly from the Apple App Store to managed iOS/iPadOS devices, either as required or available installs, using the built-in app type for store-published apps. Option E (iOS/iPadOS Line-of-business app) is correct because Intune allows uploading and assigning custom in-house .ipa packages for iOS/iPadOS, which is the standard method for distributing proprietary enterprise apps. Option A (Web link) is not an iOS/iPadOS-specific app type in this context; it is a generic web link app type used across platforms to pin a URL, not a native iOS app deployment type. Option C (Windows app (Win32)) is incorrect because Win32 apps target Windows devices, not iOS/iPadOS. Option D (Android Line-of-business app) is incorrect because Android LOB apps are for Android devices and use .apk or .aab packages, not iOS/iPadOS.

Answer

Web link

Answer

Windows app (Win32)

Answer

Android Line-of-business app

Question 4

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Answer

Require multi-factor authentication

Answer

Require hybrid Azure AD joined device

Answer

Require approved client app

Question 5

You are designing a Windows Update for Business deployment for a hybrid environment with 5,000 devices. You need to ensure that critical security updates are deployed within 48 hours while allowing feature updates to be delayed up to 60 days. Which policy configuration should you use?

Accepted Answer

Configure a 'Quality update deadline' of 2 days and a 'Feature update deadline' of 60 days.. Windows Update for Business uses 'deadline' policies to enforce when updates must be installed, not deferral periods. A 'Quality update deadline' of 2 days ensures critical security updates are installed within 48 hours, while a 'Feature update deadline' of 60 days allows feature updates to be delayed up to 60 days. Deferral periods only postpone when an update is offered, not when it must be installed, making deadlines the appropriate mechanism for enforcing installation timelines.

Answer

Use a 'Quality update deferral period' of 48 hours and a 'Feature update deferral period' of 60 days in a Windows 10 update ring.

Answer

Set the 'Update notification level' to '2 - Disable all notifications' and configure active hours.

Answer

Configure a 'Quality update deferral period' of 2 days and a 'Feature update deferral period' of 60 days.

Question 6

An administrator needs to ensure that only devices with a specific manufacturer are allowed to enroll in Intune. Which setting should the administrator configure?

Accepted Answer

Enrollment restrictions. Nrollment restrictions. Enrollment restrictions allow administrators to block devices based on manufacturer, OS version, or device platform. Conditional Access policies work after enrollment. Device categories are for organizational grouping, not blocking enrollment. Device compliance policies evaluate device health after enrollment.

Answer

Conditional Access policy

Answer

Device category

Answer

Device compliance policy

Question 7

You manage Windows devices with Microsoft Intune. A required Win32 app (an .intunewin package) was assigned to a device group, but the app never installs and the device shows no error. The app's install command is `setup.exe /silent`, and the detection rule is a registry key that the installer writes only under HKLM\SOFTWARE. You confirm the app installs successfully when run manually as a standard user. What is the most likely cause?

Accepted Answer

The install command runs in the user context, so the HKLM registry key cannot be written.. The key detail is that the detection rule checks an HKLM registry key, which can only be written with administrative privileges. If the Win32 app was configured to install in user context, the installer cannot create that key, so detection never succeeds and Intune reports the app as not installed without an obvious error. Switching the install behavior to system context allows the installer to write to HKLM and satisfy detection.

Answer

The app must be assigned to a user group because Win32 apps cannot be assigned to device groups.

Answer

The .intunewin package must be signed with a code-signing certificate before it can install.

Answer

The detection rule must use a file path instead of a registry key for required apps.

Question 8

Which THREE are valid Windows Autopilot deployment scenarios?

Accepted Answer

Self-deploying. Self-deploying (A) is a valid Windows Autopilot scenario in which the device is provisioned with no user interaction, using a device-targeted profile and TPM attestation, ideal for kiosks and shared devices. User-driven (C) is valid because it lets the end user sign in with their Microsoft Entra ID credentials during OOBE, after which the Autopilot profile applies device and user settings. White glove (E) is valid as the pre-provisioning scenario where a partner or IT technician runs the provisioning process so the device reaches the user ready for a fast, final sign-in. App-driven (B) and Policy-driven (D) are not Autopilot deployment scenarios; Autopilot modes are defined by user interaction and pre-provisioning, not by app or policy triggers.

Answer

App-driven

Answer

Policy-driven

Question 9

Your organization is deploying Microsoft Intune for the first time. You need to ensure that devices can enroll in Intune. Which of the following is a prerequisite for Intune enrollment?

Accepted Answer

A Microsoft Intune license assigned to the user. A Microsoft Intune license assigned to the user is a prerequisite because Intune uses Microsoft Entra ID (Azure AD) for identity and access management. Without an Intune license (e.g., Microsoft 365 E3, E5, or standalone Intune license) assigned to the user, the device cannot authenticate and enroll via the Intune enrollment service, as the license is required to authorize the enrollment request and apply device management policies.

Answer

A VPN connection to the corporate network

Answer

An on-premises Active Directory domain

Answer

A Configuration Manager infrastructure

Question 10

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. The Autopilot deployment profile includes a setting called 'Join to Microsoft Entra ID as' that determines whether the device performs an Microsoft Entra ID join or an Microsoft Entra ID registration. By default, this setting may be configured as 'Microsoft Entra ID registered', which results in a device that is only registered (workplace-joined) rather than fully joined. Changing this setting to 'Microsoft Entra ID joined' ensures the device completes a full Microsoft Entra ID join during the user-driven deployment, making it a managed device in Microsoft Entra ID.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.