MD-102 Practice Test 2 — 10 Questions

Question 1

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Accepted Answer

Devices enrolled in Microsoft Intune. Devices must be enrolled in Microsoft Intune to be co-managed; Intune enrollment is the mechanism that enables cloud-based management. Option B is correct because co-management requires Configuration Manager current branch (version 1606 or later) as a minimum. Option E is not strictly required: co-management supports both hybrid and pure Azure AD joined devices, though hybrid is common. Options C and D are not prerequisites; on-premises AD and PKI are optional.

Answer

On-premises Active Directory

Answer

Public Key Infrastructure (PKI)

Answer

Hybrid Microsoft Entra ID joined devices

Question 2

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) named 'Company Portal' to all devices. The app is already added to Intune. You assign the app to a static device group that includes all current devices with the intent 'Required'. However, you notice that devices that enroll after the assignment do not receive the app automatically.

What should you do to ensure that the app installs on newly enrolled devices?

Accepted Answer

Ensure the device group is a dynamic group that includes all devices (e.g., use the built-in 'All devices' group). Static groups in Intune do not automatically include devices that are enrolled after the group is created. To ensure the app installs on newly enrolled devices, the device group must be dynamic. Dynamic groups automatically include devices based on rules, such as all devices. The built-in 'All devices' group is dynamic, but if you are using a custom static group, you should change it to a dynamic group or assign the app to a dynamic group like 'All devices'.

Answer

Create a new assignment with 'Available' intent for the 'All devices' group

Answer

Re-add the app to Intune

Answer

Change the assignment intent to 'Available'

Question 3

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

Accepted Answer

Configure a selective wipe policy.. A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Answer

Configure a compliance policy to mark the device as noncompliant.

Answer

Configure a remote lock action.

Answer

Configure a full wipe action.

Question 4

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

Accepted Answer

Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.. Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Answer

Create a device configuration profile with a custom OMA-URI setting to execute the script.

Answer

Use a device compliance policy to trigger the script when noncompliant.

Answer

Use Intune proactive remediations and configure the script to run as a detection script.

Question 5

An organization uses Configuration Manager to deploy Windows 11. The administrator needs to ensure that after deployment, the devices are automatically enrolled in Microsoft Intune for co-management. Which THREE actions are required?

Accepted Answer

Configure Azure AD hybrid join in the environment.. Azure AD hybrid join is required for co-management because it allows devices to be registered in both on-premises Active Directory and Azure AD, enabling them to be managed by both Configuration Manager and Intune simultaneously. Without hybrid join, devices cannot authenticate to Intune for enrollment, as co-management relies on Azure AD identity for device registration and policy assignment.

Answer

Enable WinRM on the target devices.

Answer

Configure a Group Policy for automatic Intune enrollment.

Question 6

You manage devices with Microsoft Intune and have enabled co-management with Configuration Manager. You need to ensure that Windows Update policies are managed by Intune for all co-managed Windows 10 devices. Which workload slider should you set in Configuration Manager?

Accepted Answer

Windows Update Policies. In a co-management scenario, the workload slider determines which management authority handles specific workloads. Setting the 'Windows Update Policies' slider to 'Intune' directs Windows Update for Business policies to be applied via Intune, overriding Configuration Manager policies for co-managed Windows 10 devices. This ensures that update rings and deferral settings configured in Intune are enforced.

Answer

Endpoint Protection

Answer

Client Apps

Answer

Device Configuration

Question 7

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Accepted Answer

Number of failed attempts before wipe.. The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Answer

Maximum passcode age (days).

Answer

Allow simple passcode.

Question 8

Which TWO actions should you take to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with a work account on Windows 10/11?

Accepted Answer

Set the MDM user scope to 'All' or 'Some' in Azure AD.. Options A and E are correct. Option A: Setting the MDM user scope to 'All' or 'Some' in Azure AD enables automatic MDM enrollment for the specified users. Option E: Configuring the MDM discovery URL via Group Policy allows Windows 10/11 devices to automatically enroll in Intune by discovering the MDM service. Option B is incorrect because enrollment restrictions in Intune control device platforms but do not directly trigger automatic enrollment. Option C is incorrect because automatic Azure AD registration is a separate process and does not automatically enroll devices into Intune. Option D is incorrect because co-management with Configuration Manager is a hybrid management approach and is not required for automatic Intune enrollment.

Answer

In Intune, set the enrollment restriction to allow Windows devices.

Answer

Enable automatic Azure AD registration for Windows devices.

Answer

Enable co-management with Configuration Manager.

Question 9

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

Accepted Answer

The user is blocked by a Conditional Access policy due to sign-in risk.. The user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Azure AD Identity Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Answer

The app protection policy is misconfigured.

Answer

The device model is blocked by a Conditional Access policy.

Answer

The device is not compliant with the compliance policy.

Question 10

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Accepted Answer

Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.. Setting 'Allow personally owned devices' to 'No' in enrollment restrictions explicitly blocks users from enrolling personal devices while still allowing corporate-owned device enrollment. This setting is enforced at the time of enrollment, preventing personal devices from being added to Intune management entirely.

Answer

Create a conditional access policy that blocks devices not marked as corporate.

Answer

Create a conditional access policy that requires compliant devices.

Answer

Create a device compliance policy that marks personal devices as non-compliant.