MD-102 Practice Test 20 — 15 Questions

Question 1

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.

Question 2

You are an endpoint administrator for a company that uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access Exchange Online. You have configured a Conditional Access policy that grants access to Exchange Online only if the device is marked as compliant. A user reports that they cannot access email from their iOS device, which is enrolled in Intune and shows as compliant. The user can access other Microsoft 365 services. What is the most likely cause?

Accepted Answer

The Exchange Online workload is not enabled in Intune for mobile device management.. The most likely cause is that the Exchange Online workload is not enabled in Intune for mobile device management (MDM). Even though the device is enrolled and compliant, Intune must have the Exchange Online workload enabled to apply Conditional Access policies that govern email access. Without this, the Conditional Access policy cannot enforce compliance checks specifically for Exchange Online, resulting in access being blocked despite the device showing as compliant.

Answer

The user does not have an Exchange Online license assigned.

Answer

The Conditional Access policy is configured to block access from non-corporate networks.

Answer

The device compliance policy is not set to require a PIN or password.

Question 3

Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile in Device restrictions.. The correct policy type is an Endpoint Protection profile within Device restrictions, because BitLocker settings for Windows 10/11 devices managed by Intune are configured under the 'Windows Encryption' category of an Endpoint Protection profile. This profile directly controls BitLocker drive encryption, including encryption method, recovery key management, and silent encryption enforcement, which is required for the scenario.

Answer

Device configuration profile with Administrative Templates.

Answer

Device compliance policy.

Answer

Windows Update ring policy.

Question 4

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

Accepted Answer

Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.. Deploying a staging server (or an Azure AD Connect staging server) allows the initial device synchronization to Azure AD to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Answer

Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

Answer

Use Windows Autopilot to reset the devices and enroll them in Intune.

Answer

Manually enroll each device by signing in to the Company Portal.

Question 5

You are deploying a Win32 app that requires .NET Framework 4.8. You create a dependency in Intune for the .NET Framework app. However, some devices fail to install the parent app even though .NET Framework is present. What is the most likely issue?

Accepted Answer

The dependency detection rule does not match the actual .NET installation.. Intune uses detection rules to verify whether a dependency is installed. If the detection rule for the .NET Framework dependency does not match the actual installation state (e.g., it checks for a registry key or file version that differs from what .NET 4.8 actually creates), Intune will incorrectly report the dependency as missing, blocking the parent app installation even though .NET is present.

Answer

The dependency version is set to 'Greater than' instead of 'Greater than or equal to'.

Answer

The parent app is set to install before the dependency.

Answer

The dependency is set to 'Do not install automatically'.

Question 6

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Microsoft Entra ID join with automatic MDM enrollment.. The correct answers are B (Microsoft Entra ID join with automatic MDM enrollment) and D (Windows Autopilot). Both are valid methods to enroll Windows devices into Microsoft Intune. Option A (Android Zero Touch) is for Android devices, not Windows. Option C (Apple Business Manager) is for Apple devices. Option E (Samsung Knox Mobile Enrollment) is for Samsung Android devices.

Answer

Android Zero Touch.

Answer

Apple Business Manager.

Answer

Samsung Knox Mobile Enrollment.

Question 7

Which TWO Intune policies can be used to enforce encryption on macOS devices?

Accepted Answer

Device Configuration policy (Endpoint Protection) for FileVault.. FileVault is the native full-disk encryption solution for macOS, and Intune's Device Configuration policy (Endpoint Protection) provides a dedicated profile to enable and enforce FileVault encryption. Option E is correct because a Device Compliance policy can also require FileVault encryption as a compliance setting, allowing conditional access to block non-compliant devices.

Answer

Device Compliance policy that requires BitLocker.

Answer

Device Compliance policy that requires Disk Encryption.

Answer

Device Configuration policy (Device Restrictions) for Disk Encryption.

Question 8

A company is deploying Windows 11 using a task sequence in Configuration Manager. They encounter an issue where the task sequence fails on devices that have BitLocker enabled. Which TWO actions should you take to ensure the task sequence completes successfully on BitLocker-enabled devices?

Accepted Answer

Add a 'Suspend BitLocker' step before the 'Format and Partition Disk' step. Suspending BitLocker before the 'Format and Partition Disk' step prevents the task sequence from failing due to BitLocker-protected volumes. When BitLocker is active, the disk cannot be repartitioned or formatted without first suspending protection, as the Trusted Platform Module (TPM) validation and encryption keys would be invalidated. Option D is correct because the boot image must include the BitLocker optional component in WinPE to enable BitLocker-related operations (e.g., suspend, resume, preprovision) during the task sequence execution.

Answer

Add a 'Preprovision BitLocker' step before the 'Apply Operating System' step

Answer

Ensure the boot image includes the Microsoft BitLocker Administration and Monitoring (MBAM) optional component

Answer

Disable Secure Boot in the device BIOS

Question 9

A company uses Microsoft Intune to manage Android Enterprise devices. They have a requirement to deploy a set of apps that are critical for business operations. Which TWO app deployment policies should the administrator configure to ensure the apps are always available and up-to-date?

Accepted Answer

Enable 'Auto-update' for the apps in the managed Play Store.. Enabling 'Auto-update' for apps in the managed Play Store ensures that critical business apps are automatically updated to the latest version without user intervention, maintaining security and functionality. Option B is correct because assigning apps as 'Required' to a device group forces installation on all targeted devices, guaranteeing that the apps are always present for business operations.

Answer

Configure the app to allow users to update manually.

Answer

Assign the apps as 'Available for enrolled devices' to the device group.

Answer

Set the app assignment type to 'Uninstall' for the device group.

Question 10

Refer to the exhibit. You create a new update ring policy for Windows 10 devices. You assign the policy to a test group. After a week, you notice that no devices have installed any quality updates. Devices are online and enrolled. What is the most likely reason?

Accepted Answer

Devices are assigned a different update ring policy that defers quality updates.. The most likely reason is that devices are assigned a different update ring policy that defers quality updates. In Microsoft Intune, if multiple update ring policies are assigned to a device, the policy with the most restrictive settings (i.e., the highest deferral or pause) takes precedence. Even though the new policy sets QualityUpdateDeferralInDays to 0, an existing policy with a positive deferral would delay installation. Option B is incorrect because feature update deferral does not affect quality updates. Option C is incorrect because the pause start date is not set; a null value means no pause. Option D is incorrect because the policy takes effect without requiring a restart; updates install based on deferral settings.

Answer

The feature update deferral period is too long.

Answer

The quality update pause start date is set to a future date.

Answer

The policy requires a restart to take effect.

Question 11

You are troubleshooting an Intune enrollment issue on a Windows 10 device. The device is Microsoft Entra joined, but the enrollment status shows 'Pending'. What is the most likely cause?

Accepted Answer

The Enrollment Status Page (ESP) profile is not assigned to the device.. The Enrollment Status Page (ESP) tracks the installation of profiles, policies, and apps during enrollment. If the ESP profile is not assigned to the device, the enrollment process may hang in a 'Pending' state waiting for the ESP configuration. Option A is incorrect because conditional access policies are evaluated after enrollment, not during. Option B is incorrect because BitLocker is a disk encryption feature unrelated to enrollment status. Option D is incorrect because the MDM authority is set at the tenant level; if it were not set to Intune, enrollment would fail entirely, not just show 'Pending'.

Answer

The device is not compliant with a conditional access policy.

Answer

The device does not have BitLocker enabled.

Answer

The MDM authority is not set to Intune.

Question 12

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company-specific application (a .pkg file) to all macOS devices. The application requires a specific configuration file that must be placed in the /Library/Application Support/ directory. You also need to ensure that the application is installed silently without user interaction. How should you configure the deployment in Intune?

Accepted Answer

Add the .pkg file as a macOS line-of-business app in Intune, specify installation arguments for silent install, and include a script to copy the configuration file post-install.. Intune's macOS line-of-business (LOB) app deployment supports .pkg files and allows you to specify installation arguments (e.g., `-silent` or `--acceptLicense`) for silent installation. To place the configuration file in /Library/Application Support/, you must use a post-install script because Intune does not natively copy files to specific directories during LOB app deployment. This combination ensures the app is installed silently and configured correctly.

Answer

Use a shell script in Intune to download and install the .pkg file from a secure URL.

Answer

Create a device configuration profile for macOS that includes the app installation settings.

Answer

Use Apple Volume Purchase Program (VPP) to distribute the app as a managed app.

Question 13

Refer to the exhibit. The JSON snippet shows a dynamic device group configuration in Microsoft Intune. What is the effect of the 'enrollmentTimeDeviceMembershipLimit' property set to 15?

Accepted Answer

Devices added to the group will be removed after 15 days from enrollment. The 'enrollmentTimeDeviceMembershipLimit' property in a dynamic device group rule sets a time window (in days) from enrollment during which a device remains a member of the group. When set to 15, devices are automatically removed from the group 15 days after their enrollment date, regardless of their compliance or management status. This is used for scenarios like temporary access or pilot groups where membership should expire after a fixed period.

Answer

The group will only contain devices that have been enrolled for at least 15 days

Answer

Only devices enrolled in the last 15 days are eligible

Answer

Limits the number of devices in the group to 15

Question 14

Your organization uses Microsoft Intune to manage iOS devices. You need to prevent users from removing the Intune Company Portal app from their devices. Which setting should you configure?

Accepted Answer

Block app removal in device restrictions. The 'Block app removal' setting in iOS device restrictions prevents users from uninstalling the Company Portal app, ensuring it remains on the device for management. Option B is incorrect because blocking screen capture does not affect app removal. Option C is incorrect because requiring a PIN for app store purchases is unrelated to app removal. Option D is incorrect because blocking jailbroken devices addresses security risks, not app removal.

Answer

Block screen capture

Answer

Require PIN for app store purchases

Answer

Block jailbroken devices

Question 15

Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?

Accepted Answer

The app must be assigned to a security group.. For an iOS line-of-business (LOB) app to be successfully installed via Intune, three conditions must be met. First, the app must be assigned to a security group (A) because Intune targets app deployments to groups; without assignment the app will not be installed. Second, the app must be signed with an Apple Developer Enterprise Distribution certificate (B) to be trusted by devices without individual Apple approval. Third, the app must be uploaded as a .ipa file (D), which is the required package format for iOS LOB apps. Option C is incorrect because registering the device UDID with Apple Business Manager is not a requirement for LOB app installation; it is used for device enrollment and supervision. Option E is incorrect because an active Apple ID is not needed for enterprise-distributed LOB apps.

Answer

The device UDID must be registered with Apple Business Manager.

Answer

The user must have an active Apple ID.