MD-102 Practice Exam 1 — 20 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

Accepted Answer

Automated investigation and response. The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Answer

Threat analytics

Answer

Device inventory

Answer

Alert queue

Question 2

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot. Conditional Access policies in Microsoft Entra ID can require devices to be marked as compliant before granting access to corporate resources. A device compliance policy in Intune can be configured to check for TPM 2.0 and Secure Boot status on Windows 11 devices. Only when both conditions are met will the device be considered compliant, and the Conditional Access policy will enforce that compliance requirement, effectively blocking non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business in Intune

Answer

Deploy an attack surface reduction rule in Microsoft Defender XDR

Answer

Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

Question 3

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Conditional Access grant control 'Require device to be marked as compliant' ensures that only devices enrolled in Microsoft Intune and meeting your compliance policies (e.g., encryption, OS version, threat level) can access Microsoft 365 apps. This directly enforces the requirement that only corporate-owned devices are allowed, as compliance status is tied to managed devices. In contrast, other options either don't restrict to corporate-owned devices or address different security concerns.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

Accepted Answer

Selective wipe from the Intune console.. A selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Answer

Full wipe from the Intune console.

Answer

Delete the device from Microsoft Entra ID.

Answer

Retire the device from Intune.

Question 5

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Accepted Answer

Configure a BitLocker policy in Intune that enables key escrow to Azure AD.. Intune's BitLocker policy includes a setting to automatically store recovery keys in Azure AD, which is essential for key escrow. This integration ensures that if a device is lost or stolen, administrators can retrieve the recovery key from Azure AD to access encrypted data or perform a remote wipe. Without this policy, BitLocker keys would not be escrowed to Azure AD even if the device is enrolled in Intune.

Answer

Join devices to on-premises Active Directory.

Answer

Configure a Group Policy to escrow BitLocker keys to Active Directory.

Question 6

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 7

Which TWO are prerequisites for deploying Win32 apps via Microsoft Intune?

Accepted Answer

The Intune management extension must be installed on devices. The Intune management extension is the client-side component that handles Win32 app detection, download, and installation on Windows devices. Without this extension, Intune cannot process the PowerShell scripts or .intunewin files required for Win32 app deployment.

Answer

The app must be signed with a Microsoft certificate

Answer

Devices must have at least 4 GB of RAM

Answer

Devices must be enrolled with user affinity

Question 8

Your company uses Microsoft Intune to manage iOS devices. You have an app protection policy that requires a PIN to access corporate data. Users report that they can access corporate data without entering a PIN after the first time. You want to ensure that the PIN is required every time the app is opened. What should you configure?

Accepted Answer

Set 'PIN reset after number of hours' to 0.. Setting 'PIN reset after number of hours' to 0 forces the user to enter a PIN every time the app is opened, regardless of whether they previously entered it. Option A is incorrect because 'Require PIN to access' is already set to 'Yes' but does not control PIN frequency; the PIN can be cached for a session. Option B is incorrect because requiring a device PIN instead of an app PIN changes the authentication method, but the issue is about requiring the app PIN on every open, not changing to device PIN. Option D is incorrect because 'Timeout' controls how long the app can be inactive before requiring a PIN, not upon initial app launch.

Answer

Set 'Require PIN to access' to 'Yes'.

Answer

Require device PIN instead of app PIN.

Answer

Set 'Timeout' to 1 minute.

Question 9

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

Accepted Answer

Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.. A Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Answer

Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

Answer

Set a device compliance policy that requires device name prefix 'CORP-'.

Answer

Modify the Enrollment Status Page (ESP) policy to require device naming.

Question 10

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is co-managed with Configuration Manager. You need to configure a policy that requires BitLocker encryption. You create a BitLocker policy in Intune and assign it to the device. After 24 hours, BitLocker is not enabled on the device. You verify that the device is online and the policy is assigned. What is the most likely cause?

Accepted Answer

The encryption workload is set to Configuration Manager.. In a co-managed environment, workload control determines which management authority (Configuration Manager or Intune) handles specific policies. If the encryption workload is set to Configuration Manager, Intune's BitLocker policy will be ignored, even if assigned and the device is online. This is the most likely reason the policy did not take effect after 24 hours.

Answer

The device is not online.

Answer

The device is not enrolled in Intune.

Answer

The BitLocker policy is not assigned to the correct group.

Question 11

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Accepted Answer

Devices enrolled in Microsoft Intune. Devices must be enrolled in Microsoft Intune to be co-managed; Intune enrollment is the mechanism that enables cloud-based management. Option B is correct because co-management requires Configuration Manager current branch (version 1606 or later) as a minimum. Option E is not strictly required: co-management supports both hybrid and pure Azure AD joined devices, though hybrid is common. Options C and D are not prerequisites; on-premises AD and PKI are optional.

Answer

On-premises Active Directory

Answer

Public Key Infrastructure (PKI)

Answer

Hybrid Microsoft Entra ID joined devices

Question 12

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) named 'Company Portal' to all devices. The app is already added to Intune. You assign the app to a static device group that includes all current devices with the intent 'Required'. However, you notice that devices that enroll after the assignment do not receive the app automatically.

What should you do to ensure that the app installs on newly enrolled devices?

Accepted Answer

Ensure the device group is a dynamic group that includes all devices (e.g., use the built-in 'All devices' group). Static groups in Intune do not automatically include devices that are enrolled after the group is created. To ensure the app installs on newly enrolled devices, the device group must be dynamic. Dynamic groups automatically include devices based on rules, such as all devices. The built-in 'All devices' group is dynamic, but if you are using a custom static group, you should change it to a dynamic group or assign the app to a dynamic group like 'All devices'.

Answer

Create a new assignment with 'Available' intent for the 'All devices' group

Answer

Re-add the app to Intune

Answer

Change the assignment intent to 'Available'

Question 13

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

Accepted Answer

Configure a selective wipe policy.. A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Answer

Configure a compliance policy to mark the device as noncompliant.

Answer

Configure a remote lock action.

Answer

Configure a full wipe action.

Question 14

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

Accepted Answer

Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.. Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Answer

Create a device configuration profile with a custom OMA-URI setting to execute the script.

Answer

Use a device compliance policy to trigger the script when noncompliant.

Answer

Use Intune proactive remediations and configure the script to run as a detection script.

Question 15

An organization uses Configuration Manager to deploy Windows 11. The administrator needs to ensure that after deployment, the devices are automatically enrolled in Microsoft Intune for co-management. Which THREE actions are required?

Accepted Answer

Configure Azure AD hybrid join in the environment.. Azure AD hybrid join is required for co-management because it allows devices to be registered in both on-premises Active Directory and Azure AD, enabling them to be managed by both Configuration Manager and Intune simultaneously. Without hybrid join, devices cannot authenticate to Intune for enrollment, as co-management relies on Azure AD identity for device registration and policy assignment.

Answer

Enable WinRM on the target devices.

Answer

Configure a Group Policy for automatic Intune enrollment.

Question 16

You manage devices with Microsoft Intune and have enabled co-management with Configuration Manager. You need to ensure that Windows Update policies are managed by Intune for all co-managed Windows 10 devices. Which workload slider should you set in Configuration Manager?

Accepted Answer

Windows Update Policies. In a co-management scenario, the workload slider determines which management authority handles specific workloads. Setting the 'Windows Update Policies' slider to 'Intune' directs Windows Update for Business policies to be applied via Intune, overriding Configuration Manager policies for co-managed Windows 10 devices. This ensures that update rings and deferral settings configured in Intune are enforced.

Answer

Endpoint Protection

Answer

Client Apps

Answer

Device Configuration

Question 17

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Accepted Answer

Number of failed attempts before wipe.. The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Answer

Maximum passcode age (days).

Answer

Allow simple passcode.

Question 18

Which TWO actions should you take to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with a work account on Windows 10/11?

Accepted Answer

Set the MDM user scope to 'All' or 'Some' in Azure AD.. Options A and E are correct. Option A: Setting the MDM user scope to 'All' or 'Some' in Azure AD enables automatic MDM enrollment for the specified users. Option E: Configuring the MDM discovery URL via Group Policy allows Windows 10/11 devices to automatically enroll in Intune by discovering the MDM service. Option B is incorrect because enrollment restrictions in Intune control device platforms but do not directly trigger automatic enrollment. Option C is incorrect because automatic Azure AD registration is a separate process and does not automatically enroll devices into Intune. Option D is incorrect because co-management with Configuration Manager is a hybrid management approach and is not required for automatic Intune enrollment.

Answer

In Intune, set the enrollment restriction to allow Windows devices.

Answer

Enable automatic Azure AD registration for Windows devices.

Answer

Enable co-management with Configuration Manager.

Question 19

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

Accepted Answer

The user is blocked by a Conditional Access policy due to sign-in risk.. The user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Azure AD Identity Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Answer

The app protection policy is misconfigured.

Answer

The device model is blocked by a Conditional Access policy.

Answer

The device is not compliant with the compliance policy.

Question 20

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Accepted Answer

Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.. Setting 'Allow personally owned devices' to 'No' in enrollment restrictions explicitly blocks users from enrolling personal devices while still allowing corporate-owned device enrollment. This setting is enforced at the time of enrollment, preventing personal devices from being added to Intune management entirely.

Answer

Create a conditional access policy that blocks devices not marked as corporate.

Answer

Create a conditional access policy that requires compliant devices.

Answer

Create a device compliance policy that marks personal devices as non-compliant.