MD-102 Practice Exam 2 — 20 Questions

Question 1

An administrator uses Configuration Manager to manage Windows 10 devices. The administrator wants to deploy a custom Windows application as an Application model deployment type. The application requires a reboot. Which deployment purpose should the administrator use to allow users to control the installation timing?

Accepted Answer

Available. The Available deployment purpose allows users to see the application in Software Center and choose when to install it, including scheduling the required reboot at their convenience. This gives users control over installation timing, which is the stated requirement. Required and Mandatory deployments force installation according to a schedule, removing user choice.

Answer

Mandatory

Answer

Pre-deploy

Answer

Required

Question 2

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

Accepted Answer

%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Answer

%windir%	emp\MdmEnrollment.log

Answer

%windir%\Panther\setupact.log

Answer

Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

Question 3

A technician is troubleshooting a Windows 11 device that is enrolled in Intune. The device reports as 'Not compliant' due to missing required updates. The administrator runs the following command on the device and receives the output shown. What should the administrator do next to resolve the compliance issue?

Accepted Answer

Restart the device.. The command output indicates that the Windows Update service is in a 'Stopped' state, which prevents the device from installing required updates. Restarting the device (Option D) will restart the Windows Update service and trigger a fresh update scan, allowing the device to become compliant on the next Intune check-in. This is the most direct fix for a stopped service that is blocking update installation.

Answer

Check for a policy conflict in Intune.

Answer

Run a manual sync from the Company Portal app.

Answer

Verify network connectivity to Microsoft Update.

Question 4

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices with BitLocker enabled can access corporate email via Exchange Online. Which configuration should the administrator use to enforce this requirement?

Accepted Answer

Create a Conditional Access policy that requires device compliance and assign it to Exchange Online.. Option B is correct because a Conditional Access policy in Azure AD can require that devices accessing Exchange Online be marked as compliant in Intune. By combining a Device Compliance policy that requires encryption (BitLocker) with a Conditional Access policy targeting Exchange Online, only compliant devices with BitLocker enabled will be granted access to corporate email.

Answer

Create a Device Compliance policy for Windows 10 with the 'Require encryption of data storage on device' setting enabled.

Answer

Create an App Protection policy for the Outlook mobile app that requires device encryption.

Answer

Configure Windows Defender Firewall to block non-BitLocker encrypted devices.

Question 5

You are configuring Microsoft Intune to manage Windows 10 devices. Which TWO actions are required to enable BitLocker encryption on devices?

Accepted Answer

Create a device configuration profile for endpoint protection and enable BitLocker settings.. Option A is correct because BitLocker settings are configured via a device configuration profile for endpoint protection in Microsoft Intune. This profile includes policies such as requiring TPM startup PIN or startup key, encryption method, and OS drive encryption. Without this profile, BitLocker cannot be enforced or configured on managed Windows 10 devices.

Answer

Create a compliance policy that requires BitLocker.

Answer

Configure a device cleanup rule.

Answer

Deploy a Windows 10 update ring.

Question 6

Order the steps for configuring a Windows 10 kiosk device using Assigned Access.

Question 7

Order the steps to migrate user profiles from Windows 10 to a new device using User State Migration Tool (USMT).

Question 8

Arrange the steps to deploy Windows 10 using Microsoft Deployment Toolkit (MDT) in the correct order.

Question 9

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Question 10

You are an enterprise administrator for Contoso Ltd. You need to configure Microsoft 365 tenant-wide settings for external collaboration. Which TWO actions should you take to meet the following goals: (1) allow only specific external domains to collaborate with your organization, and (2) ensure that external users are required to sign in with multi-factor authentication (MFA) before accessing shared resources?

Accepted Answer

Configure the SharePoint and OneDrive domain allowlist to include only the approved external domains.. Option B is correct because configuring the SharePoint and OneDrive domain allowlist restricts external sharing to only the approved external domains, meeting the first goal. Option D is correct because a Conditional Access policy in Azure AD can require MFA for all external users, satisfying the second goal by enforcing authentication requirements before access to shared resources.

Answer

Disable external sharing in the Microsoft 365 admin center for all workloads.

Answer

Configure the SharePoint and OneDrive domain blocklist to exclude all external domains except the approved ones.

Answer

Enable B2B direct connect in the cross-tenant access settings for the approved external domains.

Question 11

A company manages 500 Windows 10 devices using Microsoft Intune. They plan to upgrade to Windows 11. The IT team wants to ensure that only devices meeting the Windows 11 hardware requirements are allowed to upgrade. They need to block the upgrade on devices that do not meet the requirements, and provide a clear error message to users. What should the IT team configure?

Accepted Answer

Configure a Windows 11 readiness policy in Intune and assign it to all devices.. Option A is correct because a Windows 11 readiness policy in Intune is specifically designed to evaluate device hardware compatibility against Windows 11 requirements and block the upgrade on non-compliant devices while displaying a custom error message to users. This policy uses the Windows Health Monitoring and the TPM 2.0 attestation checks to enforce the hardware requirements before the upgrade can proceed.

Answer

Configure a feature update policy for Windows 10 and Windows 11 in Intune.

Answer

Create a compliance policy with Windows 11 requirements and assign it to all devices.

Answer

Use a device configuration profile to set the 'TargetReleaseVersion' policy for Windows 11.

Question 12

Match each PowerShell cmdlet to its function in Microsoft 365 management.

Question 13

Match each Microsoft 365 Defender feature to its description.

Question 14

Match each Microsoft Entra ID (Azure AD) join type to its description.

Question 15

Match each Windows 10/11 edition to its applicable Microsoft 365 feature.

Question 16

Match each Microsoft 365 Apps update channel to its description.

Question 17

You are the compliance administrator for a large organization using Microsoft 365 E5 licenses. The company has a hybrid identity configuration with Azure AD Connect syncing on-premises Active Directory to Azure AD. The security team requires that all mobile devices accessing corporate email and documents must be enrolled in Microsoft Intune and compliant with company device policies. Recently, several users reported that they cannot access Outlook on their iOS devices, receiving a message: 'Your organization requires this device to be managed by Intune. Please install the Company Portal app and enroll your device.' However, after installing Company Portal and completing enrollment, they still cannot access Outlook and see the same error. Upon investigation, you find that the devices are showing as 'Compliant' in the Microsoft Intune admin center. You also verify that the Conditional Access policy requiring device compliance is correctly configured and assigned to all users. What should you do to resolve the issue?

Accepted Answer

Verify that the devices are properly registered in Azure AD and, if not, ask users to unenroll and re-enroll their devices.. The issue is that the devices are compliant in Intune but not properly registered in Azure AD, which is a prerequisite for Conditional Access policies to evaluate device compliance. Even after enrollment, if the device registration fails or is incomplete, the Conditional Access policy will still block access. Option D addresses this by verifying and fixing the Azure AD registration, typically requiring unenrollment and re-enrollment to trigger a fresh registration.

Answer

Disable the Conditional Access policy, wait 10 minutes, and then re-enable it.

Answer

Recreate the Conditional Access policy with the same settings and assign it to the affected users.

Answer

Check if the affected users have an Intune license assigned; if not, assign one.

Question 18

You are reviewing a Windows 10 compliance policy in Microsoft Intune. A user with a device running Windows 10 version 20H2 (build 19042.985) reports that the device is marked as non-compliant. The device has a password of length 8, a PIN with 4 characters, Secure Boot enabled, BitLocker enabled, and Windows Defender Firewall active. What is the most likely reason for non-compliance?

Accepted Answer

The device uses a PIN with only 4 characters, which does not meet the minimum password length of 6.. The device uses a PIN with only 4 characters, which does not meet the minimum password length of 6. In Intune compliance policies for Windows 10, the 'Minimum password length' setting applies to both passwords and PINs. A PIN of 4 characters violates this requirement, causing non-compliance even if other settings like BitLocker and Secure Boot are properly configured.

Answer

Windows Defender Firewall is not active.

Answer

Secure Boot is not enabled on the device.

Answer

The OS build number 19042.985 is below the required minimum version 19041.0.

Question 19

A company uses Microsoft Intune to manage Windows 10 devices. A user reports that their device is not receiving critical security updates despite being compliant with all update policies. You verify that the device is online and communicating with Intune. Which action should you take to resolve the issue?

Accepted Answer

Review the Windows Update Rings policy assigned to the device and adjust the deferral settings for quality updates.. The user's device is compliant and online, but not receiving critical security updates. The most likely cause is that the Windows Update Rings policy assigned to the device has a deferral period configured for quality updates, which delays the installation of security patches. Adjusting the deferral settings for quality updates to 0 days ensures that critical security updates are installed immediately upon release, resolving the issue without changing the feature update deferral.

Answer

Verify that the device meets the minimum hardware requirements for the update.

Answer

Force a sync from the device via Intune Company Portal or Settings > Accounts > Access work or school.

Answer

Reassign the device to a different Update Ring policy that has no feature update deferral.

Question 20

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

Accepted Answer

The OMA-URI path is incorrect for an ADMX-backed policy.. Option D is correct because the OMA-URI path for an ADMX-backed policy must follow the exact format: `./Device/Vendor/MSFT/Policy/Config/ADMX_/`. If the path is incorrect—for example, missing the `ADMX_` prefix or using a wrong category name—the policy will fail to apply on Windows 10 devices. Custom configuration policies do support ADMX-backed policies, but the URI must precisely match the ADMX administrative template structure.

Answer

The value must be an integer, not a string.

Answer

The OMA-URI targets the user, not the device.

Answer

Custom configuration policies are not supported on Windows 10.