MD-102 Practice Exam 2 — 20 Questions

Question 1

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Accepted Answer

Ensure the device has a Windows 10/11 Pro or Education license. Subscription activation requires a qualifying base license of Windows 10/11 Pro or Education. These editions support the subscription activation feature, which upgrades the device to Windows 10/11 Enterprise without requiring a separate product key. Without this base license, the device cannot be upgraded via subscription activation.

Answer

Enter a MAK key

Answer

Configure a KMS host key

Answer

Install the Azure AD Connect tool

Question 2

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom shell script that runs once on each device. What should you configure?

Accepted Answer

A shell script with the 'Run script once per device' option.. Microsoft Intune provides a native 'Shell script' policy type for macOS that includes a 'Run script once per device' setting. This ensures the script executes exactly one time on each target device, meeting the requirement without additional configuration or workarounds.

Answer

A device compliance policy with a custom shell script.

Answer

A custom configuration profile with a script payload.

Answer

A managed app that includes the script.

Question 3

You are troubleshooting a Windows 11 device that fails to receive a PowerShell script deployed via Intune. The script is assigned to a group containing the device. Other policies on the device apply successfully. What should you check first?

Accepted Answer

Check the Windows PowerShell execution policy on the device.. The Windows PowerShell execution policy controls whether scripts can run on the device. Even if the script is successfully delivered by Intune, a restrictive execution policy (e.g., Restricted) will block its execution. Since other policies apply successfully, connectivity and group membership are not the issue, making the execution policy the most likely cause.

Answer

Ensure the device has internet connectivity.

Answer

Check that the script is digitally signed.

Answer

Verify that the device is in the correct security group.

Question 4

You are an Intune administrator for a company that has recently deployed Windows 11 devices. Management wants to ensure that all devices are running the latest feature update (Windows 11 23H2) within 60 days of release. You need to configure a Windows Update for Business policy in Intune to achieve this goal. Which settings should you configure?

Accepted Answer

Set the feature update deferral period to 60 days and assign the policy to all devices.. Setting the feature update deferral period to 60 days in a Windows Update for Business policy ensures that devices will wait up to 60 days after Microsoft releases a feature update (e.g., Windows 11 23H2) before installing it. This meets the requirement of having all devices running the latest feature update within 60 days of release, as the deferral period defines the maximum delay from the release date. Assigning the policy to all devices ensures blanket coverage across the Windows 11 fleet.

Answer

Set the feature update deferral period to 60 days and pause updates for 30 days.

Answer

Set the feature update deadline to 60 days and assign the policy to a device group.

Answer

Set the feature update deferral period to 0 days and assign to all users.

Question 5

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. App Protection Policies (APP) in Microsoft Intune provide data protection at the application layer, independent of device management. By setting 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' to 'Policy managed apps', corporate data in Microsoft 365 apps is prevented from leaking to unmanaged or compromised apps, even if the device itself is jailbroken or otherwise compromised. This ensures data remains protected regardless of the device's security state.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 6

Which TWO settings can be configured in a Microsoft Intune device compliance policy for iOS/iPadOS?

Accepted Answer

Require a password. Intune device compliance policies for iOS/iPadOS include a setting to require a password on the device, which can enforce specific password complexity rules such as minimum length, number of complex characters, and lockout behavior. This setting is a core compliance requirement for securing devices that access corporate resources.

Answer

Allow app installation from App Store only

Answer

Block USB devices

Answer

Jailbroken devices

Question 7

An organization uses Microsoft Intune to manage iOS/iPadOS devices. They have a custom line-of-business (LOB) iOS app that must be deployed to 50 devices. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the 50 devices. After 24 hours, only 30 devices have the app installed. The remaining 20 devices show 'pending install' status. What is the most likely cause?

Accepted Answer

The devices do not have a trusted certificate profile that trusts the enterprise signing certificate.. The most likely cause is that the 20 devices lack a trusted certificate profile that trusts the enterprise signing certificate. For an enterprise-signed LOB app to install on iOS/iPadOS, the device must trust the root certificate used to sign the app. Without a trusted certificate profile deployed via Intune, the installation will remain in 'pending install' status because the device cannot validate the app's signature.

Answer

The .ipa file exceeds the maximum file size allowed for LOB apps.

Answer

The users on the 20 devices have not opened the Company Portal app to trigger the installation.

Answer

The MDM push certificate has expired, preventing app installation.

Question 8

A company is planning to deploy a custom Win32 app to Windows 10 devices using Intune. The app requires a .NET Framework 4.8 prerequisite. Which TWO methods can the administrator use to ensure the prerequisite is installed?

Accepted Answer

Add the prerequisite as a dependency in the app deployment. Intune Win32 app deployment supports dependencies, allowing an administrator to specify .NET Framework 4.8 as a required dependency. When configured, Intune automatically installs the dependency before the main app, ensuring the prerequisite is present without manual intervention or additional scripting.

Answer

Require users to manually install the prerequisite

Answer

Use Group Policy to deploy the prerequisite

Answer

Package the prerequisite into the same Win32 app

Question 9

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

Accepted Answer

Compliance policy. A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Answer

Device configuration policy

Answer

Windows Update for Business policy

Answer

Device health attestation policy

Question 10

Which TWO settings must be configured to enable Windows Hello for Business in an Intune policy?

Accepted Answer

Use Windows Hello for Business.. To enable Windows Hello for Business in an Intune policy, you must configure two settings: 'Use Windows Hello for Business' acts as the master toggle to enable WHfB, and 'Minimum PIN length' establishes a mandatory PIN security baseline. Biometrics (facial recognition or fingerprint) is optional and not required to enable Windows Hello for Business.

Answer

Enable Windows Hello for Business provisioning.

Answer

Configure biometrics (facial recognition or fingerprint).

Answer

Certificate enrollment policy.

Question 11

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Accepted Answer

Users must have an Intune license assigned.. Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Answer

Devices must be connected via VPN.

Answer

Tenant must have Azure AD Premium P2.

Question 12

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned devices with work profile. Android Enterprise corporate-owned devices with work profile is a valid enrollment method in Microsoft Intune that allows IT to manage a work profile on company-owned devices while keeping the personal space separate. This method uses the Android Enterprise platform to enforce corporate policies without requiring full device management, leveraging the work profile container for security and compliance.

Answer

Android Device Administrator

Answer

Apple Business Manager

Answer

Windows Autopilot

Question 13

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

Accepted Answer

Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.. The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates. Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Answer

Change the update ring policy deadline to 7 days to ensure devices have enough time.

Answer

Create a new feature update policy for KB5001234 and assign it to all devices.

Answer

Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.

Question 14

You are planning the deployment of Windows 11 using Intune. Which TWO components are required to perform an in-place upgrade from Windows 10?

Accepted Answer

A Windows 11 feature update profile in Intune.. To perform an in-place upgrade from Windows 10 to Windows 11 using Intune, you need two core components: a Windows 11 feature update profile in Intune to trigger the upgrade, and hardware that meets Windows 11 system requirements for compatibility. Although the question asks for three components, only two of the listed options are correct. A valid product key is not needed because the digital license carries forward. The Intune Management Extension is not used for feature updates, and Group Policy for Windows Update for Business is not required when using Intune's built-in update management. The third component is not applicable in this context.

Answer

A Group Policy to enable Windows Update for Business.

Answer

A valid Windows 11 product key.

Answer

The Intune Management Extension installed on the device.

Question 15

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

Accepted Answer

.intunewin. The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Answer

.msi

Answer

.appx

Answer

.exe

Question 16

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. The ComplianceState property in Microsoft Intune reflects the compliance status at the time of the last device check-in. If a device has not synced for 7 days, the stored ComplianceState is stale and may no longer represent the actual compliance posture. The device could have become non-compliant since its last sync due to policy changes, missing updates, or configuration drift, but Intune will not update the state until the next successful sync.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

Question 17

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

Accepted Answer

%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Answer

%windir%	emp\MdmEnrollment.log

Answer

%windir%\Panther\setupact.log

Answer

Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

Question 18

A company uses Microsoft Intune to manage macOS devices. They need to deploy a custom plist configuration file to set security settings. Which policy type should they use?

Accepted Answer

Device configuration profile (custom). A custom device configuration profile in Microsoft Intune allows administrators to deploy plist files to macOS devices, enabling the configuration of settings not covered by built-in templates. This is the correct policy type for deploying a custom plist file because it directly supports uploading and assigning property list files to enforce specific security configurations.

Answer

App protection policy

Answer

Device compliance policy

Answer

Device cleanup rule

Question 19

Which TWO of the following are valid remote assistance tools for Windows devices managed by Microsoft Intune? (Choose two.)

Accepted Answer

Quick Assist. Quick Assist is a built-in Windows tool that allows remote assistance connections and is fully supported for managed devices in Microsoft Intune. It uses Remote Desktop Protocol (RDP) for screen sharing and control, and can be deployed and configured via Intune policies, making it a valid remote assistance option.

Answer

Windows Remote Management (WinRM)

Answer

Remote Desktop

Answer

Skype

Question 20

Your organization requires that all corporate laptops be encrypted. You manage Windows 10 devices with Microsoft Intune. Which policy should you configure?

Accepted Answer

Create a BitLocker policy in Intune Endpoint Protection.. Microsoft Intune's Endpoint Protection policy includes a dedicated BitLocker settings section that allows administrators to enforce encryption on Windows 10 devices. This policy centrally manages BitLocker drive encryption, recovery key escrow to Azure AD, and encryption method (e.g., XTS-AES 128-bit), meeting the requirement for corporate laptop encryption.

Answer

Enable Device Encryption in Windows settings.

Answer

Configure a FileVault policy for Windows devices.

Answer

Deploy an Encrypting File System (EFS) policy.