MD-102 Practice Exam 3 — 20 Questions

Question 1

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.. The scenario requires a user-driven deployment where the user signs in with Microsoft Entra ID credentials during OOBE, and the device is automatically enrolled in Intune. Setting 'Deployment mode' to 'User-Driven' ensures the user authenticates during OOBE, and 'Join to Microsoft Entra ID as' to 'Microsoft Entra ID joined' makes the device Microsoft Entra ID-joined, which triggers automatic Intune enrollment via the MDM enrollment authority configured in Microsoft Entra ID.

Answer

Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.

Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.

Answer

Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.

Question 2

Match each Microsoft 365 Defender feature to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides endpoint detection and response (EDR) and antivirus across devices. The correct matches are: Microsoft Defender for Endpoint (endpoint protection), Microsoft Defender for Office 365 (email/collaboration protection), Microsoft Defender for Identity (on-premises threat detection via AD), and Microsoft Defender for Cloud Apps (SaaS security via CASB). The distractors swap the definitions of Endpoint and Office 365.

Answer

Microsoft Defender for Endpoint: Protects email and collaboration tools

Answer

Microsoft Defender for Office 365: Provides endpoint detection and response

Question 3

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

Accepted Answer

Device configuration profile for Windows Update for Business. Windows Update for Business (WUfB) policies are configured using a device configuration profile in Microsoft Intune, specifically under the 'Windows Update for Business' template. This profile type allows you to manage update settings such as deferral periods, pause updates, and feature update targeting directly from Intune without requiring on-premises WSUS or additional infrastructure.

Answer

App protection policy

Answer

Device compliance policy

Answer

Endpoint security policy for antivirus

Question 4

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a user reports a lost device, you can remotely lock it and display a custom message on the lock screen. The solution must not erase any data. What should you do?

Accepted Answer

Use the Remote lock action and configure a custom lock screen message.. To remotely lock a lost Windows device and display a custom message without erasing data, use the Remote lock action in Intune. Additionally, configure a custom lock screen message through a device configuration profile. This secures the device and provides contact information, all without data loss.

Answer

Use the Fresh Start action.

Answer

Perform a full wipe.

Answer

Perform a selective wipe.

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. After deploying, users report that the app is not available in the work profile. What is the most likely cause?

Accepted Answer

The app has not been approved in the managed Google Play store.. Managed Google Play apps must be approved before they can be deployed to work profile devices. Without approval, the app will not appear in the work profile's Play Store.

Answer

The app is only available for corporate-owned devices.

Answer

Android Enterprise enrollment is not enabled in Intune.

Answer

The device does not have a work profile configured.

Question 6

Refer to the exhibit. A Microsoft Intune security baseline is configured for Windows 10 devices. What is the effect of this setting?

Accepted Answer

It reduces the CPU priority of scheduled scans to minimize performance impact.. This setting in the Microsoft Intune security baseline for Windows 10 configures the 'Low CPU priority for scheduled scans' policy for Microsoft Defender Antivirus. When enabled, it reduces the CPU priority of scheduled scans to minimize performance impact on the user's active workload, ensuring that background scanning does not interfere with foreground tasks.

Answer

It requires a reboot for the setting to take effect.

Answer

It enables real-time protection for scheduled scans.

Answer

It disables scheduled scans when the device is in use.

Question 7

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

Accepted Answer

Assign the app and configure 'Require device compliance' with a filter for minimum OS version.. Intune allows you to create a filter based on device properties such as OS version, and apply that filter to app assignments. This ensures the deployment is only available to devices meeting the minimum OS version. Option B is incorrect because 'Uninstall' intent would remove the app, not deploy it with OS filtering. Option C is incorrect because 'Available for enrolled devices' without filters does not enforce any OS version requirement. Option D is incorrect because assigning as 'Required' to all devices does not filter by OS version.

Answer

Assign the app with 'Uninstall' intent.

Answer

Assign the app as 'Available for enrolled devices' without filters.

Answer

Assign the app as 'Required' to all devices.

Question 8

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Accepted Answer

Retain the Autopilot registration. Options C and D are correct. Windows Autopilot reset retains the device's Autopilot registration (option C) and removes personal files and apps (option D). Option A is incorrect because Autopilot reset does not change the primary user; that requires a different process. Option B is incorrect because Autopilot reset does not reinstall Windows from scratch; it refreshes the existing OS. Option E is incorrect because Autopilot reset does not remove the device from Microsoft Intune; that would require a manual action.

Answer

Change the primary user of the device

Answer

Reinstall Windows 11 from scratch

Answer

Remove the device from Microsoft Intune

Question 9

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

Accepted Answer

Check the Intune console for Wi-Fi profile assignment and conflict status. Checking the Intune console for Wi-Fi profile assignment and conflict status is the fastest way to identify deployment issues, such as the profile not being assigned to the affected devices or conflicts with other profiles. Option A is wrong because recreating the profile may not address the root cause and could be time-consuming without first verifying the current assignment. Option B is wrong because running 'netsh wlan show profiles' only lists profiles stored locally and does not show Intune deployment status. Option D is wrong because reviewing Microsoft Entra ID sign-in logs does not show Wi-Fi profile status or assignment conflicts.

Answer

Recreate the Wi-Fi profile in Intune with new settings

Answer

Run the 'netsh wlan show profiles' command on affected devices

Answer

Review Microsoft Entra ID sign-in logs for authentication failures

Question 10

Match each Microsoft 365 Apps update channel to its description.

Accepted Answer

Current Channel: Provides users with the newest features as soon as they are released by Microsoft.. Update channels control how Microsoft 365 Apps are updated, relevant for MD-102.

Answer

Current Channel: Provides users with new features twice a year, typically in January and July.

Answer

Monthly Enterprise Channel: Provides users with the newest features as soon as they are released by Microsoft.

Question 11

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

Accepted Answer

Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.. Update rings are the primary policy in Microsoft Intune for controlling how and when Windows 10 and later devices receive updates from Windows Update. Setting 'Automatic update behavior' to 'Auto install and reboot' ensures that critical and security updates are automatically downloaded and installed without user intervention, meeting the requirement for all Windows 11 devices.

Answer

Configure a device configuration profile with 'Windows Update for Business' settings.

Answer

Deploy a feature update policy to install the latest quality updates.

Answer

Create a device compliance policy that requires devices to have the latest updates.

Question 12

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

Accepted Answer

Microsoft 365 Apps (Windows) configuration policy. The Microsoft 365 Apps (Windows) configuration policy is the correct choice because it is specifically designed to manage the deployment, update settings, and configuration of Microsoft 365 Apps for enterprise on Intune-managed Windows devices. This policy type provides granular control over installation parameters, update channels, and app settings, directly aligning with the requirement to deploy a Microsoft 365 Apps configuration.

Answer

Device configuration profile (settings catalog)

Answer

Managed apps policy

Answer

Windows update ring policy

Question 13

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes:
- 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune)
- 1,500 iOS devices (corporate-owned, managed via Intune)
- 500 Android devices (BYOD, managed via Intune with work profile)
- 200 macOS devices (corporate-owned, managed via Intune)

You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.

You have the following requirements:
1. Zero-touch enrollment for new Windows 11 devices.
2. Devices must be automatically configured with security policies and required applications.
3. Conditional access to Microsoft 365 resources based on device compliance.
4. Support for both corporate and BYOD devices.

Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

Accepted Answer

Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.. Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Answer

Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.

Answer

Assign Microsoft Intune licenses to all users who will receive the new devices.

Answer

Create a compliance policy that requires BitLocker encryption and a minimum OS version.

Question 14

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

Accepted Answer

The devices must be registered in Microsoft Intune via the hardware vendor or manually.. For Windows Autopilot to automatically enroll devices, the devices must be registered in Microsoft Intune. This can be done by the hardware vendor (OEM registration) or manually by the organization. Without registration, Autopilot cannot identify the device and apply the deployment profile.

Answer

The organization must have a hybrid Azure AD join configuration in place.

Answer

BitLocker must be enabled on the devices before they are shipped.

Answer

A local administrator account must be created on each device prior to deployment.

Question 15

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

Accepted Answer

Configure Conditional Access policies in Microsoft Entra ID that require compliant devices. Conditional Access policies in Microsoft Entra ID can require that devices accessing Microsoft 365 services be marked as compliant by Intune. This ensures that only devices meeting your security policies (e.g., encryption, antivirus, OS patch level) are granted access, directly addressing the security team's concern about unmanaged devices on public Wi-Fi.

Answer

Deploy Windows Autopilot for all devices and require Entra ID join

Answer

Configure a VPN profile in Intune and enforce device compliance on the VPN server

Answer

Create a compliance policy in Intune and assign it to all users

Question 16

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

Accepted Answer

Configure a device restriction policy to allow only managed Google Play apps.. A device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Answer

Set the device to 'Fully managed' and disable unknown sources.

Answer

Deploy an app configuration policy that blocks sideloading.

Answer

Use a compliance policy to block non-compliant apps.

Question 17

Contoso Ltd. is a financial services company with 2,000 users. They use Microsoft Intune to manage Windows 10 devices. The company has a strict security policy that requires all devices to have a specific set of security applications installed: an antivirus (AV) app, a disk encryption app, and a VPN client. These apps are all line-of-business (LOB) Win32 apps packaged as .intunewin files. The administrator created a Win32 app for each and assigned them as 'Required' to all devices. After the deployment, the administrator notices that the apps are not installing on approximately 10% of devices. The devices are online and have connectivity. The Intune Management Extension is running. When the administrator checks the Intune Management Extension logs on a failing device, they see the following error: 'Failed to download content. Error: 0x80070002 - The system cannot find the file specified.' What is the most likely cause?

Accepted Answer

The content for the Win32 app was not uploaded correctly or is missing from Intune.. The error 0x80070002 ('The system cannot find the file specified') in the Intune Management Extension logs indicates that the client is attempting to download the Win32 app content from Intune, but the content blob is missing or inaccessible. This typically occurs when the .intunewin file was not uploaded correctly, the upload was interrupted, or the content was deleted from Intune after assignment. Since the extension is running and connectivity is confirmed, the issue is server-side content availability, not client-side permissions or detection logic.

Answer

The Intune Management Extension does not have permission to install apps on those devices.

Answer

The user is not logged in, so the app cannot be installed.

Answer

The app detection rules do not match the installed version.

Question 18

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

Accepted Answer

Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.. The native integration between Microsoft Defender for Endpoint and Microsoft Intune enables automatic remediation of vulnerabilities discovered by Defender's threat and vulnerability management (TVM) component. When Defender XDR surfaces a critical vulnerability, Intune can push remediation actions (patches, configuration changes, app updates) to the affected managed devices without manual intervention. This is the built-in 'security task' workflow that flows from Defender into Intune's endpoint security node.

Answer

Configure a Microsoft Sentinel playbook.

Answer

Configure a Microsoft Foundry AI model.

Answer

Configure a Microsoft Purview data loss prevention policy.

Question 19

You need to wipe a lost corporate-owned Windows 10 device that is enrolled in Intune. Which action should you take?

Accepted Answer

Select the device and choose Wipe.. The Wipe action in Intune restores a Windows 10 device to its factory default settings, removing all data and corporate access. This is the appropriate action for a lost corporate-owned device because it ensures sensitive data is erased while retaining the device's enrollment record for potential recovery or re-provisioning.

Answer

Delete the device from Intune.

Answer

Select the device and choose Retire.

Answer

Reset the device using the Company Portal.

Question 20

You are configuring an app protection policy in Microsoft Intune for iOS/iPadOS devices. Which setting can you enforce to prevent users from copying data from a managed app and pasting it into an unmanaged app?

Accepted Answer

Restrict cut, copy, and paste between other apps. The 'Restrict cut, copy, and paste between other apps' setting in an Intune app protection policy (APP) for iOS/iPadOS directly controls data transfer between managed and unmanaged apps. When set to 'Blocked' or 'Policy Managed with Paste In', it prevents users from copying data from a managed app and pasting it into an unmanaged app, enforcing data leakage prevention at the OS clipboard level via the Intune MAM SDK.

Answer

Require a PIN for access

Answer

Prevent iTunes and iCloud backups

Answer

Block managed apps from running on jailbroken devices