MD-102 Practice Exam 4 — 20 Questions

Question 1

You are configuring Microsoft Intune for Windows 10 devices. Which two settings can you enforce using a device restrictions profile? (Select TWO.)

Accepted Answer

Disable the camera. A is correct because the device restrictions profile in Microsoft Intune includes a 'Camera' setting under the 'General' category, which allows you to disable the camera on Windows 10 devices by setting it to 'Block'. This enforces a policy that prevents camera access across all apps and the OS, leveraging the CSP (Policy CSP) `Camera/AllowCamera`.

Answer

Set default web browser

Answer

Set battery saver threshold

Answer

Configure Windows Update for Business settings

Question 2

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Accepted Answer

Request the hardware hash from the device manufacturer (OEM). OEMs can provide the hardware hash for devices they manufacture, which can be uploaded to Microsoft Intune or the Autopilot deployment service. This method is commonly used for new devices ordered directly from the manufacturer, as the hash is generated during the manufacturing process and included in the device's packaging or accessible via the OEM's portal.

Answer

Extract the hardware hash from the device BIOS

Answer

Use Microsoft Intune to generate the hardware hash from the device serial number

Answer

Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

Question 3

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

Accepted Answer

The update ring is not assigned to the device's group.. The device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Answer

The update ring is configured with an incorrect deferral period.

Answer

The device is not compliant with the security baseline.

Answer

Windows Update is blocked by the corporate firewall.

Question 4

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Accepted Answer

Microsoft Entra ID Connect. In a hybrid deployment, Windows Hello for Business requires synchronization of user credentials from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID Connect (B) provides this synchronization, enabling the device to authenticate against both on-premises and cloud resources. Additionally, a Public Key Infrastructure (PKI) (C) is required to issue the certificate-based authentication keys used by Windows Hello for Business in hybrid deployments, as the on-premises domain controllers must trust the certificates.

Answer

Configuration Manager

Answer

Multifactor authentication (MFA)

Answer

Microsoft Intune

Question 5

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

Accepted Answer

Microsoft 365 Apps for Windows. The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Answer

Web link

Answer

Windows app (MSI)

Answer

Line-of-business app

Question 6

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

Accepted Answer

Trigger a sync from Intune to force the device to check in.. The PowerShell command shown likely runs a compliance evaluation or sync action, but the device remains noncompliant because the evaluation results haven't been reported back to Intune. Triggering a sync from Intune forces the device to check in, upload its latest compliance status, and update the portal, which is the first troubleshooting step before considering re-enrollment or policy changes.

Answer

Re-enroll the device.

Answer

Delete the device from Intune and re-register.

Answer

Assign a new compliance policy to the device.

Question 7

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

Accepted Answer

Check if the dependency app is assigned and installed successfully. When a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Answer

Ensure the devices have internet connectivity

Answer

Verify that the app is signed with a trusted certificate

Answer

Recreate the deployment policy

Question 8

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

Accepted Answer

The conditional access policy has the grant control set to 'Require device to be marked as compliant'.. The most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Answer

All users have the required Microsoft 365 license.

Answer

The conditional access policy includes all cloud apps.

Answer

The device platform condition is set to iOS and Android only.

Question 9

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

Accepted Answer

Apple Automated Device Enrollment (ADE). Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Answer

Apple Configurator enrollment

Answer

Device Enrollment Manager (DEM) account

Answer

User-initiated enrollment via Company Portal

Question 10

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Accepted Answer

Create a Windows 10 feature update deployment policy.. A Windows 10 feature update deployment policy is the specific Intune policy type designed to deliver feature updates (like version 22H2) to devices. This policy allows you to specify the target version and control the rollout, which is required for deploying feature updates via Intune.

Answer

Create a device compliance policy for the target version.

Answer

Create a Windows 10 update ring with expedited updates.

Question 11

You manage Windows 10 devices with Microsoft Intune. A user reports that their device is not receiving required compliance policies, and the device status in Intune shows 'Not evaluated' for compliance. You confirm the device is enrolled and able to sync. What should you check first?

Accepted Answer

Ensure the compliance policy is assigned to a group that includes the user or device.. A compliance policy must be assigned to a group containing the user or device for it to be evaluated. Even if the device is enrolled and syncing, without assignment the policy will not apply, resulting in a 'Not evaluated' status in Intune.

Answer

Verify that the user is assigned an Intune license.

Answer

Run the 'dsregcmd /status' command to check the device registration status.

Answer

Check that the device has a TPM chip enabled and Secure Boot turned on.

Question 12

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Accepted Answer

MDM enrollment enabled in Microsoft Entra ID. Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Answer

A device compliance policy assigned to the device

Answer

Azure AD Premium P1 license

Question 13

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

Accepted Answer

Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.. Setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Answer

Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

Answer

Set 'Update deferral period (days)' to 7.

Answer

Set 'Update deferral period (days)' to 30.

Question 14

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Accepted Answer

Enables the Windows Firewall for the public network profile. The setting shown in the exhibit configures the Windows Firewall to enable the firewall for the public network profile. In Intune, the 'Windows Firewall' configuration policy allows administrators to define per-profile firewall states. Enabling the firewall for the public profile is a common security baseline requirement to protect devices on untrusted networks.

Answer

Disables the Windows Firewall for all network profiles

Answer

Enables Microsoft Defender Antivirus real-time protection

Answer

Disables the Windows Firewall for the domain network profile

Question 15

A company uses Microsoft Intune to manage Windows 11 devices. Users report that the Company Portal app is not showing required applications. You verify that the devices show as 'Compliant' in Microsoft Intune. Which configuration should you check first?

Accepted Answer

Check the application assignments in Intune.. The most common reason required applications are not visible in Company Portal is that the applications have not been assigned to the user or device group. Even if a device is compliant, Intune will only display applications that are assigned with an 'Available' intent to the user or device. Checking application assignments first directly addresses the symptom without assuming other configurations are misconfigured.

Answer

Check the Microsoft Entra ID (Azure AD) configuration for the device.

Answer

Check the Windows Update for Business ring assignments.

Answer

Check the device compliance policy settings.

Question 16

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Accepted Answer

Device compliance policy. Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

Windows update ring

Question 17

Your organization needs to deploy a web app link to users' devices via Microsoft Intune. Which app type should you select?

Accepted Answer

Web link. C is correct because a Web link app type in Microsoft Intune allows you to deploy a shortcut to a web app on users' devices without installing any software. This is ideal for linking to a web app that runs in a browser, as it simply places an icon on the device's app list or home screen that opens the specified URL.

Answer

Windows app (Win32)

Answer

iOS store app

Answer

Managed Google Play app

Question 18

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

Accepted Answer

Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.. Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Answer

Set up an automatic enrollment policy that retires devices after 30 days of inactivity.

Answer

Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.

Answer

Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.

Question 19

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Accepted Answer

Create a device compliance policy that checks for required settings.. A device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Answer

Configure an Exchange Active Sync policy in Intune.

Answer

Create a device configuration profile to enforce security settings.

Answer

Deploy an app protection policy for Outlook for iOS and Android.

Question 20

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile