MD-102 Practice Exam 4 — 20 Questions

Question 1

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

Accepted Answer

An enterprise certification authority (CA) must be deployed and all devices must be Azure AD joined or hybrid Azure AD joined.. Certificate-based Windows Hello for Business requires an enterprise PKI to issue and validate certificates for authentication. Devices must be Azure AD joined or hybrid Azure AD joined to enroll these certificates and support the certificate trust model. On-premises Active Directory and Azure AD Connect provide the hybrid identity foundation, but the CA and appropriate device join state are the critical prerequisites.

Answer

All users must have the Microsoft Authenticator app installed.

Answer

Conditional Access policies must be configured to require Windows Hello for Business.

Answer

All users must be configured for passwordless sign-in.

Question 2

A company uses Microsoft 365 E3 licenses. They need to enforce that all users must use the Microsoft Authenticator app for MFA instead of SMS or phone call. What should the administrator configure?

Accepted Answer

Authentication methods policy. The Authentication methods policy (B) is the correct configuration because it allows administrators to control exactly which authentication methods users can register and use for MFA. By targeting the policy to all users and disabling SMS and voice call while enabling Microsoft Authenticator (push notifications or OTP), the requirement is met. This policy supersedes legacy MFA settings and provides granular control over modern authentication methods.

Answer

MFA service settings in the legacy portal

Answer

Security defaults

Answer

Conditional Access policy

Question 3

A company uses Microsoft 365 with hybrid identity. Users report that after changing their on-premises passwords, they cannot access SharePoint Online for up to 30 minutes, but Outlook on the web works immediately. You need to reduce the delay for SharePoint Online access. What should you do?

Accepted Answer

Run a Delta Sync in Azure AD Connect.. The delay occurs because password changes are synchronized only during the next Azure AD Connect sync cycle, which by default runs every 30 minutes. Running a Delta Sync immediately replicates the new password hash to Azure AD, eliminating the wait for SharePoint Online authentication.

Answer

Configure password writeback in Azure AD Connect.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

In Azure AD, configure the user to require password change at next sign-in.

Question 4

A company uses Microsoft Intune to manage Windows 10 devices. The administrator needs to configure Windows Defender Firewall rules via a device configuration profile. Which TWO settings can be configured?

Accepted Answer

Set default inbound action. Option B is correct because the Windows Defender Firewall device configuration profile in Microsoft Intune includes the 'Default inbound action' setting, which allows administrators to specify whether inbound connections that do not match an explicit rule should be blocked or allowed. This setting is a core firewall behavior control that can be enforced via a device configuration profile (Windows 10 and later) under the 'Endpoint Protection' category.

Answer

Configure notification settings

Answer

Configure log file location

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a device compliance policy that requires BitLocker.. Option B is correct because a device compliance policy in Microsoft Intune can include the setting to require BitLocker on Windows 10 devices. This policy evaluates the device's BitLocker status and marks it as noncompliant if BitLocker is not enabled, which is a prerequisite for Conditional Access to block access to corporate resources.

Answer

Assign the device compliance policy to all users.

Answer

Enable Windows Hello for Business.

Answer

Create a device configuration profile to enable BitLocker.

Question 6

An organization uses Configuration Manager to deploy software updates to Windows 10 devices. The administrator wants to ensure that devices receive updates from the local distribution point rather than the cloud. Which boundary group option should be configured?

Accepted Answer

Prefer distribution points over cloud sources. Option A is correct because the 'Prefer distribution points over cloud sources' boundary group option ensures that clients will attempt to download software updates from a local distribution point before falling back to a cloud-based source. This setting directly controls client behavior to prioritize on-premises distribution points, which aligns with the administrator's goal of keeping traffic local and avoiding cloud egress.

Answer

Enable peer caching

Answer

Use cloud distribution points only

Answer

Fallback to cloud sources

Question 7

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Accepted Answer

Multi-factor authentication (MFA). Multi-factor authentication (MFA) is essential for a zero-trust architecture because it enforces strong identity verification beyond just a password, ensuring that each authentication request is validated with an additional factor (e.g., a phone call, text message, or authenticator app). This aligns with the zero-trust principle of 'never trust, always verify' by requiring explicit proof of identity at every access attempt, even if the user is inside the corporate network.

Answer

Azure AD Application Proxy

Answer

Azure AD Connect sync

Question 8

An administrator runs the above PowerShell command on a Windows 10 device managed by Microsoft Defender for Endpoint. The device is reporting as healthy in the security console. Based on the output, which protection feature is disabled?

Accepted Answer

Real-time protection. The PowerShell command `Get-MpComputerStatus` returns the current status of Microsoft Defender Antivirus. The output shows `AMServiceEnabled : False`, which indicates the antimalware service is disabled, but the critical indicator is `RealTimeProtectionEnabled : False`. Real-time protection monitors file system activity for malware in real time; when disabled, the device may still report as healthy in the Microsoft Defender for Endpoint console if other components (e.g., cloud-delivered protection) are active, but the device is not fully protected against immediate threats.

Answer

IOAV protection

Answer

Antimalware service

Answer

Antivirus

Question 9

A company uses Microsoft Intune to manage Windows 10 devices. They have a compliance policy that requires BitLocker to be enabled. Some devices are marked as non-compliant even though BitLocker appears to be on. The administrator runs 'manage-bde -status' on a non-compliant device and sees that the protection status is 'Protection Off'. What is the most likely cause?

Accepted Answer

The BitLocker key protectors are missing or have been removed.. The compliance policy requires BitLocker to be enabled, but 'manage-bde -status' shows 'Protection Off'. This indicates that while the drive is encrypted, BitLocker is not actively protecting the data because the key protectors (such as the TPM protector) are missing or have been removed. Intune checks the protection status, not just encryption state, so when protectors are absent, the device is marked non-compliant.

Answer

The TPM is not initialized.

Answer

The device has a recovery password protector but no TPM protector.

Answer

The device uses a different encryption method (e.g., XTS-AES 256 vs AES 128).

Question 10

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is packaged as an .msi file. Which TWO steps are required to deploy this app via Intune?

Accepted Answer

Assign the app to a group of users or devices.. Option C is correct because after preparing the Win32 app, you must assign it to a group of users or devices in Intune to trigger deployment. Without assignment, the app is uploaded but not installed on any target. This step is mandatory for any Intune-managed app deployment.

Answer

Upload the .msi file directly as a Microsoft Store for Business app.

Answer

Install the app on a file server and configure a shortcut.

Answer

Create a PowerShell script to install the app silently.

Question 11

A company deploys Windows 10 Enterprise devices managed by Microsoft Intune. Users report that after a recent Windows update, the Start menu layout is reset to default on some devices. The company uses a custom Start menu layout XML policy. How should the administrator ensure the custom layout is reapplied automatically after feature updates?

Accepted Answer

Configure the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar to point to the XML file.. Option C is correct because the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar in a Group Policy Object (GPO) or Intune Administrative Template profile is designed to persistently enforce a custom Start layout XML. When a Windows feature update resets the Start menu to default, this policy automatically reapplies the custom layout at next user logon or policy refresh, ensuring consistency without manual intervention.

Answer

Use a Feature Update policy in Intune to set the 'Start layout XML' setting.

Answer

Deploy a provisioning package with the custom layout to all devices via Intune.

Answer

Reapply the Start layout policy manually after each feature update.

Question 12

A company uses Microsoft Intune to manage iOS devices. They want to enforce a policy that requires a passcode of at least 6 characters and auto-lock after 5 minutes. Which configuration profile type should they use?

Accepted Answer

Device restrictions profile.. A Device restrictions profile is the correct configuration profile type because it contains the security settings for iOS devices, including passcode requirements (minimum length, complexity) and device lock timeouts (auto-lock after minutes). This profile type enforces device-level security policies directly managed by Intune, making it the appropriate choice for requiring a 6-character passcode and 5-minute auto-lock.

Answer

Wi-Fi profile.

Answer

VPN profile.

Answer

Email profile.

Question 13

A company uses Microsoft Intune to manage iOS devices. The administrator configures a device compliance policy that requires a minimum OS version of 15.0. Users report that devices running iOS 14.8 are marked non-compliant even after updating to iOS 15.0. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune after the update. The most likely cause is that the device has not checked in with Intune after the update. Intune relies on periodic check-ins to evaluate compliance; if the device updated to iOS 15.0 but hasn't completed a check-in, Intune still sees the last reported OS version (14.8) and marks it non-compliant. A forced sync or waiting for the next scheduled check-in resolves this.

Answer

The compliance policy requires a grace period

Answer

The update was not applied successfully

Answer

The compliance policy is not assigned to the correct user group

Question 14

Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?

Accepted Answer

The app must be signed with an Apple Developer Enterprise Distribution certificate.. Option B is correct because iOS line-of-business (LOB) apps distributed outside the App Store must be signed with an Apple Developer Enterprise Distribution certificate to be trusted by the device. This certificate allows the app to run without being individually approved by Apple, which is required for Intune-managed enterprise deployment. Without this signing, the device will reject the installation due to code signing validation failures.

Answer

The app must be assigned to a security group.

Answer

The user must have an active Apple ID.

Question 15

A company applies the above BitLocker policy to Windows 10 devices via Intune. An administrator discovers that some devices are not encrypting. The administrator checks a device and finds that it has no TPM chip. Which setting in the policy will cause encryption to fail?

Accepted Answer

requireTpm. The 'requireTpm' setting enforces that BitLocker will only start encryption if a Trusted Platform Module (TPM) chip is present on the device. If a device lacks a TPM, this policy setting causes the encryption process to fail outright, as BitLocker cannot meet the mandatory hardware requirement.

Answer

recoveryKeyRotation

Answer

encryptionMethod

Answer

requireStartupPin

Question 16

You manage a hybrid Azure AD joined environment with Microsoft Intune. You need to migrate Group Policy objects (GPOs) to Intune policies for Windows 10 devices. Which THREE tools or methods should you use?

Accepted Answer

MDM Migration Analysis Tool (MMAT). The MDM Migration Analysis Tool (MMAT) is correct because it analyzes existing on-premises Group Policy Objects (GPOs) and generates a report mapping each GPO setting to its equivalent MDM policy in Intune, including a readiness score. This tool directly supports the migration workflow by identifying which GPOs can be converted and which require manual intervention, making it essential for planning a GPO-to-Intune migration.

Answer

Desktop Analytics

Answer

PowerShell scripts to apply registry settings

Question 17

A company uses Microsoft Intune to manage iOS/iPadOS devices. The compliance policy requires a minimum OS version of 15.0. A user reports that their iPad running iOS 14.8 cannot access company email and shows as non-compliant. However, the device is up to date with the latest available OS for that hardware. What should you do to allow the device to access email while maintaining security?

Accepted Answer

Configure a compliance grace period of 30 days on the policy.. Option A is correct because a compliance grace period allows the device to remain non-compliant for a specified duration (e.g., 30 days) without immediately blocking access to company resources. This gives the user time to update the OS if possible, but since the iPad hardware cannot go beyond iOS 14.8, the grace period still permits email access while the device is marked non-compliant, maintaining security by not permanently exempting the device.

Answer

Change the minimum OS version to 14.8 in the policy.

Answer

Delete the compliance policy that requires iOS 15.0.

Answer

Request the user to update the iPad to iOS 15.0.

Question 18

You are deploying Microsoft Defender for Endpoint to Windows 10 devices managed by Microsoft Intune. After onboarding, you need to verify that the sensor is running. Which cmdlet should you use on the device?

Accepted Answer

Get-Service -Name Sense. The correct cmdlet is Get-Service -Name Sense because the Microsoft Defender for Endpoint sensor runs as a Windows service named 'Sense' (Microsoft Defender Advanced Threat Protection Service). Checking this service confirms the sensor is installed and running, which is the standard verification step after onboarding devices to Defender for Endpoint.

Answer

Get-Service -Name WinDefend

Answer

Get-DefenderEndpoint

Answer

Get-MpComputerStatus

Question 19

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

Accepted Answer

Create an update ring for Windows 10 with a deadline of 7 days.. Option B is correct because update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Answer

Create a compliance policy for Windows 10 update compliance.

Answer

Create a device configuration profile for Windows 10 updates.

Answer

Configure a Windows Update for Business policy in Group Policy.

Question 20

A user reports that their Windows 10 device is not receiving policies from Microsoft Intune. The device shows as 'Not compliant' in the Intune console. You run the Get-MgDeviceManagementManagedDevice cmdlet and see that the device is enrolled and appears in the list. However, the LastSyncTime is 14 days ago. What is the most likely cause?

Accepted Answer

The Intune Management Extension service is not running on the device.. The Intune Management Extension (IME) service is responsible for synchronizing policies, including compliance and configuration policies, from Intune to Windows 10 devices. If the IME service is not running, the device will not receive new policies or sync status, leading to a stale LastSyncTime (14 days ago) and a 'Not compliant' state, even though the device is enrolled and appears in the Get-MgDeviceManagementManagedDevice output.

Answer

The MDM certificate has expired.

Answer

The device is not connected to the internet due to a proxy misconfiguration.

Answer

The device is not enrolled in Intune.