MD-102 Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Company Portal app from their devices. Which configuration should you apply?

Accepted Answer

Assign the Company Portal app as 'Required' with 'Removable' set to No.. When you assign the Company Portal app as 'Required' for iOS/iPadOS devices in Microsoft Intune, you can set the 'Removable' option to 'No'. This configuration prevents users from uninstalling the Company Portal app, ensuring it remains on the device for management and compliance purposes.

Answer

Assign the Company Portal app as 'Available for enrolled devices' with 'Removable' set to Yes.

Answer

Assign the Company Portal app as 'Uninstall' for all devices.

Answer

Create a device restriction policy that blocks removal of the Company Portal app.

Question 2

A company uses Microsoft Intune to manage iOS devices. They want to ensure that only devices with a passcode of at least 6 characters and without jailbreak can access corporate email. Which policy type should they configure?

Accepted Answer

Device compliance policy. Device compliance policies in Microsoft Intune evaluate device-level security settings such as jailbreak status and passcode length. By configuring a compliance policy that requires a passcode of at least 6 characters and detects jailbroken devices, Intune can mark non-compliant devices and, when combined with Conditional Access, block access to corporate email. This is the correct policy type because it directly assesses the device's security posture rather than app-level or configuration settings.

Answer

Conditional Access policy

Answer

App protection policy

Answer

Device configuration policy

Question 3

A user reports that a Microsoft 365 Apps for enterprise installation on a Windows 10 device fails with error code 30088-1028. The device is managed by Intune. What is the most likely cause?

Accepted Answer

The device does not have enough free disk space.. Error code 30088-1028 during Microsoft 365 Apps for enterprise installation specifically indicates insufficient disk space on the system drive. The Office deployment process requires a minimum of 4-8 GB of free space for download, extraction, and installation. Intune-managed devices will fail with this exact error when the Click-to-Run service cannot allocate the required temporary and permanent storage.

Answer

Windows Update is disabled on the device.

Answer

The user does not have an appropriate license assigned.

Answer

The device is behind a proxy that blocks the Microsoft CDN.

Question 4

Refer to the exhibit. A KQL query is run in Microsoft Defender XDR for a device 'WIN10-PC'. The results show that a critical line-of-business app 'ContosoApp' version '2.0.0' has InstallationResult 'Failed' with ErrorCode '0x80073CF6'. What does this error code typically indicate?

Accepted Answer

The app package is not signed correctly. Error code 0x80073CF6 in Microsoft Defender XDR corresponds to APPX_E_CORRUPT_CONTENT, which indicates that the app package's digital signature is invalid or the package content has been tampered with. This typically occurs when the .appx or .msix package is not signed correctly or the signature does not match the package contents, preventing installation on Windows 10/11 devices.

Answer

The device does not have internet connectivity

Answer

The user does not have permission to install apps

Answer

The device has insufficient disk space

Question 5

A user reports that their iOS device is not receiving email on their work account. The device is enrolled in Intune. You verify that the Exchange ActiveSync profile is assigned correctly. What should you check next?

Accepted Answer

Check the device's compliance status in Intune.. If the device is noncompliant (e.g., due to a noncompliant app or OS version), Conditional Access policies in Intune will block email access even if the Exchange ActiveSync profile is correctly assigned. Option A is incorrect because the MDM authority is already verified by the fact the device is enrolled and the profile is assigned; changing it would not resolve the issue. Option B is incorrect because app protection policies (MAM) are separate from device-level email access via the native mail app—they manage data protection within apps, not connectivity. Option C is incorrect because Device Enrollment Manager (DEM) mode is used for bulk enrollment scenarios, not for individual device email issues.

Answer

Ensure the MDM authority is set to Intune.

Answer

Check if an app protection policy is assigned to the user.

Answer

Verify that the device is enrolled in device enrollment manager mode.

Question 6

You are deploying a custom Windows 10 image to 200 new laptops using MDT. The deployment fails on several devices at the 'Apply Operating System' step with error 0x80070070. The laptops have 60 GB SSDs and 4 GB RAM. What is the most likely cause?

Accepted Answer

The custom image is too large for the 60 GB SSD.. Error 0x80070070 translates to 'insufficient disk space' (ERROR_DISK_FULL). During the 'Apply Operating System' step, MDT decompresses the custom WIM image and applies it to the local disk. With a 60 GB SSD, if the custom image (including drivers, updates, and applications) exceeds the available free space after partitioning, the deployment fails. This is the most direct cause given the error code and hardware constraints.

Answer

The laptops have insufficient RAM (4 GB) to run the deployment.

Answer

The deployment share is not accessible over the network.

Answer

The custom image is missing critical drivers.

Question 7

A company is using Microsoft Deployment Toolkit (MDT) to deploy Windows 11 to 200 new laptops. The deployment includes applications such as Microsoft 365 Apps for enterprise and a line-of-business (LOB) application. The LOB application requires a specific registry key to be set before installation. You have added a 'Set Registry' step in the task sequence before the application installation step. During a test deployment, the LOB application fails to install. The MDT logs show that the registry key is set correctly, but the application installer still fails. You suspect the application requires a reboot after setting the registry key. The task sequence does not have a reboot step after the registry change. Which step should you add to the task sequence?

Accepted Answer

Add a 'Restart Computer' step immediately after the 'Set Registry' step. The LOB application requires a reboot after the registry key is set to make the change effective. In MDT, a 'Restart Computer' step forces a system restart, ensuring the registry modification is recognized by the application installer. Without this reboot, the installer may read stale registry data and fail, even though the key is correctly written.

Answer

Add a 'Wait' step for 60 seconds

Answer

Add a 'Set Task Sequence Variable' step to set a reboot variable

Answer

Add a 'Run Command Line' step to run gpupdate /force

Question 8

You are reviewing an iOS LOB app configuration in Intune. The app is assigned to a user group that includes both iPhone and iPad users. Users with iPhones report that the app does not appear in Company Portal. What is the most likely reason?

Accepted Answer

The app is configured to deploy only to iPads.. Intune allows administrators to configure iOS LOB apps with device-type restrictions, including a setting that limits deployment to iPads only. If this setting is enabled, the app will not appear in Company Portal for iPhone users, even though they are in the assigned user group. The app's assignment is based on user group membership, but device-level filtering prevents it from being visible on unsupported device types.

Answer

The bundle ID is incorrect for the app.

Answer

The build number is missing.

Answer

The app version is not specified.

Question 9

A company with 500 users uses Microsoft 365 E3 licenses. They want to ensure that all users have multi-factor authentication (MFA) enforced. Currently, 80% of users have MFA enabled through the legacy per-user MFA setting. The security team wants to use Conditional Access policies instead. You need to migrate from per-user MFA to Conditional Access with no disruption to users. What should you do?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding break-glass accounts. Disable per-user MFA for all users.. You need to exclude the break-glass accounts from the Conditional Access policy to ensure admin access if something goes wrong. You should first create a Conditional Access policy that requires MFA for all users except the break-glass accounts, then disable the per-user MFA for all users. Option A is incorrect because disabling per-user MFA before creating the policy would leave users without MFA. Option B is incorrect because using a Conditional Access policy to require MFA from outside the network only would not enforce MFA for internal access. Option D is incorrect because creating a policy without excluding break-glass accounts could lock out administrators.

Answer

Create a Conditional Access policy requiring MFA for all cloud apps, including break-glass accounts. Then disable per-user MFA.

Answer

Create a Conditional Access policy requiring MFA for all users only when accessing from outside the corporate network.

Answer

Disable per-user MFA for all users, then create a Conditional Access policy requiring MFA for all cloud apps.

Question 10

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

Accepted Answer

Create an update ring for Windows 10 with a deadline of 7 days.. Update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Answer

Create a compliance policy for Windows 10 update compliance.

Answer

Create a device configuration profile for Windows 10 updates.

Answer

Configure a Windows Update for Business policy in Group Policy.

Question 11

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows 11 devices remotely? (Choose two.)

Accepted Answer

Collect diagnostics. Collecting diagnostics is a remote action available in the Microsoft Intune admin center under the 'Devices' blade. It allows administrators to gather detailed logs (e.g., MDM diagnostic logs, event logs, and registry keys) from a Windows 11 device without user interaction, which is critical for troubleshooting issues remotely.

Answer

Deploy a line-of-business app

Answer

Create a VPN profile

Answer

Assign a compliance policy

Question 12

A company uses Microsoft Intune to manage iOS devices. Users report that they cannot install the required Microsoft Defender for Endpoint app from the Company Portal. The app shows as 'Not available' in the Company Portal. Which of the following is the most likely reason?

Accepted Answer

The device is marked as non-compliant with Intune compliance policies.. When a device is marked as non-compliant with Intune compliance policies, the Company Portal will display required apps as 'Not available' because Intune blocks the installation of required apps on non-compliant devices to enforce security baselines. This behavior is controlled by the 'Mark devices with no compliance policy as' setting and the 'Action for noncompliance' configuration, which can block app deployment until the device is remediated.

Answer

The app requires a valid Apple VPP token that has expired.

Answer

The Company Portal app version is outdated.

Answer

The device has 'Unknown Sources' enabled.

Question 13

Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Bulk enrollment using provisioning package. Windows provisioning packages (PPKG) created with Windows Configuration Designer allow bulk enrollment of Windows devices into Intune without user interaction. This method is ideal for large-scale deployments where devices are not yet Azure AD joined or Autopilot-registered, as the PPKG contains the enrollment credentials and settings to automatically join the device to Azure AD and enroll it in Intune during the out-of-box experience (OOBE).

Answer

VPN connection

Answer

Cloud Management Gateway

Answer

Azure AD join

Question 14

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Company Portal app from their devices. Which configuration should you apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Driver Update Rings. Windows Driver Update Rings (D) is the correct feature. This Intune policy type allows you to manage driver updates separately from quality updates. You can decline a problematic driver update that has already been installed, which will trigger the device to uninstall it and revert to the previous driver version. This provides granular rollback without affecting other updates. Option A (Windows Update Rings) manages all Windows updates but does not directly support rolling back a driver that is already installed. Option B (Group Policy Administrative Templates) is for device configuration, not driver rollback. Option C (Microsoft 365 Apps Admin Center) manages Office apps. Option D is the appropriate tool for this scenario.

Answer

Windows Update Rings

Answer

Group Policy Administrative Templates

Answer

Microsoft 365 Apps Admin Center

Question 15

Which TWO methods can you use to deploy Microsoft 365 Apps to Windows 10 devices managed by Intune?

Accepted Answer

Use the Microsoft 365 Apps (Windows) app type in Intune.. The 'Microsoft 365 Apps (Windows)' app type in Intune is a built-in deployment method specifically designed to install Office 365 ProPlus (now Microsoft 365 Apps) on managed Windows 10 devices. It allows you to select the installation channel, language, and update settings directly from the Intune console without needing external tools.

Answer

Use the Office Deployment Tool wrapped as a Win32 app.

Answer

Use Group Policy to assign Office installation.

Answer

Deploy the Microsoft Store version of Office.