MD-102 Practice Test 21 — 15 Questions

Question 1

A company uses Microsoft Intune to manage Windows 10 devices. They want to prevent users from installing unapproved applications. Which approach provides the most granular control?

Accepted Answer

Deploy AppLocker rules via Intune to allow only approved publishers.. AppLocker provides the most granular control because it allows administrators to create rules based on publisher, product name, file name, file version, or file hash, and apply them to specific users or groups. Deployed via Intune, these rules can enforce which applications are allowed to run, effectively blocking unapproved installations. This level of detail (e.g., allowing only signed apps from a specific publisher) is not achievable with the other options.

Answer

Use the Microsoft Store for Business to deploy only approved apps.

Answer

Enable Windows Defender SmartScreen to block unknown apps.

Answer

Configure User Account Control (UAC) to always notify.

Question 2

You manage a hybrid Azure AD joined environment with Microsoft Intune. You need to migrate Group Policy objects (GPOs) to Intune policies for Windows 10 devices. Which THREE tools or methods should you use?

Accepted Answer

MDM Migration Analysis Tool (MMAT). The MDM Migration Analysis Tool (MMAT) is correct because it analyzes existing on-premises Group Policy Objects (GPOs) and generates a report mapping each GPO setting to its equivalent MDM policy in Intune, including a readiness score. This tool directly supports the migration workflow by identifying which GPOs can be converted and which require manual intervention, making it essential for planning a GPO-to-Intune migration.

Answer

Desktop Analytics

Answer

PowerShell scripts to apply registry settings

Question 3

A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?

Accepted Answer

Conditional Access policies with device compliance. Conditional Access policies with device compliance (Option D) is the correct technology because it integrates Intune compliance policies with Microsoft Entra Conditional Access to enforce access controls on Exchange Online. When a device is marked non-compliant by Intune, Conditional Access blocks or restricts access to Exchange Online, ensuring only compliant devices can connect. This is the standard Microsoft approach for combining device management with identity-driven access control.

Answer

Mobile Application Management (MAM) policies

Answer

Intune compliance policies without Conditional Access

Answer

Azure AD join with automatic enrollment

Question 4

Which THREE conditions must be met for a Windows 10 device to be co-managed with Microsoft Intune and Microsoft Configuration Manager? (Choose three.)

Accepted Answer

The device must be enrolled in Microsoft Intune.. Option A is correct because co-management requires the device to be enrolled in Microsoft Intune, which provides the MDM channel and enables the Intune workload authority alongside Configuration Manager. Option B is correct because the Configuration Manager client must be installed on the device so that the Configuration Manager channel and its workloads can function. Option C is correct because the device must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined to establish the identity and authentication needed for Intune enrollment and co-management. Option D is not required because hybrid Microsoft Entra ID join is only one of the acceptable identity states; Microsoft Entra ID join alone also satisfies the requirement. Option E is not required because the Intune Management Extension is only needed for specific workloads such as PowerShell scripts and Win32 apps, not as a baseline condition for co-management.

Answer

The device must be hybrid Azure AD joined.

Answer

The device must have the Intune Management Extension installed.

Question 5

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

Accepted Answer

In the Intune portal, select the devices and click 'Sync'.. The Intune 'Sync' action sends a direct MDM policy refresh command to the device via the Microsoft Intune service. This triggers the device's enrollment client to immediately check in with the MDM server, download the latest policies, and apply them without waiting for the next scheduled sync interval. Since the devices are online and have connectivity, this remote sync forces an immediate policy refresh.

Answer

Ask users to restart their devices.

Answer

Ask users to run Windows Update.

Answer

Adjust the MDM sync interval in Intune.

Question 6

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Accepted Answer

Convert existing devices to Autopilot by uploading hardware hash. Option B is correct because Windows Autopilot supports registering existing devices by collecting their hardware hash (via the Get-WindowsAutoPilotInfo script or similar) and uploading it as a CSV to Intune, which creates an Autopilot device record so the device can be reset and reprovisioned through the Autopilot flow. Option D is correct because Autopilot's core purpose is to define and customize the out-of-box experience (OOBE) using deployment profiles, including settings like the privacy prompts, user account type, language/region, and whether the user is a standard user or local admin. Option A is not an Autopilot action; security baselines are enforced through Intune configuration profiles/policies, not through Autopilot itself. Option C is not specific to Autopilot; third-party applications are deployed via Intune app deployment (Win32 apps, MSI, Microsoft Store apps, etc.), which can be assigned to Autopilot-enrolled devices but is not an Autopilot capability. Option E is not an Autopilot function; BIOS/UEFI settings are typically configured through vendor tools (e.g., Dell Command | Configure, HP Client Management Script Library) or Intune's OEM-specific configuration, not Autopilot.

Answer

Enforce security baselines on devices

Answer

Deploy third-party applications automatically

Answer

Configure BIOS settings remotely

Question 7

You have the following JSON compliance policy for Windows 10 devices in Intune. A device with OS version 10.0.19042.0, build 19042, with BitLocker enabled, Secure Boot enabled, but Code Integrity disabled reports as non-compliant. Which setting is causing the non-compliance?

Accepted Answer

requireCodeIntegrity. The device reports as non-compliant because the compliance policy requires `requireCodeIntegrity` to be enabled, but the device has Code Integrity disabled. Even though BitLocker and Secure Boot are enabled, and the OS version meets the minimum requirement, the absence of Code Integrity enforcement triggers non-compliance. In Intune, Windows 10 compliance policies evaluate each setting independently, and a failure on any required setting results in overall non-compliance.

Answer

minimumOsVersion

Answer

requireSecureBoot

Answer

requireDeviceEncryption

Question 8

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

Accepted Answer

In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.. To enable co-management and move the Device configuration workload to Intune, you need to configure co-management in ConfigMgr. This involves enabling co-management, selecting a pilot collection (or all devices), and setting the workload slider for Device configuration to either 'Pilot Intune' or 'Intune' (full migration). This triggers automatic enrollment in Intune via the co-management policy. Option A is incorrect because the Intune connector is not needed for co-management; enrollment happens via ConfigMgr policy. Option B is incorrect because Group Policy for automatic MDM enrollment is not required when using co-management; the enrollment is triggered by ConfigMgr. Option D is incorrect because hybrid Microsoft Entra ID join alone does not automatically enroll devices into co-management; the ConfigMgr co-management configuration is necessary.

Answer

Install the Intune connector for ConfigMgr and configure the workloads.

Answer

Create a Group Policy that enables automatic MDM enrollment to Intune.

Answer

Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.

Question 9

Your organization uses Microsoft Intune to manage devices. You need to configure a compliance policy for Windows devices that requires the device to be at a specific OS version and have antivirus enabled. Which TWO settings should you configure in the compliance policy?

Accepted Answer

Require antivirus (Windows Defender). A Windows compliance policy enforces a required OS build/version by setting the minimum OS version, which blocks devices running older builds than the specified value. Option B (Require antivirus (Windows Defender)) is correct because the compliance policy includes a setting that requires Windows Defender Antivirus to be enabled (and optionally up to date) on the device. Option A (Maximum OS version) is not appropriate here because the requirement is to ensure devices are at least a specific OS version, not to cap them at a maximum version. Option D (Device type) is not a compliance setting for enforcing OS version or antivirus state; it is used for targeting/platform scoping. Option E (Storage encryption) enforces BitLocker/device encryption and does not address the OS version or antivirus requirements.

Answer

Maximum OS version

Answer

Device type

Answer

Storage encryption

Question 10

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. Devices that do not meet the policy are marked as non-compliant. Which diagnostic step would you take to identify why a specific device is non-compliant despite having BitLocker enabled?

Accepted Answer

Review the device's hardware security features: Secure Boot and Code Integrity.. The compliance policy JSON requires Secure Boot and Code Integrity in addition to BitLocker. Even if BitLocker is enabled, a device will be marked non-compliant if Secure Boot or Code Integrity is disabled or unsupported. Therefore, the correct diagnostic step is to review the device's hardware security features — Secure Boot and Code Integrity — to confirm they meet the policy requirements.

Answer

Verify the compliance policy is assigned to the device's group.

Answer

Check the device's compliance status in Intune for details.

Answer

Modify the policy to remove the requireSecureBoot and requireCodeIntegrity settings.

Question 11

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a VPP (Volume Purchase Program) app that is already purchased and assigned to your tenant. What is the minimum configuration required to make the app available to users?

Accepted Answer

Sync the VPP token, then add the app from the store and assign it.. For VPP apps in Intune, the minimum requirement is to sync the VPP token so Intune can communicate with Apple's Volume Purchase Program, then add the app from the store and assign it to users or groups. Once the token is synced and the app is assigned, Intune handles license distribution automatically. No IPA upload or configuration policy is required for basic availability.

Answer

Configure a device enrollment restriction to allow the app.

Answer

Distribute the app via the Company Portal without any additional configuration.

Answer

Upload the app IPA file to Intune, then create an app configuration policy.

Question 12

Arrange the steps to deploy Windows 10 using Microsoft Deployment Toolkit (MDT) in the correct order.

Accepted Answer

Import OS, then import drivers, then create task sequence, then update deployment share, then boot client, then run the deployment wizard.. MDT deployment requires importing OS and drivers first, then creating a task sequence, updating the share, booting the client, and finally running the wizard.

Answer

Boot client, then import OS, then import drivers, then create task sequence, then update deployment share, then run the deployment wizard.

Answer

Create task sequence, then import OS, then import drivers, then update deployment share, then boot client, then run the deployment wizard.

Answer

Import OS, then create task sequence, then import drivers, then update deployment share, then boot client, then run the deployment wizard.

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

Accepted Answer

Set feature update deferral to 120 days and quality update deferral to 30 days.. The Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Answer

Set feature update deferral to 180 days and quality update deferral to 0 days.

Answer

Set feature update deferral to 30 days and quality update deferral to 120 days.

Answer

Set both feature and quality update deferrals to 60 days.

Question 14

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

Accepted Answer

The device will be blocked from completing OOBE.. The Autopilot deployment profile shown has the Enrollment Status Page (ESP) configured with 'Block device use until all required apps and profiles are installed' enabled. When a required app fails to install during OOBE, the ESP enforces a hard block, preventing the user from proceeding past the ESP until the failure is resolved. This is why the device is blocked from completing OOBE, making option C correct.

Answer

The device will be allowed to proceed because enrollment status is notStarted.

Answer

The device will retry enrollment automatically.

Answer

The device will be blocked until retry due to pendingRetry setting.

Question 15

You manage devices with Microsoft Intune. You need to deploy a Windows 10 feature update to a pilot group of devices. Which profile type should you use?

Accepted Answer

Windows 10 feature update profile. A Windows 10 feature update profile is the correct choice because it is specifically designed to deploy feature updates (e.g., Windows 10 version 22H2) to targeted groups in Intune. Unlike update rings, which control the timing and deferral of updates, a feature update profile pins devices to a specific Windows version and orchestrates the upgrade process for pilot or broad deployments.

Answer

Windows 10 configuration profile

Answer

Windows 10 compliance policy

Answer

Windows 10 update ring profile