MD-102 Practice Test 22 — 15 Questions

Question 1

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Windows feature update profile targeting Windows 11.. A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Answer

Deploy a configuration profile with the Windows 11 installation script.

Answer

Create a Windows update ring profile targeting Windows 11.

Answer

Configure a device compliance policy requiring Windows 11.

Question 2

You manage a hybrid Azure AD joined Windows 10 device with Intune. The device is showing as 'Pending' enrollment. You have verified that the user has an Intune license and the device is synced with Azure AD Connect. What is the most likely issue?

Accepted Answer

The Group Policy for automatic Intune enrollment is not applied to the device.. When a hybrid Azure AD joined device shows 'Pending' enrollment in Intune, the most common cause is that the Group Policy setting 'Automatically enroll devices to Microsoft Intune' has not been applied to the device. This policy triggers the automatic MDM enrollment via the device's scheduled task during user sign-in. Without this policy, the device remains in a pending state even if the user has a license and the device object is synced.

Answer

The user is not the primary user of the device.

Answer

The device is not co-managed with Configuration Manager.

Answer

Azure AD Connect has not synced the device object.

Question 3

Your organization plans to deploy Windows 11 to 500 devices using Microsoft Intune. You need to ensure that each device receives the correct language pack and regional settings based on the user's location. Which configuration method should you use?

Accepted Answer

Configure Windows Autopilot with enrollment profile specifying language and region. Windows Autopilot with an enrollment profile allows you to specify language and region settings that are applied during the out-of-box experience (OOBE). This ensures each device receives the correct configuration based on the user's location without requiring post-enrollment scripts or manual intervention, making it the most efficient and scalable method for 500 devices managed by Intune.

Answer

Deploy a PowerShell script via Intune to set language after enrollment

Answer

Use Configuration Manager task sequence with language packs

Answer

Create a provisioning package (PPKG) with language settings and apply via USB

Question 4

Your organization is migrating from on-premises SCCM to Microsoft Intune. You have a Win32 app that requires a custom script to run after installation. The app must be available to users in a remote office with limited internet connectivity. What should you use to deploy the app?

Accepted Answer

Deploy the Win32 app via Intune with Delivery Optimization and peer caching enabled.. Delivery Optimization combined with peer caching allows devices in a remote office with limited internet connectivity to download the Win32 app from other peers on the same local network, reducing WAN bandwidth usage. Intune natively supports Win32 app deployment with this feature, and the custom script can be included as a post-installation detection or requirement script. This approach aligns with the migration from SCCM to Intune while addressing connectivity constraints.

Answer

Configure a cloud management gateway (CMG) to distribute the app.

Answer

Store the app in Azure Files and mount it on devices.

Answer

Use a PowerShell script deployed via Intune to download the app from a local file share.

Question 5

Order the steps to configure a Windows 10 device for Microsoft 365 Apps deployment via Intune.

Accepted Answer

Sign in to Intune admin center, add a new app, select Microsoft 365 Apps, configure the suite settings, assign the app to groups.. Begin in Intune admin center, add a new app, choose Microsoft 365 Apps, configure suite, and assign.

Answer

Sign in to Intune admin center, add a new app, select Microsoft 365 Apps, assign the app to groups, configure the suite settings.

Answer

Sign in to Intune admin center, select Microsoft 365 Apps, add a new app, configure the suite settings, assign the app to groups.

Answer

Add a new app, sign in to Intune admin center, select Microsoft 365 Apps, configure the suite settings, assign the app to groups.

Question 6

Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced recently; the compliance policy may require a more recent check-in.. The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant. Option A correctly identifies this as the most likely cause.

Answer

The device is company-owned, which is noncompliant by default.

Answer

The device is a userless device and cannot be compliant.

Answer

The device's operating system version is not supported.

Question 7

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

Accepted Answer

The device has not been successfully registered in Windows Autopilot.. 'NotRegistered' indicates the device is not properly registered in Autopilot. Option B is incorrect because if the profile were not assigned, it would show 'NotAssigned' but still registered. Option C is incorrect because the diagnostics show registration status. Option D is incorrect because the device can still be registered even if it has been imaged.

Answer

The Autopilot profile is not assigned to the device group.

Answer

The device was previously manually imaged.

Answer

The device is not connected to the internet during OOBE.

Question 8

Your organization plans to use Windows Autopilot for device provisioning. You need to ensure devices are automatically registered in Microsoft Entra ID when they are powered on for the first time. Which prerequisite must be met?

Accepted Answer

Users must have Microsoft Entra ID P1 or P2 licenses assigned. Microsoft Entra ID P1 or P2 licenses are required because Windows Autopilot relies on Microsoft Entra ID features such as dynamic device groups, conditional access policies, and automatic enrollment policies, which are only available with these license tiers. Without these licenses, devices cannot be automatically registered in Microsoft Entra ID during the first power-on, as the Autopilot profile assignment and device registration process depend on these premium capabilities.

Answer

Devices must be pre-registered in Intune via an OEM or partner

Answer

Devices must have a TPM 2.0 chip for self-deploying mode

Answer

An on-premises Active Directory domain must be available

Question 9

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

Accepted Answer

Add as a macOS line-of-business app.. The recommended method to deploy a .pkg app to macOS devices managed by Microsoft Intune is to add it as a macOS line-of-business (LOB) app. This app type is specifically designed for deploying macOS installer packages (.pkg) and requires the file to be uploaded directly to Intune, which then pushes the installation to enrolled devices using the Intune management agent for macOS.

Answer

Add as a Windows line-of-business app.

Answer

Add as a macOS web app.

Answer

Add as a Microsoft Store app.

Question 10

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Accepted Answer

A Microsoft Defender for Endpoint license must be assigned.. A Microsoft Defender for Endpoint license is required because it provides the entitlement to use the Defender for Endpoint service, including its advanced threat protection, endpoint detection and response (EDR), and vulnerability management capabilities. Without this license, the service cannot be provisioned or used, even if the devices are properly enrolled and configured.

Answer

Devices must be joined to Azure AD.

Answer

Devices must have a third-party antivirus uninstalled.

Answer

An Azure AD Premium license must be assigned.

Question 11

Your organization is implementing Microsoft Entra ID join for Windows devices. You need to ensure that when users sign in with their Microsoft Entra ID credentials, they automatically get access to company resources without additional authentication. Which feature should you enable?

Accepted Answer

Primary Refresh Token (PRT). Primary Refresh Tokens (PRTs) are used on Microsoft Entra ID joined devices to enable single sign-on (SSO). When a user signs in with their Microsoft Entra ID credentials, the PRT is cached and automatically used to authenticate against company resources without prompting for credentials again. Option A is incorrect because device compliance policies enforce security requirements but do not handle authentication. Option B is incorrect because Windows Hello for Business provides passwordless sign-in but is not required for automatic resource access. Option C is incorrect because Conditional Access policies evaluate access conditions but do not provide automatic authentication.

Answer

Device compliance policies

Answer

Windows Hello for Business

Answer

Conditional Access policies

Question 12

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

Accepted Answer

Client apps. The 'Client apps' workload in Configuration Manager co-management is responsible for synchronizing client applications and enabling automatic enrollment of devices to Intune after the Configuration Manager client is installed. Option A (Endpoint Protection) is incorrect because it manages endpoint protection policies, not enrollment. Option B (Windows Update policies) is incorrect because it governs Windows Update for Business policies, not Intune enrollment. Option C (Resource access) is incorrect because it configures resource access policies like certificates and VPN, not automatic enrollment.

Answer

Endpoint Protection

Answer

Windows Update policies

Answer

Resource access

Question 13

A user has an Android Enterprise fully managed device. The device is enrolled in Microsoft Intune and all policies are applied. However, the user cannot install a required app from the managed Play Store. The app appears in the company portal but fails to install. What should you check first?

Accepted Answer

Verify that the app has been approved in the managed Google Play store.. The correct first step is to verify that the app has been approved in the managed Google Play store. For Android Enterprise fully managed devices, apps from the managed Play Store must be approved by the IT admin before they can be installed. Even if the app appears in Company Portal, if it is not approved, installation will fail. Therefore, checking approval status is the most likely cause.

Answer

Ensure that the device has a policy to allow installation of unapproved apps.

Answer

Check if the device's enrollment token is still valid.

Answer

Check if the app is available in the unmanaged Play Store.

Question 14

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Accepted Answer

Check that Secure Boot is enabled.. Options A, C, and D are correct. Windows 11 requires TPM 2.0, Secure Boot, and at least 4GB of RAM. Option B is incorrect because the processor must be at least 1 GHz with 2 cores, not 1 core. Option E is incorrect because the storage requirement is at least 64GB, not 32GB.

Answer

Check that the processor is at least 1GHz with 1 core.

Answer

Check that the device has at least 32GB of storage.

Question 15

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

Accepted Answer

Device restrictions configuration policy. Device restrictions configuration policy includes the setting to block installation of apps from unknown sources on Android Enterprise devices. Option B (Device compliance policy) is incorrect because compliance policies enforce security requirements but do not block app installations. Option C (App configuration policy) is incorrect because app configuration policies are used to pre-configure app settings, not to restrict installation. Option D (Enrollment restriction) is incorrect because enrollment restrictions control whether devices can enroll, not app installation behavior.

Answer

Device compliance policy

Answer

App configuration policy

Answer

Enrollment restriction