MD-102 Practice Test 22 — 15 Questions

Question 1

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

Accepted Answer

passwordMinimumLength. Option D is correct because the policy requires a minimum password length of 8, but the device has 6. Option A is wrong because the device may have encryption. Option B is wrong because Secure Boot may be enabled. Option C is wrong because code integrity may be enabled.

Answer

requireCodeIntegrity

Answer

requireDeviceEncryption

Answer

requireSecureBoot

Question 2

An organization manages Windows 10 devices with Microsoft Intune. They need to deploy a PowerShell script that runs once on each device to remediate a security issue. The script should not run again after successful execution. Which configuration should be used?

Accepted Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to No, and configure the remediation script to exit with code 0 on success. Option C is correct because setting the script to run once and not run again on successful remediation achieves the goal. Option A is wrong because it would run every time. Option B is wrong because running once on every logon is not desired. Option D is wrong because detection scripts are separate from remediation scripts.

Answer

Assign the script to all devices and set 'Run this script using the logged on credentials' to Yes

Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to Yes

Answer

Use a custom compliance policy with a script that runs daily

Question 3

Refer to the exhibit. A Microsoft Graph PowerShell cmdlet retrieves devices. What is the purpose of this query?

Accepted Answer

To find Windows devices that have not synced since before January 1, 2025. Option C is correct. The filter retrieves Windows devices that have not synced since before January 1, 2025, meaning they have not synced in a long time. Option A is wrong because it is not about enrollment date. Option B is wrong because it's about last sync, not OS version. Option D is wrong because it's not about compliance status.

Answer

To find Windows devices that are compliant

Answer

To find Windows devices with an operating system version earlier than 2025

Answer

To find Windows devices enrolled before January 1, 2025

Question 4

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

Accepted Answer

Wipe.. The 'Wipe' action performs a factory reset on the device. Option B is incorrect because 'Retire' removes management and corporate data but does not wipe personal data (and is less thorough). Option C is incorrect because 'Delete' removes the device from management without wiping. Option D is incorrect because 'Reset' is not a standard action.

Answer

Retire.

Answer

Delete.

Answer

Reset.

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a custom app that is not available in the Google Play Store. Which app deployment method should you use?

Accepted Answer

Add the app as a line-of-business (LOB) app and upload the APK file.. Option B is correct because line-of-business (LOB) apps are used for custom apps not in the store. Option A is wrong because Managed Google Play only offers store apps. Option C is wrong because Web links are not apps. Option D is wrong because iOS-specific deployment is irrelevant.

Answer

Add the app as a Managed Google Play app.

Answer

Deploy the app as a web link to the APK file.

Answer

Use the iOS LOB app deployment method.

Question 6

Refer to the exhibit. You run the PowerShell cmdlet in Microsoft Graph to list managed Windows devices. The output shows that several devices have a complianceState of 'noncompliant' but lastSyncDateTime is recent. What is the most likely reason for noncompliance?

Accepted Answer

The devices do not meet the assigned compliance policies.. Option A is correct because noncompliance indicates that the device does not meet one or more compliance rules. Option B is wrong because recent sync means connectivity is fine. Option C is wrong because the cmdlet returns results, so permissions are fine. Option D is wrong because the query filters by Windows OS, so OS is correct.

Answer

The devices are running a non-Windows OS.

Answer

The devices have not synced recently.

Answer

The admin lacks permissions to view compliance details.

Question 7

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Option B is correct because Conditional Access with device compliance evaluates compliance. Option A is wrong because a compliance policy defines compliance but does not enforce access. Option C is wrong because a device configuration profile configures settings. Option D is wrong because an app protection policy manages app-level protection.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 8

An organization uses Microsoft Intune to manage Windows devices. They want to deploy a Win32 app that requires admin rights to install. The app must be installed in the system context and should not require user interaction. Which installation behavior should be configured?

Accepted Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: No specific action, Installation visibility: Hidden. Option D is correct because 'System' context installs the app with elevated privileges, and 'Hidden' ensures no user interaction. Option A is wrong because 'User' context does not provide admin rights. Option B is wrong because 'System' with 'Visible' shows installation progress, which may require interaction. Option C is wrong because 'User' context cannot install with admin rights.

Answer

Install behavior: User, Installation purpose: Required, Device restart behavior: No specific action

Answer

Install behavior: User, Installation purpose: Available

Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: Immediately

Question 9

A company uses Microsoft Intune to manage devices. They want to use a script to collect inventory data from Windows devices. Which TWO methods can be used?

Accepted Answer

Proactive remediations. Options A and D are correct. Proactive remediations can run detection scripts that collect data, and custom compliance policies can use scripts to gather inventory. Option B is wrong because PowerShell scripts deployed via Intune run as scripts, not as a separate method. Option C is wrong because device configuration profiles do not run scripts. Option E is wrong because app protection policies are for app data.

Answer

Device configuration profile

Answer

PowerShell script deployment

Answer

App protection policy

Question 10

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?

Accepted Answer

Require device to be marked as compliant.. Conditional access in Microsoft Entra ID can require device compliance as a grant control. The 'Require device to be marked as compliant' option ensures only compliant devices get access. Option A is incorrect because MFA is separate. Option B is incorrect because app protection policies are for mobile app management. Option D is incorrect because device enrollment is not enough; compliance is required.

Answer

Require multi-factor authentication.

Answer

Require app protection policy.

Answer

Require device to be enrolled in Intune.

Question 11

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

Accepted Answer

A device compliance policy with a required passcode length of 6.. Option A is correct because a device compliance policy enforces passcode requirements. Option B is wrong because a device configuration profile can only configure settings, not enforce compliance. Option C is wrong because an app protection policy applies to apps, not device-level passcode. Option D is wrong because a conditional access policy works with compliance, not alone.

Answer

A device configuration profile with a passcode payload.

Answer

An app protection policy for Microsoft Outlook.

Answer

A conditional access policy requiring compliant devices.

Question 12

Which TWO are valid methods to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune? (Choose two.)

Accepted Answer

Package the Office Deployment Tool as a Win32 app.. Options A and D are correct. Intune supports built-in Microsoft 365 Apps deployment (Office 365 suite) and Win32 app packaging. Option B is wrong because MSI is not used for Office 365. Option C is wrong because web links are not app deployment. Option E is wrong because iOS deployment is irrelevant.

Answer

Use the iOS Microsoft 365 Apps deployment method.

Answer

Upload an MSI file for Microsoft 365 Apps.

Answer

Add a web link to the Office 365 portal.

Question 13

You need to configure a Windows 10 device to automatically install updates from a specific branch readiness level. Which setting in the Update ring policy should you configure?

Accepted Answer

Branch readiness level. Option A is correct because 'Branch readiness level' defines which updates the device receives (e.g., Windows Insider, Semi-Annual Channel). Option B is wrong because 'Quality update deferral period' delays updates but does not set branch. Option C is wrong because 'Feature update deferral period' delays feature updates. Option D is wrong because 'Automatic update behavior' controls installation behavior.

Answer

Automatic update behavior

Answer

Quality update deferral period

Answer

Feature update deferral period

Question 14

You are designing a Windows 11 update strategy for a fleet of 500 devices managed by Intune. The organization requires that critical security updates be applied within 7 days, but feature updates can be delayed up to 60 days. Which Update Rings configuration should you use?

Accepted Answer

Create an Update Ring with quality update deferral of 7 days and feature update deferral of 60 days. Option C is correct because Update Rings in Intune allow setting deferral periods separately for quality (security) updates and feature updates. You can set quality update deferral to 7 days and feature update deferral to 60 days. Option A (Windows Update for Business group policy) is a legacy method. Option B (Feature update policy) alone doesn't control quality updates. Option D (Quality update policy) alone doesn't control feature updates.

Answer

Assign a Quality Update policy with deferral of 7 days

Answer

Configure Windows Update for Business via Group Policy on-premises

Answer

Assign a Feature Update policy with deferral of 60 days

Question 15

A company uses Microsoft Intune to manage macOS devices. They need to deploy a custom plist configuration file to set security settings. Which policy type should they use?

Accepted Answer

Device configuration profile (custom). Option C is correct because custom configuration profiles allow uploading plist files for macOS. Option A is wrong because compliance policies do not deploy configuration files. Option B is wrong because app protection policies are for mobile apps. Option D is wrong because device cleanup rules are for device lifecycle.

Answer

App protection policy

Answer

Device compliance policy

Answer

Device cleanup rule

MD-102 Practice Test 22 — 15 Questions

Exhibit

MD-102 Practice Test 22 — 15 Questions

Exhibit