MD-102 Practice Test 23 — 15 Questions

Question 1

A company uses Microsoft Intune to manage iOS devices. They need to ensure that only devices with a passcode of at least 6 characters can access corporate email. Which type of policy should they create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device compliance policy. Device compliance policies enforce security requirements like passcode length at the device level. Option A (App protection policy) is incorrect because it targets app-level data protection, not device settings. Option B (Enrollment restriction) is incorrect because it controls which devices can enroll but does not enforce passcode requirements. Option C (Device configuration policy) is incorrect because it configures device settings but does not enforce compliance with policies.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy

Question 2

Your organization uses Microsoft Intune to manage corporate-owned iOS devices. You need to ensure that devices are supervised and can be configured with restrictions that cannot be removed by the user. Which THREE steps must you take?

Accepted Answer

Add devices to Apple Business Manager (ABM).. Options A, B, and C are correct. Supervising devices requires Apple Business Manager, automated enrollment, and a supervision profile. Option D is not required because supervised devices do not need user affinity for supervision. Option E is for device compliance, not supervision.

Answer

Assign a user to each device during enrollment.

Answer

Create a device compliance policy that requires supervision.

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

Accepted Answer

Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.. Enrollment platform restrictions allow you to set a minimum OS version for enrollment, preventing devices with older iOS versions from enrolling. Option A is incorrect because a device configuration profile is applied after enrollment and manages device settings, not enrollment requirements. Option B is incorrect because the enrollment profile defines the enrollment method (e.g., user vs. device enrollment), not OS version restrictions. Option C is incorrect because a compliance policy is applied after enrollment; it can mark devices as non-compliant but does not block enrollment itself.

Answer

Create a device configuration profile that requires iOS 16.0.

Answer

Modify the enrollment profile to require iOS 16.0.

Answer

Create a compliance policy that requires iOS 16.0 or later.

Question 4

You have an Intune-managed device that is not receiving compliance policies. You check the Intune console and see the device status is 'Pending'. The device is connected to the internet and can sync. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune for more than 7 days. A 'Pending' status in Intune often indicates that the device has not checked in for more than 7 days, even if it can sync. Option A is incorrect because an incorrect time zone would not cause a pending status; it might cause other issues but not pending. Option B is incorrect because an expired certificate would typically show an error or conflict status, not pending. Option D is incorrect because the device is connected to the internet and can sync, so network connectivity is not the issue.

Answer

The device's time zone is incorrect

Answer

The device's certificate has expired

Answer

The device is not connected to the internet

Question 5

Which TWO of the following are required to configure Windows Hello for Business using Microsoft Intune?

Accepted Answer

A Trusted Platform Module (TPM) chip on the device. A Trusted Platform Module (TPM) chip is required to provide hardware-based key protection for Windows Hello for Business. Additionally, a key trust model must be configured in Intune to manage the public keys. The Company Portal app is not required; it is used for enrollment but not specifically for Windows Hello configuration. Azure AD Premium P1 licenses are not required for Windows Hello for Business; they are needed for other features like Conditional Access. Certificate-based authentication is optional and not a requirement.

Answer

Company Portal app installed

Answer

Azure AD Premium P1 licenses

Answer

Certificate-based authentication

Question 6

Refer to the exhibit. You have configured the above enrollment restriction in Microsoft Intune. A user attempts to enroll a personal Windows 11 device. What will be the outcome?

Accepted Answer

The device will be blocked from enrolling.. The enrollment restriction is configured to block personally owned Windows devices. Since the user is trying to enroll a personal Windows 11 device, enrollment will be blocked regardless of OS version. Option B is incorrect because no prompt is shown; it's a block, not a prompt. Option C is incorrect because enrollment is blocked, so the device never becomes non-compliant. Option D is incorrect because the restriction specifically blocks personal devices, so OS version does not matter; enrollment fails.

Answer

The device will be prompted to confirm enrollment.

Answer

The device will enroll but will be marked as non-compliant.

Answer

The device will enroll successfully because it meets the OS requirements.

Question 7

You are planning to deploy Microsoft Intune for device management. Which ONE of the following is a prerequisite for enrolling Windows 10 devices in Intune?

Accepted Answer

Microsoft Intune license assigned to the user.. Option B is the correct prerequisite: a Microsoft Intune license must be assigned to the user enrolling the device. Option A (Microsoft Entra ID Premium P1/P2) is not required; Microsoft Entra ID Free is sufficient for Intune enrollment. Option C (Microsoft account) is not needed for corporate devices. Option D (Microsoft 365 E3) is a bundled subscription but not a standalone prerequisite. Option E (Azure Information Protection) is unrelated to device enrollment. Therefore, only one option is correct.

Answer

Microsoft Entra ID (Azure AD) Premium P1 or P2.

Answer

A Microsoft account (MSA) for each user.

Answer

Microsoft 365 E3 subscription.

Answer

Azure Information Protection license.

Question 8

Refer to the exhibit. A Microsoft Graph PowerShell cmdlet retrieves devices. What is the purpose of this query?

Accepted Answer

To find Windows devices that have not synced since before January 1, 2025. The query uses Get-MgDevice with a filter on approximateLastSignInDateTime being less than 2025-01-01T00:00:00Z. This filter retrieves devices whose last approximate sign-in occurred before January 1, 2025, indicating they have not synced since that date. The -and operator with deviceId -ne $null ensures only actual devices (not null device IDs) are returned. Option D correctly identifies this as finding devices that have not synced since before January 1, 2025.

Answer

To find Windows devices that are compliant

Answer

To find Windows devices with an operating system version earlier than 2025

Answer

To find Windows devices enrolled before January 1, 2025

Question 9

You use Microsoft Intune to manage Android Enterprise fully managed devices. You need to ensure that only work apps can access corporate data. Personal apps should not be able to read work data. What should you configure?

Accepted Answer

Configure an Intune App Protection Policy (APP) targeting the work apps.. Intune App Protection Policies (APP) can be configured to restrict data transfer between managed and unmanaged apps, ensuring that only approved work apps can access corporate data. This policy applies at the app layer, blocking personal apps from reading or copying work data even on fully managed devices, which aligns with the requirement to prevent personal app access to corporate data.

Answer

Configure Conditional Access to block personal apps.

Answer

Enable Android Enterprise work profile on the devices.

Answer

Deploy Windows Information Protection (WIP) policy.

Question 10

Refer to the exhibit. You apply this Intune custom OMA-URI policy to a Windows 10 device. What is the expected outcome?

Accepted Answer

VPN connections over cellular are blocked.. The OMA-URI ./Device/Vendor/MSFT/Policy/Config/Connectivity/AllowCellularData refers to the policy that controls whether cellular data is allowed for VPN connections. When set to 0, it blocks VPN connections over cellular networks, enforcing that VPN traffic must use Wi-Fi or Ethernet. This is a device-level policy, not user-specific, and the OMA-URI is valid for Windows 10 devices managed by Intune.

Answer

VPN connections are allowed over cellular networks.

Answer

The policy will fail to apply due to an invalid OMA-URI.

Answer

The policy applies only to users, not devices.

Question 11

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?

Accepted Answer

Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'. Microsoft Defender for Endpoint (MDE) automatically tags devices with a 'HighThreat' security tag when they reach a high threat level. You can create a dynamic device group in Microsoft Entra ID using a rule that queries `device.securityTags -contains 'HighThreat'`, which will automatically include any device that receives this tag from MDE. This group can then be targeted with a compliance policy in Intune to mark those devices as non-compliant, enabling automated remediation or conditional access blocking.

Answer

Create a security group in Microsoft Entra ID and manually add devices with high threat

Answer

Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy

Answer

Create a dynamic device group in Microsoft Intune using a rule based on threat level

Question 12

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You want to automatically remediate devices that are found to be missing critical security updates during a vulnerability assessment. What should you configure?

Accepted Answer

Configure automated investigation and remediation in Microsoft Defender for Endpoint.. Microsoft Defender for Endpoint's automated investigation and remediation capabilities can be configured to automatically respond to vulnerabilities detected during assessments, including missing critical security updates. This leverages the built-in threat and vulnerability management (TVM) module to trigger remediation actions without manual intervention, aligning with the requirement for automatic remediation.

Answer

Assign a Windows Update for Business policy to all devices.

Answer

Create a compliance policy that marks devices as non-compliant if missing updates.

Answer

Configure an endpoint security policy for Windows Defender Antivirus.

Question 13

You are designing a Windows 11 update strategy for a fleet of 500 devices managed by Intune. The organization requires that critical security updates be applied within 7 days, but feature updates can be delayed up to 60 days. Which Update Rings configuration should you use?

Accepted Answer

Create an Update Ring with quality update deferral of 7 days and feature update deferral of 60 days. Update Rings in Intune allow you to independently configure deferral periods for quality updates (security fixes) and feature updates. Setting quality update deferral to 7 days ensures critical security patches are applied within the required window, while feature update deferral of 60 days delays non-security feature updates as needed, all managed via cloud-based Windows Update for Business policies.

Answer

Assign a Quality Update policy with deferral of 7 days

Answer

Configure Windows Update for Business via Group Policy on-premises

Answer

Assign a Feature Update policy with deferral of 60 days

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Accepted Answer

Endpoint protection. 'Endpoint protection' profiles include FileVault settings for macOS. Option A is incorrect because 'Custom' profiles are used for importing custom settings, not for encryption. Option C is incorrect because 'Device restrictions' contain general restrictions but not FileVault. Option D is incorrect because 'Device features' include settings like wallpaper and lock screen, not encryption.

Answer

Custom

Answer

Device restrictions

Answer

Device features

Question 15

An administrator needs to ensure that only devices with a specific manufacturer are allowed to enroll in Intune. Which setting should the administrator configure?

Accepted Answer

Enrollment restrictions. Nrollment restrictions. Enrollment restrictions allow administrators to block devices based on manufacturer, OS version, or device platform. Conditional Access policies work after enrollment. Device categories are for organizational grouping, not blocking enrollment. Device compliance policies evaluate device health after enrollment.

Answer

Conditional Access policy

Answer

Device category

Answer

Device compliance policy