MD-102 Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

Accepted Answer

User-driven deployment with Microsoft Entra ID join.. The enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Answer

Self-deploying mode where no user interaction is required.

Answer

Hybrid Microsoft Entra ID join with on-premises domain controller.

Answer

On-premises Active Directory domain join only.

Question 2

Refer to the exhibit. You run the PowerShell cmdlet shown and get the output. You need to investigate why Laptop-02 is non-compliant. Which additional cmdlet should you run to get the non-compliance reasons?

Accepted Answer

Get-MgDeviceManagementManagedDeviceCompliancePolicyState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc. Get-MgDeviceManagementManagedDeviceCompliancePolicyState returns the per-policy compliance state for a specific managed device, including the non-compliance reason strings for each assigned compliance policy. This is the correct cmdlet to drill into why a device is non-compliant after identifying it via a device listing. It maps directly to the Intune 'Device compliance' per-policy view in the portal.

Answer

Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -DeviceCompliancePolicyId <id>

Answer

Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Answer

Get-MgDeviceManagementDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Question 3

Arrange the steps to perform a Windows 10 feature update using Windows Update for Business in Intune.

Accepted Answer

Create ring, then set version and rollout, then assign, then monitor.. The correct sequence for performing a Windows 10 feature update using Windows Update for Business in Intune starts with creating a deployment ring, then configuring the feature update version and rollout settings, followed by assigning the ring to the target devices or groups, and finally monitoring the update deployment to track success and issues. This order ensures that the ring is properly configured before being applied, and that monitoring captures the actual deployment activity.

Answer

Create ring, then assign, then set version and rollout, then monitor.

Answer

Set version and rollout, then create ring, then assign, then monitor.

Answer

Create ring, then set version and rollout, then monitor, then assign.

Question 4

Arrange the steps to configure Conditional Access for Microsoft 365 in Azure AD.

Accepted Answer

Sign in to Azure AD, Navigate to Azure Active Directory > Security > Conditional Access, Create new policy, Set conditions (users/groups, cloud apps, conditions), Set access controls, Enable policy.. Sign in, go to Conditional Access, create policy, set conditions, set controls, enable.

Answer

Sign in to Azure AD, Navigate to Conditional Access, Create new policy, Enable policy, Set conditions, Set controls.

Answer

Sign in to Azure AD, Navigate to Conditional Access, Set conditions, Create new policy, Set controls, Enable policy.

Answer

Navigate to Conditional Access, Sign in to Azure AD, Create new policy, Set conditions, Set controls, Enable policy.

Question 5

A company is planning to use Windows Autopilot to deploy new devices. They want to ensure that devices are automatically enrolled in Microsoft Intune when a user signs in with their Microsoft Entra ID credentials. Which configuration is required?

Accepted Answer

Configure MDM auto-enrollment in Microsoft Intune admin center.. Configuring MDM auto-enrollment in Microsoft Entra ID (under Mobility > MDM) is the required step to automatically enroll devices in Intune when users sign in with their Microsoft Entra ID credentials during Windows Autopilot. Option A (Enrollment Status Page) only affects the end-user experience during enrollment, it does not trigger enrollment. Option B (compliance policy) enforces compliance after enrollment, not enrollment itself. Option C (device enrollment restrictions) controls which platforms can enroll, not automatic enrollment.

Answer

Configure an Enrollment Status Page (ESP) profile in Intune.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Enforce enrollment'.

Answer

Set device enrollment restrictions to allow all device platforms.

Question 6

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Accepted Answer

Allows end users to set up their own devices with minimal IT involvement.. Option B is correct because Windows Autopilot lets end users complete the out-of-box experience (OOBE) themselves, joining the device to Microsoft Entra ID and applying Intune policies with minimal IT interaction. Option D is correct because Autopilot uses the OEM-installed Windows image and cloud-based configuration, eliminating the need to build, maintain, and apply custom images or perform manual setup steps. Option A is incorrect because Autopilot depends on Microsoft Entra ID for device identity and user authentication, so an Entra ID subscription is still required. Option C is incorrect because Autopilot provisioning requires direct internet access and does not support deployment over a VPN connection during OOBE. Option E is incorrect because Autopilot is a cloud-based service that requires internet connectivity throughout provisioning.

Answer

Eliminates the requirement for a Microsoft Entra ID subscription.

Answer

Enables device provisioning over a VPN connection.

Answer

Supports deployment without any internet connectivity.

Question 7

Which TWO actions should you take to ensure that only healthy Windows 10/11 devices can access Microsoft 365 services? (Choose two.)

Accepted Answer

Create a device compliance policy that includes health attestation checks. Option A is correct because a device compliance policy in Microsoft Intune can include health attestation checks (e.g., BitLocker, Secure Boot, TPM, and code integrity via the Health Attestation Service), which determine whether a Windows 10/11 device meets the health and security baseline required to be marked compliant. Option E is correct because a Conditional Access policy that requires a compliant device enforces the compliance state at authentication time, blocking access to Microsoft 365 services from devices that are not marked compliant by Intune. Together, A defines what 'healthy' means and E enforces it for M365 access. Option B is not correct on its own because Intune enrollment is a prerequisite for compliance evaluation but does not itself ensure only healthy devices can access M365 services. Option C is not correct because Windows Autopilot only pre-provisions and configures devices; it does not gate access based on device health. Option D is not correct because app protection policies (MAM) protect app data on unmanaged or managed devices but do not enforce device health attestation for M365 service access.

Answer

Configure Intune enrollment

Answer

Use Windows Autopilot to pre-provision devices

Answer

Deploy an app protection policy to M365 apps

Question 8

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Accepted Answer

Disable screen capture.. To restrict screenshots on Android Enterprise devices, only the 'Disable screen capture' setting directly prevents the device from taking screenshots by using the FLAG_SECURE window flag. Options B and C ('Disable copy and paste' and 'Disable camera') do not prevent screen capture; they restrict clipboard operations and camera usage respectively. Therefore, the only correct setting is A.

Answer

Disable copy and paste.

Answer

Disable camera.

Answer

Disable Bluetooth.

Answer

Disable Wi-Fi.

Question 9

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Accepted Answer

Set 'Defer quality updates (days)' to 0.. Option A is correct because setting 'Defer quality updates (days)' to 0 means quality updates (security fixes) are offered immediately when released, with no deferral, which matches the requirement to receive them as soon as possible. Option E is correct because setting 'Defer feature updates (days)' to 60 delays feature updates by exactly 60 days, satisfying the requirement to defer feature updates for up to 60 days. Option B is not correct because 'Semi-Annual Channel' is a servicing channel designation, not a deferral setting, and it does not by itself defer feature updates by 60 days. Option C is not correct because 'Update notification level' controls user-facing update notifications, not the timing of quality or feature update delivery. Option D is not correct because deferring quality updates by 60 days would delay security fixes, contradicting the goal of receiving them as soon as they are released.

Answer

Set 'Feature update channel' to 'Semi-Annual Channel'.

Answer

Set 'Update notification level' to 'Turn off notifications'.

Answer

Set 'Defer quality updates (days)' to 60.

Question 10

Your organization uses Windows Autopilot for device provisioning. Users report that after initial setup, devices are not automatically enrolled in Microsoft Intune. What should you verify?

Accepted Answer

That the devices are registered in Windows Autopilot with a valid hardware hash.. Windows Autopilot requires devices to be registered in the Autopilot service with a valid hardware hash (or other unique identifier like PKID or serial number) so that the service can match the device during OOBE and trigger the enrollment process into Intune. Without a valid hardware hash, the device will not be recognized by Autopilot and will proceed through standard OOBE without automatic Intune enrollment.

Answer

That a device configuration profile is assigned to the devices.

Answer

That a Conditional Access policy is in place requiring Intune enrollment.

Answer

That a device compliance policy is assigned to the Autopilot devices.

Question 11

Refer to the exhibit. You query Microsoft Graph API and receive this JSON for a managed device. App2 installation failed. The app is a Win32 app deployed as required. The device is compliant and enrolled via MDM. What is the most likely reason for the failure?

Accepted Answer

The Intune Management Extension is not installed.. Win32 apps deployed as required require the Intune Management Extension (IME) to be present on the device for installation. Since the device is enrolled via MDM and compliant, but the app installation failed, the most likely cause is that the IME is missing or not functioning. The IME handles Win32 app deployment, detection, and remediation, and without it, required Win32 apps cannot install.

Answer

The app is not assigned to the user.

Answer

The app version is incompatible with the device OS.

Answer

The device is not compliant.

Question 12

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Accepted Answer

Microsoft Defender for Endpoint license assigned to the user or device. The correct prerequisites are: A and B. For A: Microsoft Defender for Endpoint requires a valid license assigned to the user or device. For B: The macOS device must be enrolled in Microsoft Intune to receive the configuration profile and policies for Defender. Option C is incorrect because the Microsoft Intune management extension is for Windows only, not macOS. Option D is incorrect because onboarding to Microsoft Defender for Cloud is not a prerequisite; Defender for Endpoint can be deployed independently. Option E is incorrect because a VPN connection is not required for Defender for Endpoint to function on macOS.

Answer

Microsoft Intune management extension installed on the device

Answer

Onboarding to Microsoft Defender for Cloud

Answer

A VPN connection to the corporate network

Question 13

Your organization is implementing a zero-trust security model using Microsoft Intune. Devices must be compliant before accessing corporate resources. You need to deploy compliance policies for Windows 10 devices that require BitLocker encryption and a minimum OS version. Which two policy settings should you configure? (Choose two.)

Accepted Answer

Minimum OS version.. The 'Minimum OS version' setting in a Windows 10 compliance policy ensures that devices must be running at least a specified build number (e.g., 10.0.19041 for Windows 10 20H1). This directly enforces the zero-trust requirement that only devices with a supported, up-to-date OS can access corporate resources, reducing exposure to known vulnerabilities. Option D is correct because the 'Require encryption of data storage on device' setting mandates BitLocker encryption on the system drive, which is a core data protection control in a zero-trust model.

Answer

Require device health attestation.

Answer

Require firewall (Windows Defender Firewall).

Answer

Maximum OS version.

Question 14

You are an Endpoint Administrator for a company that uses Microsoft Intune. The security team requires that Windows 11 devices assigned to the Finance department must use a specific set of DNS servers and must not allow users to modify the DNS settings. You create a device configuration profile using the Settings catalog. Which setting category should you use to enforce the DNS server assignment?

Accepted Answer

DNS. The Settings catalog exposes granular Windows configuration service provider settings, and the DNS category specifically includes settings to define DNS server addresses and prevent modification. Applying a device configuration profile with those settings to the Finance device group enforces the required DNS servers and blocks user changes, directly satisfying the security team's requirement.

Answer

VPN

Answer

Wi-Fi

Answer

Network proxy

Question 15

A company uses Configuration Manager to deploy Windows 11. During the deployment, several devices fail with error code 0x80070002. The administrator suspects the issue is related to missing boot images or content distribution. What should the administrator do first to resolve the issue?

Accepted Answer

Verify that the boot image and OS image are distributed to all distribution points.. Error code 0x80070002 translates to 'The system cannot find the file specified.' In a Configuration Manager task sequence deployment, this typically indicates that the boot image or OS image content is not available on the distribution point that the client is accessing. Verifying distribution ensures the required content is present and accessible, which is the most direct and common fix for this error.

Answer

Increase the client cache size on the affected devices.

Answer

Check the driver packages in the task sequence.

Answer

Recreate the task sequence with new OS image.