MD-102 Practice Test 23 — 15 Questions

Question 1

A company uses Microsoft Intune to manage macOS devices. A security audit requires that all macOS devices must have FileVault encryption enabled. Compliance policy reports show that 90% of devices are compliant, but 10% are non-compliant. You review the non-compliant devices and find that FileVault is enabled on them. What is the most likely cause of the non-compliance?

Accepted Answer

The recovery key is not escrowed to Intune.. Intune compliance policy for macOS FileVault checks both encryption status and whether the recovery key has been escrowed to Intune. If the key is not escrowed, the device is considered non-compliant. Option A is incorrect because FileVault is enabled. Option B is incorrect because the key escrow setting is separate from encryption. Option D is incorrect because the policy is correctly applied.

Answer

FileVault is not actually enabled on those devices.

Answer

The devices are not supervised.

Answer

The compliance policy is not assigned to those devices.

Question 2

You need to deploy Microsoft Defender for Endpoint to Windows 10 devices using Microsoft Intune. Which TWO methods can you use to deploy the Microsoft Defender for Endpoint client?

Accepted Answer

As a line-of-business (LOB) app in Intune.. You can deploy the Microsoft Defender for Endpoint client via Intune as a line-of-business app (by uploading the installer) or as part of a device configuration profile (by enabling the 'Microsoft Defender for Endpoint' configuration service provider (CSP) settings). Option C, Microsoft Store, is not applicable because Defender for Endpoint is not a store app. Option D, Group Policy, is not managed by Intune. Option E, Configuration Manager, is a separate management tool.

Answer

Using Group Policy connected to Intune.

Answer

From the Microsoft Store for Business.

Answer

Via Microsoft Configuration Manager.

Question 3

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

Accepted Answer

In the Intune portal, select the devices and click 'Sync'.. Option C is correct because you can remotely trigger a sync from the Intune portal. Option A is wrong because rebooting does not force a policy refresh. Option B is wrong because Windows Update is unrelated. Option D is wrong because the sync interval is client-side and not directly configurable from Intune.

Answer

Ask users to restart their devices.

Answer

Ask users to run Windows Update.

Answer

Adjust the MDM sync interval in Intune.

Question 4

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps can be installed on corporate-owned devices. Which configuration profile type should you use?

Accepted Answer

Device restrictions profile with 'Allow app installation from App Store only' set to 'Block'.. Option B is correct because a device restrictions profile with 'Allow app installation from App Store only' and a compliant apps policy can restrict apps. Option A is wrong because the Apple Configurator enrollment profile is for device enrollment, not app control. Option C is wrong because the Device Features profile manages settings like wallpaper. Option D is wrong because the Email profile configures mail settings.

Answer

Email profile.

Answer

Device features profile.

Answer

Apple Configurator enrollment profile.

Question 5

Which TWO are valid methods to enroll Windows devices in Microsoft Intune?

Accepted Answer

Manual enrollment using work or school account. Options A and D are correct. A: Windows Autopilot is a modern enrollment method. D: Manual enrollment via Settings > Accounts > Access work or school is valid. Option B is wrong because Apple Business Manager is for Apple devices. Option C is wrong because Android Enterprise is for Android. Option E is wrong because Azure AD Join is a prerequisite, not an enrollment method.

Answer

Apple Business Manager

Answer

Android Enterprise

Answer

Azure AD Join

Question 6

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a specific firewall rule. However, the profile fails to apply on a subset of devices. The Intune console shows 'Conflict' status. What is the most likely cause?

Accepted Answer

Another profile with overlapping settings is assigned. Option A is correct because a configuration profile conflict occurs when two profiles with overlapping settings are assigned to the same device. Option B (Network connectivity) would show 'Pending' or 'Error'. Option C (Unsupported macOS version) would show 'Not applicable'. Option D (User not licensed) would prevent enrollment altogether.

Answer

The user does not have a macOS license

Answer

The macOS version is not supported by the profile

Answer

The device is not connected to the internet

Question 7

Refer to the exhibit. The JSON snippet shows a dynamic device group configuration in Microsoft Intune. What is the effect of the 'enrollmentTimeDeviceMembershipLimit' property set to 15?

Accepted Answer

Devices added to the group will be removed after 15 days from enrollment. Option B is correct. The enrollmentTimeDeviceMembershipLimit property defines how many days after enrollment a device remains in the dynamic group. Option A is wrong because it does not limit total devices. Option C is wrong because it does not limit scope tags. Option D is wrong because it does not limit assignments.

Answer

The group will only contain devices that have been enrolled for at least 15 days

Answer

Only devices enrolled in the last 15 days are eligible

Answer

Limits the number of devices in the group to 15

Question 8

You are troubleshooting a Windows 10 device that is not receiving policy updates from Intune. The device shows 'Pending' status in the Intune console. The device is connected to the internet. What is the most likely cause?

Accepted Answer

The Intune management extension service is not running.. Intune policies are delivered via the Intune management extension. If the service is not running or is disabled, policies cannot be applied. Option A is incorrect because the device is online. Option B is incorrect because enrollment shows as valid. Option D is incorrect because the management extension is required for policies.

Answer

The device is not connected to the network.

Answer

The device has a pending reboot.

Answer

The device enrollment is expired.

Question 9

You manage Windows 11 devices with Microsoft Intune. Some users report that their device is marked as noncompliant even though it meets all compliance rules. You discover that the devices have not checked in with Intune for over 30 days. What should you do to prevent this issue?

Accepted Answer

In the device compliance policy, set the 'Days until device is considered noncompliant' option to 30.. Option C is correct because configuring a device compliance policy to mark devices as noncompliant after a missed check-in (e.g., 30 days) ensures stale devices are flagged. Option A is wrong because a configuration profile cannot set a check-in interval. Option B is wrong because Conditional Access does not change check-in behavior. Option D is wrong because automatic re-enrollment is not a built-in feature for this scenario.

Answer

Configure a device configuration profile to set the MDM enrollment URL.

Answer

Create a Conditional Access policy to block devices that haven't checked in.

Answer

Enable automatic re-enrollment for Windows devices in Intune.

Question 10

Refer to the exhibit. The JSON snippet shows a device compliance policy for Windows 10. You assign this policy to a device group. Some devices report as noncompliant even though they have BitLocker enabled and meet password requirements. What is the most likely cause?

Accepted Answer

The devices are not enrolled in Microsoft Defender for Endpoint.. Option B is correct because deviceThreatProtectionEnabled and deviceThreatProtectionRequiredSecurityLevel require integration with Microsoft Defender for Endpoint (Defender XDR) to assess threat level. Option A is wrong because password length is already set. Option C is wrong because deviceThreatProtectionEnabled is set to true, but the error is due to missing Defender integration. Option D is wrong because storageRequireEncryption is separate from BitLocker.

Answer

The deviceThreatProtectionEnabled setting should be false.

Answer

The password minimum length is too short.

Answer

The storageRequireEncryption setting conflicts with BitLocker.

Question 11

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

Accepted Answer

Add as a macOS line-of-business app.. Option B is correct because macOS LOB apps support .pkg files. Option A is wrong because macOS web apps are for web links. Option C is wrong because Windows LOB app is for Windows devices. Option D is wrong because Microsoft Store app is for Windows.

Answer

Add as a Windows line-of-business app.

Answer

Add as a macOS web app.

Answer

Add as a Microsoft Store app.

Question 12

A user reports that their Microsoft Intune enrolled device is not receiving required compliance policies. The device shows as 'Not evaluated' in the Microsoft Intune admin center. What is the most likely cause?

Accepted Answer

The Intune Management Extension is not installed. Option D is correct because compliance policies require the Intune Management Extension to be installed and running to evaluate and apply policies. Option A (Network connectivity) would show as 'Not compliant' or 'Unknown', not 'Not evaluated'. Option B (Device is unenrolled) would show as 'Not enrolled'. Option C (User lacks license) would prevent enrollment but not cause 'Not evaluated' after enrollment.

Answer

The device is not connected to the internet

Answer

The user does not have an Intune license assigned

Answer

The device is not enrolled in Intune

Question 13

You apply the custom policy shown in the exhibit to a Windows 11 device. Users report that they cannot use Bluetooth devices (e.g., mouse, keyboard) after the policy applies. Which setting in the policy is causing this issue?

Accepted Answer

allowBluetooth set to false. Option D is correct because 'allowBluetooth' is set to false, which disables Bluetooth functionality entirely, including peripherals. Option A (allowCamera) affects camera only. Option B (allowCopyPaste) affects clipboard. Option C (allowStorageCard) affects external storage.

Answer

allowStorageCard set to false

Answer

allowCopyPaste set to false

Answer

allowCamera set to false

Question 14

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

Accepted Answer

Windows 10 2004. Option B is correct. The JSON shows 'osMinimumVersion' set to '10.0.19041.0', which is Windows 10 version 2004. Option A is wrong because 1903 is 10.0.18362. Option C is wrong because 20H2 is 10.0.19042. Option D is wrong because 21H2 is 10.0.19044.

Answer

Windows 10 20H2

Answer

Windows 10 1903

Answer

Windows 10 21H2

Question 15

Your organization is planning to use Microsoft Intune to manage Windows 11 devices. Which TWO are prerequisites for enrolling a Windows device in Intune?

Accepted Answer

Network connectivity to https://manage.microsoft.com and other Intune endpoints.. Windows 11 devices require a Microsoft account for enrollment (unless using a work or school account with automatic MDM enrollment) and network connectivity to Intune services. Option C is not a prerequisite because Intune enrollment can be done without Azure AD Premium P2. Option D is not required because a local admin account is not needed for enrollment. Option E is not required because Copilot is optional.

Answer

Local administrator account on the device.

Answer

Microsoft Copilot for Microsoft 365 license.

Answer

Azure AD Premium P2 license.