MD-102 Practice Test 24 — 15 Questions

Question 1

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy is not applied to Exchange Online as a cloud app.. The Conditional Access policy must explicitly include Exchange Online as a cloud app to govern access to it. If the policy is not applied to Exchange Online, it will not enforce compliance requirements for that service, allowing unenrolled devices to connect. Intune's Conditional Access policies are app-specific; omitting the target cloud app renders the policy ineffective for that workload.

Answer

The policy does not include iOS as a device platform.

Answer

The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

Answer

The policy is not scoped to all users.

Question 2

An organization needs to deploy Windows 11 to remote users who do not have access to the corporate network. The devices are brand new and have internet connectivity. Which deployment method should the administrator recommend?

Accepted Answer

Use Windows Autopilot with user-driven mode.. Windows Autopilot with user-driven mode is the correct choice because it enables remote, zero-touch deployment of new Windows 11 devices using only internet connectivity. The devices are pre-registered in Autopilot, and during the out-of-box experience (OOBE), they automatically download the organization-specific configuration, join Azure AD, and enroll in MDM without requiring any VPN or on-premises infrastructure.

Answer

Use Configuration Manager with a task sequence over VPN.

Answer

Use PXE boot from a distribution point at the local office.

Answer

Deploy using MDT with a bootable USB drive.

Question 3

Refer to the exhibit. You are configuring a Windows Update Ring policy in Microsoft Intune. You want the pilot devices to install feature updates 30 days after Microsoft releases them, but you also need to ensure that users cannot postpone updates indefinitely. However, users are reporting that updates are installing outside of active hours. What is the most likely cause?

Accepted Answer

The device's time zone is not aligned with the active hours configured in the policy.. Windows Update for Business uses the device's local time zone to determine active hours. If the device's time zone does not match the active hours configured in the Intune policy, updates can install outside the intended window, even if the policy settings are otherwise correct.

Answer

The 'updateNotificationLevel' is set to 2, which suppresses user notifications about updates.

Answer

The 'automaticUpdateBehavior' value of 4 is incorrect; it should be set to 3 to install during active hours.

Answer

The feature update deferral of 30 days is too short; it should be 60 days to align with the pilot timeline.

Question 4

Arrange the steps to configure Conditional Access for Microsoft 365 in Azure AD.

Accepted Answer

Sign in to Azure AD, Navigate to Azure Active Directory > Security > Conditional Access, Create new policy, Set conditions (users/groups, cloud apps, conditions), Set access controls, Enable policy.. Sign in, go to Conditional Access, create policy, set conditions, set controls, enable.

Answer

Sign in to Azure AD, Navigate to Conditional Access, Create new policy, Enable policy, Set conditions, Set controls.

Answer

Sign in to Azure AD, Navigate to Conditional Access, Set conditions, Create new policy, Set controls, Enable policy.

Answer

Navigate to Conditional Access, Sign in to Azure AD, Create new policy, Set conditions, Set controls, Enable policy.

Question 5

Refer to the exhibit. You run a PowerShell cmdlet to get managed devices and see the output above. The device is noncompliant. What is the most likely reason?

Accepted Answer

The device has not synced recently.. The device is noncompliant because it has not synced recently. In Microsoft Intune, devices must regularly check in to report their compliance status; if a device fails to sync within the configured grace period (typically 30 days by default), it is marked as noncompliant. The PowerShell output shows the device is enrolled and managed, but the last sync time is missing or outdated, triggering the noncompliant state.

Answer

The device is not enrolled.

Answer

The device name is too long.

Answer

The OS version is not supported.

Question 6

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, the Start menu layout is not enforced. The administrator verified the policy is assigned to the correct device groups. What should the administrator check next?

Accepted Answer

Review the policy status in the Troubleshooting + support blade. To verify that the policy is not in a conflict state by using the Troubleshooting + support blade. Option A is incorrect because the policy is already assigned. Option B is incorrect because the enrollment restrictions are not related to Start layout. Option D is incorrect because the update ring policy does not affect Start layout enforcement.

Answer

Check the enrollment restrictions for Windows

Answer

Reassign the policy to the same group

Answer

Modify the Windows Update ring policy

Question 7

Refer to the exhibit. You apply this device configuration profile to a group of Windows 10 devices. Users report that they receive update notifications outside of active hours. Which setting should you modify to suppress notifications during active hours?

Accepted Answer

Set updateNotificationLevel to 'turnOffAllNotifications'.. The setting updateNotificationLevel controls whether Windows Update displays notifications to users. Setting it to 'turnOffAllNotifications' suppresses all update notifications, including those that appear outside of active hours. This is the correct configuration to prevent users from seeing update notifications during active hours.

Answer

Modify activeHoursStart and activeHoursEnd to cover the full day.

Answer

Set cloudBlockLevel to 'normal'.

Answer

Set detectionFrequency to a higher value.

Question 8

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Microsoft Intune to manage its Windows 10 devices. The company recently experienced a ransomware attack that encrypted local files on several devices. To mitigate future attacks, management wants to ensure that all devices have real-time protection enabled in Microsoft Defender Antivirus and that Controlled Folder Access is turned on. You need to configure these settings via Intune. You decide to create a device configuration profile for Windows 10. What is the most efficient way to deploy these settings to all existing and future devices?

Accepted Answer

Create a device configuration profile and assign it to a device group that includes all devices.. A device configuration profile in Intune can include Microsoft Defender Antivirus settings (such as real-time protection and Controlled Folder Access) and is assigned to a device group. This ensures that both existing and future devices that join the group automatically receive the settings, providing a scalable and efficient deployment method without requiring user interaction or additional scripts.

Answer

Use PowerShell scripts deployed via Intune to enable the settings on each device.

Answer

Create a device configuration profile and assign it to a user group that includes all users.

Answer

Create a compliance policy that requires these settings and assign it to all devices.

Question 9

You need to implement a solution that automatically wipes a company-owned Windows 10 device when it has not connected to Intune for 30 days. Which Intune feature should you configure?

Accepted Answer

Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.. A compliance policy can include a rule for 'Maximum days since last check-in' that marks the device non-compliant if it hasn’t connected for 30 days. You then configure a non-compliance action to retire the device, which triggers a wipe. Option A is wrong because a PowerShell script cannot reliably execute on a device that hasn’t connected to Intune for 30 days—it requires connectivity to run. Option C is wrong because device cleanup rules only remove stale device records from Intune, they do not trigger a wipe on the device. Option D is wrong because configuration profiles set settings but do not enforce check-in frequency or trigger wipe actions.

Answer

A PowerShell script that runs on the device to self-destruct after 30 days.

Answer

Device cleanup rules to automatically delete devices after 30 days.

Answer

Device configuration profile with a setting to require periodic check-in.

Question 10

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

Accepted Answer

Update Deadline for Quality Updates (days). The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Answer

Grace Period for Restarts (days)

Answer

Defer Quality Updates (days)

Answer

Active Hours

Question 11

Which TWO are valid methods to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune? (Choose two.)

Accepted Answer

Package the Office Deployment Tool as a Win32 app.. The Office Deployment Tool (ODT) can be packaged as a Win32 app in Intune, allowing administrators to customize the installation of Microsoft 365 Apps (e.g., select specific products, languages, and update channels) and deploy it to Windows devices via the Microsoft Intune Management Extension. Option D is correct because Intune provides a built-in 'Microsoft 365 Apps for Windows 10 and later' deployment profile that simplifies the process by automatically configuring the installation using the ODT under the hood, requiring only a few settings in the Intune console.

Answer

Use the iOS Microsoft 365 Apps deployment method.

Answer

Upload an MSI file for Microsoft 365 Apps.

Answer

Add a web link to the Office 365 portal.

Question 12

You are deploying a Win32 app via Intune that requires .NET Framework 4.8 as a dependency. Which THREE steps must you perform to ensure the dependency is installed before the app?

Accepted Answer

In the main app's properties, add a dependency and select the .NET Framework app.. Intune dependencies allow you to specify another app that must be installed before the main app. By adding .NET Framework 4.8 as a separate app in Intune and then configuring a dependency in the main app's properties that references that app, you ensure the dependency is installed first. This is the only supported method for enforcing installation order via dependencies in Intune.

Answer

Configure a detection rule for .NET Framework in the main app.

Answer

Create a supersedence relationship where the .NET Framework app supersedes the main app.

Question 13

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

Accepted Answer

Select the device and choose 'Wipe'.. The 'Wipe' action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost or stolen device to prevent unauthorized access to company data. The 'Retire' action only removes managed app data and policies but leaves personal data intact, which is insufficient for a security breach scenario.

Answer

Select the device and choose 'Retire'.

Answer

Select the device and choose 'Reset'.

Answer

Select the device and choose 'Delete'.

Question 14

Which THREE of the following are required to deploy a Win32 app using Microsoft Intune?

Accepted Answer

Detection rule. A detection rule is mandatory for Win32 app deployment in Intune. It defines how Intune determines whether the app is already installed on the device (e.g., by checking a file, registry key, or MSI product code). Without a detection rule, Intune cannot verify installation success or prevent reinstallation.

Answer

Product code

Answer

Dependencies

Question 15

Match each Intune configuration profile type to its purpose.

Accepted Answer

Device restrictions: Controls device settings and features (e.g., camera, Bluetooth). Device restrictions manage device features, Endpoint protection handles security settings, Administrative templates use ADMX, and Custom uses OMA-URI. Common confusions involve swapping the first two.

Answer

Device restrictions: Manages security settings like antivirus and firewall

Answer

Endpoint protection: Controls device settings and features (e.g., camera, Bluetooth)