MD-102 Practice Test 25 — 15 Questions

Question 1

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows 11 devices remotely? (Choose two.)

Accepted Answer

Collect diagnostics. Options A and D are correct. 'Restart' is a remote action to reboot a device. 'Collect diagnostics' gathers logs remotely. Option B (Create a VPN profile) is a configuration policy, not a remote action. Option C (Assign a compliance policy) is a configuration assignment. Option E (Deploy a line-of-business app) is an app deployment, not a remote action.

Answer

Deploy a line-of-business app

Answer

Create a VPN profile

Answer

Assign a compliance policy

Question 2

You manage Windows 10 devices with Microsoft Intune. Users report that after a recent Windows update, some devices fail to enroll in mobile device management (MDM). You verify that the devices are domain-joined and can reach the internet. Which configuration should you check first?

Accepted Answer

Check that the MDM enrollment URL (https://enrollment.manage.microsoft.com) is reachable and not blocked by a proxy.. Option D is correct because the MDM enrollment URL must be accessible and properly configured in Group Policy or Intune. Option A is wrong because BitLocker is not related to enrollment. Option B is wrong because Windows Defender Firewall is not the primary cause. Option C is wrong because user credentials are valid but routing is the issue.

Answer

Confirm that the user is assigned a Microsoft Entra ID P1 license.

Answer

Verify that the BitLocker recovery key is backed up to Microsoft Entra ID.

Answer

Ensure the Windows Defender Firewall allows inbound RPC traffic.

Question 3

Which THREE conditions can be used to create a dynamic device group in Microsoft Entra ID for Intune management? (Choose three.)

Accepted Answer

Enrollment profile name (e.g., 'Autopilot Profile'). Options B, C, and D are correct. Dynamic groups can be based on device model, operating system version, and enrollment profile name. Option A is wrong because last login time is not a valid attribute for dynamic device groups. Option E is wrong because application version is not a device attribute.

Answer

Last sign-in time of the user

Answer

Installed application version

Question 4

You need to remotely wipe a lost corporate-owned iOS device that is managed by Intune. Which action should you use?

Accepted Answer

Wipe. Option C is correct because the 'Wipe' action performs a factory reset. Option A is wrong because 'Retire' removes management but keeps user data. Option B is wrong because 'Delete' removes the device from Intune without wiping. Option D is wrong because 'Reset' is not a standard Intune action; the correct term is 'Wipe'.

Answer

Reset

Answer

Delete

Answer

Retire

Question 5

Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile in Device restrictions.. Option A is correct because BitLocker settings are configured in the Endpoint Protection profile under device restrictions. Option B is wrong because the Update ring policy manages Windows Update settings. Option C is wrong because the Device compliance policy evaluates compliance but does not enforce BitLocker. Option D is wrong because the Device configuration profile for 'Administrative Templates' can include BitLocker, but the standard method is the Endpoint Protection profile.

Answer

Device configuration profile with Administrative Templates.

Answer

Device compliance policy.

Answer

Windows Update ring policy.

Question 6

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. Option C is correct because compliance state is evaluated during the last sync; if the device hasn't synced, the state may be outdated. Option A is wrong because compliance state does not trigger sync. Option B is wrong because the policy may still apply. Option D is wrong because the device is still enrolled.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

Question 7

A user reports that their Android Enterprise work profile device is not receiving email from the corporate Exchange Online account. The device is enrolled in Intune and shows as compliant. The Outlook app is installed but cannot connect. What should you check first?

Accepted Answer

Email profile configuration in Intune. Option B is correct because the most common issue is incorrect email profile configuration (server, authentication). Option A (Device compliance) is fine. Option C (App protection policies) affects data leakage, not connectivity. Option D (Intune license) would affect enrollment, not app connection.

Answer

App protection policy settings

Answer

Device compliance policy settings

Answer

Intune license assignment

Question 8

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

Accepted Answer

Device compliance policies.. Option A is correct because device compliance policies evaluate device health and report compliance status to Entra ID, which Conditional Access uses. Option B is wrong because device configuration policies do not affect compliance. Option C is wrong because app protection policies are for mobile apps, not device compliance. Option D is wrong because compliance policies are required, not optional.

Answer

No additional configuration is needed.

Answer

Device configuration policies.

Answer

App protection policies.

Question 9

Which THREE features are available in Microsoft Intune's Windows Autopilot for existing devices?

Accepted Answer

Collect hardware hash from the existing device.. Options A, C, and D are correct because Windows Autopilot for existing devices supports collecting hardware hash, deploying a provisioning package, and resetting the device. Option B is wrong because converting a device to Autopilot is done via hardware hash upload, not during deployment. Option E is wrong because Autopilot is for Windows, not macOS.

Answer

Automatically convert the device to an Autopilot device without user interaction.

Answer

Apply Autopilot profiles to macOS devices.

Question 10

Your organization wants to use Windows Autopilot for user-driven deployment. Users should be able to self-deploy their devices by signing in with their corporate credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven (Azure AD join). Option A is correct because user-driven mode requires user sign-in during OOBE. Option B is wrong because self-deploying mode does not require user interaction. Option C is wrong because pre-provisioned deployment requires IT to pre-provision. Option D is wrong because there is no 'hybrid' mode.

Answer

Pre-provisioned deployment

Answer

Hybrid Azure AD join

Answer

Self-deploying (Azure AD join)

Question 11

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy a custom configuration profile to configure Wi-Fi settings for corporate devices. Which method should you use?

Accepted Answer

Use a custom configuration profile in Intune.. Custom configuration profiles are created using Apple Configurator or manually, and then uploaded to Intune for deployment.

Answer

Use a Microsoft Entra ID (Azure AD) device configuration policy.

Answer

Use a PowerShell script to apply the settings.

Answer

Use a Microsoft Defender for Endpoint security policy.

Question 12

Which THREE are supported reporting options in Microsoft Intune for device compliance?

Accepted Answer

Export compliance data to CSV. Options A, B, and D are correct. A: You can export compliance reports to CSV. B: You can view compliance status per device. D: You can view compliance trends over time. Option C is wrong because Intune does not have a built-in dashboard for real-time compliance; it updates periodically. Option E is wrong because you cannot schedule automatic email reports natively; you would need Power Automate.

Answer

Real-time compliance dashboard

Answer

Scheduled email reports

Question 13

You need to ensure that all iOS devices enrolled in Intune automatically install required apps (e.g., Microsoft Outlook, Teams) during enrollment. Which enrollment profile setting should you configure?

Accepted Answer

Install required apps during enrollment. Option B is correct because 'Install required apps during enrollment' is a setting in iOS enrollment profiles that triggers app installation as part of the setup assistant. Option A (Device type restriction) controls which devices can enroll. Option C (Company Portal branding) is for appearance. Option D (Apple Volume Purchase Program token) is for purchasing apps, not automatic installation.

Answer

Apple Volume Purchase Program token

Answer

Company Portal branding

Answer

Device type restriction

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

Accepted Answer

Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.. Option B is correct because the 'Start layout' setting in Devices > Configuration profiles > Windows 10 > Device restrictions allows you to specify an XML file that defines the Start menu layout. Option A is wrong because this is for Windows 11. Option C is wrong because Administrative Templates do not include Start layout. Option D is wrong because the Start layout policy is under Device restrictions, not Administrative Templates.

Answer

Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

Answer

Create a configuration profile for Windows 11 using 'Start layout' setting.

Answer

Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

Question 15

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

Accepted Answer

uninstallPrevious: true. Option A is correct because 'uninstallPrevious' set to true removes previous versions. Option B is wrong because channel does not affect removal. Option C is wrong because appVersion is the version to install. Option D is wrong because intent is 'required' meaning it must be installed.

Answer

appVersion: 96.0.1054.62

Answer

channel: Stable

Answer

intent: required