MD-102 Practice Test 4 — 25 Questions

Question 1

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Accepted Answer

Device compliance policy. Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

Windows update ring

Question 2

Your organization needs to deploy a web app link to users' devices via Microsoft Intune. Which app type should you select?

Accepted Answer

Web link. C is correct because a Web link app type in Microsoft Intune allows you to deploy a shortcut to a web app on users' devices without installing any software. This is ideal for linking to a web app that runs in a browser, as it simply places an icon on the device's app list or home screen that opens the specified URL.

Answer

Windows app (Win32)

Answer

iOS store app

Answer

Managed Google Play app

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

Accepted Answer

Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.. Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Answer

Set up an automatic enrollment policy that retires devices after 30 days of inactivity.

Answer

Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.

Answer

Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.

Question 4

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Accepted Answer

Create a device compliance policy that checks for required settings.. A device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Answer

Configure an Exchange Active Sync policy in Intune.

Answer

Create a device configuration profile to enforce security settings.

Answer

Deploy an app protection policy for Outlook for iOS and Android.

Question 5

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 6

You are a Microsoft 365 Endpoint Administrator for a mid-sized company with 5,000 Windows 10 devices. The company is planning to migrate to Windows 11. You are tasked with deploying Windows 11 using a phased approach with Windows Autopilot. You have configured an Autopilot deployment profile for self-deploying mode targeting all Windows 10 devices in a dynamic device group. However, during the first wave of deployment, you notice that devices that have been upgraded to Windows 11 via an in-place upgrade are not automatically transitioning to the Autopilot experience. Instead, they boot directly to the existing Windows 10 desktop without any Autopilot enrollment. You verify that the devices are registered in Autopilot and that the deployment profile is assigned correctly. What is the most likely cause of this issue?

Accepted Answer

The devices have not been reset to OOBE state after the in-place upgrade. Windows Autopilot requires the device to be in an Out-of-Box Experience (OOBE) state to trigger the enrollment process. An in-place upgrade to Windows 11 preserves the existing user state and settings, so the device boots directly to the desktop without entering OOBE. Even though the device is registered in Autopilot and the profile is assigned, the Autopilot experience only initiates when the device is reset to OOBE (e.g., via a Windows reset or a fresh start). Therefore, the most likely cause is that the devices have not been reset to OOBE state after the in-place upgrade.

Answer

The Autopilot profile has a pre-provisioning policy that blocks self-deploying mode

Answer

The Autopilot profile is configured for user-driven mode instead of self-deploying mode

Answer

The devices are not connected to the internet during the first boot after upgrade

Question 7

A user reports that their Windows 11 device is not receiving Microsoft 365 Apps updates from Intune. You verify the device is enrolled and compliant. The device has a Microsoft 365 Apps update policy assigned. What is the most likely cause?

Accepted Answer

The device is in a low-power state and not checking in for updates. The most likely cause is that the device is in a low-power state (e.g., sleep or hibernation) and not checking in for updates. Intune relies on the Microsoft 365 Apps update service, which uses a scheduled task that runs only when the device is awake and connected. If the device is in a low-power state, it cannot execute the update check, even though it is enrolled and compliant.

Answer

The Microsoft 365 Apps update channel is not configured in the policy

Answer

The device is not connected to the internet

Answer

The device has an older version of Office installed that does not support Intune management

Question 8

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

Accepted Answer

The app is assigned to users, not devices. When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy. The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Answer

The device is low on storage

Answer

The app is available but not required

Answer

The device has offline files enabled

Question 9

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the Start menu layout resets to default every time they sign in. Which Intune policy setting is most likely causing this issue?

Accepted Answer

Start layout policy under Device Restrictions. The Start layout policy under Device Restrictions (D) is the most likely cause because it enforces a specific Start menu configuration on Windows 11 devices. When this policy is set to 'Enabled' and configured with a layout XML, it reapplies the layout at every user sign-in, overriding any user customizations. This behavior matches the reported issue of the Start menu resetting to default after a recent update.

Answer

Import Microsoft Edge assets policy

Answer

Show 'Recommended' section policy

Answer

Allow pinned folders policy

Question 10

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running OS version 10.0.22621.100. The device has a password set, firewall active, and Defender enabled. However, the device is marked as non-compliant. What is the most likely reason?

Accepted Answer

The OS version exceeds the maximum allowed version specified in the policy.. The device OS version 10.0.22621.100 exceeds the maximum OS version specified in the policy (10.0.22621.0). In Microsoft Intune compliance policies, the 'Maximum OS version' setting marks a device as non-compliant if the device's OS build number is greater than the specified value, even if all other conditions are met. This is a common configuration to prevent devices from running untested or incompatible OS builds.

Answer

The password length is exactly 8 characters, but the policy requires more than 8.

Answer

Microsoft Defender is not at the required version 4.18.2207.7.

Answer

The device does not have a password set.

Question 11

A user reports that after resetting their Windows 10 device, they cannot re-enroll it in Intune. The device appears as 'Pending' in the admin center. What is the most likely reason?

Accepted Answer

The device has a stale record in Intune that needs to be deleted.. When a Windows 10 device is reset, its existing Intune enrollment record becomes stale. The device attempts to re-enroll but the old record causes a conflict, leaving the device in a 'Pending' state in the admin center. Deleting the stale device record from Intune allows the enrollment to complete successfully.

Answer

The user is trying to enroll with a different Azure AD account.

Answer

The MDM authority is not set to Intune.

Answer

The user does not have an Intune license assigned.

Question 12

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices are compliant with a new security policy that requires Windows Defender Antivirus to be enabled and up-to-date. You create a device compliance policy with the setting 'Require' for Windows Defender Antivirus. After assigning the policy, you see that 90% of devices are compliant. The remaining 10% show 'Not evaluated'. You check the devices and find that they are online, enrolled, and have Windows Defender Antivirus enabled. What is the most likely reason for the 'Not evaluated' status?

Accepted Answer

The devices have not checked in with Intune since the policy was assigned. A device must check in with Intune after the compliance policy is assigned for evaluation to occur. If the device has not checked in since the policy was assigned, it will show 'Not evaluated' even if it is online and has Windows Defender Antivirus enabled. Option B is incorrect because the devices are stated to be online. Option C is incorrect because the policy is assigned, but the devices haven't checked in to receive it. Option D is incorrect because Windows Defender Antivirus is enabled, but the policy hasn't been evaluated yet.

Answer

The devices are offline

Answer

The policy is not assigned to the devices

Answer

Windows Defender Antivirus is disabled

Question 13

You are managing devices with Microsoft Intune. You need to ensure that only compliant devices can access corporate email. Which TWO components should you configure?

Accepted Answer

Compliance policy for Microsoft Intune. To ensure only compliant devices can access corporate email, you need a compliance policy (Option B) that defines device health rules and a Conditional Access policy (Option D) that enforces access based on compliance status. Option C is essentially the same concept as Option B and should not be selected as an additional component. Option A (device configuration profile) sets device settings but does not define compliance. Option E (app protection policy) protects app data but does not evaluate device compliance.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

App protection policy

Question 14

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Accepted Answer

Multi-factor authentication (MFA). Multi-factor authentication (MFA) is essential for a zero-trust architecture because it enforces strong identity verification beyond just a password, ensuring that each authentication request is validated with an additional factor (e.g., a phone call, text message, or authenticator app). This aligns with the zero-trust principle of 'never trust, always verify' by requiring explicit proof of identity at every access attempt, even if the user is inside the corporate network.

Answer

Azure AD Application Proxy

Answer

Azure AD Connect sync

Question 15

You need to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. The deployment must be available to users in the company portal. Which app type should you select?

Accepted Answer

Windows 10/11 (Microsoft 365 Apps). The 'Windows 10/11 (Microsoft 365 Apps)' app type in Intune is specifically designed to deploy Microsoft 365 Apps (formerly Office 365 ProPlus) with built-in support for the Office Deployment Tool (ODT) and XML configuration. This app type automatically handles the installation, updates, and licensing via the Microsoft 365 Apps for enterprise channel, and it appears in the Company Portal for user-initiated installation. Other app types lack the native integration for Microsoft 365 Apps deployment or do not support user-visible installation in the Company Portal.

Answer

Microsoft 365 (Web link)

Answer

Microsoft Store app (new)

Answer

Windows app (Win32)

Question 16

Arrange the steps to perform a Windows 10 feature update using Windows Update for Business in Intune.

Accepted Answer

Create ring, then set version and rollout, then assign, then monitor.. The correct sequence for performing a Windows 10 feature update using Windows Update for Business in Intune starts with creating a deployment ring, then configuring the feature update version and rollout settings, followed by assigning the ring to the target devices or groups, and finally monitoring the update deployment to track success and issues. This order ensures that the ring is properly configured before being applied, and that monitoring captures the actual deployment activity.

Answer

Create ring, then assign, then set version and rollout, then monitor.

Answer

Set version and rollout, then create ring, then assign, then monitor.

Answer

Create ring, then set version and rollout, then monitor, then assign.

Question 17

A company applies the above BitLocker policy to Windows 10 devices via Intune. An administrator discovers that some devices are not encrypting. The administrator checks a device and finds that it has no TPM chip. Which setting in the policy will cause encryption to fail?

Accepted Answer

requireTpm. The 'requireTpm' setting enforces that BitLocker will only start encryption if a Trusted Platform Module (TPM) chip is present on the device. If a device lacks a TPM, this policy setting causes the encryption process to fail outright, as BitLocker cannot meet the mandatory hardware requirement.

Answer

recoveryKeyRotation

Answer

encryptionMethod

Answer

requireStartupPin

Question 18

A company uses Microsoft Intune to manage iOS/iPadOS devices. After enabling Apple User Enrollment (UE), some users report that they cannot install company-recommended apps from the Company Portal. What is the most likely cause?

Accepted Answer

Apps are assigned to devices instead of users. Apple User Enrollment creates a per-user, per-device Managed Apple ID and a separate APNs certificate. Under User Enrollment, apps must be assigned to users (not devices) because the enrollment type lacks a device-level identity for app installation. When apps are assigned to devices, the Intune service cannot target them to User Enrollment devices, causing the installation to fail silently in Company Portal.

Answer

Device type is restricted in enrollment restrictions

Answer

VPP token is not configured for user enrollment

Answer

User Enrollment does not support app distribution

Question 19

Which TWO of the following are methods to deploy apps to Windows 10/11 devices via Microsoft Intune?

Accepted Answer

Microsoft Store app. The correct answers are C and E. Option C is correct because Microsoft Intune supports deploying Microsoft Store apps (including Store for Business and the new Microsoft Store experience) to Windows 10/11 devices. Intune can synchronize apps from the Microsoft Store and assign them to users or devices. Option E is correct because Intune also supports deploying Win32 apps (traditional .exe and .msi applications) to Windows devices using the Win32 app management feature, which allows packaging and deploying line-of-business applications. Options A, B, and D are incorrect: iOS and Android apps are platform-specific and cannot be deployed to Windows devices via Intune; a web link is not an app deployment method but a shortcut.

Answer

iOS app

Answer

Web link

Answer

Android app

Question 20

An organization uses Microsoft Defender for Endpoint (MDE) with Microsoft Intune for device management. The security team wants to automatically remediate risks detected by MDE on Windows devices. Which Intune feature should be used to trigger remediation actions based on MDE alerts?

Accepted Answer

Conditional Launch policy for MDE. The Conditional Launch policy in Microsoft Defender for Endpoint (MDE) allows you to define automatic remediation actions (e.g., running a scan, isolating a device) triggered by specific MDE threat alerts. This policy is configured within the MDE security settings managed by Intune, enabling a direct, automated response to risks without manual intervention.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

Windows Update rings