MD-102 Practice Test 5 — 25 Questions

Question 1

Your organization is deploying Microsoft Intune for the first time. You need to ensure that devices can enroll in Intune. Which of the following is a prerequisite for Intune enrollment?

Accepted Answer

A Microsoft Intune license assigned to the user. A Microsoft Intune license assigned to the user is a prerequisite because Intune uses Azure Active Directory (Azure AD) for identity and access management. Without an Intune license (e.g., Microsoft 365 E3, E5, or standalone Intune license) assigned to the user, the device cannot authenticate and enroll via the Intune enrollment service, as the license is required to authorize the enrollment request and apply device management policies.

Answer

A VPN connection to the corporate network

Answer

An on-premises Active Directory domain

Answer

A Configuration Manager infrastructure

Question 2

You are implementing Windows Autopilot for your organization. You need to ensure that during the first boot, the device automatically enrolls in Microsoft Intune and joins Microsoft Entra ID. What is the minimum requirement for the device?

Accepted Answer

The device must be registered in Autopilot with a valid profile.. Windows Autopilot requires the device to be registered in the Autopilot service with a valid profile assigned. This profile contains the settings that dictate the out-of-box experience (OOBE), including automatic enrollment into Microsoft Intune and joining Microsoft Entra ID (formerly Azure AD). Without a registered Autopilot profile, the device will not trigger the automated enrollment and join process during first boot.

Answer

The device must have a local administrator account.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

The device must have a TPM 2.0 chip.

Question 3

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a custom Line-of-Business (LOB) app that is signed with a certificate not trusted by the devices. The app must be available to users in the Company Portal. What should you do?

Accepted Answer

Upload the app as a LOB app in Intune and assign it to the target group.. Intune natively supports deploying signed Line-of-Business (LOB) apps directly to managed Windows devices, even if the signing certificate is not trusted by the devices. Intune handles the app delivery through the Company Portal, and the app will install as long as the device is enrolled and the app is assigned to the target group. The certificate trust issue is irrelevant for LOB app deployment via Intune because Intune does not validate the certificate chain for LOB apps; it only requires the app to be signed.

Answer

Upload the app to Microsoft Store for Business and assign it as offline.

Answer

Enable side-loading of apps on the target devices using Group Policy.

Answer

Convert the app to a .appx package and sign it with a trusted certificate.

Question 4

An administrator deploys a Win32 app via Intune with detection rule 'File exists: C:\Program Files\MyApp\app.exe'. The app is reported as installed, but users cannot launch it. The file exists but is corrupted. How should the administrator modify the detection rule to ensure the app is correctly detected and re-installed if corrupted?

Accepted Answer

Use a custom detection script that validates the file hash or signature. A custom detection script can verify the file's integrity by checking its hash or digital signature, ensuring that even if the file exists, it is not corrupted. Intune's built-in detection rules only check for file existence or version, not file integrity. By using a script that validates the hash, the administrator can force a reinstall when the file is corrupted, as the detection will fail.

Answer

Remove the detection rule so Intune always re-installs the app

Answer

Add a registry detection rule for the app's uninstall key

Answer

Change detection rule to 'File version comparison' and set minimum version

Question 5

Your organization uses Microsoft Intune to manage Android devices. You need to deploy an app that is available in the Managed Google Play store as a required app. What must you do first?

Accepted Answer

Connect Intune to the Managed Google Play store.. To deploy a required app from the Managed Google Play store, you must first establish the connection between Intune and the Managed Google Play store. This connection is a prerequisite because Intune uses it to synchronize apps, manage licenses, and push required apps to Android devices. Without this connection, Intune cannot access or deploy any apps from the Managed Google Play store.

Answer

Enroll the device in Intune.

Answer

Install the Managed Google Play app on the device.

Answer

Upload the app package to Intune.

Question 6

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a compliance policy requiring devices to have BitLocker enabled. Some devices report as non-compliant even though BitLocker appears to be on. You discover these devices are using software-based encryption instead of hardware-based encryption. What should you do to resolve the compliance failure?

Accepted Answer

Modify the compliance policy to include 'BitLocker hardware encryption' as 'not configured' or set to 'allow software encryption'.. The compliance policy can be configured to accept both hardware and software encryption. By setting 'BitLocker hardware encryption' to 'not configured' or 'allow software encryption', the policy will consider software-based encryption as compliant. Option B is incorrect because TPM attestation is not required for this issue; the problem is the encryption type, not TPM presence. Option C is incorrect because BitLocker is available on Windows 10 Pro and Enterprise, so upgrading to Enterprise does not resolve the compliance failure. Option D is incorrect because changing 'require' to 'allow' for BitLocker would still require some form of encryption, but the policy currently requires it; the issue is that software encryption is not being recognized, so allowing it directly addresses the problem.

Answer

Configure the compliance policy to require TPM attestation.

Answer

Upgrade the devices to Windows 10 Enterprise edition.

Answer

Change the compliance policy setting from 'require' to 'allow' for BitLocker.

Question 7

You manage devices with Microsoft Intune. Some Windows devices are not receiving required security updates despite being assigned to an update ring for Windows 10. You verify that the devices are active and connected to the internet. What is the most likely cause?

Accepted Answer

The update ring has a deferral period configured that delays updates for 30 days.. The most likely cause is that the update ring has a deferral period configured that delays updates for 30 days. In Microsoft Intune, update rings for Windows 10 allow administrators to set deferral periods for quality and feature updates. A deferral period of 30 days means that even if the device is active and connected, it will not install the update until the specified number of days after Microsoft releases it. This explains why the devices are not receiving the updates despite being compliant and online.

Answer

The devices have a compliance policy requiring a specific version that is not yet met.

Answer

The devices are not connected to a corporate VPN.

Answer

Delivery Optimization is disabled on the devices.

Question 8

Your organization deploys Microsoft Defender for Endpoint (now Microsoft Defender XDR) on Windows 10 devices using Intune. After deployment, some devices show 'Defender service is not running' in the security console. The devices are online and compliant. What is the most likely cause?

Accepted Answer

A third-party antivirus is installed and active.. When a third-party antivirus is installed and active on a Windows 10 device, Windows Defender (now Microsoft Defender Antivirus) automatically disables itself to avoid conflicts. This is by design: the Windows Security Center detects the active third-party AV and sets Defender's service state to stopped or disabled. In the Microsoft Defender for Endpoint console, this appears as 'Defender service is not running' even though the device is online and compliant with Intune policies.

Answer

Tamper protection is enabled and blocking the service.

Answer

The devices are not compliant with the Defender policy.

Answer

Windows Firewall is blocking Defender updates.

Question 9

You are designing a Windows Update for Business deployment for a hybrid environment with 5,000 devices. You need to ensure that critical security updates are deployed within 48 hours while allowing feature updates to be delayed up to 60 days. Which policy configuration should you use?

Accepted Answer

Configure a 'Quality update deadline' of 2 days and a 'Feature update deadline' of 60 days.. Windows Update for Business uses 'deadline' policies to enforce when updates must be installed, not deferral periods. A 'Quality update deadline' of 2 days ensures critical security updates are installed within 48 hours, while a 'Feature update deadline' of 60 days allows feature updates to be delayed up to 60 days. Deferral periods only postpone when an update is offered, not when it must be installed, making deadlines the appropriate mechanism for enforcing installation timelines.

Answer

Use a 'Quality update deferral period' of 48 hours and a 'Feature update deferral period' of 60 days in a Windows 10 update ring.

Answer

Set the 'Update notification level' to '2 - Disable all notifications' and configure active hours.

Answer

Configure a 'Quality update deferral period' of 2 days and a 'Feature update deferral period' of 60 days.

Question 10

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

Accepted Answer

The devices have exceeded the grace period and should be blocked from accessing resources.. The complianceGracePeriodExpirationDateTime represents the deadline by which a device must become compliant after initially being marked noncompliant. When this timestamp is in the past, it means the grace period has expired, and the device should be blocked from accessing corporate resources as per the conditional access policy. This is a standard behavior in Microsoft Intune for managing noncompliant devices.

Answer

The compliance policy has been removed from these devices.

Answer

The devices are still within the grace period and can access resources.

Answer

The devices were recently remediated and are now compliant.

Question 11

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

Accepted Answer

The policy has not been applied to the device yet.. If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer

Real-time scanning is set to monitorAllFiles, but the file was an archive.

Answer

The scan type is set to quick, which does not scan downloaded files.

Answer

The cloud block level is set to high, which may block unknown files, but known files might be missed.

Question 12

You need to retire a device in Microsoft Intune. What is the effect of retiring a device?

Accepted Answer

The device is unenrolled, and corporate data and apps are removed. Personal data is preserved.. Retiring a device in Microsoft Intune performs a selective wipe that removes only corporate-managed data and apps while preserving the user's personal data. The device is also unenrolled from Intune management, meaning it no longer receives policy or compliance enforcement. This is distinct from a full wipe, which resets the entire device to factory settings.

Answer

The device is factory reset to its original settings.

Answer

The device remains enrolled but can no longer access corporate resources.

Answer

The device is deleted from Azure AD and Intune.

Question 13

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

Accepted Answer

Sync-IntuneDevice -DeviceId .... The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Answer

Start-DeviceSync -DeviceName PC-001

Answer

Invoke-IntuneDeviceAction -DeviceId ... -Action Sync

Answer

Update-IntuneDevice -DeviceId ...

Question 14

The above PowerShell cmdlet returns the following output:

DeviceName: LAPTOP001
LastSyncDateTime: 2025-03-15T08:30:00Z
ComplianceState: noncompliant
ManagementState: managed
OSVersion: 10.0.19044.1288

The device last synced 3 days ago. What is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced in over 24 hours.. The device last synced 3 days ago, and the output shows ComplianceState: noncompliant. In Microsoft Intune, a device that has not checked in for more than 24 hours is automatically marked as noncompliant because the compliance policies cannot be evaluated without a recent sync. The LastSyncDateTime of 2025-03-15T08:30:00Z confirms the device has not synced within the required 24-hour window, making C the correct answer.

Answer

The device is running an outdated OS version.

Answer

The device has been retired or wiped.

Answer

The device has no compliance policy assigned.

Question 15

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Accepted Answer

iOS/iPadOS app store app. Microsoft Intune supports deploying iOS/iPadOS app store apps (option B) by integrating with the Apple Volume Purchase Program (VPP) or directly assigning public store apps via the Intune console. iOS/iPadOS line-of-business apps (option E) are custom-built apps that are uploaded as .ipa files and deployed to devices without going through the public App Store. Both are native app types for iOS/iPadOS management in Intune.

Answer

Web link

Answer

Windows app (Win32)

Answer

Android Line-of-business app

Question 16

Your organization, Fabrikam, uses Microsoft Intune to manage iOS/iPadOS and Android devices. You need to implement a solution that ensures company email can only be accessed from the Outlook mobile app, and that data from the Outlook app cannot be copied to personal apps. You also need to ensure that when a user leaves the company, the corporate data in Outlook is removed without affecting personal data. You plan to use app protection policies (MAM). The devices are not enrolled in Intune (unmanaged). You configure the app protection policies for Outlook on iOS and Android. However, users report that they can still copy email content to personal apps. What should you check?

Accepted Answer

Verify that the 'Cut, copy, and paste' setting in the app protection policy is set to 'No' or 'Policy managed apps'.. The 'Cut, copy, and paste' setting in the app protection policy controls data transfer between apps. To prevent copying email content to personal apps, this setting must be set to 'No' or 'Policy managed apps'. Option A is incorrect because device enrollment is not required for MAM policies on unmanaged devices. Option B is incorrect because device compliance policies are not applicable without enrollment. Option D is incorrect because Outlook is already a managed app; the issue is the policy setting.

Answer

Ensure that the devices are enrolled in Intune.

Answer

Check that the device compliance policy is assigned.

Answer

Confirm that the Outlook app is a managed app in Intune.

Question 17

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

Accepted Answer

The current OS version on the device.. The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Answer

The user's license status.

Answer

The compliance policy is assigned to the device.

Answer

The device is connected to the internet.

Question 18

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Accepted Answer

Windows 10 devices that are domain-joined to the on-premises Active Directory.. Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.

Answer

Active Directory Federation Services (AD FS) deployed.

Answer

Azure AD Premium P1 licenses for all users.

Answer

Windows Hello for Business configured for all users.

Question 19

Which THREE of the following are valid detection rule types for a Win32 app in Microsoft Intune? (Select THREE.)

Accepted Answer

MSI product code. MSI product code detection rules allow Intune to verify the presence of a Win32 app by checking the Windows Installer (MSI) product code in the registry (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall). This is a native detection method that directly confirms the application's installation state without requiring custom scripts.

Answer

Windows feature

Answer

DNS query

Question 20

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Accepted Answer

The Microsoft Intune agent installed on the Linux device.. The Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

An Azure Active Directory Premium P2 license for each user.