MD-102 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. The JSON snippet shows a Windows Update for Business policy assigned to a device group. Users report that quality updates are installed 7 days after release. Which setting controls this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

qualityUpdateDeferralPeriodInDays. The setting `qualityUpdateDeferralPeriodInDays` controls how long quality updates (security fixes) are deferred after release. A value of 7 means updates are installed 7 days post-release, matching the user report. This is a Windows Update for Business policy configured via CSP (Policy CSP - Update).

Answer

featureUpdateDeferralPeriodInDays

Answer

businessReadyUpdatesOnly

Answer

automaticUpdateMode

Question 2

Match each PowerShell cmdlet to its function in Microsoft 365 management.

Accepted Answer

Get-MgUser: Retrieves all users. PowerShell is used for programmatic management; these cmdlets are from Microsoft Graph PowerShell SDK.

Answer

Get-MgUser: Modifies user properties

Answer

Update-MgUser: Retrieves all users

Question 3

Your organization uses Microsoft Intune to manage devices. You need to configure a compliance policy for Windows devices that requires the device to be at a specific OS version and have antivirus enabled. Which TWO settings should you configure in the compliance policy?

Accepted Answer

Require antivirus (Windows Defender). The correct settings are 'Require antivirus (Windows Defender)' and 'Minimum OS version'. These are standard compliance policy settings for Windows devices in Microsoft Intune. 'Maximum OS version' is not typically used for compliance; instead, a minimum version ensures devices are up-to-date. 'Device type' is not a compliance setting. 'Storage encryption' is a compliance setting (Require BitLocker), but it is not required by the scenario's specific criteria.

Answer

Maximum OS version

Answer

Device type

Answer

Storage encryption

Question 4

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

Accepted Answer

Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment. Microsoft Entra ID (formerly Azure AD) registration or join is a prerequisite for Intune enrollment. Intune requires a device to have an identity in Entra ID to apply policies and manage compliance. Without this prerequisite, the device cannot authenticate or receive management commands from Intune.

Answer

Configure enrollment restrictions to require corporate ownership

Answer

Set device type restrictions to block unregistered devices

Answer

Configure automatic enrollment via Group Policy

Question 5

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

Accepted Answer

Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.. Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Azure AD group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Answer

Include the settings in the Windows 365 provisioning policy.

Answer

Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

Answer

Use a Group Policy Object (GPO) applied via on-premises AD.

Question 6

Your company uses Microsoft Intune for device management. You need to configure a Windows 10 device restriction policy that blocks the use of the camera and microphone on all devices. Which settings should you configure?

Accepted Answer

Camera and Microphone. To block the camera and microphone on Windows 10 devices managed by Microsoft Intune, you configure the 'Camera' and 'Microphone' settings within a device restrictions policy (under the 'General' category). These settings directly disable the corresponding hardware devices at the OS level by modifying the relevant registry keys (e.g., HKLM\SOFTWARE\Policies\Microsoft\Camera\AllowCamera and HKLM\SOFTWARE\Policies\Microsoft\Sound\AllowMicrophone). This ensures that no application can access the camera or microphone, meeting the compliance requirement.

Answer

Bluetooth and Nearby Share

Answer

Copy and paste and Clipboard

Answer

Location and Messaging

Question 7

You are troubleshooting a Windows device that is not receiving policies from Intune. Which TWO actions should you take?

Accepted Answer

Verify the device is enrolled in Intune. A device must be enrolled in Intune to receive policies; if enrollment is missing, the device will not appear in the Intune console and cannot process MDM policies. Verifying enrollment status (e.g., via Settings > Accounts > Access work or school) confirms the device is managed and can receive policy payloads.

Answer

Configure a Conditional Access policy

Answer

Reset the user's password

Answer

Review the app protection policy assignment

Question 8

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

Accepted Answer

The app is not assigned to the user's device group.. The app is assigned as 'Available for enrolled devices' in Intune, which means it must be assigned to a device group that includes the user's device. Since the device is enrolled and compliant, the most likely issue is that the app is not assigned to the correct device group, preventing it from appearing in the Company Portal for installation.

Answer

The device is not compliant with the compliance policy.

Answer

The app is not approved in the Android Enterprise managed Google Play.

Answer

The Company Portal app is not installed on the device.

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 feature update using the Windows 10 Update Rings feature. However, the deployment fails and devices show error 0x800f0905. What is the most likely cause?

Accepted Answer

The feature update package is missing prerequisite updates.. Error 0x800f0905 indicates missing installation files for the feature update. This typically occurs when prerequisite updates are not installed. Therefore, the most likely cause is that the feature update package is missing prerequisite updates (Option C). Option A is incorrect because insufficient disk space would result in a different error. Option B is incorrect because the update ring does not involve language settings. Option D is incorrect because a maintenance window would not cause this error.

Answer

The device does not have enough free disk space.

Answer

The device is not set to the correct language for the update.

Answer

The update ring is configured with a maintenance window that is too short.

Question 10

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Answer

Require multi-factor authentication

Answer

Require hybrid Azure AD joined device

Answer

Require approved client app

Question 11

You are configuring app protection policies (MAM) in Microsoft Intune for iOS devices. Which THREE settings can you configure to prevent data leakage?

Accepted Answer

Restrict web content transfer to managed browsers.. Restricting web content transfer to managed browsers ensures that corporate data opened via web links can only be viewed in browsers that support Intune MAM policies (e.g., Microsoft Edge). This prevents data from being opened in unmanaged browsers where app protection policies cannot enforce data leakage controls, such as preventing copy/paste or requiring encryption.

Answer

Require device PIN.

Answer

Block screenshots of corporate data.

Question 12

A company uses Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) Win32 app to devices that are not assigned to any user. The app requires installation in the system context. Which installation behavior should be configured in the Intune Win32 app deployment?

Accepted Answer

System. (System) is correct because the Win32 app must run in the system context to install without a user session, which is required for devices not assigned to any user. In Intune, the 'System' installation behavior runs the installer as the local SYSTEM account, enabling silent, elevated installations regardless of user presence.

Answer

User

Answer

Device

Answer

LoggedOnUser

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that all devices have a passcode of at least 6 characters and that devices are updated to the latest iOS version. You create a compliance policy. After assigning the policy, some devices are marked as non-compliant even though they have a passcode. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune since the policy was assigned.. Intune compliance policies are evaluated only when devices check in with the service. If a device has not performed a check-in since the policy was assigned, it will not have received or evaluated the new policy, and its compliance status will remain based on the previous state. The check-in interval for iOS/iPadOS devices is typically every 8 hours, but can be forced manually by the user. Until the device checks in, it cannot be marked compliant even if it meets the passcode and OS version requirements.

Answer

The devices have multiple compliance policies applied.

Answer

iOS devices do not support compliance policies.

Answer

The policy was assigned to a user group instead of a device group.

Question 14

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. A device is marked as non-compliant even though it has a password of length 8, firewall enabled, and Defender enabled. What is the most likely cause?

Accepted Answer

The device does not lock after inactivity.. The compliance policy JSON includes a setting for 'requireDeviceLock' or similar inactivity lock enforcement. Even though the device has a password of length 8, firewall enabled, and Defender enabled, if the device does not lock after a period of inactivity, it violates the policy. The policy likely specifies a maximum inactivity timeout (e.g., 5 minutes) and a grace period; failure to meet this requirement results in non-compliance regardless of other settings.

Answer

Microsoft Defender is not running.

Answer

The device firewall is not active.

Answer

The device password is not complex enough.

Question 15

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

Accepted Answer

The devices are not connected to the internet.. Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Answer

The hardware hashes are invalid.

Answer

The devices are not running Windows 11 Pro or Enterprise.

Answer

The user does not have an Intune license.