MD-102 Practice Test 27 — 15 Questions

Question 1

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. Option B is correct because forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration. Option D is wrong because the device is already joined.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 2

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Accepted Answer

Devices must be enrolled in Microsoft Intune.. Option A, Option B, and Option C are correct. Devices must be managed by Intune, run a supported Windows 10 version, and have the Microsoft Defender for Endpoint license assigned. Option D is wrong because Microsoft 365 Apps for enterprise is not a prerequisite. Option E is wrong because the Microsoft Defender for Endpoint client is already part of Windows 10; no separate client download is needed.

Answer

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Answer

Devices must have Microsoft 365 Apps for enterprise installed.

Question 3

You need to ensure that only compliant devices can access Microsoft 365 resources. You create a Conditional Access policy in Microsoft Entra ID. Which condition should you use?

Accepted Answer

Require device to be marked as compliant.. Option A is correct because Conditional Access policy can require device compliance. Option B is wrong because it's not a condition. Option C is wrong because it's a control, not a condition. Option D is wrong because it's a location condition.

Answer

Locations condition set to trusted IPs.

Answer

Grant access with multi-factor authentication.

Answer

Device platform condition set to all.

Question 4

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. Option C is correct because the 'Data transfer' settings control how data can be moved between apps, including preventing transfer to unmanaged apps. Option A is wrong because jailbreak detection is a device condition, not an app-level data protection. Option B is wrong because device PIN is a device-level policy. Option D is wrong because app PIN is for access control, not data transfer.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 5

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. Option D is correct because 'Inactive' status often indicates that the sensor data is not being sent, which can be resolved by restarting the Microsoft Defender for Endpoint service. Option A is wrong because the issue is not with the onboarding script. Option B is wrong because modifying a policy is not needed for activation. Option C is wrong because reinstallation is excessive.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 6

A hospital uses Intune to manage Windows 10 devices used by doctors. The devices should automatically install critical updates from Windows Update for Business. Which type of policy should the administrator create?

Accepted Answer

Update rings for Windows 10. The correct answer is Update ring policy. Option A is incorrect because compliance policies do not manage updates. Option B is incorrect because configuration profiles can set update settings but update rings are the recommended method. Option D is incorrect because application protection policies are for mobile app management.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (Update settings)

Question 7

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.. Option B is correct because Conditional Access can enforce device compliance for cloud apps like Exchange Online. Option A is wrong because App Protection Policies are for mobile apps, not Outlook desktop. Option C is wrong because Compliance Policies alone don't enforce access; they need Conditional Access. Option D is wrong because device enrollment is a prerequisite, not the enforcement mechanism.

Answer

Enable App Protection Policies for Outlook for Windows.

Answer

Require all devices to be enrolled in Intune before accessing email.

Answer

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Question 8

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. Option C is correct because if the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 9

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. Option A is correct because the Autopilot profile determines the join type; setting it to 'Azure AD joined' ensures the device is joined, not registered. Option B is wrong for the same reason. Option C is wrong because enrollment restrictions affect user enrollment, not the join type. Option D is wrong because the domain join profile is for hybrid scenarios.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.

Question 10

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. Option D is correct because the Microsoft Defender for Endpoint portal provides detailed incident investigation tools, including the attack timeline and initial access vector. Option A is wrong because Event Viewer alone lacks the context of Defender detections. Option B is wrong because Intune compliance reports do not contain threat data. Option C is wrong because Sysinternals is not integrated with Microsoft 365 Defender.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.

Question 11

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

Accepted Answer

The policy is not applied to Exchange Online as a cloud app.. Option D is correct because the Conditional Access policy must target all cloud apps, including Exchange Online. Option A is wrong because the policy can apply to all users. Option B is wrong because the policy applies to device platforms. Option C is wrong because the policy should be set to 'Require device to be marked as compliant'.

Answer

The policy does not include iOS as a device platform.

Answer

The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

Answer

The policy is not scoped to all users.

Question 12

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Option D is correct because enterprise-signed LOB apps can be added as an iOS LOB app in Intune and deployed to devices. Option A is wrong because the App Store is for public apps. Option B is wrong because Apple Business Manager is for volume purchasing, not LOB distribution. Option C is wrong because the app is already signed; a signing certificate is not needed.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 13

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Option C is correct because the sensor can become disconnected if malware is interfering; running a scan can detect and remove it. Option A is wrong because the issue is not enrollment. Option B is wrong because reinstallation is excessive. Option D is wrong because macOS does not have a Windows Security app.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 14

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

Accepted Answer

The app is not assigned to the user's device group.. Option B is correct because the app must be assigned to the user or device group. Option A is wrong because the device is compliant. Option C is wrong because Android app approval status is not a common issue. Option D is wrong because Company Portal is installed.

Answer

The device is not compliant with the compliance policy.

Answer

The app is not approved in the Android Enterprise managed Google Play.

Answer

The Company Portal app is not installed on the device.

Question 15

An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?

Accepted Answer

Endpoint security disk encryption policy. Option A is correct: Endpoint security disk encryption policy in Intune manages BitLocker settings. Option B (Device compliance policy) checks encryption status but doesn't enforce it. Option C (Device configuration profile) can include some encryption settings but the dedicated endpoint security policy is recommended. Option D (App protection policy) manages data protection at the app level, not device encryption.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (settings catalog)