MD-102 Practice Test 27 — 15 Questions

Question 1

You are the endpoint administrator for Contoso Ltd., a global company with 5,000 Windows 11 devices managed by Microsoft Intune. The company has a strict security policy requiring that all devices must have BitLocker Drive Encryption enabled on the operating system drive. Additionally, devices must be compliant with the policy to access corporate resources via Conditional Access. Recently, an audit revealed that 200 devices are non-compliant because BitLocker is not enabled. You investigate and find that these devices are all personal devices enrolled as 'Windows bring your own device' (BYOD). The BitLocker policy is configured as a device configuration profile targeting 'All Devices'. The compliance policy requires 'Storage encryption' to be enabled. You need to resolve the non-compliance for these BYOD devices. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upgrade the Windows edition on BYOD devices to Windows Pro or Enterprise.. BitLocker Drive Encryption is only available on Windows Pro, Enterprise, or Education editions. BYOD devices often run Windows Home, which does not support BitLocker. Upgrading to Windows Pro or Enterprise enables BitLocker, resolving the non-compliance. Option A is incorrect because the profile is already assigned to 'All Devices', but it cannot enable BitLocker on unsupported editions. Option C is incorrect as it would bypass the security requirement. Option D is incorrect because compliance policies cannot override device capabilities; they can only require encryption on devices that support it.

Answer

Assign the BitLocker configuration profile to device groups that include BYOD devices.

Answer

Create a separate compliance policy for BYOD devices that does not require storage encryption.

Answer

Configure the compliance policy to mark devices as compliant if BitLocker is not enabled but other settings are met.

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

Accepted Answer

Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.. Update rings are the primary policy in Microsoft Intune for controlling how and when Windows 10 and later devices receive updates from Windows Update. Setting 'Automatic update behavior' to 'Auto install and reboot' ensures that critical and security updates are automatically downloaded and installed without user intervention, meeting the requirement for all Windows 11 devices.

Answer

Configure a device configuration profile with 'Windows Update for Business' settings.

Answer

Deploy a feature update policy to install the latest quality updates.

Answer

Create a device compliance policy that requires devices to have the latest updates.

Question 3

Which THREE conditions can be used in a Conditional Access policy to require a compliant device?

Accepted Answer

Client apps. Options B, C, and D are correct. Option B: Client apps condition allows targeting specific applications or user actions. Option C: Locations condition allows requiring compliance based on IP ranges or countries. Option D: Device platform condition allows targeting specific operating systems. Option A is incorrect because the Device state condition includes options like 'Device hybrid Azure AD joined' and 'Device marked as compliant', but it filters based on current state rather than requiring compliance. To require a compliant device, you use the grant control, not the Device state condition. Option E is incorrect because sign-in risk is a condition but is not used to require a compliant device; it's used for risk-based policies.

Answer

Device state

Answer

Sign-in risk

Question 4

Match each Windows Update for Business deployment service to its capability.

Accepted Answer

Update Rings: Configures deferral periods and deadlines for updates. The correct matches are: Update Rings configures deferral periods and deadlines; Feature Update Policies specify which feature update version is offered; Quality Update Policies control which quality updates are offered. Common confusions arise from mixing the roles of these policies.

Answer

Update Rings: Controls which feature updates are offered to devices

Answer

Feature Update Policies: Configures deferral periods for quality updates

Question 5

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that corporate data in managed apps is encrypted at rest. Which setting should you configure?

Accepted Answer

App protection policy – Data protection – Encrypt app data.. App Protection Policies (APP) in Microsoft Intune include a 'Data Protection' setting called 'Encrypt app data' that enforces encryption of corporate data at rest on iOS/iPadOS devices. This setting uses hardware-backed file-level encryption (Data Protection class) to protect data in managed apps, ensuring that even if the device is lost or stolen, the data remains inaccessible without the user's passcode.

Answer

Device compliance policy – Require data encryption.

Answer

Enrollment restrictions – Require encrypted backup.

Answer

Device configuration profile – Encryption settings.

Question 6

Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?

Accepted Answer

Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.. AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist. This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.

Answer

Add a deny rule for all Microsoft signed executables.

Answer

Keep the policy in AuditOnly and rely on Windows Defender to block unsigned apps.

Answer

Delete the existing rule and create a new rule that explicitly allows only specific signed apps.

Question 7

Refer to the exhibit. You deploy this ARM template to create an Intune configuration policy for macOS devices. The policy sets the 'com.apple.ManagedClient.appstore' setting to true. What is the expected behavior on the target macOS devices?

Accepted Answer

Users will be allowed to install apps from the App Store.. Setting 'com.apple.ManagedClient.appstore' to true in an Intune macOS configuration policy explicitly allows users to install apps from the App Store. This key controls the 'allow app store app installation' restriction; when true, the restriction is disabled, meaning users can install apps from the App Store. The policy does not affect automatic updates or restrict installation to only Apple Business Manager purchases.

Answer

App Store updates will be automatically installed.

Answer

Only apps purchased through Apple Business Manager will be installable.

Answer

Users will be blocked from installing apps from the App Store.

Question 8

You are planning to deploy a Win32 app to Windows 10 devices using Microsoft Intune. The app requires a specific registry key to be present before installation. How should you ensure the prerequisite is met?

Accepted Answer

Set a requirement rule for the registry key.. Requirement rules are used to evaluate conditions that must be met before the app installation begins. By setting a requirement rule to check for the existence of the specific registry key, Intune will verify the prerequisite and only install the app if the key is present. Detection rules, on the other hand, are intended to verify the app's installation status after deployment, not to check prerequisites before installation. Therefore, option D is incorrect.

Answer

Configure the installation behavior as 'System' to bypass user context.

Answer

Add the registry key as a dependency.

Answer

Configure a detection rule to verify the registry key exists.

Question 9

Contoso uses Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps from the Microsoft Store can be installed on corporate devices. What should you configure?

Accepted Answer

iOS/iPadOS App Configuration policies. To ensure only approved apps from the Microsoft Store can be installed on corporate iOS/iPadOS devices, configure a Device restrictions policy (Device configuration profile) with settings such as blocking the App Store or allowing only managed apps. App Configuration policies cannot restrict app installation; they only supply app-specific settings.

Answer

App Protection Policies (APP)

Answer

Device Compliance policies

Answer

Managed App Policies (MAM)

Question 10

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

Accepted Answer

To list the IDs of Windows devices.. The script uses Get-MgDevice with a filter for operatingSystem eq 'Windows' to retrieve all Windows device objects from Microsoft Entra ID, regardless of their join type (joined, registered, or hybrid). By selecting the DeviceId property, it outputs the unique identifiers of these devices. The DeviceId is the Entra ID object identifier, not the device name or Autopilot registration status.

Answer

To output the device names of all Windows devices.

Answer

To list devices that are registered in Autopilot.

Answer

To update the enrollment type of all Windows devices.

Question 11

You need to deploy a custom Windows 10 image to 100 new devices using Microsoft Intune. The devices are not yet enrolled. Which method should you use to deploy the image and enroll the devices?

Accepted Answer

Use Windows Autopilot to deploy a custom image and automatically enroll the devices.. Windows Autopilot is the correct method because it can deploy a custom Windows 10 image and automatically enroll devices into Intune, providing a zero-touch deployment experience. Option A is incorrect because PXE boot is not natively supported by Intune and a provisioning package alone cannot deploy an image. Option B is incorrect because creating a bootable USB and manually enrolling each device is not scalable for 100 devices and does not leverage Intune's automated enrollment. Option C is incorrect because while Configuration Manager can deploy images, co-management is an additional configuration and not the simplest approach for this scenario; Windows Autopilot is the recommended method for modern deployment with Intune.

Answer

Use PXE boot to deploy the image and then enroll via a provisioning package.

Answer

Create a bootable USB with the image and manually enroll each device.

Answer

Use Microsoft Configuration Manager to deploy the image and enroll via co-management.

Question 12

You need to wipe a lost corporate-owned Windows 10 device that is enrolled in Intune. Which action should you take?

Accepted Answer

Select the device and choose Wipe.. The Wipe action in Intune restores a Windows 10 device to its factory default settings, removing all data and corporate access. This is the appropriate action for a lost corporate-owned device because it ensures sensitive data is erased while retaining the device's enrollment record for potential recovery or re-provisioning.

Answer

Delete the device from Intune.

Answer

Select the device and choose Retire.

Answer

Reset the device using the Company Portal.

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a line-of-business (LOB) app that requires a reboot after installation. Which deployment configuration should you use to ensure the app installs and the device reboots outside of business hours?

Accepted Answer

Required assignment with a reboot behavior of 'Immediate'. A Required assignment ensures the app is forcibly installed on devices. Although the reboot behavior is set to 'Immediate', you can use device configuration policies (such as Active Hours or Windows Update restart policies) to defer the reboot until outside business hours. Option A does not guarantee installation because it is only available. Option B is invalid because Available assignments do not support deadlines or grace periods. Option C is for uninstalling, not deploying.

Answer

Available assignment without deadline

Answer

Available assignment with a deadline and a grace period for reboot

Answer

Uninstall assignment for all devices

Question 14

You need to deploy a custom Microsoft Edge extension to managed Windows 10 devices via Intune. Which policy type should you use?

Accepted Answer

Administrative Templates profile (ADMX-backed policies). Deploying a custom Microsoft Edge extension via Intune requires configuring the 'Install Extensions Silently' policy, which is an ADMX-backed policy available through the Administrative Templates profile. This policy type allows you to manage Edge-specific settings using the built-in ADMX files that Intune imports from the Edge administrative templates, enabling silent installation of extensions by specifying their update URL or extension ID.

Answer

Device restrictions profile

Answer

Compliance policy

Answer

PowerShell script deployment

Question 15

Order the steps for configuring a Windows 10 kiosk device using Assigned Access.

Accepted Answer

1. Create a local user account for the kiosk.
2. Open Settings and navigate to Accounts > Other users.
3. Click 'Set up a kiosk' and select the created user.
4. Choose the app to run in kiosk mode.
5. Sign out and test the kiosk.. First create the account, then navigate to Settings, set up the kiosk with the user, choose the app, and test by signing in.

Answer

1. Open Settings and navigate to Accounts > Other users.
2. Create a local user account for the kiosk.
3. Click 'Set up a kiosk' and select the created user.
4. Choose the app to run in kiosk mode.
5. Sign out and test the kiosk.

Answer

1. Create a local user account for the kiosk.
2. Sign out and sign in with the kiosk user.
3. Open Settings and navigate to Accounts > Other users.
4. Click 'Set up a kiosk' and select the current user.
5. Choose the app to run in kiosk mode.

Answer

1. Open Settings and navigate to Accounts > Other users.
2. Click 'Set up a kiosk' and skip user selection.
3. Create a local user account for the kiosk.
4. Choose the app and assign it to the new user.
5. Sign out and test the kiosk.