MD-102 Practice Test 28 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.. The Start layout for Windows 10 devices managed by Intune is configured under Device restrictions, not Administrative Templates. The 'Start layout' setting in Device restrictions allows you to upload an XML file that defines the Start menu layout, which can be applied to restore the missing layout after a software update.

Answer

Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

Answer

Create a configuration profile for Windows 11 using 'Start layout' setting.

Answer

Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

Question 2

You configured the above app protection policy for a Microsoft 365 app. Users report that they cannot paste text from the managed app into another app. What is the most likely reason?

Accepted Answer

The 'dataTransferPolicy' is set to 'allowNone', which prevents data from leaving the managed app.. The 'dataTransferPolicy' setting controls how data can be transferred between managed and unmanaged apps. When set to 'allowNone', it prevents any data from leaving the managed app, including paste operations from the managed app into another app. This is the most direct cause of the reported issue.

Answer

The 'pinLength' requirement is not met.

Answer

The 'requireBiometric' setting is blocking actions.

Answer

The 'allowCutCopy' setting is set to false, which blocks copy, but paste is unaffected.

Question 3

Your organization plans to use Microsoft Intune to manage macOS devices. Which TWO prerequisites are required for macOS enrollment?

Accepted Answer

An Apple Push Notification service (APNs) certificate.. An Apple Push Notification service (APNs) certificate is required for macOS enrollment because it establishes a persistent, secure connection between Microsoft Intune and Apple's servers. This certificate enables Intune to send management commands, policies, and app installations to macOS devices. Without a valid APNs certificate, Intune cannot communicate with enrolled devices, making enrollment impossible.

Answer

A user enrollment certificate from a public CA.

Answer

A Volume Purchase Program (VPP) token.

Answer

A Microsoft Configuration Manager connector.

Question 4

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Sideloading policy for the device group.. Enabling the Sideloading policy for the device group allows installation of line-of-business (LOB) apps signed with a certificate not trusted by the devices. In Microsoft Intune, sideloading bypasses the requirement for the app's signing certificate to be trusted by the device's trusted root store, enabling successful installation of internally developed or signed LOB apps on Windows 11 devices managed via Intune.

Answer

Create a device configuration profile to allow sideloading.

Answer

Add the app to the Microsoft Store for Business.

Answer

Disable automatic app updates for the device group.

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to enroll a personally owned device with a work profile. Which enrollment method should the user use?

Accepted Answer

Android Enterprise personally owned work profile enrollment.. Android Enterprise personally owned devices with a work profile use the 'Bring your own device' (BYOD) enrollment method. Option A is wrong because corporate-owned dedicated devices use a different method. Option C is wrong because fully managed devices are corporate-owned. Option D is wrong because corporate-owned work profile is for corporate devices with work profile.

Answer

Android Enterprise fully managed enrollment.

Answer

Android Enterprise corporate-owned work profile enrollment.

Answer

Corporate-owned dedicated device enrollment.

Question 6

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

Accepted Answer

Device configuration profile for Windows Update for Business. Windows Update for Business (WUfB) policies are configured using a device configuration profile in Microsoft Intune, specifically under the 'Windows Update for Business' template. This profile type allows you to manage update settings such as deferral periods, pause updates, and feature update targeting directly from Intune without requiring on-premises WSUS or additional infrastructure.

Answer

App protection policy

Answer

Device compliance policy

Answer

Endpoint security policy for antivirus

Question 7

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

Accepted Answer

The user does not have local administrator privileges on the device. Error code 0x80070005 translates to 'Access Denied' (E_ACCESSDENIED). Microsoft 365 Apps for enterprise installation requires local administrator privileges to write to protected system paths (e.g., Program Files, registry). Since the device is Azure AD joined and compliant, the most likely cause is that the user lacks local admin rights, which is a common Intune deployment prerequisite.

Answer

The device has insufficient disk space

Answer

The device does not have internet connectivity to the Microsoft CDN

Answer

The device is not compliant with the conditional access policy

Question 8

Match each Windows 10/11 edition to its applicable Microsoft 365 feature.

Accepted Answer

Windows 10 Pro: Supports Azure AD Join and Intune MDM management. Windows 10 Pro supports Azure AD Join and Intune MDM; Windows 10 Enterprise provides full Defender for Endpoint; Windows 11 Home lacks these enterprise features. Common confusions include thinking Pro supports all security features or that Home supports Autopilot.

Answer

Windows 10 Pro: Supports full Microsoft Defender for Endpoint capabilities

Answer

Windows 11 Home: Supports Windows Autopilot self-deploying mode

Question 9

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Accepted Answer

The device has not checked in with the Intune service recently.. When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Answer

The device is marked as non-compliant.

Answer

The device does not have a valid device certificate.

Answer

The device enrollment profile has expired.

Question 10

A company uses Microsoft Intune for mobile device management. They have a group of Android Enterprise devices that need to be enrolled in a way that allows the device to have a work profile while keeping personal apps separate. Which enrollment method should be used?

Accepted Answer

Android Enterprise personally-owned devices with a work profile. Android Enterprise personally-owned devices with a work profile (BYOD) is designed specifically to create a separate, managed work profile on the device while leaving personal apps and data untouched. This enrollment method uses the Android Device Policy app to establish a containerized work profile, ensuring that corporate policies apply only to the work side, and the user retains full control over the personal side. It is the standard approach for BYOD scenarios where the device is owned by the user but needs to access corporate resources securely.

Answer

Android Enterprise corporate-owned fully managed devices

Answer

Android Enterprise corporate-owned dedicated devices

Answer

Android Enterprise corporate-owned work profile

Question 11

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

Accepted Answer

The device has a non-compliant component that prevents policy application.. A non-compliant component (e.g., an outdated OS version, missing required app, or misconfigured setting) can cause the device to be marked as 'Not evaluated' if the compliance policy cannot be processed. The device is enrolled but the policy engine fails to evaluate compliance due to an underlying issue. Option A is incorrect: Certificate profiles are used for resource access, not for compliance evaluation. Option B is incorrect: The Intune Management Extension is for deploying Win32 apps and PowerShell scripts, not for compliance policies. Option D is incorrect: Enrollment tokens are used for enrollment; if expired, the device would not be enrolled at all.

Answer

The device does not have a valid certificate profile.

Answer

The Intune Management Extension is not installed.

Answer

The device's enrollment token has expired.

Question 12

You need to ensure that all iOS devices enrolled in Intune automatically install required apps (e.g., Microsoft Outlook, Teams) during enrollment. Which enrollment profile setting should you configure?

Accepted Answer

Install required apps during enrollment. The 'Install required apps during enrollment' setting in an iOS enrollment profile directs Intune to push mandatory apps (like Outlook and Teams) to the device as part of the Automated Device Enrollment (ADE) process. This leverages the Device Enrollment Program (DEP) workflow to install apps before the user gains full access, ensuring compliance with corporate policies from the outset.

Answer

Apple Volume Purchase Program token

Answer

Company Portal branding

Answer

Device type restriction

Question 13

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage endpoint security. You need to ensure that all Windows 10 devices are onboarded to Defender for Endpoint via Microsoft Intune. Which policy type should you use?

Accepted Answer

Endpoint detection and response policy. To onboard Windows 10 devices to Microsoft Defender for Endpoint via Intune, you must use an Endpoint detection and response (EDR) policy. This policy type deploys the required onboarding configuration package (a .cmd script or .xml file) that registers the device with the Defender for Endpoint service, enabling sensor data collection and threat detection. Antivirus, Firewall, and Windows Security experience policies manage separate security features but do not handle the initial onboarding process.

Answer

Antivirus policy

Answer

Firewall policy

Answer

Windows Security experience policy

Question 14

Refer to the exhibit. You run a PowerShell command to check the assignment status of device configuration profiles. The 'BitLocker Policy' shows 'Pending'. What does 'Pending' indicate?

Accepted Answer

The policy has been assigned to the device but not yet applied. In Microsoft Intune, when a device configuration profile shows a status of 'Pending', it means the policy has been successfully assigned to the device in the cloud but has not yet been applied or reported back as compliant. This is a normal transitional state that occurs while the device checks in with the Intune service, downloads the policy, and applies it during the next sync cycle. The 'Pending' status does not indicate failure, conflict, or user approval requirements.

Answer

The policy is waiting for user approval

Answer

The policy assignment failed due to a conflict

Answer

The policy has been successfully applied

Question 15

A company uses Microsoft Intune to manage iOS devices. They want to enforce a policy that requires a passcode of at least 6 characters and auto-lock after 5 minutes. Which configuration profile type should they use?

Accepted Answer

Device restrictions profile.. A Device restrictions profile is the correct configuration profile type because it contains the security settings for iOS devices, including passcode requirements (minimum length, complexity) and device lock timeouts (auto-lock after minutes). This profile type enforces device-level security policies directly managed by Intune, making it the appropriate choice for requiring a 6-character passcode and 5-minute auto-lock.

Answer

Wi-Fi profile.

Answer

VPN profile.

Answer

Email profile.