MD-102 Practice Test 28 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to collect diagnostic logs from a remote Windows device without user interaction. Which THREE methods can you use?

Accepted Answer

MDM diagnostic log collection policy. The MDM diagnostic log collection policy is a built-in Intune feature that allows administrators to configure and trigger the collection of device diagnostic logs from Windows devices remotely without any user interaction. This policy leverages the Windows MDM protocol to gather logs such as event viewer logs, registry keys, and network traces, and uploads them to an Azure storage container for analysis.

Answer

Device configuration profile

Answer

Microsoft Support and Recovery Assistant

Question 2

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) enforce compliance by requiring devices to be marked compliant before granting access to corporate resources. Since compliance policies are already configured in Intune, creating a Conditional Access policy that requires a compliant device will block non-compliant devices and provide user notifications.

Answer

Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

Answer

Create a device configuration policy that blocks access to corporate resources.

Answer

Create an app protection policy in Intune to block access to apps.

Question 3

A company plans to deploy Windows 11 to 500 devices using Microsoft Deployment Toolkit (MDT). The deployment must be fully automated with minimal user interaction. Which configuration should be used in the CustomSettings.ini file?

Accepted Answer

SkipWizard=YES. `SkipWizard=YES` in the CustomSettings.ini file tells MDT to bypass all deployment wizard pages, enabling a fully unattended, zero-touch deployment. This is the specific setting required to achieve minimal user interaction during the MDT deployment process.

Answer

SkipApps=YES

Answer

UserDataLocation=AUTO

Answer

DoNotCreateExtraPartition=YES

Question 4

Which THREE of the following are features of Microsoft Defender for Endpoint that help protect devices?

Accepted Answer

Attack surface reduction rules. Attack surface reduction rules (A) are a Defender for Endpoint feature that blocks risky behaviors such as Office macros spawning child processes or scripts launching executable content, thereby hardening the device against common attack vectors. Endpoint detection and response (B) provides behavioral monitoring, alert generation, investigation timelines, and automated remediation actions so security teams can detect and contain threats on endpoints. Next-generation protection (C) delivers cloud-delivered antivirus and antimalware capabilities, including real-time protection, behavior monitoring, and heuristics, to block malware at the device level. Data loss prevention (D) is not a Defender for Endpoint device-protection feature; it is a separate Microsoft Purview/Compliance capability focused on preventing sensitive data exfiltration. Conditional access policies (E) are an identity and access control feature of Microsoft Entra ID, not a Defender for Endpoint device-protection capability.

Answer

Data loss prevention

Answer

Conditional access policies

Question 5

You are configuring an app protection policy for iOS devices to protect corporate data in Microsoft Outlook. Which TWO settings prevent users from copying corporate data to personal apps?

Accepted Answer

Allow app to transfer data to other apps. Option A, 'Allow app to transfer data to other apps,' is correct because setting it to 'None' or 'Policy managed apps' restricts Outlook from sharing or transferring corporate data to unmanaged personal apps, directly preventing data leakage to personal apps. Option D, 'Restrict cut, copy, and paste between apps,' is correct because configuring it to 'Policy managed apps' or 'Policy managed apps with paste in' prevents users from copying corporate content from Outlook and pasting it into personal apps. Option B, 'Save copies of work data,' controls whether users can save copies of corporate data to personal storage locations but does not specifically govern app-to-app copying. Option C, 'Block screen capture and screen recording,' prevents screenshots of corporate data but does not stop copying data into personal apps. Option E, 'Encrypt app data,' protects data at rest on the device but does not prevent users from copying corporate data to personal apps.

Answer

Save copies of work data

Answer

Block screen capture and screen recording

Answer

Encrypt app data

Question 6

Which THREE factors can cause a required app deployment to fail on a Windows 10 device managed by Intune? (Choose three.)

Accepted Answer

The device is not connected to the internet.. Option B is correct because a required Intune app deployment relies on the device checking in with the Intune service and downloading content from Intune/Windows Delivery Optimization, so without internet connectivity the device cannot receive the policy or the app payload and the install fails. Option D is correct because requirement rules (such as OS version, architecture, disk space, or registry checks) are evaluated before installation; if the device does not satisfy them, Intune marks the app as not applicable and the required install does not proceed. Option E is correct because dependencies (for example, a Win32 app that requires another app or a specific framework) must be installed first; if a dependency fails or is missing, the dependent app's installation fails. Option A is not correct because an app update policy blocking updates affects updating already-installed apps, not the initial required deployment of an app. Option C is not correct because a required deployment targets device or user groups; if the user is not assigned, the app simply is not deployed to that user rather than causing a deployment that was assigned to fail.

Answer

The device has an app update policy that blocks updates.

Answer

The user is not assigned to the app.

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate applications. Which TWO configurations should you implement?

Accepted Answer

Create a device compliance policy. Option B (Create a device compliance policy) is correct because a compliance policy in Intune defines the rules a device must meet—such as BitLocker, minimum OS version, or jailbreak/root detection—and evaluates devices to produce a compliance state that Conditional Access can consume. Option E (Create a Conditional Access policy requiring compliant devices) is correct because Conditional Access is the enforcement engine in Microsoft Entra ID that grants or blocks access to corporate applications based on signals like device compliance, so requiring compliant devices ensures only compliant devices reach those apps. Together, the compliance policy establishes the device state and the Conditional Access policy enforces it at access time. Option A (App Protection Policy) only protects app data on mobile apps via MAM and does not gate access to corporate applications based on device compliance. Option C (device configuration profile) merely configures settings on devices and does not itself evaluate or enforce compliance for access. Option D (MFA) strengthens user authentication but does not verify device compliance, so it does not satisfy the requirement on its own.

Answer

Deploy an App Protection Policy

Answer

Configure a device configuration profile

Answer

Enable multifactor authentication (MFA) for all users

Question 8

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Accepted Answer

The device must be enrolled using Android Enterprise work profile. Option C is correct because deploying a managed Google Play app to work profile devices requires the device to be enrolled with the Android Enterprise work profile enrollment type, which creates the separate work profile container where managed apps are installed. Option D is correct because managed Google Play apps must first be approved (and optionally configured) in the managed Google Play store within Intune before they can be assigned and deployed to devices. Option A is not required because the work profile enrollment handles the Google account binding through the managed Google Play connection, and end users do not need a separate personal Google account for app deployment. Option B is not required because work profile enrollment supports both personally owned and corporate-owned devices. Option E is not required because kiosk mode is a separate dedicated-device configuration and is not needed to deploy a standard managed Google Play app.

Answer

The user must have a Google account

Answer

The device must be personally owned

Answer

The app must be configured as a kiosk app

Question 9

Which TWO actions can you perform using Microsoft Intune to protect devices from malware?

Accepted Answer

Enforce Windows Defender Antivirus real-time protection. Option D is correct because Intune can enforce Windows Defender Antivirus settings through endpoint security antivirus policies, including turning on real-time protection, which actively detects and blocks malware on managed Windows devices. Option E is correct because Intune endpoint security firewall policies let you configure Windows Defender Firewall rules (such as blocking inbound/outbound traffic on specific ports or profiles), which helps prevent malware from communicating or spreading across the network. Option A is not provided by Intune itself; network segmentation is typically handled by network security appliances, VLANs, or Azure NSGs rather than Intune device configuration. Option B is not an Intune malware-protection action; email attachment scanning is performed by Exchange Online Protection or Microsoft Defender for Office 365, not by Intune. Option C is not a native Intune malware-protection action in the sense described; while Intune can deploy apps, it does not itself provide antivirus protection, and the built-in Defender controls in D and E are the direct Intune mechanisms for malware protection.

Answer

Create network segmentation rules

Answer

Enable email attachment scanning

Answer

Deploy third-party antivirus software

Question 10

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 11

Your organization uses Microsoft Intune to manage devices. You need to collect diagnostic logs from a remote Windows device without user interaction. Which THREE methods can you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Minimum OS version. The requirement for devices to run Windows version 22H2 or later is a minimum version constraint. In Microsoft Intune compliance policies, the 'Minimum OS version' setting enforces that the device's OS version must be equal to or greater than the specified version, which directly matches the '22H2 or later' condition.

Answer

Require OS version

Answer

Maximum OS version

Answer

Exact OS version

Question 12

An organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. The security team wants to automatically apply an Intune app protection policy (APP) when a user accesses a risky app from an unmanaged device. What should the administrator use?

Accepted Answer

Conditional Access App Control with session control. Conditional Access App Control with session control is the correct solution because it allows the administrator to monitor and control app sessions in real time, applying Intune app protection policies (APP) when a user accesses a risky app from an unmanaged device. This integration uses reverse proxy architecture to intercept traffic and enforce data protection policies, such as blocking downloads or requiring managed apps, directly within the cloud app session.

Answer

Device configuration policy

Answer

App protection policy assignment to users

Answer

Device compliance policy

Question 13

Refer to the exhibit. You manage a Windows 11 device that is marked as compliant and has OS version 10.0.22621.0. You need to upgrade the device to Windows 11 version 23H2. Which Intune feature should you use?

Accepted Answer

Windows feature update profile. A Windows feature update profile is the correct Intune feature to upgrade a Windows 11 device from one version to another (e.g., from 10.0.22621.0 to 23H2). Feature update profiles deploy new OS builds that enable feature-level changes, whereas quality updates deliver only security and cumulative fixes. This profile targets the specific version upgrade required for the device.

Answer

Windows quality update profile

Answer

Driver update policy

Answer

Compliance policy

Question 14

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

Accepted Answer

Shared iPad enrollment using Apple Business Manager and Intune.. Shared iPad enrollment using Apple Business Manager (ABM) and Intune is designed specifically for scenarios where multiple students share the same iPad and each needs their own apps, data, and sign-in. It uses Managed Apple IDs and provides a personalized experience with separate user partitions, while the device remains supervised and managed by the school.

Answer

Automated Device Enrollment with user affinity.

Answer

User Enrollment

Answer

Device Enrollment (DEP) without user affinity.

Question 15

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Accepted Answer

The virtual machine does not have Secure Boot enabled in its firmware settings.. Secure Boot is a hardware-based feature that ensures the system boots using only software trusted by the PC manufacturer. In virtual machines, Secure Boot is often not enabled by default or may not be supported by the hypervisor. For Intune compliance, if the VM does not have Secure Boot enabled, it will report as non-compliant. Option C is correct because the VM's firmware settings likely have Secure Boot disabled. Option A is incorrect because the device may still be enrolled correctly. Option B is incorrect because password policy is unrelated to Secure Boot. Option D is incorrect because BitLocker is a separate encryption feature not required for Secure Boot.

Answer

The device is not enrolled in Intune correctly.

Answer

The password policy is conflicting with Secure Boot.

Answer

The device does not have BitLocker enabled, which is required for Secure Boot.