MD-102 Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. You apply this device configuration profile to a Windows 10 device. A user downloads a file that is classified as potentially unwanted application (PUA). What action will Defender take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Block the file from being downloaded.. The device configuration profile shown in the exhibit sets the 'PUAProtection' policy to 'Enabled' with the 'Block' option selected. When a user attempts to download a file classified as a potentially unwanted application (PUA), Microsoft Defender for Endpoint enforces this policy by blocking the download entirely, preventing the file from being written to disk. Option D is correct because the explicit 'Block' setting overrides any other behavior, ensuring the PUA is not allowed to execute or persist on the device.

Answer

Audit the detection and allow the download.

Answer

Send the file to the cloud for analysis.

Answer

Automatically clean the file.

Question 2

Which THREE actions can be taken from the Intune admin center when a device is retired?

Accepted Answer

Retire. When a device is retired in Intune, the device record is removed from management, and the device is no longer subject to compliance policies or conditional access. The Retire action (A) is the primary action that removes the device from Intune without wiping corporate data, while the Wipe action (D) resets the device to factory defaults and removes all data. The Delete action (E) permanently removes the device object from the Intune console, which is also available from the device blade after retirement or wipe.

Answer

Remote lock

Answer

Reset passcode

Question 3

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

Accepted Answer

The enrollment restrictions are set to block personally owned devices.. The error 'This device is not allowed to enroll' typically occurs when enrollment restrictions block the device type or ownership. In this scenario, although iOS enrollment is allowed, the restriction likely blocks personally owned devices. If users are trying to enroll personal iOS devices, the restriction preventing personally owned devices would cause this error. Option A is incorrect because a conditional access policy requiring compliant devices blocks access to resources after enrollment, not the enrollment itself. Option B is incorrect because the Apple MDM push certificate is required for Intune to communicate with iOS devices, but a missing certificate would cause a different error related to certificate setup. Option D is incorrect because terms of use appear after the enrollment attempt and would not prevent the initial enrollment.

Answer

A conditional access policy requires compliant devices.

Answer

The Apple MDM push certificate is not configured.

Answer

The users have not accepted the terms of use.

Question 4

Your organization plans to deploy a Win32 app to Windows 10 devices using Intune. The app requires the .NET Framework 4.8, which is not present on all devices. How should you handle this dependency?

Accepted Answer

Add a dependency in Intune for the .NET Framework. Intune's dependency feature allows you to specify another app (like .NET Framework 4.8) that must be installed before the Win32 app. Intune automatically installs the dependency app from the same Intune management extension context, ensuring the required runtime is present without manual scripting or bundling. This is the native, supported method for handling prerequisites in Win32 app deployment.

Answer

Include the .NET installer in the same package

Answer

Use a PowerShell script to install .NET before the app

Answer

Configure a detection rule for .NET

Question 5

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

Accepted Answer

The Conditional Access policy does not include the email application as a target.. A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it. Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.

Answer

The Conditional Access policy is set to 'Block' instead of 'Grant'.

Answer

The Conditional Access policy applies only to users in a specific group.

Answer

The compliance policy is not assigned to the users' devices.

Question 6

You are responsible for deploying Microsoft 365 Apps for enterprise to Windows 10 devices using Microsoft Intune. You want to ensure that users receive the Current Channel with updates delivered directly from the Office Content Delivery Network (CDN). You also want to minimize bandwidth usage on your network. What should you configure?

Accepted Answer

Enable delivery optimization and set the Office update channel to Current Channel.. To minimize bandwidth when deploying Office updates from the CDN, you need to enable delivery optimization with peer-to-peer distribution. This allows devices to share update content locally, reducing downloads from the internet. Setting the update channel to Current Channel ensures users receive the latest features. Therefore, option D is correct because it combines delivery optimization and the appropriate update channel. Option A is incorrect because BranchCache is not used for Office updates. Option B is incorrect because while the CDN is the default update source, it alone does not minimize bandwidth. Option C is incorrect because disabling peer-to-peer (as in disabling delivery optimization) would increase bandwidth usage.

Answer

Configure a local update server using BranchCache.

Answer

Set the update path to the Office CDN and enable Office automatic updates.

Answer

Use a configuration profile to disable peer-to-peer distribution.

Question 7

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only approved corporate apps can be installed on these devices. Which restriction profile setting should you configure?

Accepted Answer

Allow app installation from App Store only. Configuring 'Allow app installation from App Store only' to 'No' effectively blocks the App Store, preventing users from installing any apps from the store. Only apps deployed via Intune (managed apps) can then be installed, ensuring only approved corporate apps are on the devices. Option B is incorrect because requiring a password for App Store transactions does not block the installation of unapproved apps if the user has the password. Options C and D are unrelated to app installation restrictions.

Answer

Require app store password

Answer

Allow managed apps to unmanaged accounts

Answer

Allow automatic app downloads

Question 8

You need to ensure that corporate data on lost or stolen iOS devices is protected. Which TWO actions should you configure in Intune?

Accepted Answer

Configure a device passcode policy.. (Configure a device passcode policy) is correct because requiring a passcode protects data on lost or stolen devices by preventing unauthorized access. Option E (Enable remote wipe on the device) is correct because remote wipe can erase all data on a lost or stolen iOS device, ensuring corporate data is not compromised. Option A is incorrect because device inventory reporting is a management feature, not a protective action. Option C is incorrect because selective wipe (retire) removes corporate data but does not protect the device itself. Option D is incorrect because retiring the device removes management but does not immediately protect data.

Answer

Enable device inventory reporting.

Answer

Perform a selective wipe to remove corporate data only.

Answer

Retire the device from Intune.

Question 9

You manage devices with Microsoft Intune. You need to deploy a Windows 10 feature update to a pilot group of devices. Which profile type should you use?

Accepted Answer

Windows 10 feature update profile. A Windows 10 feature update profile is the correct choice because it is specifically designed to deploy feature updates (e.g., Windows 10 version 22H2) to targeted groups in Intune. Unlike update rings, which control the timing and deferral of updates, a feature update profile pins devices to a specific Windows version and orchestrates the upgrade process for pilot or broad deployments.

Answer

Windows 10 configuration profile

Answer

Windows 10 compliance policy

Answer

Windows 10 update ring profile

Question 10

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

Accepted Answer

Check the Intune console for Wi-Fi profile assignment and conflict status. Checking the Intune console for Wi-Fi profile assignment and conflict status is the fastest way to identify deployment issues, such as the profile not being assigned to the affected devices or conflicts with other profiles. Option A is wrong because recreating the profile may not address the root cause and could be time-consuming without first verifying the current assignment. Option B is wrong because running 'netsh wlan show profiles' only lists profiles stored locally and does not show Intune deployment status. Option D is wrong because reviewing Microsoft Entra ID sign-in logs does not show Wi-Fi profile status or assignment conflicts.

Answer

Recreate the Wi-Fi profile in Intune with new settings

Answer

Run the 'netsh wlan show profiles' command on affected devices

Answer

Review Microsoft Entra ID sign-in logs for authentication failures

Question 11

Your organization uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) and Microsoft Intune. You need to ensure that devices that are deemed 'at risk' by Microsoft Defender for Endpoint are automatically blocked from accessing corporate resources. What should you configure?

Accepted Answer

A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.. To block devices at risk by Microsoft Defender for Endpoint from accessing corporate resources, you need to configure a compliance policy that evaluates the device risk level from Defender for Endpoint (using the 'Require the device to be at or under the Device Threat Level' setting) and marks devices as noncompliant if they exceed the threshold. Then, configure a Conditional Access policy that targets all cloud apps and uses the 'Grant' control to 'Require device to be marked as compliant', which will block noncompliant devices. This combination is exactly described in Option B. Option A is incorrect because an app protection policy controls access at the app level, not device level. Option C is incorrect because although it describes a similar setup, it does not explicitly state that the conditional access policy blocks noncompliant devices, and the order of configuration is reversed; the standard approach is option B. Option D is incorrect because a device configuration policy does not enforce access control; it configures device settings.

Answer

An app protection policy in Intune that blocks access based on device risk.

Answer

A conditional access policy that requires device to be compliant, and a compliance policy that uses the Defender for Endpoint device risk level.

Answer

A device configuration policy that disables network access for at-risk devices.

Question 12

Your organization uses Microsoft Intune to manage devices. You need to deploy a PowerShell script that runs every time a user logs in to a Windows 10 device. The script must run with administrative privileges. Which deployment approach should you use?

Accepted Answer

Use Intune PowerShell scripts targeting the user, with a scheduled task triggered by logon.. Intune PowerShell scripts can be deployed to users and configured to run as the logged-on user. To run with administrative privileges and on every logon, a scheduled task triggered by logon can be created that runs the script with elevated rights. Option A is incorrect because deploying a PowerShell script as a Win32 app typically runs once per assigned device, not on every user logon. Option B is incorrect because proactive remediations run on a schedule (e.g., daily) and can detect/fix issues but are not triggered by user logon events. Option D is incorrect because custom compliance policies evaluate device settings for compliance and do not execute scripts on login.

Answer

Package the script as a Win32 app and assign it as required.

Answer

Deploy the script as a proactive remediation in Intune.

Answer

Use a custom compliance policy to run the script.

Question 13

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a custom app that is not available in the Google Play Store. Which app deployment method should you use?

Accepted Answer

Add the app as a line-of-business (LOB) app and upload the APK file.. Line-of-business (LOB) apps in Intune allow administrators to upload and deploy custom APK files to Android Enterprise devices. Option A is incorrect because Managed Google Play apps must be published to the Play Store. Option B is incorrect because deploying a web link is not an app deployment method; it only provides a link to download the APK manually. Option D is incorrect because iOS LOB app deployment is specific to iOS devices and is not applicable to Android.

Answer

Add the app as a Managed Google Play app.

Answer

Deploy the app as a web link to the APK file.

Answer

Use the iOS LOB app deployment method.

Question 14

You are configuring an app protection policy (MAM) in Intune for iOS and Android devices. The policy should prevent users from copying corporate data to personal apps. Which setting should you configure?

Accepted Answer

Save copies of org data.. The 'Save copies of org data' setting controls whether users can save corporate data to personal apps or locations, which directly prevents copying corporate data to personal apps. Option A is incorrect because 'Restrict cut, copy, and paste between apps' controls clipboard actions like cutting, copying, and pasting, not saving. Option B is incorrect because 'Allow app to transfer data to other apps' controls data sharing between apps, not saving. Option D is incorrect because 'Require PIN for access' controls device access authentication, not data saving.

Answer

Restrict cut, copy, and paste between apps.

Answer

Allow app to transfer data to other apps.

Answer

Require PIN for access.

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

Accepted Answer

Use the built-in Windows 10 security baseline in Intune.. The recommended approach is to use the built-in Windows 10 security baseline in Intune (Option C). Intune provides pre-configured security baselines that include settings for BitLocker encryption and Windows Defender Antivirus, which can be customized as needed. Option A is incorrect because custom configuration profiles do not provide the pre-built baseline and are more manual. Option B is incorrect because PowerShell scripts are not a baseline and are less manageable at scale. Option D is incorrect because Group Policy from on-premises AD is not integrated with Intune and requires hybrid infrastructure.

Answer

Create a custom configuration profile using Configuration Manager.

Answer

Deploy a PowerShell script via Intune to configure the settings.

Answer

Apply Group Policy Objects from on-premises Active Directory.