MD-102 Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. You have configured the compliance policy shown above. A user reports that their Windows 11 device is compliant with all settings except the threat level. The device has no threat protection agent installed. What will happen when the user tries to access corporate resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access is blocked immediately.. The compliance policy requires a minimum threat level, which cannot be evaluated because the device has no threat protection agent installed. In Microsoft Intune, when a required compliance setting cannot be assessed (e.g., no agent), the device is treated as non-compliant, and access is blocked immediately. There is no grace period for missing required agents, and conditional access enforces the block at the time of the access request.

Answer

Access is granted but the user receives a warning notification.

Answer

Access is blocked only after a 24-hour grace period.

Answer

Access is granted because the device meets all other compliance requirements.

Question 2

You manage Windows 10 devices with Intune. You need to ensure that only approved apps can run on corporate devices. You configure AppLocker via a custom OMA-URI. However, users can still run unapproved apps. What is the most likely reason?

Accepted Answer

The AppLocker policy is set to 'Audit only' mode.. When AppLocker is configured via custom OMA-URI in Intune, the policy is device-based and can be assigned to device groups. However, if the policy is set to 'Audit only' mode, it only logs events without actually blocking applications. This allows users to still run unapproved apps. Option D is incorrect because assigning the policy to a device group does enforce AppLocker rules; the issue here is mode enforcement, not assignment type.

Answer

The device must be running Windows 10 Pro edition.

Answer

AppLocker rules can only be configured via Group Policy, not OMA-URI.

Answer

The policy is assigned to a device group instead of a user group.

Question 3

You manage Windows 10 devices with Microsoft Intune. Users report that after a recent Windows update, some devices fail to enroll in mobile device management (MDM). You verify that the devices are domain-joined and can reach the internet. Which configuration should you check first?

Accepted Answer

Check that the MDM enrollment URL (https://enrollment.manage.microsoft.com) is reachable and not blocked by a proxy.. The most common cause of MDM enrollment failure after a Windows update is a change in proxy or firewall settings that blocks the MDM enrollment URL. Since the devices can reach the internet generally but fail specifically during enrollment, verifying that `https://enrollment.manage.microsoft.com` is reachable and not blocked by a proxy is the logical first troubleshooting step. This URL is required for the device to communicate with the Intune MDM service during the enrollment process.

Answer

Confirm that the user is assigned a Microsoft Entra ID P1 license.

Answer

Verify that the BitLocker recovery key is backed up to Microsoft Entra ID.

Answer

Ensure the Windows Defender Firewall allows inbound RPC traffic.

Question 4

You manage Windows 10 devices with Microsoft Intune. A user reports that a device has a red shield icon in the Windows Security Center, indicating tamper protection is off. You need to re-enable tamper protection on the device using Intune. Which profile type should you configure?

Accepted Answer

Endpoint protection profile (Microsoft Defender Antivirus). Tamper protection is a Microsoft Defender Antivirus setting that prevents unauthorized changes to security features. In Intune, this setting is configured under the 'Endpoint protection profile' using the 'Microsoft Defender Antivirus' template, specifically via the 'Enable tamper protection to prevent Microsoft Defender being disabled' toggle. This profile type directly manages Defender settings, including tamper protection, and applies them to enrolled Windows 10 devices.

Answer

Device configuration profile (settings catalog)

Answer

Security baseline (Windows 10/11)

Answer

Compliance policy

Question 5

You are planning to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. Which TWO methods can you use to deploy Microsoft 365 Apps? (Choose two.)

Accepted Answer

Windows Installer (Win32) app type using the Office Deployment Tool.. Option B is correct because you can package Microsoft 365 Apps as a Windows Installer (Win32) app in Intune by using the Office Deployment Tool (ODT) to generate the setup.exe and Configuration.xml, then wrap it with the Intune Win32 Content Prep Tool for deployment. Option E is correct because Intune provides a dedicated built-in app type called 'Microsoft 365 Apps for Windows' (the Microsoft 365 Apps app type) that lets you select Office apps, update channel, and architecture directly without packaging. Option A is incorrect because the Android store app type deploys Android apps, not Windows Office apps. Option C is incorrect because a web link app type only creates a shortcut to a URL and does not install Microsoft 365 Apps. Option D is incorrect because the iOS store app type targets iOS devices, not Windows.

Answer

Android store app type.

Answer

Web link app type pointing to the Office website.

Answer

iOS store app type.

Question 6

Your organization is planning to deploy Windows 10 updates using Windows Update for Business. You need to ensure that critical security updates are installed within 7 days of release. Which configuration should you use?

Accepted Answer

Set a deadline for quality updates to 7 days. To ensure critical security updates are installed within 7 days of release, set a deadline for quality updates to 7 days. A deadline specifies the maximum number of days after the update is offered that the device has to install it. This enforces installation within the desired timeframe. A deferral period delays when the update is offered, which would not guarantee installation within 7 days.

Answer

Create a feature update policy for Windows 10

Answer

Configure a deferral period of 7 days for quality updates

Answer

Pause quality updates for 7 days

Question 7

Refer to the exhibit. You configure this Enrollment Status Page (ESP) policy for Windows Autopilot deployments. During a deployment, a device fails to install a required app. What happens?

Accepted Answer

The device will be blocked from use until the app is installed or the device is reset.. The Enrollment Status Page (ESP) policy in Windows Autopilot can be configured to block device use until all required apps are installed. When a required app fails to install, the ESP enters a blocking state, preventing the user from accessing the desktop until the installation succeeds or the device is reset. This behavior is controlled by the 'Block device use until required apps are installed' setting in the ESP profile.

Answer

The user can retry the installation manually.

Answer

The timeout will extend by 60 minutes.

Answer

The device will automatically retry the installation.

Question 8

You need to remotely wipe a lost corporate-owned iOS device that is managed by Intune. Which action should you use?

Accepted Answer

Wipe. The 'Wipe' action in Microsoft Intune performs a factory reset on a corporate-owned iOS device, removing all data and settings to protect sensitive information. This is the appropriate action for a lost device because it restores the device to its out-of-box state, ensuring no corporate data remains accessible.

Answer

Reset

Answer

Delete

Answer

Retire

Question 9

You manage Windows 10 devices with Microsoft Intune. A user reports that their device is not receiving required compliance policies, and the device status in Intune shows 'Not evaluated' for compliance. You confirm the device is enrolled and able to sync. What should you check first?

Accepted Answer

Ensure the compliance policy is assigned to a group that includes the user or device.. A compliance policy must be assigned to a group containing the user or device for it to be evaluated. Even if the device is enrolled and syncing, without assignment the policy will not apply, resulting in a 'Not evaluated' status in Intune.

Answer

Verify that the user is assigned an Intune license.

Answer

Run the 'dsregcmd /status' command to check the device registration status.

Answer

Check that the device has a TPM chip enabled and Secure Boot turned on.

Question 10

Which TWO actions can you perform in Microsoft Intune to remediate a noncompliant Windows device that has been marked as noncompliant due to missing antivirus? (Choose two.)

Accepted Answer

Deploy a proactive remediation script to detect and install antivirus.. Option B is correct because proactive remediations in Intune pair a detection script with a remediation script that runs on the device, so you can detect missing antivirus and automatically install it to bring the device back into compliance. Option D is correct because running a PowerShell script from Intune (via a platform script or device script) lets you execute installation commands for the missing antivirus directly on the Windows device. Option A is not a remediation action; a sync only forces the device to check in and re-evaluate policy/compliance, which does not install antivirus. Option C merely notifies the user and relies on manual action, so it does not remediate the device automatically. Option E is a Conditional Access policy that blocks access rather than fixing the noncompliance, so it is not a remediation action.

Answer

Send a sync command to the device to re-evaluate compliance.

Answer

Send a notification to the user to install antivirus via Windows Security.

Answer

Create a Conditional Access policy to block the device until fixed.

Question 11

You need to deploy Microsoft 365 Apps to 1000 devices using Microsoft Intune. The devices are a mix of Windows 10 and Windows 11. Which app deployment method should you use to ensure the latest version is always installed?

Accepted Answer

Deploy Microsoft 365 Apps for enterprise as a built-in app type in Intune.. The Microsoft 365 Apps for enterprise built-in app type in Intune is specifically designed to deploy and manage Office with automatic updates from the Office Content Delivery Network (CDN). This method ensures that devices always receive the latest version of Microsoft 365 Apps without requiring manual intervention or custom configuration, as Intune handles the deployment policy and update channel settings natively.

Answer

Deploy a line-of-business app from the installation file.

Answer

Deploy a Win32 app with the Office Deployment Tool.

Answer

Deploy a custom script that installs Office from a network share.

Question 12

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Accepted Answer

The device has not checked in with the Intune service recently.. When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Answer

The device is marked as non-compliant.

Answer

The device does not have a valid device certificate.

Answer

The device enrollment profile has expired.

Question 13

You are a Microsoft 365 Endpoint Administrator for a mid-sized company with 5,000 Windows 10 devices. The company is planning to migrate to Windows 11. You are tasked with deploying Windows 11 using a phased approach with Windows Autopilot. You have configured an Autopilot deployment profile for self-deploying mode targeting all Windows 10 devices in a dynamic device group. However, during the first wave of deployment, you notice that devices that have been upgraded to Windows 11 via an in-place upgrade are not automatically transitioning to the Autopilot experience. Instead, they boot directly to the existing Windows 10 desktop without any Autopilot enrollment. You verify that the devices are registered in Autopilot and that the deployment profile is assigned correctly. What is the most likely cause of this issue?

Accepted Answer

The devices have not been reset to OOBE state after the in-place upgrade. Windows Autopilot requires the device to be in an Out-of-Box Experience (OOBE) state to trigger the enrollment process. An in-place upgrade to Windows 11 preserves the existing user state and settings, so the device boots directly to the desktop without entering OOBE. Even though the device is registered in Autopilot and the profile is assigned, the Autopilot experience only initiates when the device is reset to OOBE (e.g., via a Windows reset or a fresh start). Therefore, the most likely cause is that the devices have not been reset to OOBE state after the in-place upgrade.

Answer

The Autopilot profile has a pre-provisioning policy that blocks self-deploying mode

Answer

The Autopilot profile is configured for user-driven mode instead of self-deploying mode

Answer

The devices are not connected to the internet during the first boot after upgrade

Question 14

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not connected to the cloud service.. The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Answer

The device is not compliant with Intune compliance policies.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device does not have Microsoft Defender Antivirus enabled.

Question 15

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

Accepted Answer

The device's group membership is still being processed, so policies are not yet applied.. When a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet. The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Answer

The OMA-URI setting is invalid.

Answer

The device is not enrolled.

Answer

The device is not compliant.