MD-102 Practice Test 3 — 10 Questions

Question 1

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.

Question 2

A company uses Microsoft Intune to manage Windows 10 devices. They have a compliance policy that requires BitLocker to be enabled. Some devices are marked as non-compliant even though BitLocker appears to be on. The administrator runs 'manage-bde -status' on a non-compliant device and sees that the protection status is 'Protection Off'. What is the most likely cause?

Accepted Answer

The BitLocker key protectors are missing or have been removed.. The compliance policy requires BitLocker to be enabled, but 'manage-bde -status' shows 'Protection Off'. This indicates that while the drive is encrypted, BitLocker is not actively protecting the data because the key protectors (such as the TPM protector) are missing or have been removed. Intune checks the protection status, not just encryption state, so when protectors are absent, the device is marked non-compliant.

Answer

The TPM is not initialized.

Answer

The device has a recovery password protector but no TPM protector.

Answer

The device uses a different encryption method (e.g., XTS-AES 256 vs AES 128).

Question 3

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app that has a complex installation requiring multiple command-line parameters. The app must be available to users in the Company Portal. What is the best way to handle the installation parameters?

Accepted Answer

Use the Intune Win32 app packaging to specify the installation command with parameters.. Intune's Win32 app packaging allows you to specify the full installation command, including complex parameters, directly in the 'Install command' field. This method ensures the installer runs with the exact parameters needed, and the app is then published to the Company Portal for user self-service. PowerShell scripts or detection rules do not handle the installation parameters themselves, and administrative templates are for configuring settings, not installation commands.

Answer

Deploy a PowerShell script via Intune that runs the installer with parameters.

Answer

Configure detection rules to run a script that passes parameters.

Answer

Use an administrative template to set parameters before installing.

Question 4

An administrator deploys a Win32 app via Intune with detection rule 'File exists: C:\Program Files\MyApp\app.exe'. The app is reported as installed, but users cannot launch it. The file exists but is corrupted. How should the administrator modify the detection rule to ensure the app is correctly detected and re-installed if corrupted?

Accepted Answer

Use a custom detection script that validates the file hash or signature. A custom detection script can verify the file's integrity by checking its hash or digital signature, ensuring that even if the file exists, it is not corrupted. Intune's built-in detection rules only check for file existence or version, not file integrity. By using a script that validates the hash, the administrator can force a reinstall when the file is corrupted, as the detection will fail.

Answer

Remove the detection rule so Intune always re-installs the app

Answer

Add a registry detection rule for the app's uninstall key

Answer

Change detection rule to 'File version comparison' and set minimum version

Question 5

Your organization deploys Microsoft Defender for Endpoint (now Microsoft Defender XDR) on Windows 10 devices using Intune. After deployment, some devices show 'Defender service is not running' in the security console. The devices are online and compliant. What is the most likely cause?

Accepted Answer

A third-party antivirus is installed and active.. When a third-party antivirus is installed and active on a Windows 10 device, Windows Defender (now Microsoft Defender Antivirus) automatically disables itself to avoid conflicts. This is by design: the Windows Security Center detects the active third-party AV and sets Defender's service state to stopped or disabled. In the Microsoft Defender for Endpoint console, this appears as 'Defender service is not running' even though the device is online and compliant with Intune policies.

Answer

Tamper protection is enabled and blocking the service.

Answer

The devices are not compliant with the Defender policy.

Answer

Windows Firewall is blocking Defender updates.

Question 6

You need to deploy a Microsoft Store app (e.g., Microsoft Whiteboard) to Windows 10 devices managed by Intune. Which app type should you use?

Accepted Answer

Microsoft Store app (Windows). To deploy a Microsoft Store app like Microsoft Whiteboard to Windows 10 devices managed by Intune, you must use the 'Microsoft Store app (Windows)' app type. This type directly integrates with the Microsoft Store catalog, allowing you to select and deploy store apps without needing offline licensing or manual packaging. It supports both online and offline licensing models, but for a standard store app deployment, this is the correct and simplest choice.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store for Business (offline licensed)

Question 7

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

Accepted Answer

The devices have exceeded the grace period and should be blocked from accessing resources.. The complianceGracePeriodExpirationDateTime represents the deadline by which a device must become compliant after initially being marked noncompliant. When this timestamp is in the past, it means the grace period has expired, and the device should be blocked from accessing corporate resources as per the conditional access policy. This is a standard behavior in Microsoft Intune for managing noncompliant devices.

Answer

The compliance policy has been removed from these devices.

Answer

The devices are still within the grace period and can access resources.

Answer

The devices were recently remediated and are now compliant.

Question 8

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

Accepted Answer

Set the install context to system.. Setting the install context to 'system' runs the Win32 app installer with the SYSTEM account, which has the highest privileges on a Windows device. This ensures the installer can perform actions requiring admin rights, such as writing to Program Files or modifying system registry keys, without user interaction or credential prompts. In Intune, the system context is the only way to silently deploy apps that demand elevated permissions.

Answer

Set the install context to user.

Answer

Assign the app as required for all users.

Answer

Use a line-of-business app type instead.

Question 9

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

Accepted Answer

The policy has not been assigned to the device or its user group.. The most likely reason is that the compliance policy was created but never assigned to the device or its user group. In Microsoft Intune, a compliance policy must be assigned to a security group that contains the device or its user; otherwise, the policy is not evaluated against the device, and the device will default to a compliant status. The PowerShell cmdlet shown only creates the policy object; it does not assign it.

Answer

The BitLocker setting is not supported on Windows 11.

Answer

The policy was not saved correctly due to a syntax error.

Answer

The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

Question 10

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

Accepted Answer

It uses the password type configured in the device's local policy. When the password type is set to 'deviceDefault' in a Microsoft Intune compliance policy for Windows 10, the policy does not enforce a specific password type (e.g., alphanumeric or numeric). Instead, it defers to the password type already configured in the device's local security policy (via Local Group Policy or the SAM registry). This means the device can still be compliant even if the local policy requires only a simple PIN or no complexity, as long as the local password type meets the minimum length and other requirements defined in the compliance policy.

Answer

It requires a password that meets the minimum length but no complexity

Answer

It does not require a password at all

Answer

It requires a password that contains at least one number and one letter