MD-102 Practice Test 30 — 15 Questions

Question 1

You are deploying a managed Google Play app to Android Enterprise fully managed devices. The app is not appearing in the work profile. What is the most likely reason?

Accepted Answer

The app is not approved in Managed Google Play. The most likely reason the app is not appearing is that it has not been approved in Managed Google Play. For Android Enterprise fully managed devices, apps must be approved in the Managed Google Play console before they can be deployed via Intune. Option B is incorrect because the work profile is not relevant for fully managed devices; they are corporate-owned and do not use work profiles. Option C is incorrect because the device must be enrolled in Intune, but if it is enrolled and the app is missing, lack of enrollment is not the most likely reason. Option D is incorrect because fully managed devices are associated with a managed Google account via the enrollment token, not a personal Google account.

Answer

The work profile is not enabled

Answer

The device is not enrolled in Intune

Answer

The device is not associated with a Google account

Question 2

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data is separated from personal data on the device. Which management approach should you use?

Accepted Answer

Android Enterprise work profile. Android Enterprise work profile creates a separate container for corporate data, keeping it isolated from personal data on the same device. Android Enterprise fully managed devices are for corporate-owned devices and do not have a personal space. Android Enterprise kiosk mode locks the device to a single app or set of apps, not designed for data separation. Android device administrator is a legacy management method that does not provide data separation.

Answer

Android Enterprise kiosk mode

Answer

Android Enterprise fully managed

Answer

Android device administrator

Question 3

You are reviewing the Intune Win32 app configuration for FinanceApp. The app fails to install on a Windows 10 device running version 1809. The installation log shows no errors. What is the most likely reason?

Accepted Answer

The detection rule finds the finance.exe file already exists.. The app fails to install because the detection rule is configured to check for the existence of finance.exe. Since the file already exists on the device from a previous installation, Intune's detection logic determines the app is already installed and does not run the installation again. No errors appear because the installation process is never initiated. Option B is incorrect because the device runs Windows 10 version 1809, which meets the minimum release requirement (10.0.16299). Option C is incorrect because the install experience can be set to system regardless of enrollment type. Option D is incorrect because the install command line includes the silent switch as required.

Answer

The device does not meet the minimum Windows release requirement.

Answer

The install experience is set to system but the device is user enrolled.

Answer

The install command line is missing a silent switch.

Question 4

Which TWO are valid methods to enroll iOS/iPadOS devices into Microsoft Intune?

Accepted Answer

Automated Device Enrollment (ADE). Options B and C are correct. Automated Device Enrollment (ADE) is the modern, automated method for enrolling corporate-owned iOS/iPadOS devices, while Company Portal enrollment allows users to enroll their personally owned devices. Option A is incorrect because Apple Configurator 2 is a tool for manually preparing devices, not a primary enrollment method. Option D is incorrect because Windows Autopilot is for Windows devices, not iOS/iPadOS. Option E is incorrect because Android Zero Touch enrollment is for Android devices.

Answer

Apple Configurator 2

Answer

Windows Autopilot

Answer

Android Zero Touch enrollment

Question 5

Refer to the exhibit. You are deploying a line-of-business iOS app. Which statement is correct about this app?

Accepted Answer

The app will expire on December 31, 2025.. The exhibit shows the app's expiration date is set to December 31, 2025, under the 'Expiration date' field. In Microsoft Intune, when you configure a line-of-business (LOB) iOS app, you can specify an expiration date; after that date, the app will be blocked from installation or launch. Therefore, option C is correct because the app will expire on that date.

Answer

The app requires iOS 15.0 or later.

Answer

The app can only be installed on iPads.

Answer

The app has no expiration date.

Question 6

Your company is deploying iOS devices using Apple Business Manager and Intune. You need to ensure that devices are automatically configured with Wi-Fi settings, email profiles, and a list of required apps during the initial setup. Which THREE configurations should you create in Intune?

Accepted Answer

A device configuration profile for Wi-Fi settings.. Options A, D, and E are correct. Device configuration profiles (A) can deploy Wi-Fi settings to iOS devices. Device configuration profiles (D) can also deploy email settings. An iOS app configuration policy (E) can be used to require specific apps during enrollment. Option B is incorrect because Windows Configuration Designer provisioning packages are for Windows devices, not iOS. Option C is incorrect because a device compliance policy is for compliance checking, not initial configuration.

Answer

A Windows configuration designer provisioning package.

Answer

A device compliance policy for iOS.

Question 7

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to configure a Windows Autopilot deployment for new devices that are shipped directly to users. The devices must be automatically enrolled in Intune and configured with your organization's standard settings. What is the minimum requirement for the device to be recognized by Windows Autopilot?

Accepted Answer

The device must have its hardware hash uploaded to Microsoft Intune.. The minimum requirement for a device to be recognized by Windows Autopilot is that its hardware hash must be uploaded to Microsoft Intune. This hash uniquely identifies the device and allows Autopilot to associate it with the correct deployment profile during the out-of-box experience. Option A is incorrect because while some Autopilot features may require Microsoft Entra ID Premium P2, it is not a minimum requirement for device recognition. Option C is incorrect because the device does not need to be Azure AD registered before shipping; registration occurs during the Autopilot process. Option D is incorrect because joining on-premises Active Directory is not required; Autopilot devices are typically Azure AD joined.

Answer

The device must have a Microsoft Entra ID Premium P2 license assigned.

Answer

The device must be Azure AD registered before shipping.

Answer

The device must be joined to on-premises Active Directory first.

Question 8

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Accepted Answer

An on-premises Active Directory environment.. Options A and B are correct. Group Policy enrollment into Intune requires an on-premises Active Directory environment (A) to target devices via Group Policy, and a Group Policy object (B) configured with the MDM enrollment settings to enable automatic enrollment. Option C is incorrect because an Intune subscription is necessary but not a prerequisite specific to Group Policy enrollment—it is a general requirement. Option D is incorrect because Azure AD Connect is needed for hybrid identity, but Group Policy enrollment works with on-premises AD only. Option E is incorrect because hybrid Azure AD join is not required for Group Policy enrollment; devices can be on-premises joined and still enroll.

Answer

A Microsoft Intune subscription must be active.

Answer

Azure AD Connect must be configured.

Answer

Devices must be Azure AD hybrid joined.

Question 9

You are planning device management for a corporate environment with Windows 10, iOS, and Android devices. You need to implement a solution that allows users to access corporate email and documents securely on their personal devices without IT managing the entire device. Which THREE components should you include?

Accepted Answer

Azure AD application proxy for on-premises apps. Options A, C, and D are correct. Microsoft Intune app protection policies (MAM) protect corporate data at the application level without requiring full device management, allowing personal devices to remain unenrolled. Azure AD Conditional Access policies enforce access controls based on user, location, and app risk, ensuring only authorized users can access corporate resources. Azure AD Application Proxy provides secure remote access to on-premises web applications, such as corporate email and intranet sites, without a VPN. Option B (Device enrollment into Intune) is not required because the goal is to avoid managing the entire device; MAM provides app-level protection instead. Option E (Device compliance policies) is also not needed as they apply to managed devices, which are not used in this scenario.

Answer

Device enrollment into Intune

Answer

Device compliance policies

Question 10

You are troubleshooting an issue where Windows 10 devices are not receiving policies from Microsoft Intune. The devices are enrolled and show as 'active' in the console. Which THREE steps should you take to diagnose the problem?

Accepted Answer

Verify the last sync time in Intune console.. Options A, D, and E are correct. Verifying the last sync time (A) helps determine if the device has checked in recently and whether policies should have been applied. Re-enrolling the device (D) can resolve enrollment or communication issues by forcing a fresh registration and policy download. Collecting MDM diagnostic logs (E) provides detailed error information from the device side. Option B is unnecessary because the device is already enrolled and active; re-registering in Azure AD would not address policy delivery issues. Option C is not a standard troubleshooting step for Intune policy problems, as Intune uses HTTPS (port 443) which is typically allowed by default firewalls.

Answer

Re-register the device in Azure AD.

Answer

Check the device's local firewall rules for Intune ports.

Question 11

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

Accepted Answer

Shared iPad enrollment using Apple Business Manager and Intune.. Shared iPad enrollment using Apple Business Manager and Intune is the correct method because it enables multiple users to sign in with Managed Apple IDs on a single device, keeping their apps and data separate. This meets the requirement of providing each student access to their own apps and data on shared iPads. Option B (Automated Device Enrollment with user affinity) assigns the device to a single user and is not suitable for shared use. Option C (User Enrollment) is intended for personally owned devices (BYOD), not organization-owned shared devices. Option D (Device Enrollment without user affinity) allows shared use but does not provide per-user data separation unless combined with Shared iPad mode, which is specifically option A.

Answer

Automated Device Enrollment with user affinity.

Answer

User Enrollment

Answer

Device Enrollment (DEP) without user affinity.

Question 12

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

Accepted Answer

The devices must be registered in Microsoft Intune via the hardware vendor or manually.. Autopilot requires the device to be registered in Microsoft Intune (or Entra ID) before it can be automatically enrolled. Option B is incorrect because a hybrid Azure AD join is not a prerequisite for Autopilot enrollment; it is an optional configuration. Option C is incorrect because BitLocker does not need to be enabled before shipment; it can be configured later via policy. Option D is incorrect because a local administrator account is not required; Autopilot can create accounts during deployment.

Answer

The organization must have a hybrid Azure AD join configuration in place.

Answer

BitLocker must be enabled on the devices before they are shipped.

Answer

A local administrator account must be created on each device prior to deployment.

Question 13

Refer to the exhibit. You run the PowerShell cmdlet shown and get the output. You need to investigate why Laptop-02 is non-compliant. Which additional cmdlet should you run to get the non-compliance reasons?

Accepted Answer

Get-MgDeviceManagementManagedDeviceCompliancePolicyState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc. Get-MgDeviceManagementManagedDeviceCompliancePolicyState retrieves the compliance policy state for a specific managed device, including the non-compliance reasons. This cmdlet returns compliance policy state details per device, which allows you to investigate why Laptop-02 is non-compliant. Option B is incorrect because Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary provides a summary of settings across devices, not per-device reasons. Option C is incorrect because Get-MgDeviceManagementManagedDeviceConfigurationState retrieves device configuration state, not compliance policy state. Option D is incorrect because Get-MgDeviceManagementDeviceConfigurationState retrieves device configuration state, not compliance reasons.

Answer

Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -DeviceCompliancePolicyId <id>

Answer

Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Answer

Get-MgDeviceManagementDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

Question 14

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy an app that requires a VPN configuration when the app is launched. Which TWO options can you use to achieve this? (Choose two.)

Accepted Answer

Use a managed app configuration to include VPN settings.. Options A and E are correct. A per-app VPN configuration profile (E) can be assigned to the app to trigger VPN on launch. Alternatively, a managed app configuration (A) can include VPN settings to enable per-app VPN. Option B is incorrect because a device compliance policy cannot configure VPN settings. Option C is incorrect because app protection policies do not manage VPN connectivity. Option D is incorrect because a device-wide VPN profile applies to all traffic and does not restrict to specific apps.

Answer

Use a device compliance policy to require VPN.

Answer

Assign an app protection policy that enables VPN.

Answer

Create a device-wide VPN configuration profile.

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that all devices have Windows Defender Antivirus enabled and up to date. You create a security baseline that includes antivirus settings and assign it to all devices. After a week, you find that some devices still have outdated antivirus definitions. What should you check first?

Accepted Answer

Ensure that Windows Update for Business is configured to update definitions.. The security baseline assigns configuration settings, but it does not automatically trigger definition updates. Windows Defender Antivirus definitions are updated via Windows Update, so Windows Update for Business must be configured to deliver those updates. Without this, devices may have the correct baseline policies but still run outdated definitions.

Answer

Verify that the security baseline is assigned to the devices.

Answer

Check the device compliance status.

Answer

Review the device's network firewall settings.