MD-102 Practice Test 30 — 15 Questions

Question 1

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

Accepted Answer

PowerShell scripts (Devices > Scripts). PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Answer

Proactive remediations

Answer

Compliance policy

Answer

Device configuration profile

Question 2

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

Accepted Answer

Enable the TPM in the device's BIOS settings.. The device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Answer

Replace the device's motherboard.

Answer

Assign a grace period for the device.

Answer

Remove the tpmRequired setting from the compliance policy.

Question 3

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 4

Your organization uses Microsoft Defender for Endpoint (Defender XDR) to manage endpoint security. You need to ensure that all Windows devices report their security baselines compliance to Intune. Which configuration should you verify?

Accepted Answer

Security baselines are configured and assigned in Intune endpoint security. Intune security baselines are the mechanism that defines and enforces security configuration policies on Windows devices. To report compliance with those baselines, the baselines must first be configured and assigned to the devices via Intune endpoint security. Without this assignment, devices have no baseline to compare against, and compliance reporting will not occur.

Answer

Devices are onboarded to Defender for Endpoint

Answer

Group Policy objects are linked to the domain

Answer

Devices are registered in Microsoft 365 Defender portal

Question 5

You need to deploy Windows 10 Enterprise to 100 new computers using Microsoft Intune. The computers are not yet joined to Microsoft Entra ID. What is the recommended method?

Accepted Answer

Register the devices in Windows Autopilot and deploy an Autopilot profile.. Windows Autopilot is the recommended method for deploying Windows 10 Enterprise to new devices that are not yet joined to Microsoft Entra ID because it automates the entire provisioning process—from joining Entra ID to enrolling in Intune—without requiring any manual intervention or imaging. By registering the devices in Autopilot and deploying an Autopilot profile, the out-of-box experience (OOBE) is customized to join Entra ID and enroll in Intune automatically, ensuring a zero-touch deployment that aligns with modern management best practices.

Answer

Join each device to Entra ID manually and then enroll in Intune.

Answer

Create a provisioning package using Windows Configuration Designer and deploy via USB.

Answer

Use a Configuration Manager task sequence to deploy the OS.

Question 6

Your organization manages Windows devices with Intune and uses Azure Information Protection (AIP) to classify documents. You are deploying the AIP client as a Win32 app. After deployment, some users report that the AIP add-in is not visible in Office applications. What should you check first?

Accepted Answer

Ensure that the required .NET Framework and Visual Studio Tools for Office runtime are installed.. The AIP client (Azure Information Protection unified labeling client) requires the .NET Framework and Visual Studio Tools for Office (VSTO) runtime to integrate with Office applications. If these prerequisites are missing, the AIP add-in will not load in Office, even if the client is installed. Therefore, checking for these dependencies is the first troubleshooting step.

Answer

Confirm that Office is updated to the latest version.

Answer

Verify that the user has local administrator rights.

Answer

Check if the device has internet access to activate the client.

Question 7

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

Accepted Answer

A device compliance policy with a required passcode length of 6.. A device compliance policy in Microsoft Intune evaluates whether devices meet specific security requirements, such as a minimum passcode length. By creating a compliance policy with a required passcode length of 6, Intune marks any iOS device with a shorter passcode as noncompliant. This noncompliant status can then be used by a conditional access policy to block access to corporate email, achieving the stated goal.

Answer

A device configuration profile with a passcode payload.

Answer

An app protection policy for Microsoft Outlook.

Answer

A conditional access policy requiring compliant devices.

Question 8

Your organization uses Microsoft Intune to manage corporate-owned iOS devices. You need to ensure that devices are supervised and can be configured with restrictions that cannot be removed by the user. Which THREE steps must you take?

Accepted Answer

Add devices to Apple Business Manager (ABM).. Supervision on iOS requires the device to be owned and enrolled through Apple's corporate enrollment channel, so option A is correct: the devices must be added to Apple Business Manager (ABM) so Apple recognizes them as organization-owned and eligible for supervised enrollment. Option B is correct because automated device enrollment (formerly DEP) must be configured in ABM and linked to Intune via an MDM server token, which is the mechanism that pushes the devices into Intune as supervised during Setup Assistant. Option C is correct because the Intune iOS enrollment profile used for these devices must have the 'Supervised' setting enabled; this profile is what actually applies supervision and allows restrictions that users cannot remove. Option D is not required because user assignment (or user affinity) is optional for automated device enrollment and does not create supervision. Option E is incorrect because a compliance policy only evaluates and reports device state; it cannot enable or grant supervision.

Answer

Assign a user to each device during enrollment.

Answer

Create a device compliance policy that requires supervision.

Question 9

An organization is deploying Windows 10 using Configuration Manager task sequences. During a pilot deployment, the task sequence fails with error code 0x80070002. What is the most likely cause?

Accepted Answer

The boot image is missing or corrupted. Error code 0x80070002 translates to 'The system cannot find the file specified.' In the context of a Configuration Manager task sequence, this typically indicates that the boot image (WIM file) referenced by the task sequence is missing from the distribution point or is corrupted. The boot image is required to start Windows PE and initiate the OS deployment; if it cannot be located or loaded, the task sequence fails immediately.

Answer

The device does not meet minimum hardware requirements

Answer

The task sequence includes a duplicate step

Answer

The distribution point is unreachable

Question 10

Refer to the exhibit. An administrator retrieves a list of Win32 apps. They notice that one app shows installExperience as 'system' and detectionRules as 'fileVersion' with version '1.0.0'. The app fails to install on some devices. The event viewer on a failing device shows 'The app was installed but detection rule did not match'. What is the most likely cause?

Accepted Answer

The detection rule expects version 1.0.0 but the installed version is different. The detection rule is configured to check for file version '1.0.0', but the installed version on the failing device does not match this value. When Intune deploys a Win32 app, it uses the detection rule to verify successful installation; if the rule does not match, the app is marked as failed even though the installation itself completed. This mismatch is the most likely cause of the event viewer message.

Answer

The PowerShell cmdlet is deprecated

Answer

The installExperience should be 'user' instead of 'system'

Answer

The app requires a reboot that is not handled

Question 11

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

Accepted Answer

Ensure the password includes characters from at least 3 character sets.. PasswordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers. Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Answer

Increase passwordMinimumLength to 10.

Answer

Set passwordExpirationDays to 0 to never expire.

Answer

Set passwordRequiredType to 'alphanumeric' (it is already set).

Question 12

A company uses Microsoft Intune to manage Windows 11 devices. Users report that the Company Portal app is not showing required applications. You verify that the devices show as 'Compliant' in Microsoft Intune. Which configuration should you check first?

Accepted Answer

Check the application assignments in Intune.. The most common reason required applications are not visible in Company Portal is that the applications have not been assigned to the user or device group. Even if a device is compliant, Intune will only display applications that are assigned with an 'Available' intent to the user or device. Checking application assignments first directly addresses the symptom without assuming other configurations are misconfigured.

Answer

Check the Microsoft Entra ID (Azure AD) configuration for the device.

Answer

Check the Windows Update for Business ring assignments.

Answer

Check the device compliance policy settings.

Question 13

A hospital uses Intune to manage Windows 10 devices used by doctors. The devices should automatically install critical updates from Windows Update for Business. Which type of policy should the administrator create?

Accepted Answer

Update rings for Windows 10. Update rings for Windows 10 are the correct policy type in Intune to manage when and how Windows 10 devices receive updates from Windows Update for Business. This policy allows you to configure deferral periods, pause updates, and set the update behavior (e.g., automatic installation of critical updates) without requiring on-premises WSUS or manual approval.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (Update settings)

Question 14

A company uses Microsoft Intune to manage iOS devices. The administrator configures a device compliance policy that requires a minimum OS version of 15.0. Users report that devices running iOS 14.8 are marked non-compliant even after updating to iOS 15.0. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune after the update. The most likely cause is that the device has not checked in with Intune after the update. Intune relies on periodic check-ins to evaluate compliance; if the device updated to iOS 15.0 but hasn't completed a check-in, Intune still sees the last reported OS version (14.8) and marks it non-compliant. A forced sync or waiting for the next scheduled check-in resolves this.

Answer

The compliance policy requires a grace period

Answer

The update was not applied successfully

Answer

The compliance policy is not assigned to the correct user group

Question 15

You are reviewing an Intune endpoint protection profile for Windows 10. The exhibit shows a JSON snippet of the configuration. A user reports that a device detected malware with moderate severity, but the action taken was 'quarantine'. However, the desired action is 'clean'. Which setting should you modify?

Accepted Answer

defenderDetectedMalwareActions for moderateSeverity. The `defenderDetectedMalwareActions` setting in Intune endpoint protection profiles allows you to specify the remediation action for each threat severity level, including moderate. Since the user wants 'clean' instead of 'quarantine' for moderate severity threats, you must modify the `moderateSeverity` value within this setting. This is the only setting that controls per-severity remediation actions for Microsoft Defender Antivirus.

Answer

defenderScheduleScanDay and defenderScheduleScanTime

Answer

A global setting to override all actions

Answer

defenderScanType