MD-102 Practice Test 2 — 30 Questions

Question 1

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Accepted Answer

Users must have an Intune license assigned.. Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Answer

Devices must be connected via VPN.

Answer

Tenant must have Azure AD Premium P2.

Question 2

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned devices with work profile. Android Enterprise corporate-owned devices with work profile is a valid enrollment method in Microsoft Intune that allows IT to manage a work profile on company-owned devices while keeping the personal space separate. This method uses the Android Enterprise platform to enforce corporate policies without requiring full device management, leveraging the work profile container for security and compliance.

Answer

Android Device Administrator

Answer

Apple Business Manager

Answer

Windows Autopilot

Question 3

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

Accepted Answer

Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.. The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates. Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Answer

Change the update ring policy deadline to 7 days to ensure devices have enough time.

Answer

Create a new feature update policy for KB5001234 and assign it to all devices.

Answer

Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.

Question 4

You are planning the deployment of Windows 11 using Intune. Which TWO components are required to perform an in-place upgrade from Windows 10?

Accepted Answer

A Windows 11 feature update profile in Intune.. To perform an in-place upgrade from Windows 10 to Windows 11 using Intune, you need two core components: a Windows 11 feature update profile in Intune to trigger the upgrade, and hardware that meets Windows 11 system requirements for compatibility. Although the question asks for three components, only two of the listed options are correct. A valid product key is not needed because the digital license carries forward. The Intune Management Extension is not used for feature updates, and Group Policy for Windows Update for Business is not required when using Intune's built-in update management. The third component is not applicable in this context.

Answer

A Group Policy to enable Windows Update for Business.

Answer

A valid Windows 11 product key.

Answer

The Intune Management Extension installed on the device.

Question 5

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

Accepted Answer

.intunewin. The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Answer

.msi

Answer

.appx

Answer

.exe

Question 6

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. The ComplianceState property in Microsoft Intune reflects the compliance status at the time of the last device check-in. If a device has not synced for 7 days, the stored ComplianceState is stale and may no longer represent the actual compliance posture. The device could have become non-compliant since its last sync due to policy changes, missing updates, or configuration drift, but Intune will not update the state until the next successful sync.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

Question 7

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

Accepted Answer

%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Answer

%windir%	emp\MdmEnrollment.log

Answer

%windir%\Panther\setupact.log

Answer

Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

Question 8

A company uses Microsoft Intune to manage macOS devices. They need to deploy a custom plist configuration file to set security settings. Which policy type should they use?

Accepted Answer

Device configuration profile (custom). A custom device configuration profile in Microsoft Intune allows administrators to deploy plist files to macOS devices, enabling the configuration of settings not covered by built-in templates. This is the correct policy type for deploying a custom plist file because it directly supports uploading and assigning property list files to enforce specific security configurations.

Answer

App protection policy

Answer

Device compliance policy

Answer

Device cleanup rule

Question 9

Which TWO of the following are valid remote assistance tools for Windows devices managed by Microsoft Intune? (Choose two.)

Accepted Answer

Quick Assist. Quick Assist is a built-in Windows tool that allows remote assistance connections and is fully supported for managed devices in Microsoft Intune. It uses Remote Desktop Protocol (RDP) for screen sharing and control, and can be deployed and configured via Intune policies, making it a valid remote assistance option.

Answer

Windows Remote Management (WinRM)

Answer

Remote Desktop

Answer

Skype

Question 10

Your organization requires that all corporate laptops be encrypted. You manage Windows 10 devices with Microsoft Intune. Which policy should you configure?

Accepted Answer

Create a BitLocker policy in Intune Endpoint Protection.. Microsoft Intune's Endpoint Protection policy includes a dedicated BitLocker settings section that allows administrators to enforce encryption on Windows 10 devices. This policy centrally manages BitLocker drive encryption, recovery key escrow to Azure AD, and encryption method (e.g., XTS-AES 128-bit), meeting the requirement for corporate laptop encryption.

Answer

Enable Device Encryption in Windows settings.

Answer

Configure a FileVault policy for Windows devices.

Answer

Deploy an Encrypting File System (EFS) policy.

Question 11

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Accepted Answer

Assign to a device group.. Microsoft Intune supports assigning Microsoft 365 Apps for enterprise directly to device groups, which ensures the application is installed on the specified devices regardless of which user signs in. This method is useful for shared or kiosk devices where user-based assignment would not apply. Option E is correct because assigning to a Microsoft Entra ID user group is the standard method for user-based deployment, allowing the apps to be provisioned based on user identity.

Answer

Assign to individual users directly.

Answer

Assign to a distribution group.

Answer

Assign to a dynamic group using device attributes.

Question 12

Your organization is deploying Windows 10 devices using Windows Autopilot. The devices are purchased from a vendor and will be shipped directly to users. You need to ensure that the devices are automatically enrolled in Intune and configured with your organization's standard settings as soon as the user turns on the device and connects to the internet. The devices should be Azure AD joined. What is the minimal configuration required?

Accepted Answer

Upload the device's hardware hash to Microsoft Intune.. The hardware hash must be uploaded to Microsoft Intune for Autopilot to automatically recognize the device, enroll it in Intune, and join it to Azure AD upon first boot. Option A is incorrect because vendors cannot pre-configure Autopilot settings; they should provide the hardware hash. Option B is incorrect because the hardware hash is uploaded to Intune, not Azure AD directly. Option C is incorrect because the user should not manually enroll; Autopilot automates the process.

Answer

Ask the vendor to configure the devices with your organization's settings before shipping.

Answer

Upload the device's hardware hash to Azure AD.

Answer

Instruct the user to manually enroll the device after receiving it.

Question 13

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

Accepted Answer

The device does not have a TPM 2.0 chip.. Windows Autopilot self-deploying mode requires a TPM 2.0 chip to perform hardware-based attestation and automatically enroll the device without user interaction. If the device lacks TPM 2.0, the provisioning process will fail because the required cryptographic keys for attestation cannot be generated, preventing the device from completing the self-deploying profile.

Answer

The device name template is invalid.

Answer

The profile requires a user to sign in during deployment.

Answer

The language settings are not configured.

Question 14

Your organization is planning to deploy Windows 11 to 5000 devices using Microsoft Intune. The devices are currently a mix of Windows 10 and Windows 11 eligible hardware. You need to ensure that only devices meeting the Windows 11 hardware requirements can be upgraded. What is the most efficient way to achieve this using Intune?

Accepted Answer

Create a Windows feature update profile targeting Windows 11 and assign it to all devices; Intune will automatically skip ineligible devices.. A Windows feature update profile in Intune automatically checks device hardware eligibility before applying the Windows 11 upgrade. Intune queries the Windows Update for Business service, which evaluates TPM 2.0, Secure Boot, CPU generation, and RAM requirements; devices that do not meet the minimum hardware requirements are skipped without any manual intervention or additional configuration.

Answer

Use Windows Autopilot to reset each device and manually verify hardware compatibility.

Answer

Create a dynamic device group based on TPM version and assign a Windows 10 update ring to non-compliant devices.

Answer

Create a compliance policy requiring TPM 2.0 and Secure Boot, then assign a Windows 11 update ring to compliant devices.

Question 15

You have a Windows 10 device that is managed by Intune and enrolled in Microsoft Defender for Endpoint. The device is reporting a high number of false positive detections from Microsoft Defender Antivirus. You need to configure an exclusion for a specific folder path to reduce false positives. Where should you configure the exclusion?

Accepted Answer

In the endpoint protection profile for Microsoft Defender Antivirus in Intune. In an Intune-managed environment, antivirus exclusions for Microsoft Defender Antivirus are configured within the endpoint protection profile, specifically under the Microsoft Defender Antivirus settings. This profile is assigned to devices via Intune policies, allowing centralized management of exclusions without requiring on-premises Group Policy or direct interaction with the Microsoft Defender Security Center portal.

Answer

In a device compliance policy

Answer

In Group Policy

Answer

In Microsoft Defender Security Center

Question 16

You deploy a new line-of-business app to Windows 10 devices via Intune. Users report that the app does not appear in the Company Portal. You verify that the app is assigned to the correct group. What is the most likely cause?

Accepted Answer

The app's installation behavior is set to 'System'.. When a line-of-business (LOB) app is deployed with installation behavior set to 'System', it installs in the device context and runs as SYSTEM. The Company Portal only displays apps installed in the user context. Even though the app is assigned to the correct group, it will not appear in the Company Portal because the portal filters out system-context apps. To make it visible, the installation behavior must be set to 'User'.

Answer

The app is not supported on Windows 10.

Answer

Users need to add the app manually.

Answer

The app is assigned to the wrong group.

Question 17

Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant are blocked from accessing corporate resources. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that requires compliant devices.. Conditional Access policies in Azure AD are the correct mechanism to enforce access controls based on device compliance status. By creating a policy that requires devices to be marked as compliant, you ensure that only compliant devices can access corporate resources, while non-compliant devices are blocked at the authentication level. This integrates with Intune compliance policies to evaluate device health before granting access.

Answer

Create a device compliance policy and assign it to users.

Answer

Create a device configuration profile that restricts access.

Answer

Configure enrollment restrictions to block non-compliant devices.

Question 18

You need to deploy Microsoft 365 Apps to 1000 devices using Microsoft Intune. The devices are a mix of Windows 10 and Windows 11. Which app deployment method should you use to ensure the latest version is always installed?

Accepted Answer

Deploy Microsoft 365 Apps for enterprise as a built-in app type in Intune.. The Microsoft 365 Apps for enterprise built-in app type in Intune is specifically designed to deploy and manage Office with automatic updates from the Office Content Delivery Network (CDN). This method ensures that devices always receive the latest version of Microsoft 365 Apps without requiring manual intervention or custom configuration, as Intune handles the deployment policy and update channel settings natively.

Answer

Deploy a line-of-business app from the installation file.

Answer

Deploy a Win32 app with the Office Deployment Tool.

Answer

Deploy a custom script that installs Office from a network share.

Question 19

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

Accepted Answer

Device compliance policies.. A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.

Answer

No additional configuration is needed.

Answer

Device configuration policies.

Answer

App protection policies.

Question 20

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

Accepted Answer

The devices have TPM version 1.2 instead of 2.0.. The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Answer

The devices are not joined to Microsoft Entra ID.

Answer

The BitLocker policy is configured only for Windows 11 Enterprise devices.

Answer

The devices are running Windows 10 instead of Windows 11.