MD-102 Practice Test 2 — 30 Questions

Question 1

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

Accepted Answer

Add a shell script under Devices > Scripts. In Microsoft Intune, shell scripts for macOS are managed under Devices > Scripts, where you can add a script with a specific shell (e.g., bash, sh, zsh) and configure its execution frequency, run context, and notifications. This is the correct method because Intune natively supports deploying and running shell scripts on macOS devices via the Intune management agent, without requiring additional infrastructure.

Answer

Use Company Portal to distribute the script

Answer

Add a PowerShell script under Devices > Scripts

Answer

Create a custom configuration profile with Bash script

Question 2

Your organization, Fabrikam, uses Microsoft Intune to manage iOS/iPadOS and Android devices. You need to implement a solution that ensures company email can only be accessed from the Outlook mobile app, and that data from the Outlook app cannot be copied to personal apps. You also need to ensure that when a user leaves the company, the corporate data in Outlook is removed without affecting personal data. You plan to use app protection policies (MAM). The devices are not enrolled in Intune (unmanaged). You configure the app protection policies for Outlook on iOS and Android. However, users report that they can still copy email content to personal apps. What should you check?

Accepted Answer

Verify that the 'Cut, copy, and paste' setting in the app protection policy is set to 'No' or 'Policy managed apps'.. The 'Cut, copy, and paste' setting in the app protection policy controls data transfer between apps. To prevent copying email content to personal apps, this setting must be set to 'No' or 'Policy managed apps'. Option A is incorrect because device enrollment is not required for MAM policies on unmanaged devices. Option B is incorrect because device compliance policies are not applicable without enrollment. Option D is incorrect because Outlook is already a managed app; the issue is the policy setting.

Answer

Ensure that the devices are enrolled in Intune.

Answer

Check that the device compliance policy is assigned.

Answer

Confirm that the Outlook app is a managed app in Intune.

Question 3

Your company uses Microsoft Defender for Endpoint (Defender XDR). You need to configure an automated investigation and remediation (AIR) rule that automatically quarantines a file when a specific alert is triggered. Which action should you take?

Accepted Answer

Create a new automation rule in the Microsoft 365 Defender portal.. Automated investigation and remediation (AIR) rules in Microsoft 365 Defender allow you to define automated actions—such as quarantining a file—when a specific alert is triggered. This is the native mechanism for orchestrating response actions based on alert conditions, directly supporting the requirement to automatically quarantine a file upon alert generation.

Answer

Add an indicator of compromise for the file.

Answer

Configure a device control policy.

Answer

Create an attack surface reduction rule.

Question 4

Which THREE of the following are required to deploy a Win32 app using Microsoft Intune?

Accepted Answer

Detection rule. To deploy a Win32 app in Microsoft Intune, a detection rule (B) is mandatory because Intune must determine whether the app is already installed on the device, using methods such as MSI product code, file/folder existence, or a custom script. Return codes for success (C) are also required so Intune can interpret the exit code returned by the installer and correctly report the installation as succeeded, failed, or requiring a restart (e.g., 0 for success, 3010 for soft reboot). The installation command (E) is essential because Intune needs the exact command line (for example, msiexec /i "app.msi" /qn or setup.exe /silent) to actually install the Win32 app on the target device. Product code (A) is not universally required, since it is only one possible detection method and can be replaced by file, folder, or script-based detection. Dependencies (D) are optional, as they are only needed when the app requires other apps to be installed first, and are not mandatory for every Win32 app deployment.

Answer

Product code

Answer

Dependencies

Question 5

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

Accepted Answer

Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.. Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Microsoft Entra ID group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Answer

Include the settings in the Windows 365 provisioning policy.

Answer

Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

Answer

Use a Group Policy Object (GPO) applied via on-premises AD.

Question 6

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

Accepted Answer

Windows 10 and later update ring. The Windows 10 and later update ring policy in Intune is specifically designed to configure Windows Update for Business settings, including deferral periods for feature and quality updates. By setting the 'Feature update deferral period (days)' to 60 and 'Quality update deferral period (days)' to 14, you directly control how long updates are postponed after they are released by Microsoft. This policy applies to devices managed via Intune and leverages the Windows Update for Business service to enforce these deferrals.

Answer

Windows compliance policy

Answer

Windows feature update policy

Answer

Windows driver update policy

Question 7

Match each Microsoft 365 compliance feature to its description.

Accepted Answer

Data Loss Prevention: Helps prevent accidental sharing of sensitive information.. Compliance features are part of the Microsoft 365 security and compliance center, relevant for endpoint administrators.

Answer

Data Loss Prevention: Allows legal teams to search for content across Microsoft 365.

Answer

Sensitivity Labels: Defines how long content is kept and when it is deleted.

Question 8

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Accepted Answer

Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.. Option A is correct because Intune policies are assigned to Microsoft Entra ID groups, so if the device (or its user) is not a member of the group targeted by the security policy, the policy will never be delivered and the device will remain non-compliant. Option D is correct because Intune is a cloud-based MDM service; the device must have an active internet connection and be able to reach Intune endpoints (e.g., *.manage.microsoft.com over TCP 443) for policy sync, check-in, and compliance evaluation to occur. Option B is not relevant because Microsoft 365 licensing affects access to services like Exchange and Office, not Intune policy delivery or compliance state. Option C is not appropriate because resetting enrollment state via the Company Portal is a drastic remediation that removes management and would not fix a group-targeting or connectivity issue. Option E is incorrect because gpupdate /force applies on-premises Active Directory Group Policy, not Intune MDM policies, and Invoke-Command targets PowerShell remoting rather than Intune policy sync.

Answer

Reissue the user's Microsoft 365 license from the admin center.

Answer

Reset the device's enrollment state via the Company Portal.

Answer

Run Invoke-Command to remotely execute gpupdate /force.

Question 9

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

Accepted Answer

The user does not have local administrator privileges on the device. Error code 0x80070005 translates to 'Access Denied' (E_ACCESSDENIED). Microsoft 365 Apps for enterprise installation requires local administrator privileges to write to protected system paths (e.g., Program Files, registry). Since the device is Microsoft Entra ID joined and compliant, the most likely cause is that the user lacks local admin rights, which is a common Intune deployment prerequisite.

Answer

The device has insufficient disk space

Answer

The device does not have internet connectivity to the Microsoft CDN

Answer

The device is not compliant with the conditional access policy

Question 10

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Accepted Answer

Open GPMC, then edit GPO, then navigate to exclusions, then configure exclusions, then force GP update.. The correct order to configure Windows Defender Antivirus exclusions via Group Policy is to first open the Group Policy Management Console (GPMC), edit the desired Group Policy Object (GPO), navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Exclusions, configure the specific exclusions (e.g., file, folder, or process exclusions), and then force a Group Policy update using gpupdate /force to apply the changes immediately. This sequence ensures that the policy settings are properly accessed and applied, preventing common errors like applying an empty configuration or navigating to a non-edited GPO.

Answer

Open GPMC, then navigate to exclusions, then edit GPO, then configure exclusions, then force GP update.

Answer

Open GPMC, then edit GPO, then configure exclusions, then navigate to exclusions, then force GP update.

Answer

Open GPMC, then edit GPO, then force GP update, then navigate to exclusions, then configure exclusions.

Question 11

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

Accepted Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.. The scenario requires a user-driven deployment where the user signs in with Microsoft Entra ID credentials during OOBE, and the device is automatically enrolled in Intune. Setting 'Deployment mode' to 'User-Driven' ensures the user authenticates during OOBE, and 'Join to Microsoft Entra ID as' to 'Microsoft Entra ID joined' makes the device Microsoft Entra ID-joined, which triggers automatic Intune enrollment via the MDM enrollment authority configured in Microsoft Entra ID.

Answer

Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.

Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.

Answer

Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.

Question 12

Match each Microsoft 365 Defender feature to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides endpoint detection and response (EDR) and antivirus across devices. The correct matches are: Microsoft Defender for Endpoint (endpoint protection), Microsoft Defender for Office 365 (email/collaboration protection), Microsoft Defender for Identity (on-premises threat detection via AD), and Microsoft Defender for Cloud Apps (SaaS security via CASB). The distractors swap the definitions of Endpoint and Office 365.

Answer

Microsoft Defender for Endpoint: Protects email and collaboration tools

Answer

Microsoft Defender for Office 365: Provides endpoint detection and response

Question 13

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

Accepted Answer

Device configuration profile for Windows Update for Business. Windows Update for Business (WUfB) policies are configured using a device configuration profile in Microsoft Intune, specifically under the 'Windows Update for Business' template. This profile type allows you to manage update settings such as deferral periods, pause updates, and feature update targeting directly from Intune without requiring on-premises WSUS or additional infrastructure.

Answer

App protection policy

Answer

Device compliance policy

Answer

Endpoint security policy for antivirus

Question 14

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a user reports a lost device, you can remotely lock it and display a custom message on the lock screen. The solution must not erase any data. What should you do?

Accepted Answer

Use the Remote lock action and configure a custom lock screen message.. To remotely lock a lost Windows device and display a custom message without erasing data, use the Remote lock action in Intune. Additionally, configure a custom lock screen message through a device configuration profile. This secures the device and provides contact information, all without data loss.

Answer

Use the Fresh Start action.

Answer

Perform a full wipe.

Answer

Perform a selective wipe.

Question 15

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. After deploying, users report that the app is not available in the work profile. What is the most likely cause?

Accepted Answer

The app has not been approved in the managed Google Play store.. Managed Google Play apps must be approved before they can be deployed to work profile devices. Without approval, the app will not appear in the work profile's Play Store.

Answer

The app is only available for corporate-owned devices.

Answer

Android Enterprise enrollment is not enabled in Intune.

Answer

The device does not have a work profile configured.

Question 16

Refer to the exhibit. A Microsoft Intune security baseline is configured for Windows 10 devices. What is the effect of this setting?

Accepted Answer

It reduces the CPU priority of scheduled scans to minimize performance impact.. This setting in the Microsoft Intune security baseline for Windows 10 configures the 'Low CPU priority for scheduled scans' policy for Microsoft Defender Antivirus. When enabled, it reduces the CPU priority of scheduled scans to minimize performance impact on the user's active workload, ensuring that background scanning does not interfere with foreground tasks.

Answer

It requires a reboot for the setting to take effect.

Answer

It enables real-time protection for scheduled scans.

Answer

It disables scheduled scans when the device is in use.

Question 17

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

Accepted Answer

Assign the app and configure 'Require device compliance' with a filter for minimum OS version.. Intune allows you to create a filter based on device properties such as OS version, and apply that filter to app assignments. This ensures the deployment is only available to devices meeting the minimum OS version. Option B is incorrect because 'Uninstall' intent would remove the app, not deploy it with OS filtering. Option C is incorrect because 'Available for enrolled devices' without filters does not enforce any OS version requirement. Option D is incorrect because assigning as 'Required' to all devices does not filter by OS version.

Answer

Assign the app with 'Uninstall' intent.

Answer

Assign the app as 'Available for enrolled devices' without filters.

Answer

Assign the app as 'Required' to all devices.

Question 18

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Accepted Answer

Retain the Autopilot registration. Options C and D are correct. Windows Autopilot reset retains the device's Autopilot registration (option C) and removes personal files and apps (option D). Option A is incorrect because Autopilot reset does not change the primary user; that requires a different process. Option B is incorrect because Autopilot reset does not reinstall Windows from scratch; it refreshes the existing OS. Option E is incorrect because Autopilot reset does not remove the device from Microsoft Intune; that would require a manual action.

Answer

Change the primary user of the device

Answer

Reinstall Windows 11 from scratch

Answer

Remove the device from Microsoft Intune

Question 19

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are unable to connect to the corporate Wi-Fi network. The Wi-Fi profile is deployed via Intune. Which troubleshooting step should you take first?

Accepted Answer

Check the Intune console for Wi-Fi profile assignment and conflict status. Checking the Intune console for Wi-Fi profile assignment and conflict status is the fastest way to identify deployment issues, such as the profile not being assigned to the affected devices or conflicts with other profiles. Option A is wrong because recreating the profile may not address the root cause and could be time-consuming without first verifying the current assignment. Option B is wrong because running 'netsh wlan show profiles' only lists profiles stored locally and does not show Intune deployment status. Option D is wrong because reviewing Microsoft Entra ID sign-in logs does not show Wi-Fi profile status or assignment conflicts.

Answer

Recreate the Wi-Fi profile in Intune with new settings

Answer

Run the 'netsh wlan show profiles' command on affected devices

Answer

Review Microsoft Entra ID sign-in logs for authentication failures

Question 20

Match each Microsoft 365 Apps update channel to its description.

Accepted Answer

Current Channel: Provides users with the newest features as soon as they are released by Microsoft.. Update channels control how Microsoft 365 Apps are updated, relevant for MD-102.

Answer

Current Channel: Provides users with new features twice a year, typically in January and July.

Answer

Monthly Enterprise Channel: Provides users with the newest features as soon as they are released by Microsoft.