MD-102 Practice Test 3 — 30 Questions

Question 1

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

Accepted Answer

Wipe.. The Wipe action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost corporate-owned iOS device to ensure sensitive data is completely erased and the device cannot be accessed. Retire only removes managed apps and policies but leaves personal data intact, which is insufficient for a lost device scenario.

Answer

Retire.

Answer

Delete.

Answer

Reset.

Question 2

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

Accepted Answer

bitLockerDisableWarningForOtherDiskEncryption set to false. Setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Answer

bitLockerEncryptionMethod set to aes256

Answer

passwordRequired set to true

Answer

bitLockerDisableWarningForOtherDiskEncryption set to true

Question 3

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

Accepted Answer

Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment. Microsoft Entra ID (formerly Azure AD) registration or join is a prerequisite for Intune enrollment. Intune requires a device to have an identity in Entra ID to apply policies and manage compliance. Without this prerequisite, the device cannot authenticate or receive management commands from Intune.

Answer

Configure enrollment restrictions to require corporate ownership

Answer

Set device type restrictions to block unregistered devices

Answer

Configure automatic enrollment via Group Policy

Question 4

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

Accepted Answer

To list the IDs of Windows devices.. The script uses Get-MgDevice with a filter for operatingSystem eq 'Windows' to retrieve all Windows device objects from Microsoft Entra ID, regardless of their join type (joined, registered, or hybrid). By selecting the DeviceId property, it outputs the unique identifiers of these devices. The DeviceId is the Entra ID object identifier, not the device name or Autopilot registration status.

Answer

To output the device names of all Windows devices.

Answer

To list devices that are registered in Autopilot.

Answer

To update the enrollment type of all Windows devices.

Question 5

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

Accepted Answer

Assign a Windows 10/11 feature update policy.. A Windows 10/11 feature update policy in Microsoft Intune is specifically designed to manage the upgrade of Windows 10 devices to Windows 11. This policy uses Windows Update for Business to deliver the feature update (e.g., Windows 11 23H2) and automatically applies it to devices that meet the hardware requirements, ensuring a controlled upgrade process.

Answer

Assign a driver update policy.

Answer

Assign a quality update policy.

Answer

Assign an update ring for Windows 10.

Question 6

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Accepted Answer

Apple Business Manager: Used for automated enrollment of corporate-owned iOS devices with supervision.. Correct matches: Apple Business Manager automates enrollment of corporate iOS devices; Android Enterprise Work Profile supports BYOD Android with work/personal separation. Common confusions include mistaking Windows Autopilot for Android enrollment and confusing user-driven enrollment with automated methods.

Answer

Windows Autopilot: Used for enrolling corporate-owned Android devices with Zero Touch enrollment.

Answer

User-Driven Enrollment: Used for automatically enrolling devices without user interaction during setup.

Question 7

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot. Conditional Access policies in Microsoft Entra ID can require devices to be marked as compliant before granting access to corporate resources. A device compliance policy in Intune can be configured to check for TPM 2.0 and Secure Boot status on Windows 11 devices. Only when both conditions are met will the device be considered compliant, and the Conditional Access policy will enforce that compliance requirement, effectively blocking non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business in Intune

Answer

Deploy an attack surface reduction rule in Microsoft Defender XDR

Answer

Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

Question 8

You are a Microsoft 365 Endpoint Administrator for a global organization with 5,000 Windows 11 devices managed by Intune. The company has a strict security policy requiring that all devices have BitLocker enabled with TPM validation, PIN, and startup key. Currently, only 80% of devices are compliant with BitLocker. After investigating, you discover that many non-compliant devices are older models that lack TPM 2.0, but they do have TPM 1.2. Additionally, some devices are virtual machines (VMs) that do not have a TPM at all. The security team insists that all devices must be encrypted, but they are willing to accept alternative configurations for devices without TPM 2.0. You need to propose a solution that maximizes security while ensuring compliance. What should you do?

Accepted Answer

Create multiple compliance policies: one for devices with TPM 2.0 requiring full BitLocker, one for devices with TPM 1.2 requiring BitLocker with TPM validation, and one for VMs requiring BitLocker with startup password.. It uses multiple compliance policies to enforce the strongest possible BitLocker configuration based on each device's TPM capabilities. Devices with TPM 2.0 can meet the full requirement (TPM validation, PIN, startup key), devices with TPM 1.2 can use TPM-only validation (since TPM 1.2 does not support PIN+startup key in the same way), and VMs without a TPM can use a startup password. This approach maximizes security while ensuring all devices remain compliant with the security policy's intent.

Answer

Create a single compliance policy that requires BitLocker with TPM validation, PIN, and startup key, and exclude devices without TPM 2.0 from the policy.

Answer

Modify the existing compliance policy to remove the PIN requirement so that all devices can comply.

Answer

Downgrade all non-compliant devices to Windows 10 and enable BitLocker with TPM 1.2.

Question 9

You are implementing Windows Autopilot for your organization. You need to ensure that during the first boot, the device automatically enrolls in Microsoft Intune and joins Microsoft Entra ID. What is the minimum requirement for the device?

Accepted Answer

The device must be registered in Autopilot with a valid profile.. Windows Autopilot requires the device to be registered in the Autopilot service with a valid profile assigned. This profile contains the settings that dictate the out-of-box experience (OOBE), including automatic enrollment into Microsoft Intune and joining Microsoft Entra ID (formerly Azure AD). Without a registered Autopilot profile, the device will not trigger the automated enrollment and join process during first boot.

Answer

The device must have a local administrator account.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

The device must have a TPM 2.0 chip.

Question 10

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

Accepted Answer

Add as a macOS line-of-business app.. The recommended method to deploy a .pkg app to macOS devices managed by Microsoft Intune is to add it as a macOS line-of-business (LOB) app. This app type is specifically designed for deploying macOS installer packages (.pkg) and requires the file to be uploaded directly to Intune, which then pushes the installation to enrolled devices using the Intune management agent for macOS.

Answer

Add as a Windows line-of-business app.

Answer

Add as a macOS web app.

Answer

Add as a Microsoft Store app.

Question 11

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Accepted Answer

Intune licenses assigned to users. Intune licenses must be assigned to users to grant them access to the service. Without a license, the user cannot authenticate with Intune, and automatic enrollment will fail during the device registration step. This is a prerequisite enforced by Microsoft Entra ID and Intune together.

Answer

Apple Push Notification service certificate (for iOS)

Answer

Configuration Manager (for co-management)

Question 12

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

Accepted Answer

Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker. Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Answer

Device configuration profile to enable BitLocker

Answer

Device compliance policy with a noncompliance action to mark device as non-compliant

Answer

PowerShell script deployment with assignment to all devices

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to create a compliance policy that requires devices to have a firewall enabled. Which setting should you configure?

Accepted Answer

Firewall. The Firewall setting in a Windows compliance policy specifically evaluates whether Windows Firewall is enabled. Setting it to 'Require' ensures devices without an active firewall are non-compliant, directly satisfying the scenario's requirement.

Answer

Antivirus

Answer

Require a password to unlock mobile devices

Answer

Require BitLocker

Question 14

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.

Question 15

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

Accepted Answer

Device restrictions configuration policy. Device restrictions configuration policies in Microsoft Intune are designed to control built-in device settings and hardware features, including security-related options like blocking installation from unknown sources. For Android Enterprise, this policy type directly maps to the 'Unknown sources' setting under Device Restrictions, allowing you to prevent sideloading of apps. Compliance policies only evaluate conditions and mark devices as compliant or non-compliant; they do not enforce configuration changes. App configuration policies deliver app-specific settings (e.g., server URLs) to managed apps, and enrollment restrictions control which devices can enroll, not what users can do after enrollment.

Answer

Device compliance policy

Answer

App configuration policy

Answer

Enrollment restriction

Question 16

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

Accepted Answer

Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center. Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center is the standard method to register devices for Windows Autopilot. Option A is incorrect because the Microsoft Store for Business is deprecated and no longer supports Autopilot registration. Option B is incorrect because while OEMs can register devices, you already have the hardware hashes, making direct upload more efficient. Option C is incorrect because Windows Configuration Designer is used to create provisioning packages for manual setup, not for Autopilot device registration.

Answer

Use the Microsoft Store for Business to automatically register devices

Answer

Contact the OEM to register the devices using the device serial numbers

Answer

Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings

Question 17

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 18

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

Accepted Answer

Use a Win32 app with install context set to 'system'.. Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Answer

Assign the app as 'available' for user-install.

Answer

Deploy as a line-of-business app with device context.

Answer

Package as a Microsoft Store for Business app.

Question 19

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

Accepted Answer

App protection policy (MAM). App protection policies (MAM) protect corporate data in apps like Outlook without requiring device enrollment in MDM. Option A (Device compliance policy) requires MDM enrollment. Option B (Device configuration profile) is for device settings, not data protection. Option C (Conditional Access policy) controls access but does not directly protect data within apps.

Answer

Device compliance policy

Answer

Device configuration profile

Answer

Conditional Access policy

Question 20

Which FOUR of the following are valid detection rules for a Win32 app in Intune?

Accepted Answer

PowerShell script (custom detection). Option A (PowerShell script / custom detection) is valid because Intune Win32 apps support a custom detection script whose exit code and stdout determine whether the app is considered installed. Option B (MSI product code) is valid because Intune can detect an installed app by matching its MSI product code in the Windows Installer database. Option C (Registry key or value exists) is valid because Intune's registry detection rule checks for a specified key/value (and can compare a value's string, integer, or version) to confirm installation. Option D (File system / file or folder exists) is valid because Intune's file/folder detection rule verifies existence (and optionally date, size, or version) of a specified path. Option E (Network share access) is not a supported Win32 app detection rule type in Intune, so it does not belong.

Answer

Network share access