MD-102 Practice Test 31 — 15 Questions

Question 1

You are reviewing an ARM template for Intune device configuration. The exhibit shows a snippet. What will be the effect on Windows 10 devices?

Accepted Answer

Devices will receive updates from WSUS.. The ARM template sets 'UpdateNotificationLevel' to 1, which configures Windows Update to suppress notifications and directs devices to receive updates from a local WSUS server.

Answer

Automatic updates will be disabled.

Answer

Users can sideload trusted apps.

Answer

Developer unlock is allowed.

Question 2

You are configuring an app protection policy for iOS devices to protect corporate data in Microsoft Outlook. Which TWO settings prevent users from copying corporate data to personal apps?

Accepted Answer

Allow app to transfer data to other apps. Setting 'Allow app to transfer data to other apps' to 'Policy managed apps' or 'None' prevents corporate data from being transferred from Outlook to unmanaged personal apps. Option D is correct because 'Restrict cut, copy, and paste between apps' can be set to 'Policy managed apps' or 'None', which blocks users from copying corporate data from Outlook and pasting it into personal apps. These two settings directly control data movement at the app-to-app and clipboard levels.

Answer

Save copies of work data

Answer

Block screen capture and screen recording

Answer

Encrypt app data

Question 3

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

Accepted Answer

A device with OS version 10.0.16299.0 (build 1709).. The compliance policy specifies a minimum OS version of 10.0.17134.1 (build 1803). Devices with an OS version lower than this minimum are marked non-compliant. Options A (build 16299.0, version 1709) and D (build 15063.0, version 1703) are both below the minimum, so they are non-compliant. Option B matches exactly and is compliant. Option C has a higher build (17134.2), which exceeds the minimum, making it compliant.

Answer

A device with OS version 10.0.17134.1 (build 1803).

Answer

A device with OS version 10.0.17134.2 (build 1803).

Question 4

An Android device running OS version 9.0 with app version 1.5.0 is targeted by the app protection policy in the exhibit. What is the expected behavior when the user tries to access work data?

Accepted Answer

Access is allowed without any warning because minimum requirements are met. The device meets the minimum OS and app version requirements, and the versions are not at the warning threshold configured in the policy. Therefore, access is allowed without any warning.

Answer

Access is blocked because the OS version is below the warning level

Answer

Access is allowed with a warning to update the app and OS

Answer

Access is blocked because the app version is below the warning level

Question 5

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

Accepted Answer

Provide the vendor with a bulk enrollment token and URL.. Providing the vendor with a bulk enrollment token (also known as an Autopilot registration token) and the associated URL allows the vendor to register devices in your tenant via Autopilot without granting full user privileges. This token is specifically designed for OEMs or resellers to upload device hashes and associate them with your tenant, scoping their permissions to only that action. Option D is incorrect because a 'custom device preparation profile with delegated admin privileges' is not a standard or recognized method for Autopilot device registration by vendors; the correct approach is to use an Autopilot registration token or delegate via Microsoft Partner Center.

Answer

Export the device list from the vendor and import it via CSV in Microsoft Intune.

Answer

Add the vendor as a global administrator in Microsoft Entra ID.

Answer

Create a custom device preparation profile with delegated admin privileges.

Question 6

Your organization is planning to deploy Windows 10 updates using Windows Update for Business. You need to ensure that critical security updates are installed within 7 days of release. Which configuration should you use?

Accepted Answer

Set a deadline for quality updates to 7 days. To ensure critical security updates are installed within 7 days of release, set a deadline for quality updates to 7 days. A deadline specifies the maximum number of days after the update is offered that the device has to install it. This enforces installation within the desired timeframe. A deferral period delays when the update is offered, which would not guarantee installation within 7 days.

Answer

Create a feature update policy for Windows 10

Answer

Configure a deferral period of 7 days for quality updates

Answer

Pause quality updates for 7 days

Question 7

Your organization manages Windows 10 and 11 devices using Microsoft Intune. Users report that after a recent update, the Microsoft Store for Business app 'Company Portal' fails to launch. You verify that the app is assigned as required to all devices. What should you do first to resolve the issue?

Accepted Answer

Trigger a device sync from the Microsoft Intune admin center.. The correct first step is to trigger a device sync from the Microsoft Intune admin center. This forces the affected devices to check in with Intune, which can push down any pending policy or app configuration updates that may have been missed after the recent Windows update. Since the Company Portal app is assigned as required, a sync ensures the device receives the latest app version or remediation actions without requiring a full reinstall.

Answer

Enable automatic updates for Company Portal in Intune.

Answer

Uninstall and reinstall Company Portal from all devices.

Answer

Run Windows Update troubleshooter on affected devices.

Question 8

Your organization uses Microsoft Intune to manage mobile devices. You need to configure compliance policies that trigger conditional access. Which TWO conditions can be used in a device compliance policy?

Accepted Answer

Minimum OS version is 14.0.. Correct answers are C and D. Device compliance policies in Microsoft Intune can check for conditions like minimum OS version (C) and whether the device is jailbroken or rooted (D). These conditions can trigger conditional access to enforce compliance. Option A is incorrect because compliance policies do not check the MDM authority; they assume Intune. Option B is incorrect because app version requirements are managed via app protection policies, not compliance policies. Option E is incorrect because SD card encryption is not a standard compliance policy setting; device encryption is checked but not specifically SD cards.

Answer

Device is enrolled in a specific MDM authority.

Answer

App must have a minimum version.

Answer

SD card encryption is enabled.

Question 9

You manage Windows 10 devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is an .msi file that requires admin privileges to install. Which deployment method should you use?

Accepted Answer

Use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy as a Win32 app. The correct deployment method is to use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy it as a Win32 app. This is required because Intune's native line-of-business (LOB) app deployment only supports .msi files that install in the user context without elevation, whereas this app requires admin privileges. The Win32 app model allows Intune to run the installer with system context, handle detection rules, and support complex installation logic.

Answer

Upload the .msi file as a line-of-business app directly

Answer

Add the app as a Microsoft Store for Business app

Answer

Deploy the app using a PowerShell script in Intune

Question 10

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data is protected when users access Microsoft 365 apps. Which policy should you configure?

Accepted Answer

Deploy an Intune App Protection Policy (APP) for Microsoft 365 apps.. Intune App Protection Policies (APP) protect corporate data at the app level for Microsoft 365 apps, without requiring device enrollment or management. Option A is incorrect because Mobile App Configuration policies enforce app settings but do not protect data. Option C is incorrect because Device Compliance policies ensure devices meet compliance criteria but do not protect data within apps. Option D is incorrect because Conditional Access policies control access based on conditions but do not directly protect data within apps.

Answer

Use a Mobile App Configuration policy to enforce app settings.

Answer

Create a Device Compliance policy for iOS devices.

Answer

Configure a Conditional Access policy to require compliant devices.

Question 11

A user reports that their Android Enterprise work profile device is not receiving email from the corporate Exchange Online account. The device is enrolled in Intune and shows as compliant. The Outlook app is installed but cannot connect. What should you check first?

Accepted Answer

Email profile configuration in Intune. The most common reason for an Outlook connection failure on a compliant Android Enterprise work profile device is an incorrect email profile configuration in Intune. Since the device is compliant and licensed, and app protection policies affect data leakage rather than connectivity, the first step should be to verify the email profile settings (server, authentication method, and user identity) in the Intune console. Option A is correct.

Answer

App protection policy settings

Answer

Device compliance policy settings

Answer

Intune license assignment

Question 12

Which THREE of the following are features of Microsoft Defender for Endpoint that help protect devices?

Accepted Answer

Attack surface reduction rules. Attack surface reduction rules (A) are a feature of Microsoft Defender for Endpoint that help protect devices by applying configurable rules to block behaviors commonly used by malware, such as Office macro execution, script obfuscation, and credential theft. These rules reduce the attack surface by preventing malicious actions at the process level, leveraging Windows Defender Antivirus and the Microsoft Defender for Endpoint cloud service.

Answer

Data loss prevention

Answer

Conditional access policies

Question 13

A company wants to prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. What should they configure?

Accepted Answer

Intune app protection policy. Intune app protection policies (APP) are designed to manage and protect corporate data within applications, regardless of the device management state. By configuring data protection settings such as 'Allow app to transfer data to other apps' set to 'Policy managed apps only' and 'Save copies of org data' set to 'Block', you can prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. This policy applies at the app layer, using the Intune App SDK or MAM (Mobile Application Management) channel, and does not require device enrollment.

Answer

Device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access policy

Question 14

You need to deploy a line-of-business (LOB) app to Windows 10 devices managed by Intune. The app is a .msi file. Which app type should you select when adding the app in Intune?

Accepted Answer

Windows line-of-business app. The correct app type for deploying a line-of-business (LOB) .msi file to Windows 10 devices managed by Intune is 'Windows line-of-business app'. This app type is specifically designed for sideloading enterprise LOB apps that are not distributed through the Microsoft Store, and it supports .msi and .appx file formats. It uses Intune's built-in LOB deployment channel, which handles the app package directly without requiring the Win32 app preparation tool or complex detection rules.

Answer

Microsoft Store app

Answer

Web link

Answer

Windows app (Win32)

Question 15

You are a Microsoft 365 Endpoint Administrator for a global organization with 5,000 Windows 11 devices managed by Intune. The company has a strict security policy requiring that all devices have BitLocker enabled with TPM validation, PIN, and startup key. Currently, only 80% of devices are compliant with BitLocker. After investigating, you discover that many non-compliant devices are older models that lack TPM 2.0, but they do have TPM 1.2. Additionally, some devices are virtual machines (VMs) that do not have a TPM at all. The security team insists that all devices must be encrypted, but they are willing to accept alternative configurations for devices without TPM 2.0. You need to propose a solution that maximizes security while ensuring compliance. What should you do?

Accepted Answer

Create multiple compliance policies: one for devices with TPM 2.0 requiring full BitLocker, one for devices with TPM 1.2 requiring BitLocker with TPM validation, and one for VMs requiring BitLocker with startup password.. It uses multiple compliance policies to enforce the strongest possible BitLocker configuration based on each device's TPM capabilities. Devices with TPM 2.0 can meet the full requirement (TPM validation, PIN, startup key), devices with TPM 1.2 can use TPM-only validation (since TPM 1.2 does not support PIN+startup key in the same way), and VMs without a TPM can use a startup password. This approach maximizes security while ensuring all devices remain compliant with the security policy's intent.

Answer

Create a single compliance policy that requires BitLocker with TPM validation, PIN, and startup key, and exclude devices without TPM 2.0 from the policy.

Answer

Modify the existing compliance policy to remove the PIN requirement so that all devices can comply.

Answer

Downgrade all non-compliant devices to Windows 10 and enable BitLocker with TPM 1.2.