MD-102 Practice Test 32 — 15 Questions

Question 1

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

Accepted Answer

Configuration profiles. Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Answer

Update rings

Answer

Device enrollment profiles

Answer

Compliance policies

Question 2

Which TWO actions can you perform using Microsoft Intune to manage devices that are not compliant? (Choose two.)

Accepted Answer

Send a push notification to the user.. Microsoft Intune can send push notifications to noncompliant devices via the Company Portal app, alerting users about compliance issues and required actions. Option E is correct because marking a device as noncompliant in the Intune admin center is a manual action that updates the device's compliance state, which then triggers conditional access policies to block resources. Both actions are available for managing noncompliant devices without requiring user interaction or remote wipe.

Answer

Automatically send an email to the user's manager.

Answer

Remotely wipe the device.

Answer

Block access to corporate resources.

Question 3

Refer to the exhibit. A Windows 10 device shows a compliance state of 'noncompliant'. The last sync was 2 hours ago. The device is managed by Intune (mdm). You have verified that the assigned compliance policy requires a device threat level of 'high' from Microsoft Defender for Endpoint. Which of the following is the most likely cause of non-compliance?

Accepted Answer

The device is not enrolled in Microsoft Defender for Endpoint.. In Intune, when a compliance policy requires a device threat level of 'High', the policy actually requires the device to be at or under that threat level. Therefore, a device with a medium-severity threat would be considered compliant, not noncompliant. Given that the device synced recently and is managed, the most likely cause of noncompliance is that it is not enrolled in Microsoft Defender for Endpoint, so it cannot report any threat level.

Answer

Microsoft Defender for Endpoint reports a medium-severity threat on the device.

Answer

The device OS version is below the minimum required.

Answer

The device has not synced with Intune for over 24 hours.

Question 4

Your company has 500 Windows 10 devices that are Hybrid Azure AD joined and managed by Microsoft Intune. You need to deploy a new line-of-business (LOB) app to all devices. The app is packaged as a .msi file. You create a new app in Intune and assign it to a device group containing all devices. After 24 hours, some devices report the app as 'Installed' but others show 'Failed'. You verify that the devices are online and have network connectivity. What should you do next to resolve the installation failures?

Accepted Answer

Check the Intune management extension logs on a failed device.. The most common cause of .msi installation failures is missing prerequisites or dependencies. Checking the Intune management extension logs on the device will reveal the specific error. Option A is wrong because the app is already assigned; re-assigning won't fix underlying issues. Option C is wrong because the app is already targeted to all devices. Option D is wrong because scripts are not needed; the issue is likely with the app itself.

Answer

Use a PowerShell script to install the app on failed devices.

Answer

Create a new device group and assign the app again.

Answer

Re-assign the app to the device group.

Question 5

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. The app requires installation in the system context. Which deployment method should you use?

Accepted Answer

Win32 app. Win32 apps in Microsoft Intune support installation in the system context via the 'Install behavior' setting, and they can be deployed using a custom installation script that handles certificate trust issues (e.g., by installing the signing certificate first or using a silent install switch). This method also allows the app to run with elevated privileges, which is required for system-context installation, and does not depend on the device trusting the app's signing certificate at deployment time.

Answer

Microsoft Store for Business app

Answer

Microsoft Intune LOB app (msi/appx)

Answer

Web link

Question 6

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Accepted Answer

Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.. Intune security policies are assigned to Microsoft Entra ID groups. If the device is not a member of the targeted group, it will not receive the policy, resulting in a 'Not compliant' status. Verifying group membership ensures the policy scope is correctly applied.

Answer

Reissue the user's Microsoft 365 license from the admin center.

Answer

Reset the device's enrollment state via the Company Portal.

Answer

Run Invoke-Command to remotely execute gpupdate /force.

Question 7

You are using Microsoft Intune to deploy a custom Windows app that is packaged as an .msi. The app requires a reboot after installation. You want to minimize user disruption. What is the best deployment strategy?

Accepted Answer

Assign the app as available to a device group.. Assigning the app as available to a device group allows users to install the app on demand from the Company Portal, but only when they choose to, minimizing disruption. Since the app requires a reboot, making it available (rather than required) lets users schedule the installation and reboot at a convenient time. This approach balances deployment needs with user autonomy, avoiding forced reboots that would interrupt work.

Answer

Assign the app as available to a user group.

Answer

Assign the app as required to a device group.

Answer

Assign the app as required with a deadline.

Question 8

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

Accepted Answer

The device does not meet authentication requirements. The JSON configuration includes an 'authenticationRequirement' setting that mandates multifactor authentication (MFA) for enrollment. Since the user's device or account does not meet this MFA requirement, the enrollment is blocked. Authentication requirements are a common cause of enrollment failures, and the error message 'enrollment is blocked' typically aligns with such policy violations rather than version restrictions or device count limits.

Answer

The enrollment is restricted to Windows Holographic only

Answer

The device type filter excludes Windows 10

Answer

The user already has 5 devices enrolled

Question 9

Your company uses Intune to manage iOS devices. You need to deploy a new app that is available in the Apple App Store. You create an iOS store app in Intune and assign it as 'Required' to a group of users. After 24 hours, some users report that the app is not installed. You verify that the app is available in the App Store and that the devices are online. The devices are supervised and enrolled via Apple Business Manager. What should you do first to troubleshoot the issue?

Accepted Answer

Verify that a VPP token is configured and assigned. For supervised iOS devices enrolled via Apple Business Manager, a Volume Purchase Program (VPP) token must be configured in Intune and assigned to the device group to allow automatic installation of store apps assigned as 'Required'. Without a valid VPP token, the app installation will fail even if the app is available and devices are online. Option A is incorrect because while device restrictions policy could block certain apps, it is not the first step in troubleshooting a missing app installation. Option B is incorrect because the devices are already enrolled (as stated in the scenario). Option C is incorrect because an app configuration policy is used to customize app settings, not to control installation.

Answer

Review the iOS device restrictions policy

Answer

Confirm that the devices are enrolled in Intune

Answer

Check the app configuration policy for the app

Question 10

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

Accepted Answer

Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center. Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center is the standard method to register devices for Windows Autopilot. Option A is incorrect because the Microsoft Store for Business is deprecated and no longer supports Autopilot registration. Option B is incorrect because while OEMs can register devices, you already have the hardware hashes, making direct upload more efficient. Option C is incorrect because Windows Configuration Designer is used to create provisioning packages for manual setup, not for Autopilot device registration.

Answer

Use the Microsoft Store for Business to automatically register devices

Answer

Contact the OEM to register the devices using the device serial numbers

Answer

Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings

Question 11

You need to deploy a Microsoft 365 Apps for enterprise suite to Windows 10 devices using Intune. Users are unlicensed. How should you proceed?

Accepted Answer

Create a Win32 app package for Microsoft 365 Apps and deploy it.. When users are unlicensed, the Microsoft 365 Apps for enterprise suite cannot be deployed via the built-in Intune app type (which relies on license activation). Creating a Win32 app package allows you to bundle the Office Deployment Tool (ODT) with a configuration XML that sets the product ID to 'O365ProPlusRetail' and disables automatic licensing checks, enabling deployment to unlicensed devices.

Answer

Deploy the suite as 'available' from Company Portal.

Answer

Use the built-in Microsoft 365 Apps (Office) app type in Intune.

Answer

Assign the Office 365 E3 license to all users.

Question 12

You need to deploy a web link as an app to Android Enterprise work profile devices. Users should see the link in the Company Portal app. What type of app should you add in Microsoft Intune?

Accepted Answer

Managed Google Play web link. Managed Google Play web links are the correct app type for deploying a web link as an app to Android Enterprise work profile devices. When added in Intune, this web link appears in the Company Portal app under the 'Apps' tab, allowing users to open the link directly. Other app types like iOS web clips or Android store apps do not support this specific deployment method for Android Enterprise work profiles.

Answer

iOS/iPadOS web clip

Answer

Android store app

Answer

Windows app package (MSI)

Question 13

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Accepted Answer

Intune licenses assigned to users. Intune licenses must be assigned to users to grant them access to the service. Without a license, the user cannot authenticate with Intune, and automatic enrollment will fail during the device registration step. This is a prerequisite enforced by Microsoft Entra ID and Intune together.

Answer

Apple Push Notification service certificate (for iOS)

Answer

Configuration Manager (for co-management)

Question 14

Users report that after updating to Windows 11, their devices are no longer receiving policy updates from Intune. The devices appear as active and compliant in the Intune console. What is the most likely cause?

Accepted Answer

The Intune management extension is outdated and needs to be updated.. The Intune management extension is responsible for deploying PowerShell scripts, Win32 apps, and custom compliance policies. After a Windows 11 upgrade, the extension may become outdated or fail to re-register, causing a break in the policy retrieval loop even though the device appears active and compliant. This is a known behavior where the extension’s version mismatch prevents it from processing new policy assignments.

Answer

The devices lost compliance after the upgrade.

Answer

The MDM authority changed to Configuration Manager.

Answer

Windows 11 is not supported by Microsoft Intune.

Question 15

Order the steps to deploy a Windows 10 virtual desktop in Azure using Windows 365.

Accepted Answer

1. Ensure appropriate licenses, 2. Access Microsoft Endpoint Manager admin center, 3. Create a provisioning policy, 4. Configure provisioning policy settings, 5. Provision Cloud PCs, 6. Assign users to Cloud PCs. Deploying Windows 10 virtual desktops via Windows 365 requires a specific sequence: first, ensure you have the appropriate licenses (Windows 365 Enterprise or Business). Then access the Microsoft Endpoint Manager admin center, create a provisioning policy, and configure its settings (e.g., network, management). After the policy is configured, you can provision Cloud PCs in bulk. Finally, assign the Cloud PCs to users. Common mistakes include swapping the order of licensing and portal access, configuring after provisioning, or assigning before provisioning.

Answer

1. Access Microsoft Endpoint Manager admin center, 2. Ensure appropriate licenses, 3. Create a provisioning policy, 4. Configure provisioning policy settings, 5. Provision Cloud PCs, 6. Assign users to Cloud PCs

Answer

1. Ensure appropriate licenses, 2. Access Microsoft Endpoint Manager admin center, 3. Create a provisioning policy, 4. Provision Cloud PCs, 5. Configure provisioning policy settings, 6. Assign users to Cloud PCs

Answer

1. Ensure appropriate licenses, 2. Access Microsoft Endpoint Manager admin center, 3. Create a provisioning policy, 4. Configure provisioning policy settings, 5. Assign users to Cloud PCs, 6. Provision Cloud PCs