MD-102 Practice Test 33 — 15 Questions

Question 1

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the device's last check-in time with Intune.. The device is already compliant and enrolled, and the email profile is assigned, so the most likely issue is that the device has not recently checked in with Intune to receive the latest policy or profile. Checking the last check-in time is the first troubleshooting step because Intune relies on periodic device check-ins to push configuration profiles, including email profiles. If the device hasn't checked in recently, it won't have the email profile applied, even if it's compliant and enrolled.

Answer

Verify that the device meets the compliance policy for Android.

Answer

Confirm that the user has an Exchange Online license.

Answer

Ensure the device is enrolled in Intune.

Question 2

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor on the devices. (Microsoft Defender for Endpoint sensor) is correct. The sensor is the agent installed on devices that collects and reports vulnerability information to Microsoft Defender XDR. If the sensor is misconfigured, missing, or not running, devices will not report vulnerability data. Option A (Microsoft Sentinel workspace) is a SIEM that ingests security data but is not the source of vulnerability data. Option C (Intune MDM authority) manages device compliance and configuration but does not directly collect vulnerability data. Option D (Microsoft Purview compliance portal) handles data governance and compliance, not vulnerability reporting.

Answer

Microsoft Sentinel workspace

Answer

Intune MDM authority

Answer

Microsoft Purview compliance portal

Question 3

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

Accepted Answer

The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.. The compliance policy includes a rule for 'Maximum days since last check-in', which checks the `lastSyncDateTime` property. Devices that have not synced within the configured threshold (e.g., 30 days) are marked as noncompliant. This is a common Intune compliance setting for Windows devices to ensure they regularly communicate with the service.

Answer

The devices failed to enroll properly.

Answer

The devices are running a non-Windows operating system.

Answer

The devices have names that do not match the naming convention.

Question 4

You manage devices in Microsoft Intune. You need to ensure that a specific set of Windows 10 devices automatically receive new configuration profiles as soon as they are assigned. The devices are already enrolled and are members of an Microsoft Entra ID group. What should you do?

Accepted Answer

Assign the configuration profile to the Microsoft Entra ID group.. Assigning the configuration profile to the existing Microsoft Entra ID group that contains the devices is the most direct and effective method. Intune will deploy the profile to all devices in the group automatically. Other options either target users, use categories that are not for assignment, or introduce unnecessary complexity.

Answer

Create a device category and assign the profile to that category.

Answer

Assign the configuration profile to the user who owns the devices.

Answer

Use a dynamic device group based on device name and assign the profile to it.

Question 5

You are the administrator for a company that uses Microsoft Intune. The company has a policy that all Windows 10 devices must have a minimum OS version of 10.0.19045. You need to ensure that devices that do not meet this requirement are blocked from accessing corporate email. What should you configure?

Accepted Answer

A device compliance policy that sets the minimum OS version to 10.0.19045, and a conditional access policy that requires compliant devices.. To block email access for devices not meeting a minimum OS version, you need a compliance policy that defines that requirement and a conditional access policy that enforces compliance. Configuration profiles and enrollment restrictions do not evaluate compliance for access control, and MFA policies do not consider OS version. Thus, the combination of a compliance policy and a conditional access policy is required.

Answer

A device configuration profile that sets the minimum OS version and a conditional access policy that requires compliant devices.

Answer

A device enrollment restriction that blocks devices with an OS version lower than 10.0.19045.

Answer

A conditional access policy that requires multi-factor authentication for all users.

Question 6

You manage 500 Windows 11 devices with Microsoft Intune. A security policy requires that all devices run Microsoft Defender Antivirus with real-time protection enabled. You configure a Windows 10 and later antivirus policy in Intune and assign it to all devices. Several devices report that real-time protection is disabled. You need to ensure that real-time protection cannot be disabled by local administrators. What should you do?

Accepted Answer

Enable tamper protection in the Microsoft Defender for Endpoint security baseline or via a configuration profile.. Tamper protection is the only feature that prevents local administrators from disabling real-time protection and other Defender Antivirus settings. While other methods can enable the setting, they cannot lock it. Enabling tamper protection via the Defender for Endpoint baseline or a configuration profile ensures the setting remains enforced and cannot be overridden on the device.

Answer

Deploy a PowerShell script that runs at startup to enable real-time protection.

Answer

Create a compliance policy that requires real-time protection to be enabled.

Answer

Configure the 'Allow real-time protection' setting to 'Enabled' in the antivirus policy.

Question 7

You are deploying Microsoft Defender for Endpoint to 200 Windows 10 devices managed by Microsoft Intune. You want to onboard the devices to Defender for Endpoint using the least administrative effort. What should you do?

Accepted Answer

Use the Microsoft Defender for Endpoint connector in Intune to onboard the devices.. The Microsoft Defender for Endpoint connector in Intune is designed to simplify onboarding. When enabled, it automatically deploys the onboarding package to all Intune-managed Windows devices. This eliminates the need for manual configuration or scripting, providing the least administrative effort and ensuring consistent deployment across the organization.

Answer

Create a configuration profile with the Defender for Endpoint onboarding blob and assign it to the devices.

Answer

Deploy a PowerShell script that runs the onboarding script on each device.

Answer

Manually install the Defender for Endpoint agent on each device.

Question 8

You manage iOS/iPadOS devices with Microsoft Intune. You need to ensure that when a device is lost or stolen, its corporate data can be remotely wiped while leaving personal data intact. The devices are enrolled as user enrollment (personal devices). What should you do?

Accepted Answer

Issue a selective wipe from the Intune console for the device.. For user-enrolled iOS/iPadOS devices, selective wipe is the correct action to remove corporate data while preserving personal data. It targets only managed apps, profiles, and corporate data. Full wipe would erase personal content, retiring does not actively wipe, and conditional access only blocks access without removing data.

Answer

Retire the device from Intune and then delete the device record.

Answer

Issue a full wipe from the Intune console for the device.

Answer

Configure a conditional access policy to block the device from accessing corporate resources.

Question 9

You are configuring a Windows Autopilot deployment for a group of remote users. The users will receive new Windows 11 devices and will sign in with their Microsoft Entra ID credentials. You need to ensure that the devices are automatically enrolled in Microsoft Intune and that the users are assigned the appropriate licenses. Which license must be assigned to the users?

Accepted Answer

Microsoft Intune Plan 1. To use Windows Autopilot and automatic enrollment in Intune, users must have an Intune license. Microsoft Intune Plan 1 is the standalone license that grants access to Intune features. While higher-tier licenses like Microsoft 365 E3 or E5 include Intune, they are not the specific required license. Microsoft Entra ID P1 is not an Intune license.

Answer

Microsoft Entra ID P1

Answer

Microsoft 365 E5

Answer

Microsoft 365 E3

Question 10

You are an endpoint administrator for a company that uses Microsoft Intune. The company has a group of Windows 10 devices that are enrolled in Intune and are also co-managed with Configuration Manager. You need to configure a device configuration profile that applies a custom Start menu layout to these devices. You want to ensure that the profile is applied only to the co-managed devices and not to devices managed solely by Intune. What should you do?

Accepted Answer

Create a device configuration profile in Intune and assign it to a device group that contains only the co-managed devices.. The most straightforward way to target a configuration profile to a specific set of devices is to assign it to a device group containing those devices. Creating a group with only the co-managed devices and assigning the profile to that group ensures the policy applies exclusively to them. Other methods like scope tags or user groups do not provide the same precise device targeting.

Answer

Create a device configuration profile in Intune and use a scope tag to target only the co-managed devices.

Answer

Create a device configuration profile in Intune and assign it to a user group that contains users of the co-managed devices.

Answer

Create a device configuration profile in Intune and configure the "Configuration Manager Compliance" setting to require co-management.

Question 11

You are an endpoint administrator for a company that uses Microsoft Intune. You need to create a report that shows which devices have not checked in to Intune for more than 30 days. What should you use?

Accepted Answer

Intune devices with stale check-in report. Intune provides a specific report called 'Devices with stale check-in' that identifies devices that have not communicated with the service for a defined period. This report can be filtered to show devices with check-in times older than 30 days, making it the correct tool for the task.

Answer

Intune device inventory report

Answer

Microsoft Entra sign-in logs

Answer

Intune device compliance report

Question 12

You are the endpoint administrator for a company that uses Microsoft Intune. The security team requires that all Windows 11 devices automatically receive an Intune device configuration profile that enforces a minimum PIN length of 8 for Windows Hello for Business. You need to ensure the profile is applied without user interaction. What should you do?

Accepted Answer

Create a device configuration profile with the Windows Hello for Business template, configure the minimum PIN length setting, and assign the profile to all Windows 11 devices.. A device configuration profile with the Windows Hello for Business template is the correct Intune-native method to enforce PIN requirements. Assigning it to all Windows 11 devices ensures automatic application without user action. Compliance policies only assess, GPOs are for domain-joined devices, and scripts are not the preferred method for this policy.

Answer

Create a compliance policy that requires a minimum PIN length of 8, and assign it to all Windows 11 devices.

Answer

Create a Group Policy Object (GPO) in on-premises Active Directory and link it to the domain, then sync devices with Intune.

Answer

Deploy a PowerShell script through Intune that modifies the registry to set the minimum PIN length.

Question 13

You are setting up Microsoft Intune for a new company. The company has a mix of Windows 10, Windows 11, iOS, and Android devices. You need to ensure that devices can enroll in Intune automatically without user interaction for Windows devices that are Microsoft Entra joined. What should you configure?

Accepted Answer

Automatic enrollment in Intune.. Automatic enrollment in Intune is the feature that allows Windows devices that are Microsoft Entra joined or hybrid Microsoft Entra ID joined to enroll in Intune automatically without user interaction. This is configured in the Intune portal and ensures that devices are managed as soon as they join Microsoft Entra ID. This meets the requirement for automatic enrollment without user interaction for Windows devices.

Answer

Device enrollment manager.

Answer

Windows Autopilot deployment profile.

Answer

Enrollment restrictions.

Question 14

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that automatically marks a device as noncompliant if it has not checked in with Intune for more than 30 days. Which compliance setting should you configure?

Accepted Answer

In the compliance policy, set 'Compliance status validity period (days)' to 30.. The compliance status validity period is the exact setting that determines how long a device's reported compliance state is trusted. When a device does not check in within that period, Intune automatically marks it noncompliant. Setting the validity period to 30 days ensures that any device silent for more than 30 days is flagged, matching the requirement precisely.

Answer

In the compliance policy, configure 'System Security' and set 'Require a password to unlock mobile devices' to 'Require'.

Answer

In the compliance policy, configure 'Device Health' and set 'Require BitLocker' to 'Require'.

Answer

In the compliance policy, set 'Mark devices with no compliance policy assigned as' to 'Not compliant'.

Question 15

You are an endpoint administrator for a company that uses Microsoft Intune. You need to configure a Windows 11 device to support multiple users who will sign in with their Microsoft Entra ID credentials. The device will be shared among shift workers. You want to ensure that each user receives their own configuration profiles and applications. What should you configure?

Accepted Answer

Shared multi-user device configuration profile.. For shared Windows devices used by multiple shift workers, you should configure a shared multi-user device configuration profile. This profile optimizes the device for shared use and allows each user to sign in with their own credentials, receiving personalized settings and applications. It is the correct choice for this scenario.

Answer

Windows Autopilot pre-provisioning mode.

Answer

Device enrollment manager (DEM) account.

Answer

Windows Autopilot self-deploying mode.