MD-102 Practice Test 33 — 15 Questions

Question 1

You need to ensure that Windows 10 devices automatically receive Microsoft Defender antivirus definition updates from Microsoft. Which update channel should you configure in the endpoint protection profile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Update. The 'Microsoft Update' channel delivers Microsoft Defender antivirus definition updates directly from Microsoft. Option B is incorrect because Microsoft Update for Business is typically used for feature and quality updates, not specifically for Defender definition updates; the correct channel for automatic definition updates is Microsoft Update. Option C is incorrect because Windows Update is for OS updates, not definition updates. Option D is incorrect because WSUS may delay definition updates.

Answer

Microsoft Update for Business

Answer

Windows Update

Answer

WSUS

Question 2

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. Some devices running Windows 10 22H2 (build 19045.3803) are marked as noncompliant. What is the most likely reason?

Accepted Answer

The device has a password length of 6 characters, not meeting the minimum of 8.. The compliance policy specifies a minimum password length of 8 characters, and devices with a password length of 6 characters fail this requirement. In Microsoft Intune, compliance policies evaluate device settings against defined rules, and a password length below the minimum is a common reason for noncompliance. The devices are running Windows 10 22H2 (build 19045.3803), which is within the allowed OS version range, so the issue is specifically the password policy.

Answer

The policy requires a firewall, but Windows Defender Firewall is disabled on the device.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device is running a build outside the allowed OS version range specified in the policy.

Question 3

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

Accepted Answer

The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.. The compliance policy includes a rule for 'Maximum days since last check-in', which checks the `lastSyncDateTime` property. Devices that have not synced within the configured threshold (e.g., 30 days) are marked as noncompliant. This is a common Intune compliance setting for Windows devices to ensure they regularly communicate with the service.

Answer

The devices failed to enroll properly.

Answer

The devices are running a non-Windows operating system.

Answer

The devices have names that do not match the naming convention.

Question 4

An administrator applies the app protection policy shown in the exhibit to a group of users. A user reports that they are unable to copy data from a managed app and paste it into an unmanaged app. Which setting in the policy causes this behavior?

Accepted Answer

dataTransferToUnmanagedApps is set to false.. The setting `dataTransferToUnmanagedApps` controls whether data can be transferred from a managed app to unmanaged apps via copy/paste, share, or other data-sharing mechanisms. When set to `false`, it blocks all such transfers, including pasting into unmanaged apps. This is the specific policy that prevents the user from copying data from a managed app and pasting it into an unmanaged app.

Answer

requirePin is set to true.

Answer

appSharingFromLevel is set to 'policyManagedApps'.

Answer

disableAppEncryptionIfDeviceEncryptionIsEnabled is set to false.

Question 5

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

Accepted Answer

Upload the hardware hash to Microsoft Intune to register the device.. The Get-AutopilotInfo script collects the hardware hash and device details but does not automatically register the device with Autopilot. A 'DeviceState' of 'Unknown' and 'AssignmentStatus' of 'NotAssigned' indicate the device is not yet registered in Intune. Uploading the hardware hash to Intune is the required first step to register the device, enabling Autopilot to recognize it and assign profiles.

Answer

Assign an Autopilot deployment profile to the device group.

Answer

Run the script again with the -Online parameter.

Answer

Use a provisioning package to set up the device manually.

Question 6

You deploy a Windows Update for Business policy in Intune. You need to ensure that devices install quality updates within 2 days of release and feature updates within 30 days. Which THREE settings should you configure?

Accepted Answer

Quality update deferral period (days): 2. The Quality update deferral period (days) setting controls how many days after Microsoft releases a quality update that devices will install it. Setting this to 2 ensures that quality updates are installed within 2 days of release, meeting the requirement.

Answer

Feature update uninstall period (2-60 days): 30

Answer

Quality update pause start date

Question 7

Which TWO of the following are valid app types in Microsoft Intune for iOS/iPadOS devices?

Accepted Answer

iOS line-of-business app. Microsoft Intune supports deploying iOS line-of-business (LOB) apps, which are custom-built applications that are not available in the public App Store. Administrators upload the .ipa package directly to Intune, and the app is sideloaded onto managed iOS/iPadOS devices using the Intune Company Portal or Apple's Volume Purchase Program (VPP) for distribution.

Answer

Windows 10 Universal app

Answer

Android Enterprise system app

Answer

Managed Google Play iframe

Question 8

You are configuring Windows Autopilot for a customer who has a hybrid Azure AD join deployment. The devices are self-deploying using a self-deploying profile. Which THREE prerequisites must be met for the self-deploying mode to work?

Accepted Answer

The device must be registered in Windows Autopilot. A device must be registered in Windows Autopilot to associate it with a self-deploying profile. Registration is done by uploading the device's hardware hash to the Autopilot service, which then links the device to the profile and enables automatic provisioning without user interaction.

Answer

The local administrator account must be enabled

Answer

The user must be assigned a Windows Autopilot license

Question 9

Which TWO compliance settings can be configured in Microsoft Intune for Android devices?

Accepted Answer

Minimum OS version. The 'Minimum OS version' compliance setting in Microsoft Intune allows administrators to define a minimum Android operating system version that devices must meet to be considered compliant. This is a standard compliance policy rule that helps ensure devices run a supported and secure OS level, reducing exposure to known vulnerabilities.

Answer

Device is not jailbroken

Answer

Require a specific screen lock type

Answer

Require antivirus to be installed

Question 10

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?

Accepted Answer

Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.. AppLocker is a Windows feature that can be configured via Intune device configuration profiles to enforce application control policies. By creating an AppLocker rule for the 'Packaged apps' rule collection and setting the default action to 'Deny' for all users, you can explicitly allow only apps from the Microsoft Store, effectively blocking installation of non-Store apps.

Answer

Set 'Windows Update for Business' to defer feature updates.

Answer

Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.

Answer

Enable 'BitLocker' to encrypt the system drive.

Question 11

You run the above PowerShell command. The app is installed on a device, but the detection rule checks for CompanyPortal.exe in C:\Program Files. The app installs to C:\Program Files (x86) due to a 32-bit installer. What is the most likely outcome?

Accepted Answer

Intune repeatedly tries to install the app because it is not detected. Intune's detection rule is configured to check for CompanyPortal.exe in C:\Program Files. Since the 32-bit installer places the file in C:\Program Files (x86), the detection rule will not find it. Intune will then consider the app as not installed and will repeatedly attempt to reinstall it, leading to a loop of installation attempts.

Answer

The app is successfully detected and no action is taken

Answer

The app installation fails with error

Answer

The detection rule automatically adjusts to check both folders

Question 12

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.

Question 13

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

Accepted Answer

Windows Hello for Business. The 'Windows Hello for Business' setting in the Autopilot profile directly controls whether users are prompted to configure biometric or PIN-based authentication during the out-of-box experience (OOBE). When enabled, this setting triggers the Windows Hello for Business enrollment flow immediately after user authentication, ensuring the device is provisioned with strong credential protection before the user reaches the desktop.

Answer

Skip privacy settings

Answer

Device name template

Answer

Language (Region)

Question 14

You are a Teams administrator. After running the PowerShell script shown in the exhibit, users report they cannot communicate with federated users from 'trusted.com'. What is the most likely cause?

Accepted Answer

The script did not run in a Teams PowerShell session that supports the Set-CsTenantFederationConfiguration cmdlet.. The `Set-CsTenantFederationConfiguration` cmdlet is only available in a remote Teams PowerShell session (connected via `Connect-MicrosoftTeams`), not in a local Skype for Business Online or legacy PowerShell module. If the script was run in an incompatible session (e.g., an older Skype for Business Online Connector or a local PowerShell window without proper module import), the cmdlet would not execute, leaving the federation configuration unchanged. This would cause the default settings to block federated communication with 'trusted.com'.

Answer

The AllowedDomains list does not include a wildcard ' * ' to allow all domains, so only trusted.com is allowed.

Answer

The script sets AllowPublicUsers to $false, which blocks all external communication including federated users.

Answer

The script sets AllowFederatedUsers to $true, which disables federated user communication.

Question 15

Your organization uses Microsoft Intune to manage devices. You need to deploy a custom Windows 10 line-of-business app that is not signed. Which action must you take on the target devices to allow installation?

Accepted Answer

Enable sideloading on the devices.. To install an unsigned line-of-business (LOB) app on Windows 10 via Intune, sideloading must be enabled on the target devices. Sideloading allows the installation of apps that are not signed by the Microsoft Store, which is required for custom LOB apps that lack a valid signature. This setting can be configured via a device configuration profile in Intune using the 'Allow sideloading of apps' policy.

Answer

Enable Developer Mode on the devices.

Answer

Add the app publisher to the trusted publisher store.

Answer

Turn off Windows Defender SmartScreen.