MD-102 Practice Test 34 — 15 Questions

Question 1

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.. It leverages Configuration Manager's 'Windows 10/11 feature update' servicing plan, which is specifically designed for in-place upgrades while preserving user data and settings. Enabling Delivery Optimization for peer-to-peer download reduces bandwidth consumption in remote offices by allowing devices to share upgrade content locally, addressing the limited bandwidth constraint.

Answer

Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.

Answer

Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.

Answer

Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.

Question 2

Which THREE are valid device management actions in Microsoft Intune? (Choose three.)

Accepted Answer

Wipe. Wipe is a valid Intune device action that restores a device to factory default settings, removing all data and corporate resources. It is typically used for devices that are lost, stolen, or being repurposed, and it can be applied to both corporate-owned and personally-owned devices enrolled in Intune.

Answer

Delete

Answer

Reboot

Question 3

You have configured a Windows 10 update ring with a deadline of 3 days for quality updates. However, some devices are not installing updates within the deadline. What should you verify?

Accepted Answer

The devices are set to defer quality updates in Windows Update settings.. If devices are configured to defer quality updates in their local Windows Update settings, they will ignore the deadline specified in the update ring policy. The update ring deadline enforces installation timing, but deferral settings can override that by delaying the download or installation beyond the deadline. You must verify that no local or Group Policy deferral is active, as Intune's update ring policy does not automatically clear existing deferral configurations.

Answer

The devices have a feature update policy that conflicts.

Answer

The Intune Management Extension is installed.

Answer

The update ring is assigned to the correct Azure AD group.

Question 4

Refer to the exhibit. A KQL query in Microsoft Defender XDR returns no results for PC001 and PC002 even though you know there have been antivirus detections on those devices. What is the most likely reason?

Accepted Answer

The ActionType filter is incorrect for antivirus detections. Antivirus detections in Microsoft Defender XDR are logged under specific ActionType values such as 'AntivirusDetection' or 'AntivirusDetectionCleaned', not generic detection names. If the KQL query uses an incorrect ActionType filter (e.g., filtering for 'MalwareDetection' or a misspelled value), it will return no results for PC001 and PC002 even though detections exist. The query must reference the exact ActionType string used by Microsoft Defender for Endpoint's antivirus events.

Answer

The timestamp range is too narrow

Answer

The device names are case-sensitive and are entered incorrectly

Answer

You do not have permissions to view events on those devices

Question 5

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

Accepted Answer

Set the MDM user scope in Microsoft Entra ID to 'All' or 'Some'.. Microsoft Entra ID joined devices automatically enroll in Intune when the MDM user scope is set to 'All' or 'Some'. Option B is incorrect because the MDM discovery URL is configured automatically for Microsoft Entra ID joined devices and does not need manual configuration. Option C is incorrect because enrollment restrictions control which devices can enroll but do not trigger automatic enrollment. Option D is incorrect because device compliance policies are applied after enrollment, not before.

Answer

Configure the MDM discovery URL in Microsoft Entra ID.

Answer

Create an enrollment restriction that allows Windows devices.

Answer

Assign a device compliance policy to the user.

Question 6

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate apps are installed automatically on new devices without user interaction. Which enrollment method should you use?

Accepted Answer

Android Enterprise fully managed. Android Enterprise fully managed (A) is the correct enrollment method because it allows IT to enroll corporate-owned devices into Intune with full device control, enabling automatic, silent installation of required corporate apps without any user interaction. This mode uses the Android Enterprise API to push apps via managed Google Play as required or kiosk apps, ensuring they are installed before the device is handed to the user.

Answer

Android Enterprise dedicated device

Answer

Android Legacy device administrator

Answer

Android Enterprise work profile

Question 7

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are stuck in a reboot loop. The administrator needs to identify devices affected by the issue. Which report in the Microsoft Intune admin center should the administrator use?

Accepted Answer

Windows Update report. The Windows Update report in the Microsoft Intune admin center provides detailed information about Windows 10 update deployments, including devices that are stuck in a reboot loop after an update. This report shows update status, errors, and pending reboots, allowing the administrator to identify affected devices and take remediation actions.

Answer

Update compliance report

Answer

Device compliance report

Answer

Device inventory report

Question 8

Which TWO of the following are valid app types in Microsoft Intune for deploying applications to Windows 10/11 devices?

Accepted Answer

Windows app (Win32). Win32 apps are a primary app type in Microsoft Intune for deploying traditional desktop applications (e.g., .exe, .msi) to Windows 10/11 devices. Intune uses the Intune Management Extension to install and manage Win32 apps, supporting detection rules, dependencies, and supersedence.

Answer

Web link

Answer

macOS app

Answer

Android store app

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically install critical updates from Windows Update for Business within 3 days of release. Which configuration should you use?

Accepted Answer

Update rings for Windows 10 and later. Update rings for Windows 10 and later allow you to configure Windows Update for Business settings, including the ability to set a deadline for quality updates. By configuring the 'Quality update deferral period (days)' to 0 and the 'Deadline for quality updates (days)' to 3, devices are forced to install critical updates within 3 days of release. This is the correct policy to enforce automatic installation of critical updates within a specific timeframe.

Answer

Windows Autopatch deployment policy

Answer

Windows feature update policy

Answer

Device configuration policy for Windows 10/11

Question 10

Refer to the exhibit. You run this Microsoft Graph PowerShell command to retrieve managed devices. The output shows a device with a lastSyncDateTime of 5 days ago. What does this indicate?

Accepted Answer

The device has not communicated with Intune for 5 days.. The `lastSyncDateTime` property in Microsoft Graph for Intune-managed devices indicates the most recent time the device successfully checked in with the Intune service. A value of 5 days ago means the device has not communicated with Intune for 5 days, which could be due to network issues, device inactivity, or configuration problems. This does not inherently mean the device is non-compliant or unenrolled—it simply reflects the last successful sync.

Answer

The device was enrolled 5 days ago.

Answer

The device is non-compliant.

Answer

The device is unenrolled.

Question 11

You need to configure device compliance for devices that are not running Windows. The devices include iOS, iPadOS, Android, and macOS. Which compliance settings are common across all platforms?

Accepted Answer

Require minimum OS version.. Requiring a minimum OS version is a compliance setting supported on all major platforms including iOS, iPadOS, Android, and macOS. Option B is correct. Option A is incorrect because while requiring a device password is common, the setting 'not allow simple passwords' is not universally available across all platforms (e.g., Android and iOS have password complexity but not a simple password toggle). Option C is incorrect because jailbreak/root detection is not available on all platforms; for example, Android and iOS support it but macOS does not have a native 'rooted' detection. Option D is incorrect because BitLocker is a Windows-specific encryption technology and is not available on iOS, iPadOS, Android, or macOS.

Answer

Require device password and not allow simple passwords.

Answer

Device must not be jailbroken/rooted.

Answer

Require BitLocker encryption.

Question 12

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

Accepted Answer

Create an app protection policy that restricts data transfer between work and personal apps.. App protection policies (MAM) can restrict data transfer between work and personal apps, preventing copy/paste of corporate data. Option B is incorrect because device configuration policies do not control data transfer between apps; they configure device settings. Option C is incorrect because device compliance policies enforce device health and security requirements, not app-level data protection. Option D is incorrect because conditional access policies control access to resources based on conditions, not app data transfer.

Answer

Create a device configuration policy that disables clipboard sharing.

Answer

Create a device compliance policy that requires a work profile.

Answer

Create a conditional access policy that blocks personal apps.

Question 13

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

Accepted Answer

A device configuration profile using the 'Kiosk' settings for single-app mode. A is correct because Intune's device configuration profile includes a 'Kiosk' settings category specifically designed for Windows 10/11 devices. When you select 'Single-app mode' under kiosk settings, you can specify a single Store app (e.g., a UWP or Win32 app) that will run in full-screen, locked-down mode, preventing users from accessing any other system functions or apps.

Answer

A device restrictions profile blocking access to other apps

Answer

A compliance policy requiring the app to be installed

Answer

A configuration profile for Microsoft Edge in kiosk mode

Question 14

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy Microsoft 365 Apps for enterprise to 500 devices. The devices are in a hybrid Azure AD joined configuration. The administrator wants to use Intune to deploy the apps. Which deployment method should the administrator use?

Accepted Answer

Add a 'Microsoft 365 Apps for Windows 10 and later' app in Intune and assign it to the devices.. Intune provides a built-in 'Microsoft 365 Apps for Windows 10 and later' app type that is specifically designed to deploy and manage Microsoft 365 Apps for enterprise. This method uses Intune's native integration with the Office Content Delivery Network (CDN) to download and install the latest version of Office, and it supports hybrid Azure AD joined devices without requiring additional tools or configuration files.

Answer

Use the Office Deployment Tool (ODT) to create a configuration file and deploy via Intune as a Win32 app.

Answer

Use Group Policy to deploy the Office 2019 suite.

Answer

Upload the Office installation files as a line-of-business (LOB) app.

Question 15

Refer to the exhibit. You run this PowerShell script using the Microsoft Graph PowerShell SDK. What is the purpose of this script?

Accepted Answer

To identify devices that are not supported for compliance policies.. The script uses the `Get-MgDeviceManagementManagedDevice` cmdlet to retrieve all managed devices from Intune, then filters for devices where the `operatingSystem` property is not in the list of supported OS versions for compliance policies (e.g., Windows 10/11, iOS, Android, macOS). The output identifies devices that are unsupported for compliance policies, which aligns with option D. It does not check compliance status, enroll devices, or remove them.

Answer

To check compliance status of devices.

Answer

To enroll devices in Intune.

Answer

To remove unsupported devices from Intune.