MD-102 Practice Test 34 — 15 Questions

Question 1

You manage Windows 11 devices with Microsoft Intune. Users run a line-of-business desktop app that writes configuration data to HKEY_CURRENT_USER. After you deploy the app as a Win32 app with an install context of System, users report that their settings are not saved between sessions. You need to ensure that each user's settings persist in their own profile while the app still installs without user interaction. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the app's install context to User and redeploy the app.. Win32 apps deployed by Intune can run in either User or System context. System context installs with elevated rights and writes to the system account's profile, so per-user HKCU data is not preserved for the signed-in user. Switching the install context to User makes the app run per user, allowing HKCU writes to land in each user's profile and persist.

Answer

Wrap the app in a Win32 app package that includes a PowerShell script to copy HKCU settings to HKLM at logoff.

Answer

Add a requirement rule that targets only Windows 11 devices and redeploy the app.

Answer

Configure the app's detection rule to check for the registry key under HKEY_CURRENT_USER.

Question 2

You are preparing infrastructure for Windows Autopilot at Contoso. You need to configure the environment so that devices can be deployed with Windows Autopilot in Microsoft Entra hybrid join mode. Which two components must be in place before devices can complete the hybrid join during OOBE? (Choose two.)

Accepted Answer

A Windows Autopilot deployment profile configured with the Microsoft Entra hybrid joined join type.. Autopilot hybrid join requires the Intune Connector for Active Directory to perform the offline domain join and a deployment profile configured for Microsoft Entra hybrid joined to direct the device through the correct OOBE path. Compliance policies, Configuration Manager enrollment proxy points, and Conditional Access policies do not perform the domain join or Entra registration steps, so they are not prerequisites for completing hybrid join.

Answer

A device compliance policy requiring BitLocker and Secure Boot.

Answer

A Configuration Manager site system role for the enrollment proxy point.

Answer

A conditional access policy requiring multifactor authentication for all users.

Question 3

Your organization uses Microsoft Intune to manage Windows 11 devices. The security team requires that BitLocker recovery keys be automatically escrowed to Microsoft Entra ID before a device is marked compliant. You need to configure a compliance policy setting that enforces this. Which setting should you configure?

Accepted Answer

Require BitLocker recovery key backup. The requirement is that BitLocker recovery keys are escrowed to Microsoft Entra ID before a device is compliant. The compliance policy setting 'Require BitLocker recovery key backup' specifically validates that the recovery key has been backed up to Microsoft Entra ID. Other BitLocker-related settings check for encryption or TPM presence but do not enforce escrow, so they would not satisfy the security team's condition.

Answer

Require Trusted Platform Module (TPM)

Answer

Require storage encryption

Answer

Require BitLocker

Question 4

You manage Windows 11 devices enrolled in Microsoft Intune. Security requires that devices with unsupported antivirus signatures be blocked from accessing Microsoft 365 resources. You create a compliance policy that sets the Microsoft Defender Antivirus requirement to 'Require' and the 'Antivirus signature age' to 3 days. A device reports an antivirus signature age of 5 days. What is the resulting device state?

Accepted Answer

The device is marked noncompliant.. Compliance policies in Intune evaluate device settings such as antivirus signature age. When the signature age exceeds the configured value, the device is marked noncompliant. This status can be used by Conditional Access to block access to corporate resources. The correct outcome is that the device is noncompliant because it fails the defined requirement.

Answer

The device is marked compliant but a remediation script is triggered.

Answer

The device is marked compliant because the signature age is not evaluated.

Answer

The device is marked noncompliant only if the user has not signed in for 30 days.

Question 5

Your company uses Microsoft Intune to manage Windows 11 devices. A security policy requires that devices automatically receive quality updates as soon as they are available, with a deadline of 2 days after release and automatic restart outside active hours. You create a Windows update ring in Intune. Which setting should you configure to meet the deadline requirement?

Accepted Answer

Set 'Update deadline' to 2 days and configure 'Grace period' as needed.. A Windows update ring in Intune includes an 'Update deadline' setting that forces installation and restart after a specified number of days. Setting it to 2 days ensures quality updates are installed and the device restarts within two days of release, meeting the security policy. Other settings like active hours or auto restart do not enforce the deadline.

Answer

Set 'Restart checks' to 'Allow' and configure 'Auto restart' to 'Always'.

Answer

Set 'Automatic update behavior' to 'Auto install and restart at maintenance time'.

Answer

Set 'Active hours start' and 'Active hours end' to define the restart window.

Question 6

You are the endpoint administrator for Contoso, which uses Microsoft Intune. You need to enroll 200 new Windows 11 devices into Intune with the least administrative effort. The devices are currently running Windows 11 Pro and are connected to the internet. You want to avoid imaging or manually installing agents. What should you do?

Accepted Answer

Configure Windows Autopilot deployment profiles and register the device hardware IDs.. Windows Autopilot is designed to simplify and automate the enrollment of new Windows devices without reimaging. By registering hardware IDs, you can assign deployment profiles that automatically configure and enroll devices into Intune. This approach minimizes administrative effort and ensures devices are ready for use with minimal user interaction.

Answer

Deploy the Intune agent MSI to each device using a logon script.

Answer

Manually enroll each device by having users sign in with their Microsoft Entra ID credentials in Settings.

Answer

Use Group Policy to enable automatic MDM enrollment for all domain-joined devices.

Question 7

You are the endpoint administrator for a company that uses Microsoft Intune. The company has an on-premises network with Active Directory Domain Services (AD DS) and a Microsoft Entra tenant. You need to prepare the infrastructure for Windows Autopilot deployment of Microsoft Entra hybrid joined devices. You must ensure that the required components are in place to support the hybrid join process. Which two actions should you perform? (Choose two.)

Accepted Answer

Configure the Microsoft Entra Connect sync to include the device objects in the organizational unit (OU) where the devices will be created.. For Microsoft Entra hybrid joined Autopilot, you must install the Intune Connector for Active Directory on a server with line-of-sight to a domain controller, and configure Microsoft Entra Connect to sync the OU containing the device objects. These two components enable the creation of the computer account in AD DS during OOBE and ensure the device object is synchronized to Microsoft Entra ID, completing the hybrid join.

Answer

Create a device configuration profile that enables the Windows Push Notification Service (WNS).

Answer

Deploy a Windows Autopilot deployment profile with the deployment mode set to Microsoft Entra joined.

Answer

Assign the Intune Connector for Active Directory the necessary permissions in Microsoft Entra ID to create device objects.

Question 8

You are configuring a Microsoft Intune compliance policy for Windows 11 devices. You need to ensure that devices with BitLocker not enabled are marked noncompliant. Which setting should you configure in the compliance policy?

Accepted Answer

Require BitLocker. To enforce BitLocker encryption, the compliance policy must include the 'Require BitLocker' setting. This setting directly evaluates whether BitLocker is enabled on the device. Other security settings like Secure Boot or TPM presence do not confirm BitLocker status. Therefore, configuring 'Require BitLocker' ensures devices without encryption are marked noncompliant.

Answer

Require code integrity

Answer

Require Trusted Platform Module (TPM)

Answer

Require Secure Boot

Question 9

You manage Windows devices with Microsoft Intune. A line-of-business MSI installer must be deployed to 400 devices. The installer requires a custom transform (.mst) file and must run with administrative privileges. You need to deploy the app using the least administrative effort while ensuring the transform is applied. What should you do?

Accepted Answer

Package the MSI and .mst into a Win32 app (.intunewin) and deploy it as required.. Win32 apps in Intune support the inclusion of additional files and custom installation commands, which is necessary to apply an MSI transform. By packaging the MSI and .mst together and specifying the correct command line, the transform is applied during installation. This ensures the customizations are correctly deployed to all targeted devices.

Answer

Convert the MSI to an .intunewin file and deploy it as a Win32 app without the .mst, then use a separate script to modify the registry.

Answer

Deploy the MSI as a line-of-business app and use a PowerShell script to apply the .mst after installation.

Answer

Upload the MSI as a line-of-business app and specify the .mst file in the app configuration.

Question 10

You have a Microsoft 365 subscription that includes Microsoft Intune. You have 100 Windows 11 devices enrolled in Intune. You need to ensure that BitLocker recovery keys are automatically escrowed to Microsoft Entra ID when BitLocker is enabled. What should you configure?

Accepted Answer

An Endpoint protection profile with 'BitLocker' settings configured to save recovery information to Microsoft Entra ID. The Endpoint protection profile in Intune provides native BitLocker settings, including the option to save recovery information to Microsoft Entra ID. Enabling this setting ensures that when BitLocker is activated, the recovery key is automatically escrowed to Entra ID, allowing administrators to retrieve it if needed. This is the most direct and supported method.

Answer

A device configuration profile with the 'Encrypt devices' setting set to 'Require'

Answer

A compliance policy that requires BitLocker and marks devices without escrowed keys as non-compliant

Answer

A PowerShell script deployed via Intune that runs 'manage-bde -protectors -adbackup'

Question 11

Your company uses Microsoft Intune to manage Windows 10 and Windows 11 devices. A security team requires that all devices run a specific antivirus signature version before users can access Microsoft 365 resources. You have already created a compliance policy that requires Microsoft Defender Antivirus to be enabled. You now need to add a rule that evaluates the antivirus signature version. What should you do?

Accepted Answer

Add a custom compliance setting to the compliance policy that uses a PowerShell discovery script returning the signature version and a JSON file that validates it.. Intune compliance policies include built-in rules for Defender Antivirus status, but they do not natively expose a rule for a specific signature version. Custom compliance settings close that gap: a PowerShell discovery script reads the current signature version from the device, and a JSON file defines the acceptable values. The resulting compliance state is then honored by conditional access, ensuring only devices with current signatures reach Microsoft 365.

Answer

Create a device configuration profile that sets the Defender signature update interval to every hour and assign it to all devices.

Answer

Configure a Windows Defender Application Control policy that blocks access to Microsoft 365 when the signature is older than the required version.

Answer

Add a compliance policy rule that requires the device to be at or below a specific OS build version and rely on that as a proxy for signature currency.

Question 12

You are the endpoint administrator for a company that uses Microsoft Intune to manage 500 Windows 11 devices. The security team requires that devices cannot be enrolled if they do not have a TPM 2.0 chip and Secure Boot enabled. You need to configure a device enrollment restriction to block enrollment of devices that do not meet these hardware requirements. What should you do?

Accepted Answer

In the Microsoft Intune admin center, create a device enrollment restriction for Windows and set the minimum TPM version and require Secure Boot.. Device enrollment restrictions are the correct tool to control which devices can enroll based on hardware attributes like TPM version and Secure Boot. Compliance policies and configuration profiles only act after enrollment, and Autopilot profiles shape the provisioning experience but do not enforce hardware prerequisites. Thus, only enrollment restrictions can block non-compliant hardware at the point of enrollment.

Answer

Configure a Windows Autopilot deployment profile with hardware requirements and assign it to all devices.

Answer

Create a configuration profile with a custom OMA-URI that checks for TPM and Secure Boot, and assign it to all devices.

Answer

Create a device compliance policy that requires TPM 2.0 and Secure Boot, and assign it to all users.

Question 13

You are an administrator for Microsoft Intune. You need to ensure that when a Windows 11 device is enrolled, it automatically receives a set of configuration settings that apply to all users of the device. The settings must be applied before the user signs in. What should you create?

Accepted Answer

A device configuration profile assigned to the device group.. Device configuration profiles are the correct choice because they are designed to apply settings to devices and can be targeted to device groups. When assigned to a device group, they are processed during enrollment and apply to the device itself, ensuring settings are in place before any user signs in. This meets the requirement of applying settings that affect all users of the device.

Answer

A PowerShell script deployed to the user group.

Answer

An app configuration policy assigned to the user group.

Answer

A compliance policy assigned to the user group.

Question 14

You manage a fleet of Windows 10 devices with Microsoft Intune. A line-of-business (LOB) app named App1 is deployed as required to a group of users. Users report that App1 installs successfully on some devices but fails on others with error code 0x87D1041C. You need to resolve the installation failures. What should you do?

Accepted Answer

Modify the detection rule to match the actual installation state on the failing devices.. Error 0x87D1041C occurs when the app installation succeeds but the detection rule fails to confirm it. This often happens if the detection rule checks for a file or registry key that is not present on all devices due to variations in installation paths or versions. Correcting the detection rule to match the actual state on the failing devices resolves the error and allows Intune to mark the app as installed.

Answer

Add a dependency to the app to ensure required frameworks are installed first.

Answer

Re-deploy the app with the 'Require a restart' option set to 'No'.

Answer

Change the app assignment from 'Required' to 'Available' for the affected users.

Question 15

You manage a set of Windows 11 devices enrolled in Microsoft Intune. Users report that they can no longer sign in with their Microsoft Entra ID credentials after you deployed a new compliance policy. The devices show as compliant in Intune, but the sign-in fails with an error about device not meeting requirements. You need to ensure that users can sign in. What should you do?

Accepted Answer

Review the conditional access policy that requires compliant devices and ensure the device is included.. The sign-in error indicates a conditional access block despite Intune reporting compliance. Conditional access evaluates device compliance at authentication time, and if the device is not included in the policy or not properly registered, access is denied. Reviewing the conditional access policy to ensure the device is targeted and meets requirements resolves the issue. Other actions do not address the authentication flow.

Answer

Restart the Intune Management Extension service on the affected devices.

Answer

Assign the compliance policy to the device group instead of the user group.

Answer

Modify the compliance policy to mark the devices as compliant manually.