MD-102 Practice Test 35 — 15 Questions

Question 1

You are troubleshooting a Windows 10 device that shows as 'Noncompliant' in Intune despite having all required compliance policies applied. The device is domain-joined and configured with hybrid Azure AD join. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device's health attestation certificate has expired.. A device that is hybrid Azure AD joined and domain-joined but shows as 'Noncompliant' in Intune, despite having all required compliance policies applied, is most likely failing compliance due to an expired health attestation certificate. Intune uses Windows Health Attestation Service (HAS) to verify device integrity; if the attestation certificate has expired, the device cannot prove its health status, causing it to be marked noncompliant even when policies are correctly assigned.

Answer

The Intune Management Extension is not installed.

Answer

The device is not registered in Microsoft Entra ID.

Answer

The device is not enrolled in Intune.

Question 2

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

Accepted Answer

Microsoft 365 Apps (Windows) configuration policy. The Microsoft 365 Apps (Windows) configuration policy is the correct choice because it is specifically designed to manage the deployment, update settings, and configuration of Microsoft 365 Apps for enterprise on Intune-managed Windows devices. This policy type provides granular control over installation parameters, update channels, and app settings, directly aligning with the requirement to deploy a Microsoft 365 Apps configuration.

Answer

Device configuration profile (settings catalog)

Answer

Managed apps policy

Answer

Windows update ring policy

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting. You check the BitLocker policy and it is assigned correctly. What is the most likely reason?

Accepted Answer

The device does not have a TPM chip.. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or later to provide hardware-based key storage and integrity verification. If a device lacks a TPM chip, the BitLocker policy will not apply, and encryption will fail silently or remain off, even if the policy is correctly assigned. This is the most common cause of encryption not starting on Windows 10 devices managed by Intune.

Answer

The device is running Windows 10 Home edition.

Answer

The BitLocker policy is not assigned to the users.

Answer

The device is non-compliant and encryption is blocked.

Question 4

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

Accepted Answer

The devices have the Windows Update for Business policy assigned.. Windows Update for Business (WUfB) policies must be explicitly assigned to devices to control update behavior via Intune. Even if update rings are configured and devices are enrolled, without the WUfB policy, devices may show 'Up to date' while missing critical security updates because they are not receiving the update instructions from Intune. The WUfB policy is what actually pushes the update configuration to the Windows Update client on the device.

Answer

The deferral settings are too long.

Answer

The update ring is assigned to the correct device group.

Answer

The devices are compliant with the compliance policy.

Question 5

You need to deploy Windows 11 to a remote office with limited bandwidth. Which deployment method is most appropriate?

Accepted Answer

Deployment using BranchCache. BranchCache is the most appropriate deployment method for a remote office with limited bandwidth because it allows clients to cache content locally from a peer after the first download, reducing WAN link usage. In Windows deployment, BranchCache can be used with Configuration Manager or standalone to distribute OS images efficiently by having clients retrieve data from local peers rather than repeatedly downloading from a central source over a slow link.

Answer

Cloud-based deployment using Windows Autopilot

Answer

PXE boot deployment from a local server

Answer

Multicast deployment from a central location

Question 6

Match each Microsoft 365 Defender feature to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides endpoint detection and response (EDR) and antivirus across devices. The correct matches are: Microsoft Defender for Endpoint (endpoint protection), Microsoft Defender for Office 365 (email/collaboration protection), Microsoft Defender for Identity (on-premises threat detection via AD), and Microsoft Defender for Cloud Apps (SaaS security via CASB). The distractors swap the definitions of Endpoint and Office 365.

Answer

Microsoft Defender for Endpoint: Protects email and collaboration tools

Answer

Microsoft Defender for Office 365: Provides endpoint detection and response

Question 7

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Accepted Answer

Microsoft Defender for Endpoint license assigned to the user or device. The correct prerequisites are: A and B. For A: Microsoft Defender for Endpoint requires a valid license assigned to the user or device. For B: The macOS device must be enrolled in Microsoft Intune to receive the configuration profile and policies for Defender. Option C is incorrect because the Microsoft Intune management extension is for Windows only, not macOS. Option D is incorrect because onboarding to Microsoft Defender for Cloud is not a prerequisite; Defender for Endpoint can be deployed independently. Option E is incorrect because a VPN connection is not required for Defender for Endpoint to function on macOS.

Answer

Microsoft Intune management extension installed on the device

Answer

Onboarding to Microsoft Defender for Cloud

Answer

A VPN connection to the corporate network

Question 8

An administrator is deploying Windows 11 using Configuration Manager. The task sequence fails on some devices during the 'Apply Operating System' step with a notice that the image file is not valid. All other devices succeed. What is the most likely cause?

Accepted Answer

The OS image download was corrupted on the client.. A corrupted OS image download on the client will cause the 'Apply Operating System' step to fail with an 'image file is not valid' error. Since the issue occurs only on some devices, a per-client download corruption (e.g., due to network interruption or disk I/O errors during BITS transfer) is the most likely cause, while the image itself remains valid on the distribution point.

Answer

The boot image is not compatible with the device firmware.

Answer

The distribution point is out of disk space.

Answer

The task sequence variable OSDPackagePath is missing.

Question 9

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs in the user context to configure user settings. What type of script should you use?

Accepted Answer

A PowerShell script deployed via Intune Management Extension.. The Intune Management Extension (IME) is the component that handles PowerShell script execution on Windows 10 devices managed by Intune. When you deploy a PowerShell script via Intune, it is automatically executed by the IME, and you can choose to run it in the user context (as the logged-on user) or the system context. This is the correct mechanism for deploying a user-context PowerShell script to configure user settings.

Answer

A platform script for Windows.

Answer

A discovery script.

Answer

A remediation script.

Question 10

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

Accepted Answer

Wipe.. The Wipe action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost corporate-owned iOS device to ensure sensitive data is completely erased and the device cannot be accessed. Retire only removes managed apps and policies but leaves personal data intact, which is insufficient for a lost device scenario.

Answer

Retire.

Answer

Delete.

Answer

Reset.

Question 11

You are configuring an app protection policy in Microsoft Intune for iOS/iPadOS devices. Which setting can you enforce to prevent users from copying data from a managed app and pasting it into an unmanaged app?

Accepted Answer

Restrict cut, copy, and paste between other apps. The 'Restrict cut, copy, and paste between other apps' setting in an Intune app protection policy (APP) for iOS/iPadOS directly controls data transfer between managed and unmanaged apps. When set to 'Blocked' or 'Policy Managed with Paste In', it prevents users from copying data from a managed app and pasting it into an unmanaged app, enforcing data leakage prevention at the OS clipboard level via the Intune MAM SDK.

Answer

Require a PIN for access

Answer

Prevent iTunes and iCloud backups

Answer

Block managed apps from running on jailbroken devices

Question 12

Contoso has iOS/iPadOS devices managed by Intune. They need to prevent users from installing apps from outside the Apple App Store and ensure that devices with a jailbreak are blocked from accessing corporate email. Which two policies should they combine?

Accepted Answer

Device compliance policy and Conditional Access. To prevent installation of apps from outside the Apple App Store, you need a Device Compliance Policy that includes the 'require non-removable app store' setting (which blocks sideloading). To block jailbroken devices from accessing corporate email, you combine that compliance policy with a Conditional Access policy that requires the device to be marked as compliant. Only the combination of Device Compliance Policy and Conditional Access enforces both restrictions at the device level before granting access to corporate resources.

Answer

Windows Autopilot and Intune enrollment

Answer

Device configuration profile and Microsoft Defender XDR

Answer

App protection policy and Conditional Access

Question 13

A company is planning to deploy Windows 11 using Microsoft Deployment Toolkit (MDT). The administrator needs to ensure that the deployment can be fully automated without user interaction. Which TWO settings should be configured in the CustomSettings.ini file?

Accepted Answer

SkipTaskSequence=YES. Setting SkipTaskSequence=YES in CustomSettings.ini allows MDT to bypass the Task Sequence Wizard, enabling a fully automated, zero-touch deployment. Option E is correct because SkipFinalSummary=YES suppresses the final summary dialog that would otherwise require user acknowledgment to complete the deployment. Together, these two settings eliminate all interactive prompts during the deployment process.

Answer

SkipComputerBackup=YES

Answer

SkipBitLocker=YES

Answer

SkipDomainMembership=YES

Question 14

You are troubleshooting a Windows 11 device that fails to enroll in Intune via Group Policy. The device is domain-joined and you have configured the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO. The user has a valid Microsoft 365 license. What is the most likely reason for the failure?

Accepted Answer

The device is not registered in Azure AD.. For the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO to succeed, the device must be registered in Azure AD. Since the device is only domain-joined and no Azure AD registration has occurred, the enrollment fails. Option B is incorrect because the GPO is configured correctly; if it were not linked, it would not apply at all. Option C is incorrect because the user has a valid Microsoft 365 license that includes Intune. Option D is incorrect because a service connection point is used for Configuration Manager co-management, not for this GPO.

Answer

The GPO is not linked to the correct organizational unit.

Answer

The user does not have an Intune license assigned.

Answer

The device does not have a service connection point configured.

Question 15

Your organization is deploying Windows 10 devices using Windows Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are required to set up Windows Hello for Business. Which TWO configurations should you apply?

Accepted Answer

Configure a Windows Hello for Business enrollment policy in Intune.. Option D is correct. Configuring a Windows Hello for Business enrollment policy in Intune is sufficient to require users to set up Windows Hello during OOBE. Option C (device configuration policy) is not necessary for OOBE; it enforces settings after enrollment. Option A is incorrect because Autopilot deployment profiles do not directly enforce Windows Hello; they only configure the OOBE experience. Option B (Azure AD device registration) is a prerequisite but not sufficient alone. Option E (custom script) is not a standard or recommended configuration for OOBE.

Answer

Configure a Windows Autopilot deployment profile to require Windows Hello for Business.

Answer

Enable Azure AD device registration.

Answer

Configure a Windows Hello for Business policy in Intune device configuration.

Answer

Deploy a custom script that enables Windows Hello.