MD-102 Practice Test 35 — 15 Questions

Question 1

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. You need to configure a remediation to automatically restart the Windows Update service (wuauserv) if it stops. You create a proactive remediation script package. Which two components must you provide in the script package? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A detection script that checks whether the Windows Update service is running. A proactive remediation script package in Intune consists of two scripts: a detection script and a remediation script. The detection script identifies whether the Windows Update service is running; if it is not, it signals non-compliance. The remediation script then starts the service. Together, they automate the detection and correction of the issue, ensuring the service is restarted without manual intervention.

Answer

A PowerShell script that runs only once at device enrollment

Answer

A requirement rule that checks the service status before installation

Answer

A compliance policy that marks the device noncompliant if the service is stopped

Question 2

You use Microsoft Intune to manage Windows devices. You need to deploy a Win32 app that must run only on devices running Windows 11 and must be installed silently in the system context. The installer returns exit code 3010 on success but requires a restart. Which two actions must you perform to ensure the app installs correctly and Intune interprets the success code properly? (Choose two.)

Accepted Answer

Configure a requirement rule that the operating system is Windows 11.. Two configuration steps are needed. First, a requirement rule restricting the app to Windows 11 ensures targeting is correct. Second, adding exit code 3010 to the soft reboot return codes tells Intune the installation succeeded but a restart is required, so the app is marked installed and the reboot is handled. Together these satisfy the operating system targeting and exit code interpretation requirements.

Answer

Set the install command to run in user context instead of system context.

Answer

Assign the app as available instead of required so users can choose when to install it.

Answer

Create a PowerShell script that maps exit code 3010 to exit code 0 before returning.

Question 3

You manage Windows 11 devices with Microsoft Intune. A Win32 app deployed as Required is failing on a subset of devices, and the Intune Management Extension log shows the installer exiting with code 1618. You have already confirmed the app package and detection rule are correct. What is the most likely cause and the appropriate fix?

Accepted Answer

Another installation is already in progress; adjust the app's dependencies or deployment timing so installs do not overlap.. Exit code 1618 from Windows Installer means another installation is already running on the device. When several Required Win32 apps deploy at once, their installers contend for the single Windows Installer mutex, and the losing installer returns 1618. Sequencing dependencies or staggering deployment timing lets each installer run without contention, so the affected devices complete installation.

Answer

The app requires a reboot that was not granted; map return code 1618 to a soft reboot so the device restarts.

Answer

The install command is running in the user context and lacks elevation; switch Install behavior to System.

Answer

The detection rule is matching too early; add a longer detection script timeout so the installer finishes first.

Question 4

You are the endpoint administrator for a company that uses Microsoft Intune. You are preparing to deploy Windows 11 devices using Windows Autopilot. The devices will be used by remote workers who do not have access to the corporate network. You need to ensure that the devices are automatically enrolled in Intune and that users can sign in with their Microsoft Entra ID credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven mode with Microsoft Entra join.. User-driven mode with Microsoft Entra join is the correct choice for remote workers because it allows users to sign in with their Microsoft Entra ID credentials during OOBE, automatically joins the device to Microsoft Entra ID, and enrolls it in Intune without requiring on-premises network connectivity. Other modes either do not support user sign-in or require domain connectivity.

Answer

Self-deploying mode with Microsoft Entra join.

Answer

User-driven mode with Microsoft Entra hybrid join.

Answer

Pre-provisioning with Microsoft Entra hybrid join.

Question 5

You are an endpoint administrator for a company that uses Microsoft Intune. The company plans to deploy Windows 11 devices using Windows Autopilot in self-deploying mode. You need to ensure that the devices can be provisioned without any user interaction. Which two configurations are required for self-deploying mode? (Choose two.)

Accepted Answer

The device must be registered with Windows Autopilot.. Self-deploying mode requires TPM 2.0 and that the device is registered with Windows Autopilot. TPM 2.0 provides the hardware-based identity needed for device authentication without user credentials. Autopilot registration ensures the device receives the self-deploying profile. On-premises domain join, DEM accounts, and wired connections are not required for this mode.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

The device must have a wired network connection.

Answer

A device enrollment manager (DEM) account must be assigned.

Question 6

You use Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that automatically marks devices as noncompliant if they do not have a specific antivirus signature version installed. The signature version is updated daily. Which compliance setting should you configure?

Accepted Answer

Require the device to have up-to-date security intelligence.. The compliance setting 'Require the device to have up-to-date security intelligence' allows you to specify how many days old the antivirus signatures can be. By setting this to one day, you ensure that devices with signatures older than one day are marked noncompliant. This is the only setting among the options that directly evaluates the security intelligence version, making it the correct choice.

Answer

Require the device to have an active firewall.

Answer

Require the device to be at or under the machine risk score.

Answer

Require the device to have a minimum OS version.

Question 7

A company uses Microsoft Intune to manage Windows devices. They need to deploy a required app to all devices in the marketing department. The app is a Microsoft Store app (new). What should you do first?

Accepted Answer

Add the app from the Microsoft Store app (new) in Intune and assign it to the marketing department group as required.. To deploy a Microsoft Store app (new) to a group, you add the app in Intune by selecting the Microsoft Store app (new) type, search for the app, and then assign it to the target group with the required intent. This is the standard and supported method.

Answer

Deploy the app using a PowerShell script that installs it from the Microsoft Store.

Answer

Create a configuration profile that installs the app from the Microsoft Store.

Answer

Package the app as a Win32 app using the Microsoft Win32 Content Prep Tool and deploy it as required.

Question 8

You manage 1,200 Windows 11 devices with Microsoft Intune. The security team reports that several devices have stopped checking in and may be compromised. You need to identify devices that have not contacted the service recently and then take action. Which TWO actions should you perform? (Choose two.)

Accepted Answer

In the Intune console, review the Devices > All devices list and sort or filter by the Last check-in column.. Identifying devices that have stopped checking in requires data on the last contact time. The Intune console's All devices view exposes a Last check-in column that can be sorted or filtered, and Microsoft Graph's managedDevices entity exposes lastSyncDateTime, which can be queried directly or through the Intune Data Warehouse. Provisioning state, enrollment date filtering, and compliance marking do not surface last check-in information, so they cannot reliably identify the stale devices.

Answer

Run a PowerShell script that imports the Intune module and calls Get-IntuneManagedDevice to list devices by enrollment date.

Answer

Create a dynamic device group that includes devices based on the deviceManagement.approvisioningState property.

Answer

Configure a compliance policy with the 'Unable to check in' rule set to 30 days and a noncompliance action of 'Mark device noncompliant'.

Question 9

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. You need to configure a remediation to automatically restart the Windows Update service (wuauserv) if it stops. You create a proactive remediation script package. Which two components must you provide in the script package? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the device has an active internet connection and use the 'Wipe' action in Intune.. Intune's Wipe action is designed for remote device wipe. When initiated, the command is queued and delivered to the device over the internet through the Intune service. The device must have an active internet connection to receive the command, but it does not need to be on the corporate network. This makes it effective for compromised devices that are off-site.

Answer

Configure a conditional access policy that requires compliant devices.

Answer

Deploy a PowerShell script that triggers a factory reset when a specific file is created.

Answer

Enable Windows Defender Application Guard.

Question 10

You are the endpoint administrator for a company that uses Microsoft Intune. The company has a policy that all Windows devices must have a minimum OS version of 10.0.19045. You need to create a compliance policy that enforces this requirement. Which type of compliance setting should you configure?

Accepted Answer

Device Properties. The minimum OS version is a built-in setting under Device Properties in Intune compliance policies. Configuring it there ensures devices are evaluated against the specified version. Other setting categories like Device Health, System Security, and Custom Compliance serve different purposes and do not provide a direct way to set a minimum OS version.

Answer

Custom Compliance

Answer

Device Health

Answer

System Security

Question 11

You manage devices with Microsoft Intune. You need to ensure that when a device is marked as non-compliant, users receive a notification and the device is blocked from accessing corporate email. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires compliant devices for Exchange Online.. To notify users and block email access for non-compliant devices, you need a compliance policy with actions for non-compliance to send notifications, and a Conditional Access policy that requires compliant devices for Exchange Online. The compliance policy detects non-compliance and triggers notifications, while Conditional Access enforces the block. Together, they meet both requirements.

Answer

Set up an enrollment restriction to block non-compliant devices.

Answer

Configure an app protection policy for Outlook mobile.

Answer

Deploy a device configuration profile that disables email access.

Question 12

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to ensure that only devices running Windows 11 version 23H2 or later can enroll into Intune. You also want to block enrollment for older Windows versions. What should you configure?

Accepted Answer

An enrollment restriction for Windows devices.. To block enrollment based on OS version, you configure enrollment restrictions. Specifically, you create a Windows enrollment restriction and set a minimum OS version. Devices running versions below the minimum will be prevented from enrolling. This is a direct control over enrollment eligibility, unlike compliance policies or conditional access which operate after enrollment.

Answer

A device compliance policy with a minimum OS version rule.

Answer

A configuration profile with a Windows edition upgrade policy.

Answer

A conditional access policy requiring compliant devices.

Question 13

You are the endpoint administrator for a company that uses Microsoft Intune. The finance team needs a specific third-party accounting application deployed to their Windows 11 laptops. The vendor provides an .msi installer and a setup.exe bootstrapper. You want the deployment to be tracked by Intune and to automatically retry if the install fails. What should you do?

Accepted Answer

Add the application as a Win32 app, upload the installer, and configure the install and uninstall commands.. Win32 app is the correct type for deploying a vendor-supplied .msi or setup.exe with tracking and retry behavior. It provides install and uninstall commands, return code handling, detection rules, and reporting that the other app types cannot match. The result is a managed deployment with automatic retry on failure, exactly as required.

Answer

Add the application as a Microsoft Store app (new) and assign it to the finance team.

Answer

Add the application as a line-of-business app and upload the .msi file directly.

Answer

Create a PowerShell script and deploy it as a platform script to the finance team devices.

Question 14

You are planning to deploy Windows 11 devices using Windows Autopilot. The devices will be used by remote users who do not have a VPN connection during initial setup. The devices must be Microsoft Entra joined and enrolled in Intune. You need to ensure that the deployment works without requiring a domain controller. Which Autopilot mode should you configure?

Accepted Answer

Microsoft Entra joined. Microsoft Entra joined mode is the correct choice because it does not require connectivity to an on-premises domain controller. Devices join Microsoft Entra ID and enroll in Intune directly, enabling remote users to complete setup without VPN. This mode is designed for cloud-first management and supports access to cloud resources.

Answer

Self-deploying mode

Answer

Pre-provisioning (white glove)

Answer

Microsoft Entra hybrid joined

Question 15

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. You need to configure a remediation to automatically restart the Windows Update service (wuauserv) if it stops. You create a proactive remediation script package. Which two components must you provide in the script package? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a device cleanup rule in the Intune tenant settings and set the inactivity threshold to 30 days.. Intune's built-in device cleanup rule is designed exactly for this scenario: it automatically retires devices that have not checked in for a configured number of days. Setting the threshold to 30 days satisfies the security team's requirement without custom scripting, dynamic groups, or conditional access workarounds. It is the native, lowest-effort lifecycle management feature.

Answer

Configure an Autopilot deployment profile with a 30-day enrollment timeout and enable automatic device deletion.

Answer

Create a dynamic device group based on the last check-in date and apply a retire action using a scheduled PowerShell script.

Answer

Assign a compliance policy that marks devices as noncompliant after 30 days of inactivity, and configure conditional access to block them.