MD-102 Practice Test 36 — 15 Questions

Question 1

You are deploying a Windows 11 device using Windows Autopilot. The device fails to enroll in Intune and you see the error 'The device is not registered in Autopilot'. You have verified that the device hardware hash is uploaded. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device hardware hash is associated with a different tenant.. The error 'The device is not registered in Autopilot' indicates that the device's hardware hash is not present in the Autopilot service for your tenant. A common cause is that the hash was uploaded to a different Microsoft Entra tenant, perhaps by the OEM or a previous owner. Verifying and re-uploading the hash to the correct tenant resolves the issue. Other causes like internet connectivity or profile assignment do not produce this specific error.

Answer

The device is not running a supported version of Windows 11.

Answer

The device is not connected to the internet during OOBE.

Answer

The Autopilot deployment profile is not assigned to the device.

Question 2

You manage a set of iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot copy data from a managed corporate app (e.g., Outlook) to a personal app (e.g., Gmail). The solution must not require user interaction. What should you configure?

Accepted Answer

Create an app protection policy with the 'Restrict cut, copy, and paste between other apps' setting set to 'Blocked'.. App protection policies in Intune provide granular control over data sharing between apps. The setting to restrict cut, copy, and paste between other apps, when set to Blocked, prevents data from being copied from a managed app to any unmanaged app. This is enforced at the app level and does not require user action.

Answer

Deploy a device configuration profile with the 'Allow copy and paste' setting set to 'Blocked'.

Answer

Set the 'Require managed pasteboard' option in the app configuration policy for Outlook.

Answer

Configure a conditional access policy that requires compliant devices.

Question 3

You manage a set of Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app that requires a specific registry key to exist before installation. The app installer does not check for this key. You must ensure the app installs only on devices that have the registry key. What should you do?

Accepted Answer

Add a requirement rule to the Win32 app that checks for the registry key.. Requirement rules in Intune are evaluated before app installation. By adding a rule that checks for the presence of a specific registry key, you ensure the app is only installed on devices that already have that key. This enforces the prerequisite automatically and reliably.

Answer

Use a PowerShell script in the app package to create the registry key before installation.

Answer

Deploy the app as available and instruct users to verify the registry key before installing.

Answer

Create a detection rule that checks for the registry key.

Question 4

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy Microsoft 365 Apps to all devices. The IT team wants to minimize administrative effort and ensure the apps are always up to date. What should they use?

Accepted Answer

Microsoft 365 Apps (Windows 10 and later) app type in Intune. The Microsoft 365 Apps app type in Intune is purpose-built for deploying and managing Office. It allows you to select apps, configure update channels, and automatically keep the apps up to date. This reduces administrative effort and ensures devices receive updates according to the chosen channel, making it the ideal solution for deploying Microsoft 365 Apps at scale.

Answer

PowerShell script that downloads and installs Office

Answer

Win32 app using the Office Deployment Tool

Answer

Microsoft Store app (new) for each Office app

Question 5

You manage macOS devices enrolled in Microsoft Intune using the Intune Company Portal app. Users report that the Company Portal app does not detect newly assigned required apps and shows an outdated compliance status. You need to ensure the Company Portal refreshes device state on demand. What should you do?

Accepted Answer

Instruct users to open Company Portal, select Devices, choose the device, and select Check status to force a sync. The macOS Company Portal app includes a Check status option that forces the device to check in with Intune, refreshing compliance and app assignment data. This is the correct self-service method for users to resolve stale Company Portal information without administrator intervention. Other actions such as re-authentication, admin-initiated sync, or re-enrollment either do not trigger a check-in or are unnecessarily disruptive.

Answer

From the Intune admin center, select the device and choose Sync to push a check-in to the macOS device

Answer

Delete the device record in Intune and have the user re-enroll the macOS device to refresh state

Answer

Instruct users to sign out of and back into the Company Portal app to refresh the device state

Question 6

You are configuring a Windows Autopilot deployment for devices that must be hybrid Microsoft Entra joined. The environment includes an on-premises Active Directory domain and Microsoft Entra Connect. You need to ensure the devices can complete the hybrid join during OOBE. Which configuration is required?

Accepted Answer

Configure the Autopilot deployment profile to use Microsoft Entra hybrid join and ensure the device can reach a domain controller and the Intune service during OOBE.. Hybrid Microsoft Entra join in Autopilot requires the deployment profile to specify that join type and requires network conditions that allow the device to contact a domain controller for the domain join and reach the cloud services for the Microsoft Entra join and Intune enrollment. Missing either condition prevents successful completion.

Answer

Deploy a VPN configuration profile that connects the device to the corporate network before the Autopilot profile is applied.

Answer

Configure the Autopilot deployment profile to use Microsoft Entra join and rely on Microsoft Entra Connect to convert the device to hybrid join after enrollment.

Answer

Enable Windows Hello for Business in the Autopilot deployment profile to trigger the hybrid join during OOBE.

Question 7

You are the Intune administrator for a company that uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to ensure that when devices enroll, they automatically receive a set of configuration settings, including a custom Start menu layout and specific Wi-Fi profiles. What should you create and assign?

Accepted Answer

A device configuration profile. Device configuration profiles are the correct choice for deploying settings like Start menu layout and Wi-Fi profiles to devices. They are declarative and ensure that settings are applied consistently. When assigned to groups, devices receive these configurations upon enrollment and check-in, meeting the requirement to automatically provision devices with specific settings.

Answer

An app configuration policy

Answer

A compliance policy

Answer

A PowerShell script deployed via Intune

Question 8

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is retired, all corporate data is removed but the user's personal files remain intact. The devices are enrolled as personal devices with work profiles. What should you do?

Accepted Answer

Use the 'Retire' action in Intune.. For personal devices enrolled with work profiles, the Retire action is designed to remove only corporate data and management profiles, leaving personal files untouched. This is the correct way to deprovision a personal device without affecting the user's personal data. A factory reset or Wipe would delete everything, which is not desired.

Answer

Use the 'Wipe' action in Intune.

Answer

Remove the device from the Azure AD group.

Answer

Perform a factory reset on the device.

Question 9

You manage a fleet of Windows 10 devices enrolled in Microsoft Intune. You need to ensure that devices receive quality updates with a maximum deferral of 7 days. What should you configure?

Accepted Answer

Windows Update rings in Intune.. Windows Update rings in Intune are specifically designed to manage update deferrals for quality and feature updates. By configuring a quality update deferral of 7 days, you ensure devices receive updates after that period. Other options either do not support deferral settings or are not the correct tool for Intune-managed devices.

Answer

Device compliance policy with a setting for update deferral.

Answer

Endpoint security policy for Windows Update.

Answer

Windows Update for Business configuration in Group Policy.

Question 10

You use Microsoft Intune to manage Windows devices. You deploy a Win32 app as required to a device group. The app's detection rule uses a file version check on `C:\Program Files\Contoso\app.exe`. Users report the app appears installed, but Intune repeatedly reinstalls it on every check-in. The app's installer does not actually place app.exe in that path; instead, it places it in `C:\Program Files (x86)\Contoso\`. What should you do?

Accepted Answer

Change the detection rule to check the correct path `C:\Program Files (x86)\Contoso\app.exe`.. Intune evaluates the detection rule at each check-in to decide whether the app is present. A rule that points to a file path where the executable was never installed always evaluates as not detected, so Intune believes the app is missing and reinstalls it. Correcting the detection rule to reference the actual installation path, Program Files (x86), allows detection to succeed and ends the repeated reinstallations.

Answer

Set the app's install behavior to user context so the file is placed in the correct path.

Answer

Increase the detection rule's version comparison to 'greater than or equal to' the installed version.

Answer

Add a requirement rule that the device runs a 64-bit version of Windows.

Question 11

You are the Endpoint Administrator for a company that uses Microsoft Intune to manage Windows 11 devices. The security team requires that Microsoft Edge be configured with a specific set of security settings, including blocking outdated plugins and enforcing SmartScreen. You need to deploy these settings to all Windows 11 devices with minimal administrative effort. What should you do?

Accepted Answer

Create a device configuration profile with the 'Administrative Templates' profile type and configure the Microsoft Edge settings.. Administrative Templates in Intune provide a streamlined way to configure Microsoft Edge policies using the same ADMX-backed settings that Group Policy uses. They are built into Intune, require no custom scripting, and can be assigned to device groups. This meets the requirement to deploy security settings with minimal administrative effort.

Answer

Deploy a PowerShell script that modifies the registry to set the required Edge policies.

Answer

Create a custom configuration profile using the Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings.

Answer

Use the Microsoft 365 Apps for enterprise deployment to include Edge settings in the Office Configuration Service.

Question 12

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to ensure that when a device is retired, the primary user's corporate data is removed but the device remains enrolled and managed. Which action should you take in the Intune admin center?

Accepted Answer

Use Selective wipe.. Selective wipe is the action that removes corporate data from a device while preserving personal data and keeping the device enrolled in Intune. Wipe and reset remove all data and unenroll the device, while retire removes corporate data but also unenrolls the device. Only selective wipe satisfies both conditions of removing corporate data and maintaining enrollment.

Answer

Wipe the device.

Answer

Retire the device.

Answer

Reset the device.

Question 13

You are responsible for managing Windows 10 devices with Microsoft Intune. You need to deploy a new line-of-business (LOB) app to a group of devices. The app requires a script to run after installation to configure settings. What should you use to deploy the app and ensure the script runs?

Accepted Answer

Add the app as a Win32 app and include the script in the install command.. Win32 apps in Intune support custom install commands, allowing you to run additional scripts after the main installer. By appending the script execution to the install command, you ensure it runs immediately after installation. This is a common method for configuring LOB apps that require post-installation steps. Other options like requirement or detection rules are not designed for executing configuration scripts.

Answer

Add the app as a Win32 app and include the script as a detection rule.

Answer

Add the app as a Microsoft Store app and use a PowerShell script to configure settings.

Answer

Add the app as a Win32 app and include the script as a requirement rule.

Question 14

You are deploying a Win32 app to Windows devices using Microsoft Intune. The app requires a specific registry key to be present for detection. You also need to ensure the app installs only on devices running Windows 11 version 22H2 or later. Which two actions must you perform when creating the app? (Choose two.)

Accepted Answer

Configure a detection rule that checks for the registry key.. To ensure the app installs only on Windows 11 22H2 or later, a requirement rule for the OS version is necessary. To verify the app is installed by checking for a specific registry key, a detection rule must be configured. These two actions directly address the deployment conditions described in the scenario.

Answer

Set the install command to include a check for the registry key.

Answer

Configure the app to run in system context.

Answer

Add a dependency on a previous version of the app.

Question 15

You are planning to deploy Windows 11 devices using Windows Autopilot in Microsoft Intune. The company requires that the devices are Microsoft Entra joined and that the enrollment process includes the installation of required applications and configuration of device settings. You need to identify which two components are required to achieve this. (Choose two.)

Accepted Answer

Enrollment Status Page (ESP).. The Autopilot deployment profile defines the join type and OOBE settings, ensuring the device joins Microsoft Entra ID. The Enrollment Status Page (ESP) ensures that required applications and configurations are applied before the user reaches the desktop. Together, they meet the requirement of Microsoft Entra join with app installation and device configuration during enrollment. The other options are either for hybrid join, alternative provisioning, or post-enrollment security.

Answer

Microsoft Intune Connector for Active Directory.

Answer

Windows Configuration Designer package.

Answer

Device-based conditional access policy.