MD-102 Practice Test 36 — 15 Questions

Question 1

An IT administrator needs to ensure that iOS devices enrolled in Intune require a PIN of at least 6 digits. Where should the administrator configure this setting?

Accepted Answer

Device compliance policy for iOS. Evice compliance policy for iOS. Device compliance policies can enforce device-level settings such as requiring a PIN of at least 6 digits on iOS devices. Option A (App protection policy) applies to apps, not device-level PIN. Option C (Conditional Access policy) controls access based on conditions, not device settings. Option D (Enrollment restrictions) governs device enrollment, not post-enrollment settings.

Answer

App protection policy

Answer

Conditional Access policy

Answer

Enrollment restrictions

Question 2

You have assigned the above compliance policy to all Windows 10 devices. A user's device shows as noncompliant with a reason of 'TPM not found'. What should you do to resolve the issue?

Accepted Answer

Create a new compliance policy without the TPM requirement and assign it to devices without TPM.. The device lacks TPM hardware, so the compliance policy requirement for TPM cannot be met. The appropriate solution is to create a separate compliance policy without the TPM requirement and assign it to devices that do not have TPM, ensuring those devices can still be compliant without compromising security requirements for TPM-capable devices.

Answer

Disable the TPM requirement in the policy.

Answer

Assign the policy to a different group that excludes those devices.

Answer

Change the password complexity requirement to 'none'.

Question 3

Your organization has 500 Windows 11 devices managed by Microsoft Intune. You need to deploy a third-party Win32 application (AppDeploy.exe) that requires the user to accept an end-user license agreement (EULA) during installation. The app must be installed silently without user interaction. You have created a custom script that accepts the EULA automatically. The app is packaged as an .intunewin file. You need to configure the deployment in Intune.

The installation command must run the script that accepts the EULA and then launches the installer. The detection rule must check for the presence of a specific file (C:\Program Files\AppDeploy\app.exe). You want to ensure that if the installation fails, Intune retries automatically.

Which of the following configurations should you choose?

Accepted Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1 && AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: 3 attempts every 60 minutes. The install command uses a PowerShell script to first accept the EULA (AcceptEULA.ps1), then runs the installer silently with AppDeploy.exe /S. The detection rule checks for the file at C:\Program Files\AppDeploy\app.exe, which verifies installation. The retry settings (3 attempts every 60 minutes) ensure automatic retry on failure. Option B is wrong because it does not include the EULA acceptance. Option C is wrong because it only runs the script without launching the installer, so the app never installs. Option D is wrong because it has no retry settings.

Answer

Install command: 'AppDeploy.exe /S', Detection rule: Registry 'HKLM\Software\AppDeploy\Installed' exists, Retry: 3 attempts every 60 minutes

Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Answer

Install command: 'AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Question 4

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

Accepted Answer

PowerShell scripts (Devices > Scripts). PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Answer

Proactive remediations

Answer

Compliance policy

Answer

Device configuration profile

Question 5

You need to remotely wipe a lost corporate-owned iOS device enrolled in Microsoft Intune. The device is currently offline. What will happen when the device comes online?

Accepted Answer

The device will receive the wipe command the next time it checks in with Intune.. When a remote wipe command is issued for an offline iOS device enrolled in Microsoft Intune, the command is stored in the Microsoft Intune service. The device will receive and execute the wipe command the next time it checks in with the Intune service, regardless of whether it is supervised or not. This check-in occurs periodically (typically every 8 hours) or when the device is powered on and connected to the internet.

Answer

The device must be unenrolled first and then wiped.

Answer

The device will be wiped immediately after a grace period of 24 hours.

Answer

The wipe command will be queued only if the device is supervised.

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive data from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on app and device context. By configuring a session policy with the condition 'Device tag equals Unmanaged' and the control 'Block download', you can automatically block downloads of sensitive data from SharePoint Online to unmanaged devices, leveraging reverse proxy architecture to inspect and intercept traffic.

Answer

Activity policy

Answer

App discovery policy

Answer

Access policy

Question 7

Your organization is deploying Windows Autopilot self-deploying mode for kiosk devices. The devices will be used in a public area and must not require user interaction during the initial setup. What is the prerequisite for this deployment?

Accepted Answer

The device must have a TPM 2.0 chip.. Windows Autopilot self-deploying mode relies on the device's TPM 2.0 chip to cryptographically attest its identity to Microsoft Entra ID without any user interaction. The TPM 2.0 provides hardware-bound keys that enable the device to authenticate itself and automatically enroll, which is essential for kiosk devices in public areas where no user credentials can be supplied during initial setup.

Answer

A user must be assigned to the device in Microsoft Entra ID.

Answer

An enrollment profile must be assigned to the user.

Answer

The device must be added to Microsoft Entra ID manually.

Question 8

You are implementing Windows Autopilot for a new fleet of devices. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and is enrolled in Intune. Which configuration is required?

Accepted Answer

Create an Autopilot deployment profile assigned to the devices.. An Autopilot deployment profile specifies the out-of-box experience (OOBE) settings, including the option to automatically join the device to Microsoft Entra ID and enroll it in Intune. Without a deployment profile assigned to the device, Autopilot will not enforce these behaviors during OOBE.

Answer

Upload corporate identifiers for each device.

Answer

Configure the Enrollment Status Page in Intune.

Answer

Create a dynamic device group in Microsoft Entra ID.

Question 9

A company uses Microsoft Intune to manage Windows 10 devices. Users report that some required line-of-business (LOB) apps are not being installed on their devices. The apps are assigned as 'Required' to a device group that includes the affected devices. Which two actions should the administrator take to troubleshoot the issue? (Choose two.)

Accepted Answer

Review the Intune Management Extension logs on a device for installation errors.. The Intune Management Extension (IME) is the component responsible for deploying Win32 and line-of-business (LOB) apps on Windows 10 devices. Reviewing its logs (located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs) provides detailed error messages, such as download failures, dependency issues, or script execution errors, which directly indicate why a required app failed to install.

Answer

Uninstall the app from the affected devices and reassign it as Required.

Answer

Reassign the app to the device group with a different assignment type.

Answer

Run gpresult /r on a device to confirm the app assignment policy is applied.

Question 10

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a PKG app that requires reboot. Which app type should you select?

Accepted Answer

macOS LOB app. A macOS LOB (line-of-business) app type is required because Intune uses this type to deploy PKG files that can include installation scripts and handle reboots. The LOB app type supports the .pkg format natively and allows Intune to manage the installation lifecycle, including required reboots, through the Intune management agent on macOS.

Answer

macOS web app

Answer

Microsoft 365 for macOS

Answer

macOS DMG app

Question 11

A user reports that their Windows 10 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which of the following is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently.. A device must check in with Intune to receive and report compliance policies. The 'Not evaluated' status indicates that Intune has not received a recent health check from the device. The default check-in interval is approximately 8 hours, but it can be forced manually via Settings > Accounts > Access work or school > Info > Sync or by running the command 'dsregcmd /sync'.

Answer

The MDM authority is set to Configuration Manager.

Answer

The compliance policy is set to 'Not applicable' due to OS version.

Answer

BitLocker encryption is enabled on the device.

Question 12

Which THREE of the following are requirements for deploying a Win32 app via Microsoft Intune?

Accepted Answer

The app must be assigned to a group of users or devices.. In Microsoft Intune, a Win32 app must be assigned to at least one group of users or devices to be deployed. Without an assignment, the Intune Management Extension will not receive the policy to download and install the application on the targeted devices.

Answer

The device must have the Intune Management Extension installed separately.

Answer

The app installation files must be hosted on an external web server.

Question 13

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the system context during automatic enrollment. The script must run before the user logs on. Which approach should you use?

Accepted Answer

Add the script as a device management extension (PowerShell script) in Intune, assigned to 'All Devices'.. Device management extension (PowerShell scripts) in Microsoft Intune run in the system context and execute during automatic enrollment before the user logs on. This is the only Intune method that supports system-context script execution at enrollment time without requiring a user session.

Answer

Assign the script as a compliance policy remediation.

Answer

Deploy the script as a proactive remediation in Microsoft Intune.

Answer

Embed the script in a device configuration profile using a custom OMA-URI.

Question 14

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a PowerShell script that runs in the user context during device enrollment. Which two conditions must be met? (Select TWO.)

Accepted Answer

The script must be assigned to the user scope.. PowerShell scripts deployed via Microsoft Intune that run in the user context must be assigned to user groups (user scope). When a script is assigned to users, it executes under the user's security context during enrollment, allowing access to user-specific resources and settings. Assigning to device groups would run the script in the system context, which does not satisfy the requirement for user-context execution.

Answer

The script must be saved as a .psm1 file.

Answer

The script must be assigned to device groups.

Answer

The script must be added via a custom OMA-URI policy.

Question 15

Refer to the exhibit. You create a custom configuration profile in Intune for Windows 10 devices. The profile is assigned to a test device, but the telemetry setting is not applied. The device is managed and compliant. What is the most likely reason?

Accepted Answer

The AllowTelemetry policy value must be an integer, not a string, or the device needs a Windows 10 version that supports this setting.. The AllowTelemetry setting in a custom OMA-URI profile requires the value to be an integer (0–3) and the device must be running Windows 10 version 1703 or later. If the value is entered as a string (e.g., "2" instead of 2), Intune will not apply the policy, and the device will silently ignore the configuration. Additionally, older Windows 10 builds do not support this OMA-URI path and will fail to process it.

Answer

The device is not compliant with the baseline policy.

Answer

The OMA-URI path for AllowTelemetry is incorrect.

Answer

The custom profile conflicts with a built-in policy that sets telemetry to full.