MD-102 Practice Test 37 — 15 Questions

Question 1

Which TWO settings can be configured in a Windows 10 device restriction profile in Intune to enhance security?

Accepted Answer

Disable the camera. Options C and D are correct. Disabling the camera (C) reduces the attack surface by preventing unauthorized camera usage, and requiring a password (D) enforces authentication to unlock the device. Option A (BitLocker) is an encryption setting, not a device restriction profile setting. Option B (disable copy/paste) is an app restriction, not a device restriction. Option E (Windows Update for Business) is configured in an update policy, not a device restriction profile.

Answer

Require BitLocker encryption

Answer

Disable copy and paste between apps

Answer

Configure Windows Update for Business settings

Question 2

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

Accepted Answer

Upload the script as a PowerShell script in Intune and assign it to the device group.. Intune's 'PowerShell scripts' feature allows you to upload and assign scripts that run under the system context during device enrollment, specifically targeting devices in a group. This is the only native Intune method that executes scripts in the system context at enrollment time without additional configuration.

Answer

Deploy the script as a proactive remediation.

Answer

Use a device compliance policy to trigger the script.

Answer

Create a custom configuration profile to run the script.

Question 3

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device running Windows 10 version 20H2 (OS build 19042.1234) reports as compliant. However, the device does not have BitLocker enabled. Why is the device compliant?

Accepted Answer

The storageRequireEncryption setting is evaluated but not enforced because the device doesn't support encryption.. The storageRequireEncryption setting in the compliance policy requires encryption, but it is only evaluated and not enforced if the device does not support encryption (e.g., lacks TPM or compatible hardware). The device is correctly reported as compliant because the setting is not applicable. Option B is incorrect because the report is accurate; the policy is not enforced due to lack of support. Option C is incorrect because the password requirement is unrelated to the encryption compliance. Option D is incorrect because an OS version above the minimum does not override the encryption requirement; the device would be non-compliant if encryption were enforced.

Answer

The device is not actually compliant; the report is incorrect.

Answer

The password requirement is not enforced because passwordRequiredType is set to deviceDefault.

Answer

The OS version is above the minimum, so compliance is granted regardless of encryption.

Question 4

Refer to the exhibit. An Intune compliance policy JSON for Windows 10 devices. A device with OS version 10.0.19041.1 and no encryption reports as noncompliant. What is the most likely reason?

Accepted Answer

The device does not have BitLocker encryption enabled.. The compliance policy specifies storageRequireEncryption: true, but the device does not have BitLocker encryption enabled, causing noncompliance. Option A is incorrect because the OS version 10.0.19041.1 is below the maximum allowed (10.0.19044.1). Option B is incorrect because 'deviceDefault' allows any valid Windows password type, including numeric PIN. Option C is incorrect because the OS version is above the minimum required (10.0.19041.0).

Answer

The OS version exceeds the maximum allowed version.

Answer

The password type is set to 'deviceDefault' which does not support numeric PIN.

Answer

The OS version is below the minimum requirement.

Question 5

Refer to the exhibit. You are creating a device filter in Microsoft Intune to target a policy to Windows 10 Pro devices. The filter should only apply to devices running OS build 1904x (20H1 or later). However, some devices with build 1904x and SKU Professional are not receiving the policy. What is the most likely reason?

Accepted Answer

The device.skuFamily property value is case-sensitive and may not match 'Professional'.. The `device.skuFamily` property in Microsoft Intune is case-sensitive. When creating a device filter rule, the value 'Professional' must exactly match the case of the SKU family string returned by the device. If the actual SKU family is reported as 'Professional' with a different casing (e.g., 'professional' or 'PROFESSIONAL'), the filter will not match, causing the policy not to apply to those devices.

Answer

The -startsWith operator does not work for osVersion property.

Answer

The device must be enrolled via Autopilot for filters to apply.

Answer

The filter rule syntax is incorrect because of the parentheses.

Question 6

You need to wipe a lost corporate-owned iOS device that is enrolled in Intune. Which action should you perform?

Accepted Answer

Wipe the device.. The correct action is to wipe the device because a corporate-owned iOS device that is lost requires a full factory reset to remove all data and prevent unauthorized access. In Microsoft Intune, the 'Wipe' action performs a factory reset, returning the device to its out-of-box state and removing all corporate and personal data, which is appropriate for a lost corporate-owned device.

Answer

Delete the device from Intune.

Answer

Retire the device.

Answer

Disable the device.

Question 7

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

Accepted Answer

The BitLocker recovery key is not escrowed to Microsoft Entra ID. The compliance policy is configured to require BitLocker, but Intune's 'Require BitLocker' setting in compliance policies actually checks both that BitLocker is enabled and that the recovery key is escrowed to Microsoft Entra ID. Even if BitLocker is actively encrypting the drive, failure to escrow the key results in non-compliance. This is why the device is marked non-compliant despite BitLocker being turned on.

Answer

BitLocker is only enabled on data drives, not the system drive

Answer

The device is running a version of Windows that does not support BitLocker

Answer

The device does not have a TPM chip

Question 8

Refer to the exhibit. You run the PowerShell cmdlet in Microsoft Graph to list managed Windows devices. The output shows that several devices have a complianceState of 'noncompliant' but lastSyncDateTime is recent. What is the most likely reason for noncompliance?

Accepted Answer

The devices do not meet the assigned compliance policies.. A device's complianceState is determined by evaluating its configuration against assigned compliance policies. Even if lastSyncDateTime is recent, the device will be marked 'noncompliant' if it fails any of the policy checks (e.g., missing required updates, encryption not enabled, or a required antivirus solution not running). The sync timestamp only indicates when the device last communicated with Intune, not whether it meets policy requirements.

Answer

The devices are running a non-Windows OS.

Answer

The devices have not synced recently.

Answer

The admin lacks permissions to view compliance details.

Question 9

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

Accepted Answer

The OS build is greater than the maximum version specified.. The policy defines the maximum OS version as 10.0.22621.0 (Windows 10 22H2), but the device is running a build that exceeds this maximum. Although the device build is 22621, the policy may interpret the build range as exclusive, or the device has a newer build (e.g., 22631) that is greater than the maximum. In either case, the OS build is greater than the allowed maximum, causing non-compliance. Option A is incorrect because the validOperatingSystemBuildRanges property is not the issue. Option C is incorrect because the build is not less than the minimum version. Option D is incorrect because the policy does not require a password.

Answer

The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.

Answer

The OS build is less than the minimum version.

Answer

The policy requires a password but the devices have no password.

Question 10

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that only approved corporate apps can be installed on work profiles. What should you configure?

Accepted Answer

App configuration policy for managed Google Play. To restrict app installation on Android Enterprise work profiles to only approved corporate apps, you must configure an app configuration policy for managed Google Play. This policy enforces a list of required and allowed apps, preventing users from installing unapproved apps from the Play Store on the work profile. Device compliance and conditional access policies control access to resources, not app installation, while device restrictions lack the granularity to enforce app whitelisting on managed Google Play.

Answer

Device compliance policy to block noncompliant devices

Answer

Device restrictions configuration profile

Answer

Conditional access policy to require approved apps

Question 11

You need to configure a Windows 10 device to automatically install updates from a specific branch readiness level. Which setting in the Update ring policy should you configure?

Accepted Answer

Branch readiness level. The Branch readiness level setting in an Update ring policy directly controls which Windows Insider or semi-annual channel (e.g., Preview, Broad) a device receives updates from, determining the specific branch readiness level for automatic updates. This is the correct setting to configure when you need to specify a branch readiness level for automatic installation.

Answer

Automatic update behavior

Answer

Quality update deferral period

Answer

Feature update deferral period

Question 12

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL.

You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16.

What is the most likely cause of the configuration not applying?

Accepted Answer

The devices are not supervised. App configuration policies for iOS devices require the device to be supervised, especially when using VPP tokens. The 'Pending' status indicates the policy has not been applied because the devices are not supervised. Option A is wrong because the app installs successfully, indicating iOS version compatibility. Option B is wrong because the policy is assigned to the same group, but supervision is still required. Option D is wrong because the app is deployed via VPP correctly; the issue is with configuration policy enforcement, not VPP deployment.

Answer

The iOS version does not support app configuration

Answer

The app configuration policy is not assigned to the correct group

Answer

The app is not deployed via VPP correctly

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a set of Line-of-Business (LOB) apps using the Microsoft Intune Management Extension. Which THREE conditions must be met?

Accepted Answer

The Microsoft Intune Management Extension must be installed on the device. The correct options are B, C, and E. B: The Intune Management Extension must be installed on the device to deploy LOB apps. C: The device must have connectivity to Microsoft Intune for the management extension to communicate. E: The device must be Azure AD joined or hybrid Azure AD joined to support Intune management. Option A is incorrect because the app is deployed in system context, not user context. Option D is incorrect because co-management with Configuration Manager is not required for deploying LOB apps via Intune Management Extension.

Answer

The app must be deployed in user context

Answer

The devices must be co-managed with Microsoft Configuration Manager

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a Windows 10 feature update policy to keep devices on a specific version. After deployment, some devices report that the update is not being offered. The devices are not in a maintenance window. What is the most likely cause?

Accepted Answer

Windows Update for Business deferral or pause settings are blocking the update. The most likely cause is that Windows Update for Business deferral or pause settings are blocking the update. Feature update policies in Intune rely on Windows Update for Business to deliver updates. If a device has deferral periods set (e.g., for quality or feature updates) or has updates paused, the policy will not apply until those settings are cleared. Options A and D are incorrect: a newer build does not prevent the policy from targeting, and devices not in a maintenance window would still receive updates. Option C is possible but less likely, as the policy assignment would typically be verified before deployment.

Answer

The devices are running a build that is newer than the target version

Answer

The policy is not assigned to the correct group

Answer

The devices are in a maintenance window that blocks updates

Question 15

Refer to the exhibit. An Intune admin configures the above Windows Update for Business policy. Users report that quality updates are not being installed until 7 days later than expected. What is the likely reason?

Accepted Answer

Quality updates are deferred by 7 days. QualityUpdateDeferralPeriodInDays is set to 7, which defers updates by 7 days. This is the intended behavior; no issue. However, the question implies users think updates are late. The policy is correct; perhaps users misunderstand. But the question asks for likely reason. The deferral period is 7 days, so updates are intentionally deferred. The update notification level is default. Feature updates deferred 30 days. No pause. So the quality update deferral is the cause.

Answer

Quality updates are paused

Answer

Feature updates are deferred by 30 days

Answer

Update notifications are set to default