MD-102 Practice Test 37 — 15 Questions

Question 1

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to ensure that devices automatically receive quality updates and feature updates according to a schedule you define, with the ability to pause updates. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Update rings in Intune.. Windows Update rings in Intune are specifically designed to manage and schedule Windows updates, including quality and feature updates. They provide settings for deferral, deadlines, active hours, and the ability to pause updates. This directly addresses the requirement to schedule updates and allow pausing. Other options do not offer the same level of update control.

Answer

Compliance policies for Windows 10 devices.

Answer

Endpoint security policies for update management.

Answer

Device configuration profiles for Windows Update for Business.

Question 2

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. You need to ensure that when a device is reported as lost or stolen, you can remotely wipe the device and prevent access to corporate data. Which action should you perform?

Accepted Answer

Wipe the device. The wipe action remotely resets the device to factory settings, removing all data and preventing access. This is the correct choice for lost or stolen devices because it ensures corporate data is not accessible. Retire, reset, and Fresh Start do not provide the same immediate data protection and remote wipe capability for lost devices.

Answer

Fresh Start the device

Answer

Reset the device

Answer

Retire the device

Question 3

You manage Windows 11 devices in Microsoft Intune. A compliance policy named 'Win11-Compliance' is assigned to all users. You need to prevent users whose devices are not compliant with 'Win11-Compliance' from accessing Microsoft 365 apps, but you want to allow a 30-minute grace period before access is blocked. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires compliant devices, and set the 'Grant' control to 'Require device to be marked as compliant'. Then, in the compliance policy, set the 'Action for noncompliance' to 'Mark device noncompliant' after 30 minutes.. To allow a grace period before blocking access, you must delay the device being marked noncompliant. Conditional Access itself does not provide a grace period. By configuring the compliance policy to mark the device noncompliant after 30 minutes, the device remains compliant during that time, and Conditional Access continues to allow access. After the delay, the device becomes noncompliant and access is blocked.

Answer

Create a Conditional Access policy that requires compliant devices, and set the 'Grant' control to 'Require device to be marked as compliant' with a 30-minute session lifetime.

Answer

Create a Conditional Access policy that requires compliant devices, and configure the 'Grant' control to 'Require device to be marked as compliant' with a 30-minute grace period.

Answer

In the compliance policy, set 'Mark device noncompliant' to 30 minutes and assign the policy to all users.

Question 4

You administer Microsoft Intune for Northwind Traders. The security team wants to prevent users from enrolling personally owned Windows 10 devices while still allowing corporate-owned devices to enroll. You need to configure a device enrollment restriction that blocks personal Windows devices. Which platform setting should you modify?

Accepted Answer

Windows (MDM). Intune device enrollment restrictions are configured per platform. Windows 10 and Windows 11 devices that enroll in MDM use the Windows (MDM) platform. To block personal Windows devices while allowing corporate ones, an administrator sets the Windows (MDM) platform to Block for personally owned devices. Other platform entries such as Windows (ConfigMgr) or Windows Mobile do not apply to standard Windows 10 MDM enrollment.

Answer

Windows Mobile

Answer

Windows (ConfigMgr)

Answer

Windows (MDM) under Corporate Device Identifiers

Question 5

You use Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy to require that devices have a specific minimum OS version and that BitLocker is enabled. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Minimum OS version. To enforce a minimum OS version and BitLocker, you configure the Minimum OS version setting and the Require BitLocker setting in the Windows compliance policy. These settings directly map to the requirements. Secure Boot, code integrity, and antivirus are separate security controls that do not address the specific needs of the scenario.

Answer

Require antivirus

Answer

Require Secure Boot

Answer

Require code integrity

Question 6

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant, the user receives a notification email, and the device is automatically retired after 30 days. The solution must minimize administrative effort. What should you configure?

Accepted Answer

A compliance policy with actions for non-compliance: send email to user at 0 days, and retire device at 30 days.. Compliance policies are the correct tool to automate actions based on noncompliance. You can configure an action to send an email to the user immediately when the device becomes noncompliant, and another action to retire the device after 30 days. This requires only one policy and minimal administrative effort.

Answer

A Windows Update ring with a deadline of 30 days and an automatic retirement action.

Answer

A device configuration profile with a custom OMA-URI to send email and retire the device after 30 days.

Answer

An Intune device cleanup rule that retires devices after 30 days of inactivity and sends an email.

Question 7

You use Microsoft Intune to manage Windows 11 devices. You configure a Windows Update ring policy to defer quality updates by 7 days and feature updates by 60 days. A critical security update is released that must be installed immediately on all devices, bypassing the deferral. What should you configure?

Accepted Answer

Use expedited updates in Microsoft Intune to deploy the specific security update to all devices.. Expedited updates in Microsoft Intune are specifically designed to deploy a particular Windows quality update immediately, overriding deferrals and other update ring settings. This is the correct approach for critical security updates that cannot wait. Other methods either do not bypass deferrals or affect all updates rather than the specific one.

Answer

Deploy a PowerShell script that runs the Windows Update client to install all available updates.

Answer

Create a new Windows Update ring policy with a deadline of 0 days and assign it to all devices.

Answer

Modify the existing Windows Update ring policy to set the quality update deferral to 0 days.

Question 8

A company uses Microsoft Intune to manage Windows 11 devices. You deploy a required Win32 app that installs a line-of-business tool. Two weeks later, the vendor releases a new version that must replace the old one. You need to ensure devices upgrade to the new version without user interaction and that the old version is removed first. What should you configure?

Accepted Answer

Create a new Win32 app for the updated version and configure a supersedence relationship from the new app to the old app.. Supersedence is the supported Intune mechanism for replacing one Win32 app with another. By defining the relationship from the new app to the old one and choosing to uninstall the previous version, you get a silent, managed upgrade. Assigning the new app as required ensures every targeted device transitions automatically, satisfying both the replacement and no-user-interaction requirements.

Answer

Deploy a PowerShell platform script that calls the vendor's installer and then deletes the old app registration.

Answer

Create a new Win32 app for the updated version and assign it as available to the same group.

Answer

Update the existing Win32 app by uploading the new installer to the same app record.

Question 9

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to implement a policy that requires devices to meet specific hardware and software conditions before they can access corporate email. The policy must evaluate the device's encryption status, OS version, and whether it has a firewall enabled. What should you create?

Accepted Answer

A device compliance policy that includes the required conditions, and then a Conditional Access policy that requires a compliant device.. To evaluate specific device conditions and control access, you must use a device compliance policy to assess the settings and a Conditional Access policy to enforce the requirement. The compliance policy checks encryption, OS version, and firewall; Conditional Access then blocks non-compliant devices from accessing email. This is the standard Intune and Microsoft Entra ID integration.

Answer

A Conditional Access policy that requires a compliant device.

Answer

An app protection policy that requires a PIN and blocks jailbroken devices.

Answer

A device configuration profile that enforces encryption, OS version, and firewall settings.

Question 10

You are the endpoint administrator for a company that uses Microsoft Intune. You need to ensure that when a Windows 11 device is retired or wiped, the device record is automatically removed from Intune after 30 days. Which action should you take?

Accepted Answer

Configure a device cleanup rule in the Intune tenant settings.. The device cleanup rule in Intune tenant settings automatically deletes devices that have not checked in for a specified number of days. Setting it to 30 days removes records for retired or wiped devices that no longer communicate. Dynamic groups, compliance policies, and Entra ID retention policies do not delete Intune device records, so they cannot fulfill this requirement.

Answer

Assign a compliance policy that marks devices as noncompliant after 30 days.

Answer

Create a dynamic device group based on the enrollment date.

Answer

Enable automatic enrollment for all users and set a retention policy in Microsoft Entra ID.

Question 11

A company uses Microsoft Intune to manage Windows devices. Administrators need to deploy Microsoft 365 Apps to all managed Windows devices and ensure the apps receive updates automatically from the Microsoft 365 Apps update channel. Which Intune app type should they use?

Accepted Answer

Microsoft 365 Apps (Windows 10 and later). Intune includes a dedicated Microsoft 365 Apps (Windows 10 and later) app type that integrates with the Office Configuration Service. It lets administrators choose the update channel, select which Office applications to install, and configure update behavior, then assign the app to device groups. This provides automatic installation and ongoing updates from the chosen channel, which is exactly what the scenario requires.

Answer

Windows app (Win32)

Answer

Microsoft Store app (new)

Answer

Web link

Question 12

You are preparing to deploy a Win32 app to Windows 11 devices with Microsoft Intune. The app must install silently and be reported as installed only when a specific file exists at a known path. Which TWO configuration elements are required for Intune to evaluate and report the app as installed? (Choose two.)

Accepted Answer

An install command that runs the app's silent installer. For Intune to install and then report a Win32 app as installed, the app needs both an install command that invokes the silent installer and a detection rule that identifies the app on the device. The detection rule is what the Intune Management Extension evaluates after installation, and the install command is what it executes to place the app on the device.

Answer

A PowerShell script that writes a marker file after installation

Answer

A return code mapping that treats 3010 as a soft reboot

Answer

A requirement rule that limits installation to Windows 11

Question 13

You manage Windows devices with Microsoft Intune. You deploy a Win32 app that requires a specific registry key to be present before installation. You need to ensure the app installs only on devices that have the registry key. What should you configure?

Accepted Answer

A requirement rule in the app's properties.. Requirement rules in Intune Win32 app properties allow you to specify conditions that must be met for the app to be installed. You can check for a registry key, file, or other conditions. If the requirement is not met, the app is not installed. This is the correct method to ensure installation only on devices with the specific registry key.

Answer

A dependency on another app that creates the registry key.

Answer

A PowerShell script that checks for the registry key and installs the app if present.

Answer

A detection rule in the app's properties.

Question 14

A help desk technician reports that a Windows 11 device enrolled in Microsoft Intune has not received a newly assigned configuration profile. The device shows as compliant in the admin center. You need to force the device to check in with Intune immediately. What should you do?

Accepted Answer

From the device overview in the Intune admin center, select Sync to trigger a check-in. The Sync action in the Intune admin center sends a remote check-in request to the device, causing it to contact the service and apply any pending policies or profiles. It is the correct, non-destructive way to force an immediate check-in when a device appears healthy but has not yet received a newly assigned configuration. Other device actions such as Retire or Fresh Start are destructive and unrelated to policy refresh.

Answer

From the device overview, select Retire to remove corporate data and force a re-enrollment

Answer

From the device overview, select Collect diagnostics to gather logs and force a policy refresh

Answer

From the device overview, select Fresh Start to reset the device and reapply all policies

Question 15

You are preparing infrastructure for device management in Microsoft Intune. Your organization plans to deploy Windows 11 devices using Windows Autopilot in Microsoft Entra join mode. You need to ensure that the devices can be identified and assigned to the correct deployment profile. Which two actions must you perform? (Choose two.)

Accepted Answer

Register the device hardware hash in Intune.. To identify and assign Autopilot devices, you must register the hardware hash in Intune and create an Autopilot deployment profile assigned to a device group. The hardware hash allows Intune to recognize the device as an Autopilot device, and the profile determines the deployment settings. Without these two actions, the device will not receive the intended Autopilot configuration.

Answer

Deploy the Intune Company Portal app to all devices.

Answer

Enable automatic enrollment in Intune for all users.

Answer

Configure a conditional access policy requiring compliant devices.