MD-102 Practice Test 38 — 15 Questions

Question 1

You are troubleshooting an Intune-managed iOS device that cannot install a VPP (Volume Purchase Program) app. The device shows a 'License Not Found' error. The app is assigned as 'Available' without device enrollment. What is the most likely cause?

Accepted Answer

The device is enrolled without user affinity (device enrollment).. Option B is correct because VPP apps require user enrollment for Apple VPP token to assign licenses; device enrollment does not support user-based licensing. Option A is wrong because app removal policy is irrelevant. Option C is wrong because device compliance is not the issue. Option D is wrong because the token is valid.

Answer

The app is configured to remove when the device leaves management.

Answer

The Apple VPP token has expired.

Answer

The device is not compliant with conditional access policies.

Question 2

Refer to the exhibit. You are reviewing a Win32 app deployment configuration in Microsoft Intune. The detection rule checks for a registry key under HKLM. The app is set to install in user context. A user reports that the app appears as 'Installed' for some users but not others on the same device. What is the most likely cause?

Accepted Answer

The detection rule uses HKLM but the app installs per user, so the key may not exist for all users.. Option A is correct because the detection rule uses HKLM (machine-level), but the app installs per user; the detection might succeed for one user and not another if the registry key is written per user. Option B is wrong because 32-bit on 64-bit is false. Option C is wrong because detection type 'exists' does not check value. Option D is wrong because install context does not affect detection rule location.

Answer

The detection type 'exists' should be 'value' to check the DisplayName.

Answer

The install experience should be 'system' to write to HKLM.

Answer

The 'check32BitOn64System' flag is set to false, causing detection to fail on 64-bit systems.

Question 3

You are troubleshooting an Intune deployment of a line-of-business (LOB) app for iOS. The app fails to install on some devices with error '0x87D13B9F'. Which THREE actions should you take to diagnose the issue?

Accepted Answer

Check if the device is supervised and that the app requires supervised mode. Options A, B, and E are correct. Verify the app is signed with a valid Apple Developer Enterprise certificate; expired certificates cause failures. Check that the device is not supervised if required; some LOB apps require supervised mode. Ensure the device has enough storage; error can be storage-related. Option C is wrong because Intune Service Health is not specific to app deployment. Option D is wrong because app configuration policies are optional.

Answer

Check the Intune Service Health dashboard for service incidents

Answer

Ensure that an app configuration policy is assigned to the device

Question 4

Which TWO of the following are valid enrollment methods for Windows 10 devices in Microsoft Intune?

Accepted Answer

Windows Autopilot. Azure AD Join and Autopilot are valid enrollment methods. Option A is correct because Azure AD Join is a standard enrollment. Option B is correct because Windows Autopilot is a zero-touch enrollment method. Option C is incorrect because 'Device enrollment manager' is a role, not a method. Option D is incorrect because 'Bulk enrollment' is not a method but a process using provisioning packages. Option E is incorrect because 'Apple Business Manager' is for iOS/macOS.

Answer

Device enrollment manager (DEM)

Answer

Bulk enrollment with provisioning package

Answer

Apple Business Manager

Question 5

A user reports that a required line-of-business (LOB) app does not appear on their Windows 11 device enrolled in Microsoft Intune. The app was deployed as a 'Required' assignment to a dynamic device group. The device is compliant and shows as 'Active' in Intune. What is the most likely cause?

Accepted Answer

The device was offline during the last check-in.. Option C is correct because the device might have been offline when the policy evaluation occurred, and the app installation may be pending. Option A is wrong because assignment filters are not mentioned. Option B is wrong because user-targeted apps are different. Option D is wrong because the app is not managed by Microsoft Store for Business.

Answer

The app requires manual approval from Microsoft Store for Business.

Answer

The user is not a member of the device group.

Answer

The app is assigned to users instead of devices.

Question 6

Which THREE of the following are required to deploy a Win32 app using Microsoft Intune?

Accepted Answer

Detection rule. Options A, B, and C are required: a detection rule to verify installation, an installation command, and a return code for success. Option D is optional; Option E is only for MSI apps.

Answer

Product code

Answer

Dependencies

Question 7

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully, but the detection rule incorrectly reports the app as not installed, causing Intune to attempt reinstallation repeatedly. Which detection rule method is most likely causing this issue?

Accepted Answer

MSI product code detection uses a product code that does not match the installed app. Option D is correct because if the MSI product code is used but the product code is wrong or missing, Intune will not detect the app. Option A is wrong because file existence detection is straightforward if path is correct. Option B is wrong because registry detection is reliable if key exists. Option C is wrong because custom script detection can work if script returns correct exit code.

Answer

File existence detection checks for a file that is installed by the app

Answer

Registry detection checks for a registry key that is created by the app

Answer

Custom script detection returns exit code 0 even if app is not present

Question 8

Refer to the exhibit. A Windows 10 device with OS build 10.0.19041.1 is evaluated against this compliance policy. The device meets all settings except one: the OS version is 10.0.19041.1, which is below the minimum 10.0.19041.0? Actually it is above. But wait, the device has BitLocker enabled, Secure Boot enabled, and firewall enabled. Which setting will cause the device to be non-compliant?

Accepted Answer

Antivirus signatures are out of date.. Option C is correct. The policy requires osMinimumVersion "10.0.19041.0" and osMaximumVersion "10.0.19043.0". The device has 10.0.19041.1, which is above the minimum but below the maximum, so it is within range. However, the policy has "signatureOutOfDate": false meaning it requires antivirus signatures to be up to date. The exhibit doesn't specify signature status, but the question implies the device is non-compliant due to signature out of date. Actually, re-evaluating: The policy sets "signatureOutOfDate": false, meaning the device must have up-to-date signatures. If the device has outdated signatures, it will be non-compliant. Options A, B, and D are all satisfied per the exhibit. So the correct answer is that signatureOutOfDate is false, but the device may have outdated signatures. However, the question asks which setting will cause non-compliance. The most likely is that the device has outdated signature definitions. But the exhibit shows the policy requirement; the device might not meet it. Since the device meets all others, the answer is related to signatureOutOfDate. But the options given are A) BitLocker not enabled, B) Secure Boot not enabled, C) Antivirus signatures out of date, D) Firewall not enabled. The device has all these enabled except possibly signatures. So C is correct.

Answer

BitLocker is not enabled on the device.

Answer

Secure Boot is not enabled on the device.

Answer

The firewall is not enabled on the device.

Question 9

Refer to the exhibit. You have assigned the above compliance policy to a Windows 10 device group. A user reports that their device is non-compliant even though BitLocker is enabled on the system drive. Which of the following is the most likely reason?

Accepted Answer

A removable USB drive is not encrypted with BitLocker.. The policy requires encryption of removable drives as well (bitLockerRemovableDrivesEncryptionRequired). If the user has a USB drive that is not encrypted, the device will be non-compliant. Option C is correct. Option A is incorrect because the policy does not require a specific TPM version. Option B is incorrect because the system drive is encrypted. Option D is incorrect because recovery password rotation does not affect compliance.

Answer

BitLocker recovery password rotation is not enabled.

Answer

The device does not have a TPM 2.0 chip.

Answer

The system drive is not encrypted with BitLocker.

Question 10

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Accepted Answer

The device must be enrolled using Android Enterprise work profile. Options A and C are correct. The device must be enrolled in Android Enterprise work profile. The app must be approved in the managed Google Play store. Option B is wrong because the device does not need to be personally owned; it can be corporate-owned with work profile. Option D is wrong because a Google account is not required for managed Play store. Option E is wrong because the app does not need to be in a kiosk mode.

Answer

The user must have a Google account

Answer

The device must be personally owned

Answer

The app must be configured as a kiosk app

Question 11

Refer to the exhibit. You are reviewing an Intune app protection policy (APP) JSON for Windows. A user complains that they cannot copy data from a managed app. Which setting is causing this?

Accepted Answer

cutCopyAllowed and pasteAllowed are set to false. Option C is correct. The 'cutCopyAllowed' and 'pasteAllowed' settings are both set to false, preventing copy/paste from managed apps. Option A is wrong because 'orgRestriction' controls data transfer to other apps, not copy/paste. Option B is wrong because encryptAppData is about encryption, not copy/paste. Option D is wrong because pin requirement does not affect copy/paste.

Answer

encryptAppData is set to true

Answer

orgRestriction is set to true

Answer

requirePin is set to true

Question 12

Refer to the exhibit. You run this PowerShell script using the Microsoft Graph PowerShell SDK. What is the purpose of this script?

Accepted Answer

To identify devices that are not supported for compliance policies.. Option B is correct. The script iterates through managed devices and outputs a message for Windows RT and Windows Mobile devices, indicating they are not supported for compliance. Option A is wrong because it does not remove devices. Option C is wrong because it does not check compliance status. Option D is wrong because it does not enroll devices.

Answer

To check compliance status of devices.

Answer

To enroll devices in Intune.

Answer

To remove unsupported devices from Intune.

Question 13

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that requires devices to run Windows version 22H2 or later. When you create the policy, which option must you select for the OS version requirement?

Accepted Answer

Minimum OS version. Option C is correct because the 'Minimum OS version' setting checks that the OS version is at least the specified value. Option A is wrong because 'Require' is not a version setting. Option B is wrong because 'Maximum OS version' allows versions up to a value, not above. Option D is wrong because 'Exact OS version' requires a single version, not a minimum.

Answer

Require OS version

Answer

Maximum OS version

Answer

Exact OS version

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a line-of-business (LOB) app that requires a reboot after installation. Which deployment configuration should you use to ensure the app installs and the device reboots outside of business hours?

Accepted Answer

Available assignment with a deadline and a grace period for reboot. Option B is correct because the 'Available' assignment with 'Deadline' and 'Grace period' allows users to install the app during non-business hours and provides a grace period before forced reboot. Option A is wrong because 'Required' assignment with 'Immediate' reboot would force reboot immediately. Option C is wrong because 'Uninstall' assignment removes the app. Option D is wrong because 'Available' without deadline does not enforce reboot timing.

Answer

Available assignment without deadline

Answer

Uninstall assignment for all devices

Answer

Required assignment with a reboot behavior of 'Immediate'

Question 15

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

Accepted Answer

The user does not have local administrator privileges on the device. Option C is correct because error 0x80070005 indicates 'Access Denied', often due to missing local admin rights. Option A is wrong because this error is not related to network connectivity. Option B is wrong because error 0x80070005 is not a disk space error. Option D is wrong because the device is compliant, so compliance policy is not the issue.

Answer

The device has insufficient disk space

Answer

The device does not have internet connectivity to the Microsoft CDN

Answer

The device is not compliant with the conditional access policy