MD-102 Practice Test 38 — 15 Questions

Question 1

You need to make a web app available to users in your organization through Microsoft Intune Company Portal. Which app type should you create in Intune?

Accepted Answer

Web app. To make a web app available through Microsoft Intune Company Portal, you must create a 'Web app' type. This app type allows you to add a link to a web application that users can access via the Company Portal, without needing to install a native client. Intune's Web app type supports both HTTP and HTTPS URLs and can be configured with a display name, URL, and icon for the Company Portal listing.

Answer

iOS store app

Answer

Windows app (Win32)

Answer

Android store app

Question 2

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

Accepted Answer

Work profile. The Work profile enrollment type is correct because it creates a separate, managed container on Android Enterprise devices that isolates work apps and data from personal apps and data. This sandboxing is enforced by the Android Enterprise framework, ensuring that work apps cannot access personal data and vice versa, which meets the requirement for separation without requiring full device management.

Answer

Fully managed

Answer

Device administrator

Answer

Corporate-owned personally enabled (COPE)

Question 3

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome. When a Conditional Access policy requires the use of Microsoft Edge or the Microsoft Authenticator app for accessing SharePoint, users attempting to use Chrome on Android will be blocked. The devices show as compliant in Intune, so the issue is not device compliance but the requirement for a specific approved client app. This policy enforces app-based conditional access, which overrides browser access unless the approved app is used.

Answer

The SharePoint site is configured to allow access only from specific IP ranges

Answer

The device compliance policy has a grace period for non-compliance, and the device is still within that period

Answer

An app protection policy is blocking access to SharePoint from the browser

Question 4

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. The Autopilot deployment profile includes a setting called 'Join to Azure AD as' that determines whether the device performs an Azure AD join or an Azure AD registration. By default, this setting may be configured as 'Azure AD registered', which results in a device that is only registered (workplace-joined) rather than fully joined. Changing this setting to 'Azure AD joined' ensures the device completes a full Azure AD join during the user-driven deployment, making it a managed device in Microsoft Entra ID.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.

Question 5

Which TWO options are valid methods to deploy Windows 10 to new hardware in a Configuration Manager environment?

Accepted Answer

Bootable media deployment. Bootable media deployment (Option D) is a valid method in Configuration Manager because it allows you to create bootable USB or CD/DVD media that contains the boot image, task sequence, and required content. When the media is booted on new hardware, it initiates a task sequence that contacts the Configuration Manager site server to download the OS image and apply it, making it ideal for bare-metal deployments without network connectivity.

Answer

Microsoft Deployment Toolkit (MDT) Lite Touch

Answer

Windows Autopilot self-deploying mode

Answer

Azure Migrate

Question 6

You need to configure Intune to automatically retire devices that have not checked in for 90 days. Where should you set this?

Accepted Answer

Device cleanup rules in Intune admin center. Device cleanup rules in the Intune admin center allow administrators to automatically retire or delete devices that have not checked in for a specified number of days. This is the correct location because the rule is specifically designed for lifecycle management of stale devices, not for compliance or enrollment policies. Setting the threshold to 90 days ensures that devices exceeding that inactivity period are removed from management.

Answer

Compliance policies

Answer

Enrollment restrictions

Answer

Windows Autopilot devices blade

Question 7

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

Accepted Answer

Devices must have line-of-sight to an on-premises domain controller.. For hybrid Azure AD join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Answer

Devices must have VPN connectivity to Azure.

Answer

An Intune connector for Active Directory must be installed.

Answer

Azure AD Connect must be configured with password hash sync.

Question 8

You need to deploy a Windows 10 feature update to a pilot group. Which TWO steps are required in Microsoft Intune?

Accepted Answer

Create a feature update policy for Windows 10.. A is correct because a feature update policy in Microsoft Intune is the specific policy type designed to control which Windows 10 feature update version (e.g., 22H2) is offered to devices. This policy allows you to defer or approve updates for pilot groups, ensuring controlled rollout before broad deployment.

Answer

Create a driver update policy for Windows 10.

Answer

Create an update ring for Windows 10.

Answer

Create a compliance policy for Windows 10.

Question 9

You need to deploy a line-of-business (LOB) app to 100 iOS devices managed by Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

Upload the app package as an iOS LOB app in Intune. Intune supports deploying internally developed LOB apps to iOS devices by uploading the signed .ipa package directly. Since the app is already signed with an enterprise certificate, it can be distributed via Intune's iOS LOB app workflow without requiring the Apple App Store or VPP.

Answer

Add the app as a Volume Purchase Program (VPP) app

Answer

Use an Enterprise Code Signing certificate to deploy via MDM

Answer

Publish the app to the Apple App Store and deploy as public app

Question 10

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with TPM 2.0 and Secure Boot enabled can access Microsoft 365 resources. What is the best approach?

Accepted Answer

Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.. Device compliance policies in Microsoft Intune can evaluate hardware attributes like TPM version and Secure Boot status. When combined with a Conditional Access policy that blocks non-compliant devices, this enforces the security requirements before granting access to Microsoft 365 resources. This two-step approach ensures only devices meeting the hardware security baseline can authenticate.

Answer

Create an app protection policy targeting Microsoft 365 apps.

Answer

Create a device configuration policy to enable TPM and Secure Boot.

Answer

Create a Conditional Access policy requiring TPM and Secure Boot.

Question 11

You manage Windows 10 devices with Microsoft Intune. Users report that after a recent Windows update, some devices fail to enroll in mobile device management (MDM). You verify that the devices are domain-joined and can reach the internet. Which configuration should you check first?

Accepted Answer

Check that the MDM enrollment URL (https://enrollment.manage.microsoft.com) is reachable and not blocked by a proxy.. The most common cause of MDM enrollment failure after a Windows update is a change in proxy or firewall settings that blocks the MDM enrollment URL. Since the devices can reach the internet generally but fail specifically during enrollment, verifying that `https://enrollment.manage.microsoft.com` is reachable and not blocked by a proxy is the logical first troubleshooting step. This URL is required for the device to communicate with the Intune MDM service during the enrollment process.

Answer

Confirm that the user is assigned a Microsoft Entra ID P1 license.

Answer

Verify that the BitLocker recovery key is backed up to Microsoft Entra ID.

Answer

Ensure the Windows Defender Firewall allows inbound RPC traffic.

Question 12

A company uses Intune to manage macOS devices. They need to deploy a custom configuration profile that enforces FileVault encryption. What is the recommended approach?

Accepted Answer

Create an endpoint security disk encryption policy in Intune and assign it to the devices. The recommended approach is to create an endpoint security disk encryption policy in Intune (option A). Intune provides built-in FileVault settings under endpoint security disk encryption for macOS. Option B (Apple Configurator) is a local configuration tool, not an MDM solution, and cannot be used for remote management. Option C (manually enabling FileVault) is not scalable for enterprise deployment. Option D (JAMF Pro) is a third-party MDM, not Microsoft Intune.

Answer

Use Apple Configurator to create the profile and import it into Intune

Answer

Ask users to manually enable FileVault

Answer

Use JAMF Pro to manage FileVault

Question 13

You are configuring Microsoft Defender for Endpoint for your organization. You need to ensure that devices are onboarded to the service. Which two methods can you use to onboard Windows 10 devices? (Choose two.)

Accepted Answer

Group Policy. Group Policy is correct because it allows you to deploy a Group Policy Object (GPO) that configures the Windows 10 device to automatically download and apply the Defender for Endpoint onboarding package, including the required registry keys and service configuration. This method is ideal for on-premises, Active Directory-joined devices that are not managed by a modern management solution like Intune.

Answer

PowerShell script

Answer

Microsoft Endpoint Manager

Answer

Microsoft Configuration Manager

Question 14

Northwind Traders is a retail company with 500 employees. They use Microsoft Intune to manage iOS devices. The company has a custom iOS app for inventory management that they need to deploy to all store managers. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the store managers' devices. After 48 hours, several managers report that the app is not installed on their devices. The administrator checks the Intune console and sees that the app status for those devices is 'Pending install'. What should the administrator do first to resolve the issue?

Accepted Answer

Deploy a certificate profile that installs the enterprise root certificate to the affected devices.. The 'Pending install' status for an enterprise-signed iOS app typically indicates that the device does not trust the enterprise certificate used to sign the app. Deploying a certificate profile that installs the enterprise root certificate on the affected devices establishes trust, allowing the app to install successfully. Without this trust, iOS blocks the installation of any enterprise-signed app, even when assigned as 'Required' via Intune.

Answer

Create an app protection policy and assign it to the devices.

Answer

Instruct the users to install the app manually from the Company Portal app.

Answer

Re-upload the .ipa file to Intune with a different version number.

Question 15

Refer to the exhibit. You see this JSON in an Intune policy for a Windows 10 device. What type of app is being deployed?

Accepted Answer

Microsoft Store app. The JSON includes the key 'productId' with a value like '9WZDNCRFJ3PS', which is a Microsoft Store product identifier. Intune uses this identifier to deploy apps directly from the Microsoft Store for Windows 10 devices, making this a Microsoft Store app deployment. The absence of an installation command line, file path, or URL confirms it is not a Win32, LOB, or web app.

Answer

Win32 app

Answer

Web app

Answer

Line-of-business app