MD-102 Practice Test 38 — 15 Questions

Question 1

You use Microsoft Intune to manage Windows 11 devices. A critical Win32 app must install before any user signs in, and the installer cannot run in the user's context because it writes to protected registry keys and requires elevation. The app has no dependencies and does not need to be visible in the Company Portal. How should you configure the app?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set Install behavior to System, and assign the app as Required to a device group.. Because the installer needs privileged writes and must run without user interaction, configure Install behavior as System and assign the app as Required to a device group. System context lets the Intune Management Extension run the installer as LocalSystem, which handles protected registry writes silently, and Required device targeting guarantees delivery regardless of who signs in.

Answer

Set Install behavior to User, and assign the app as Available to a device group.

Answer

Set Install behavior to System, and assign the app as Available to a user group.

Answer

Set Install behavior to User, and assign the app as Required to a device group.

Question 2

You use Microsoft Intune to manage Windows 11 devices. A critical Win32 app must install before any user signs in, and the installer cannot run in the user's context because it writes to protected registry keys and requires elevation. The app has no dependencies and does not need to be visible in the Company Portal. How should you configure the app?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Microsoft 365 Apps app type in Intune, select the Semi-Annual Enterprise Channel from the update channel drop-down and remove Access from the list of Office apps.. The built-in Microsoft 365 Apps app type in Intune exposes update channel and app selection on its configuration pages, and a Required assignment installs the suite silently on targeted devices. Together these two actions deliver the specified channel while omitting Access and avoiding user interaction.

Answer

Deploy a Win32 app that bundles the Office Deployment Tool and runs setup.exe with a configuration file as a system-context install.

Answer

Upload a custom Configuration.xml to the app's properties page and set the Office app suite to use the Current Channel.

Answer

Assign the Microsoft 365 Apps app as Available to the device group and instruct users to install it from the Company Portal.

Question 3

You are an administrator for a company that uses Microsoft Intune. You have an iOS line-of-business (LOB) app that you need to deploy to all iOS devices. The app is signed with an enterprise certificate. You upload the app to Intune and assign it as required. Users report that the app fails to install. What is the most likely cause?

Accepted Answer

The app is not properly signed with a valid provisioning profile.. iOS line-of-business apps must be signed with a valid provisioning profile that supports enterprise distribution. If the provisioning profile is expired, does not include the necessary devices, or is otherwise invalid, the app will fail to install. This is the most likely cause when an enterprise-signed app fails to deploy. Proper signing and provisioning are critical for successful iOS LOB app deployment via Intune.

Answer

The app was not packaged using the Microsoft Win32 Content Prep Tool.

Answer

The app assignment is set to required, but it should be set to available for iOS LOB apps.

Answer

The iOS devices are not enrolled in Intune as corporate-owned devices.

Question 4

You are an endpoint administrator for a company that uses Microsoft Intune. You deploy a Win32 app to Windows 10 devices using the Intune Management Extension. The app installation fails on some devices with error code 0x87D1041C. You need to resolve the installation failure. What is the most likely cause?

Accepted Answer

The detection rule is not correctly identifying the app after installation.. Error 0x87D1041C is a detection rule failure. It indicates the app installed but the detection rule did not find it, so Intune marks it as failed. The most likely cause is an incorrect detection rule, such as wrong file path, version, or registry key. Correcting the detection rule resolves the issue.

Answer

The app content is not fully uploaded to Intune.

Answer

The app installer requires a reboot that was not allowed.

Answer

The Intune Management Extension is not installed on the device.

Question 5

You are an endpoint administrator for a company that uses Microsoft Intune. You need to deploy Microsoft 365 Apps to Windows devices. The company requires that the apps update automatically from the Office CDN and that users cannot modify the update channel. Which method should you use?

Accepted Answer

Deploy Microsoft 365 Apps using the Microsoft 365 Apps app type in Intune and configure update settings in the app suite configuration.. The Microsoft 365 Apps app type in Intune is designed specifically for deploying and managing Microsoft 365 Apps. It includes options to set the update channel and enforce automatic updates from the Office CDN, and it allows you to prevent users from changing these settings. This is the most efficient and supported method.

Answer

Deploy Microsoft 365 Apps using the Microsoft Store app (new) and configure automatic updates.

Answer

Deploy Microsoft 365 Apps as a Win32 app with a custom configuration XML.

Answer

Deploy Microsoft 365 Apps as a line-of-business app using an MSI package.

Question 6

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a Microsoft Store app (new) to a set of users, and the app must be installed automatically without requiring them to visit the Company Portal. Which assignment intent should you choose for the user group?

Accepted Answer

Required. Required is the assignment intent that makes Intune install an app automatically for the targeted users or devices. Because the app must install without the user opening the Company Portal, Available intent is unsuitable, and Uninstall would remove rather than add the app. Required on the user group produces the silent automatic installation described.

Answer

Available for enrolled devices

Answer

Available for enrolled devices with a deadline

Answer

Uninstall

Question 7

You manage devices with Microsoft Intune. You need to ensure that only devices that meet specific compliance requirements can access Microsoft 365 services. You create a compliance policy and assign it to a group of users. What should you do next to enforce the policy?

Accepted Answer

Create a conditional access policy that requires compliant devices. To enforce compliance for access to Microsoft 365 services, you must create a Conditional Access policy that requires devices to be compliant. The compliance policy alone only evaluates and reports compliance status; it does not block access. Assigning to devices or enabling a setting does not enforce access control. Conditional Access is the correct enforcement tool.

Answer

Enable device compliance in the Microsoft Intune admin center

Answer

Configure a device configuration profile with a compliance setting

Answer

Assign the compliance policy to the devices

Question 8

You administer Microsoft Intune for a company with 2,000 Windows 11 devices. The security team requires that all devices automatically receive an Intune enrollment record when they are first powered on by end users, without requiring users to manually enroll. You have already configured a Windows Autopilot deployment profile and assigned it to a device group. Which additional configuration is required to meet the requirement?

Accepted Answer

Configure automatic enrollment in Microsoft Entra ID for Windows devices.. Automatic enrollment in Microsoft Entra ID is the tenant-level setting that allows Windows devices to enroll in Intune automatically when they join or register in Microsoft Entra ID. For Autopilot, this must be enabled so that devices create an Intune record without user intervention. The other options do not enable automatic enrollment; they are either unrelated features or incorrect assignment methods.

Answer

Enable the Enrollment Status Page (ESP) in the Autopilot profile.

Answer

Assign the Autopilot deployment profile to a user group instead of a device group.

Answer

Create a device configuration profile that enables the Intune Management Extension.

Question 9

A company uses Microsoft Intune to manage Android Enterprise personally owned work profile devices. Employees report that the corporate email app allows copying text into personal apps on the same device. You need to prevent copy and paste of corporate data into personal apps while leaving personal apps otherwise unaffected. What should you configure?

Accepted Answer

An app protection policy targeting the managed apps, with the 'Restrict cut, copy, and paste between other apps' setting configured for policy-managed apps.. App protection policies create a data boundary around managed apps, and the cut-copy-paste restriction setting specifically prevents corporate data from being pasted into unmanaged personal apps on Android Enterprise work profile devices while preserving personal app functionality.

Answer

A conditional access policy requiring compliant devices for the corporate email app.

Answer

A device compliance policy for Android Enterprise that marks devices as noncompliant when data sharing is detected.

Answer

A device restrictions configuration profile that blocks the clipboard service on the Android device.

Question 10

You are the Microsoft 365 Endpoint Administrator for Contoso, Ltd. The company has an on-premises Active Directory Domain Services (AD DS) environment and uses Microsoft Entra ID with Microsoft Intune. You need to prepare infrastructure to deploy Windows 11 devices that are Microsoft Entra hybrid joined. You must ensure that devices can enroll in Intune without requiring user interaction during the out-of-box experience (OOBE). What should you configure first?

Accepted Answer

Configure automatic enrollment in Intune for Windows devices in the Microsoft Entra admin center.. Automatic enrollment in Intune must be enabled in Microsoft Entra ID to allow Microsoft Entra hybrid joined devices to enroll automatically. This setting ensures that devices receive Intune policies without user interaction, which is essential for zero-touch provisioning during OOBE. Other options either require manual steps or do not directly enable automatic enrollment.

Answer

Create a device enrollment manager (DEM) account in Intune and assign it to the deployment team.

Answer

Configure Windows Autopilot deployment profile with the 'Convert all targeted devices to Autopilot' option.

Answer

Deploy the Intune Company Portal app to devices via Group Policy.

Question 11

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to configure a compliance policy that enforces encryption and firewall settings. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Require a firewall. To enforce encryption and firewall settings in a Windows compliance policy, you configure 'Require BitLocker' under Device Health and 'Require a firewall' under System Security. These settings directly validate that encryption is active and the firewall is enabled, marking devices noncompliant if either condition fails.

Answer

Require the device to be marked as compliant by a third-party MDM

Answer

Require Windows Defender Antivirus

Answer

Require Secure Boot to be enabled on the device

Question 12

Your company uses Microsoft Intune to manage devices. You need to ensure that Windows 11 devices can receive configuration profiles and compliance policies. You have already assigned the necessary licenses to users. What should you do first to prepare the devices for management?

Accepted Answer

Enroll the devices into Microsoft Intune.. Before any policies or profiles can be applied, devices must be enrolled into Microsoft Intune. Enrollment is the process that registers the device with the service, enabling management capabilities. Once enrolled, you can assign compliance policies, configuration profiles, and other management tasks. The other actions listed are all dependent on enrollment.

Answer

Create a device compliance policy.

Answer

Configure a conditional access policy.

Answer

Deploy a configuration profile.

Question 13

A company uses Microsoft Intune to manage its Windows devices. The IT team wants to ensure that new Windows devices can enroll without requiring users to manually enter the enrollment server address. The devices are already joined to Microsoft Entra ID. Which infrastructure component enables this automatic discovery?

Accepted Answer

The MDM discovery endpoint published in Microsoft Entra ID through the mobility settings.. Microsoft Entra ID publishes the MDM discovery endpoint when automatic enrollment is configured. A Microsoft Entra joined Windows device queries that endpoint during the join process and receives the Intune enrollment URL, so users do not need to enter a server address manually. This is the standard cloud-based discovery path.

Answer

A DNS SRV record for _enterpriseregistration in the on-premises DNS zone.

Answer

The Company Portal app installed on the device before enrollment.

Answer

The Intune enrollment policy in the Microsoft Intune admin center.

Question 14

You manage Windows 10 devices with Microsoft Intune. You need to ensure that devices receive a specific Windows quality update as soon as possible, bypassing any deferral settings. What should you configure?

Accepted Answer

Expedite the update using the Expedite update feature in Intune.. The Expedite update feature in Intune is specifically designed to deploy a specific quality update to devices immediately, bypassing deferrals and deadlines. It ensures the update is installed as soon as possible. Other options either do not target a specific update or do not guarantee immediate installation. Therefore, expediting the update is the correct action.

Answer

Modify the update ring to set quality update deferral to 0 days.

Answer

Use a PowerShell script to manually install the update on each device.

Answer

Create a new update ring with no deferrals and assign it to the devices.

Question 15

A company uses Microsoft Intune to manage iOS/iPadOS devices enrolled through Apple Business Manager. They must distribute a proprietary in-house app that is not in the App Store to 500 supervised devices, and the app must be silently installed without user prompts. Which deployment method should they use?

Accepted Answer

Deploy the app as an iOS line-of-business app and assign it as required to the device group.. iOS line-of-business apps are internal IPA packages uploaded to Intune and delivered via MDM. For supervised devices with a required assignment, installation is silent and automatic, which is essential when distributing proprietary software to many devices without user involvement. Store app types and web clips either target public apps or create shortcuts, so they cannot fulfill this requirement.

Answer

Deploy the app as a Microsoft Store app for iOS and assign it as available.

Answer

Deploy the app as a line-of-business app using the iOS store app type and require installation.

Answer

Deploy the app as a web link (web clip) and assign it as required.