MD-102 Practice Test 39 — 15 Questions

Question 1

You are preparing to deploy Windows 11 devices using Windows Autopilot. The devices are Microsoft Entra joined. You need to ensure that during OOBE, devices are automatically assigned to the correct group for policy targeting. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a dynamic device group in Microsoft Entra ID with a rule based on the device's enrollment profile name.. Dynamic device groups in Microsoft Entra ID allow automatic membership based on device attributes such as enrollment profile name. This is ideal for Autopilot deployments because devices are automatically added to the correct group, enabling targeted policy and app assignments without manual effort.

Answer

Use a Group Policy object to add devices to an on-premises security group that is synced to Microsoft Entra ID.

Answer

Assign the Autopilot deployment profile to a static group that contains all users.

Answer

Configure a device category in Intune and assign it during OOBE.

Question 2

You manage Windows 10 and Windows 11 devices with Microsoft Intune. You need to configure a compliance policy that marks devices as noncompliant if they do not have a specific minimum OS version and if they have not checked in with Intune within the last 7 days. Which TWO settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Last check-in time. The compliance policy settings for Minimum OS version and Last check-in time directly enforce the two requirements. Minimum OS version ensures devices meet the specified build, while Last check-in time flags devices that have not communicated with Intune within 7 days. Together, they define the compliance state as required.

Answer

Encryption of data storage on device

Answer

Device health attestation

Answer

Antivirus and antispyware status

Question 3

A company uses Microsoft Intune to manage Windows 10 and Windows 11 devices. The IT team needs to deploy a set of Microsoft Store apps to all managed Windows devices. They want the apps to be installed automatically without user interaction and to be updated automatically by the Store. Which app type should they use in Intune?

Accepted Answer

Microsoft Store app (new). The Microsoft Store app (new) type is designed for deploying Store apps to Windows devices with support for silent installation and automatic updates from the Store. Assigning the app as Required ensures it installs without user interaction, and the Store handles updates. This matches the IT team's requirements exactly.

Answer

Microsoft 365 Apps

Answer

Windows app (Win32)

Answer

Microsoft Store app (legacy)

Question 4

You administer Microsoft Intune for a company with 500 Windows 11 devices. The security team requires that when a device is reported lost or stolen, you can remotely erase corporate data without affecting the user's personal files on devices enrolled as personally owned. Which action should you perform in the Intune admin center?

Accepted Answer

Run a Selective wipe (Retire) on the device.. The Retire action performs a selective wipe that removes only organizational data and the management profile from a device. On personally owned devices enrolled in Intune, this preserves the user's personal files while removing corporate email, apps, and policies. Full wipe, Fresh Start, and Autopilot Reset all remove user data and are intended for corporate-owned devices, so they do not meet the requirement.

Answer

Run an Autopilot Reset on the device.

Answer

Run a Fresh Start on the device.

Answer

Run a Full wipe on the device.

Question 5

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. A security policy requires that devices be automatically marked as noncompliant if they have not checked in with Intune for more than 30 days. You need to configure this behavior with the least administrative effort. What should you do?

Accepted Answer

Create a device compliance policy with the 'Device is inactive for a period of time' setting configured to 30 days.. The built-in compliance policy setting for device inactivity allows you to specify a number of days after which a device with no check-in is marked noncompliant. This is a native Intune feature that requires only configuring the compliance policy, with no custom scripting or additional services. Conditional access can then act on the noncompliant state, but the marking itself must come from the compliance policy. Therefore, the compliance policy with the inactivity rule is the correct and least-effort solution.

Answer

Configure a device configuration profile with a custom OMA-URI that sets an inactivity timeout.

Answer

Create a conditional access policy that blocks access for devices not checked in for 30 days.

Answer

Use an Intune PowerShell script to query devices and mark them noncompliant if they have not checked in for 30 days.

Question 6

You manage Windows 10 devices with Microsoft Intune. You need to deploy Microsoft 365 Apps to a group of devices. You want to ensure that the apps receive updates automatically from the Microsoft 365 Apps update channel. What should you configure in the Microsoft 365 Apps app settings?

Accepted Answer

Set the update channel to Current Channel and enable automatic updates.. The Microsoft 365 Apps app type in Intune includes settings for update channel and automatic updates. Selecting an update channel and enabling automatic updates ensures that the apps receive updates from that channel without manual intervention. This is the standard and supported method for keeping Microsoft 365 Apps current.

Answer

Deploy the Microsoft 365 Apps as a Win32 app and configure a scheduled task to run updates.

Answer

Configure a Windows Update ring to deliver Microsoft 365 Apps updates.

Answer

Set the update channel to Semi-Annual Channel and disable automatic updates.

Question 7

You manage Windows 11 devices with Microsoft Intune. A security requirement states that when a device is marked as noncompliant, it must lose access to Microsoft 365 services within 15 minutes, but the device must not be wiped. You create a compliance policy and a conditional access policy. Which setting should you configure in the compliance policy to meet the time requirement?

Accepted Answer

Set the 'Mark device noncompliant' schedule to 15 minutes.. The 'Mark device noncompliant' schedule is the compliance policy setting that controls how quickly a failed compliance check transitions the device to a noncompliant state. Once noncompliant, the conditional access policy evaluates the device state and blocks access to Microsoft 365 services. The other options either apply to different policy types or perform destructive actions that violate the no-wipe requirement.

Answer

Create an app protection policy with a 15-minute recheck interval.

Answer

Set the compliance policy action for noncompliance to 'Retire the device' after 15 minutes.

Answer

Configure a device restriction policy with a 15-minute grace period.

Question 8

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to ensure that BitLocker Drive Encryption is enabled on all devices and that the recovery keys are escrowed to Azure Active Directory (Azure AD). Which policy type should you use?

Accepted Answer

Device configuration profile for endpoint protection. To enable BitLocker and escrow recovery keys to Microsoft Entra ID, you should use a device configuration profile with the endpoint protection settings. This profile allows you to configure BitLocker to silently enable encryption and back up recovery keys to Microsoft Entra ID. Compliance policies only check for encryption, and security baselines may not handle key escrow as directly. App protection policies are unrelated.

Answer

App protection policy

Answer

Security baseline

Answer

Device compliance policy

Question 9

You manage Windows 10 and Windows 11 devices with Microsoft Intune. You need to configure a Windows Update ring to defer quality updates by 7 days and feature updates by 60 days. Which two settings should you configure in the update ring? (Choose two.)

Accepted Answer

Quality update deferral period (days). In a Windows Update ring, you can configure separate deferral periods for quality updates and feature updates. Setting the quality update deferral to 7 days and the feature update deferral to 60 days ensures that monthly security updates are delayed by a week and feature updates by two months, exactly matching the requirements.

Answer

Update/quality update deadline (days)

Answer

Automatic update behavior - Auto install at maintenance time

Answer

Windows Update for Business configuration - Servicing channel

Question 10

You manage a group of Windows 11 devices enrolled in Microsoft Intune. You need to collect a list of installed applications from these devices and view the data in the Intune admin center. What should you configure?

Accepted Answer

Review the Discovered apps report under Apps in the Intune admin center after devices check in.. Intune automatically collects installed application inventory from enrolled Windows devices and displays it in the Discovered apps report under Apps in the Intune admin center. This report requires no extra policy configuration for Windows devices, so simply reviewing it after devices check in provides the required list of installed applications.

Answer

Create a custom compliance policy that queries the registry for installed applications and marks devices compliant.

Answer

Enable device inventory collection in the Intune data collection policy for the device group.

Answer

Assign a device configuration profile that enables the Inventory Collector CSP.

Question 11

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant, users receive a notification email with instructions to remediate the issue. The email must be sent only to the primary user of the device. What should you configure?

Accepted Answer

A compliance policy with the 'Send email to users' action enabled and the 'Send email to primary user' option selected.. Compliance policies in Intune include actions that can send email notifications to users when a device is noncompliant. Configuring the action to send to the primary user ensures the email reaches the correct recipient with remediation instructions, directly fulfilling the requirement.

Answer

An Endpoint security policy with the 'Noncompliance email' setting configured.

Answer

A conditional access policy that blocks access and sends an email to the user.

Answer

A device configuration profile with the 'Compliance notification' setting enabled.

Question 12

You manage Windows 11 devices with Microsoft Intune. You need to configure a policy that will automatically lock the screen after 5 minutes of inactivity and require a password to unlock. Which policy type should you use?

Accepted Answer

Endpoint protection profile with 'Local device security options'. The Endpoint protection profile in Intune includes 'Local device security options' which allow you to configure the machine inactivity limit (screen lock timeout) and require a password on wakeup. Setting the inactivity limit to 300 seconds enforces a 5-minute lock, and the password requirement ensures unlock security. This is the most direct and supported method.

Answer

Group Policy analytics profile

Answer

Device restrictions configuration profile

Answer

Compliance policy with 'Require a password to unlock mobile devices'

Question 13

You are a Microsoft 365 administrator for a company with 200 Windows 11 devices joined to Microsoft Entra ID. The security team requires that all devices automatically receive a set of configuration profiles and compliance policies without user intervention. You need to ensure that when devices are joined, they are automatically enrolled in Microsoft Intune and grouped for policy assignment. What should you configure?

Accepted Answer

Enable automatic MDM enrollment in Microsoft Entra ID and configure dynamic device groups in Microsoft Intune.. Automatic MDM enrollment in Microsoft Entra ID ensures devices are enrolled in Intune upon join. Dynamic device groups in Intune automatically include devices based on attributes, enabling policy assignment without manual intervention. Together, they provide the required zero-touch provisioning and grouping.

Answer

Create a conditional access policy requiring compliant devices and assign it to all users.

Answer

Deploy a Windows Autopilot deployment profile to all devices and use it to assign policies.

Answer

Configure a device compliance policy with a grace period and assign it to All Users.

Question 14

You are deploying Windows 11 devices using Windows Autopilot. The devices must be joined to an on-premises Active Directory domain and also registered with Microsoft Entra ID. You need to configure the deployment profile. Which Autopilot mode should you use?

Accepted Answer

Microsoft Entra hybrid joined. Microsoft Entra hybrid joined mode is specifically designed for scenarios where devices need to be joined to on-premises Active Directory and registered with Microsoft Entra ID. This mode supports domain join during Autopilot and requires the Intune Connector for Active Directory to create computer objects in AD. It enables both cloud and on-premises management.

Answer

Microsoft Entra joined

Answer

Pre-provisioning (white glove)

Answer

Self-deploying mode

Question 15

You manage a set of Windows 11 devices with Microsoft Intune. You deploy a Win32 app as required to a group of users. The app installs successfully, but later users report that the app is missing from their devices. You discover that the app was removed after a user uninstalled it manually. You need to ensure that the app is reinstalled automatically if it is removed. What should you configure?

Accepted Answer

Set the app assignment to Required and configure a detection rule that checks for the app's presence.. For required Win32 apps, Intune relies on detection rules to verify installation status. When the detection rule indicates the app is not present, Intune will reinstall it. This enforcement happens periodically, ensuring the app remains installed even if a user removes it. Configuring a detection rule that accurately reflects the app's presence is essential for automatic reinstallation.

Answer

Set the app assignment to Available and instruct users to install it from the Company Portal.

Answer

Set the app assignment to Required and enable the 'Restart required' option.

Answer

Create a compliance policy that marks devices without the app as non-compliant.