MD-102 Practice Test 39 — 15 Questions

Question 1

You need to enroll a Windows 11 device into Microsoft Intune using a work or school account. The device is already joined to Microsoft Entra ID. What is the simplest enrollment method?

Accepted Answer

Automatic enrollment via Microsoft Entra join. Microsoft Entra joined devices automatically enroll in Intune when configured, making it the simplest method. Option A (Windows Autopilot) is wrong because it requires additional setup and is not the simplest. Option B (Group Policy) is wrong because Group Policy is typically used for on-premises devices and not automatic. Option C (Manual enrollment via Company Portal) is wrong because it requires user interaction and is not automatic.

Answer

Windows Autopilot

Answer

Group Policy to configure enrollment

Answer

Manual enrollment using the Company Portal

Question 2

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

Accepted Answer

The device's group membership is still being processed, so policies are not yet applied.. When a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet. The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Answer

The OMA-URI setting is invalid.

Answer

The device is not enrolled.

Answer

The device is not compliant.

Question 3

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode longer than six characters can access corporate email. Which type of policy should you configure?

Accepted Answer

Device compliance policy. Device compliance policies in Microsoft Intune evaluate device settings against defined rules, such as requiring a passcode longer than six characters. When a device is marked noncompliant, Conditional Access can block access to corporate email. This is the correct mechanism because compliance policies are specifically designed to enforce security requirements like passcode length before granting resource access.

Answer

Device configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 4

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

Accepted Answer

Use a Win32 app with install context set to 'system'.. Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Answer

Assign the app as 'available' for user-install.

Answer

Deploy as a line-of-business app with device context.

Answer

Package as a Microsoft Store for Business app.

Question 5

You need to ensure that Windows 10 devices automatically receive Microsoft 365 Apps updates from the Internet when not connected to the corporate network. Which update channel should you configure?

Accepted Answer

Current Channel. The Current Channel is the correct choice because it provides the most frequent updates for Microsoft 365 Apps, and it is the only channel that supports automatic updates from the Internet (via the Office Content Delivery Network) when devices are not connected to the corporate network. This channel is designed for devices that need the latest features and security updates without relying on on-premises update infrastructure.

Answer

Monthly Enterprise Channel

Answer

Office Insider

Answer

Semi-Annual Channel

Question 6

You need to deploy a custom Windows 11 feature update to a pilot group of 50 devices before rolling out to the entire organization. The devices are managed by Intune and are in a 'Pilot' Azure AD group. What is the best approach?

Accepted Answer

Create a feature update profile for Windows 11 and assign to the pilot group. Intune's feature update profiles are specifically designed to deploy Windows 11 feature updates to targeted Azure AD groups, such as the 'Pilot' group. This approach allows you to control the exact feature update version (e.g., Windows 11 23H2) and assign it only to the pilot devices, enabling a controlled rollout before expanding to the entire organization.

Answer

Configure a Windows Update for Business deferral policy for all devices

Answer

Create a custom configuration profile with update settings

Answer

Use Group Policy to configure Windows Update settings for the pilot group

Question 7

You need to configure BitLocker encryption for Windows 10 devices managed by Intune. You create a device configuration profile for endpoint protection. After assigning, devices show 'BitLocker not enabled' in the Intune console. What is the most likely cause?

Accepted Answer

The devices do not have a TPM chip.. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 to store encryption keys securely. Without a TPM chip, BitLocker cannot be enabled by default, and the Intune console will report 'BitLocker not enabled' even if the endpoint protection profile is correctly assigned. This is the most common hardware prerequisite failure in managed environments.

Answer

The profile is assigned to a user group instead of a device group.

Answer

Secure Boot is not enabled on the devices.

Answer

The devices are running Windows 10 Home edition.

Question 8

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that prevents users from disabling the camera on their corporate iOS devices. You create a device restrictions profile and set the 'Enable camera' setting to 'No'. You assign the profile to a group containing all iOS devices. After 24 hours, users report that the camera is still functional. What should you check first?

Accepted Answer

Verify that the devices are members of the assigned group.. The profile must be assigned to the correct group; if the devices are not in the group, the policy won't apply. Option B is wrong because the setting is correct. Option C is wrong because iOS restrictions are applied at the device level, not user. Option D is wrong because device compliance is not relevant here.

Answer

Ensure the setting 'Enable camera' is set to 'Not configured' instead of 'No'.

Answer

Review the device compliance status.

Answer

Check if the profile is applied to users instead of devices.

Question 9

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

Accepted Answer

Remote lock. 'Remote lock' locks the device and allows a custom message to be displayed. Option B is wrong because 'Reset passcode' changes the passcode but does not display a custom message. Option C is wrong because 'Wipe' performs a factory reset, which erases all data and prevents the message from being shown. Option D is wrong because 'Retire' removes company data only, does not lock the device.

Answer

Reset passcode

Answer

Wipe

Answer

Retire

Question 10

You need to ensure that only authorized users can enroll devices in Microsoft Intune. Which setting should you configure?

Accepted Answer

Enrollment restrictions. Device enrollment restrictions in Intune allow you to block personal devices or require user approval. Option A is correct because enrollment restrictions can limit who can enroll. Option B is incorrect because device compliance policies apply after enrollment. Option C is incorrect because conditional access policies control access to resources, not enrollment. Option D is incorrect because device categories are for grouping, not blocking enrollment.

Answer

Device categories

Answer

Device compliance policies

Answer

Conditional access policies

Question 11

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs at every device startup to map network drives based on the user's security group membership. The script should run in the system context and should not require user interaction. How should you configure the script deployment in Intune?

Accepted Answer

Add the PowerShell script as a Windows PowerShell script in Intune, set the execution context to 'System', and configure the script to run at device startup.. Intune allows PowerShell scripts to run in the system context and be configured to run at device startup, fulfilling the requirement. Option A is incorrect because assigning the script to users and running at user logon does not run in the system context and requires user interaction. Option B is incorrect because Proactive remediations run on a schedule or on demand, not at startup. Option D is incorrect because device configuration profiles cannot execute scripts directly.

Answer

Add the script as a Windows PowerShell script in Intune and assign it to users, so it runs when users log in.

Answer

Use Proactive remediations in Intune to run the script on a schedule.

Answer

Create a device configuration profile that includes the script as a custom setting.

Question 12

Contoso uses Microsoft Defender for Endpoint on Windows servers. They need to ensure that antivirus definitions are always up-to-date even if the server is disconnected from the internet for extended periods. What should they configure?

Accepted Answer

Configure a network file share as an internal update source for Microsoft Defender Antivirus. Microsoft Defender Antivirus supports using a network file share as an internal update source via Group Policy or Configuration Manager. This allows servers that are disconnected from the internet to receive definition updates from a local share, ensuring they remain up-to-date without external connectivity.

Answer

Enable Windows Update for Business group policy

Answer

Use Intune to deliver definition updates

Answer

Download definitions from Microsoft Update Catalog and install manually

Question 13

Your organization wants to use Windows Autopilot to deploy new Windows 11 devices. What is required to register a device with Windows Autopilot?

Accepted Answer

The device's hardware hash (4K HH). Windows Autopilot requires the device's hardware hash (4K HH) to uniquely identify the device during the registration process. This hash is generated from the device's hardware components and is uploaded to the Microsoft Intune or Partner portal to associate the device with an Autopilot profile. Without the hardware hash, Autopilot cannot recognize the device as registered and will not apply the deployment profile.

Answer

The device's product key

Answer

The user's Microsoft account

Answer

The device's BIOS password

Question 14

Refer to the exhibit. You are reviewing a Win32 app configuration in Microsoft Intune. The app is not installing on some Windows 10 devices. Which is the most likely reason?

Accepted Answer

The devices have an OS version lower than 10.0.19041.. The exhibit shows the 'Minimum OS version' requirement set to 10.0.19041 (Windows 10 version 20H1/2004). Devices with an OS build lower than this threshold will fail to install the Win32 app, as Intune enforces this requirement before executing the installation command. This is a common configuration issue when deploying apps to a mixed-OS environment.

Answer

The install command line is missing the /silent switch.

Answer

The detection rule path is incorrect.

Answer

The install experience is set to system, but should be user.

Question 15

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

Accepted Answer

In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.. To enable co-management and move the Device configuration workload to Intune, you need to configure co-management in ConfigMgr. This involves enabling co-management, selecting a pilot collection (or all devices), and setting the workload slider for Device configuration to either 'Pilot Intune' or 'Intune' (full migration). This triggers automatic enrollment in Intune via the co-management policy. Option A is incorrect because the Intune connector is not needed for co-management; enrollment happens via ConfigMgr policy. Option B is incorrect because Group Policy for automatic MDM enrollment is not required when using co-management; the enrollment is triggered by ConfigMgr. Option D is incorrect because hybrid Azure AD join alone does not automatically enroll devices into co-management; the ConfigMgr co-management configuration is necessary.

Answer

Install the Intune connector for ConfigMgr and configure the workloads.

Answer

Create a Group Policy that enables automatic MDM enrollment to Intune.

Answer

Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.