MD-102 Practice Test 39 — 15 Questions

Question 1

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot. Option B is correct: Conditional Access with device compliance policy is the standard method to enforce device health before granting access. Option A (Windows Hello for Business) is for passwordless authentication, not device health enforcement. Option C (Attack surface reduction) is a Defender policy for threat protection. Option D (Autopilot) is for device provisioning, not access control.

Answer

Configure Windows Hello for Business in Intune

Answer

Deploy an attack surface reduction rule in Microsoft Defender XDR

Answer

Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

Question 2

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

Accepted Answer

A device configuration profile using the 'Kiosk' settings for single-app mode. Option A is correct because a kiosk configuration profile with single-app mode is used for full-screen single-store app kiosks. Option B is wrong because device restrictions do not configure kiosk mode. Option C is wrong because a compliance policy does not enforce app behavior. Option D is wrong because a configuration profile for Microsoft Edge is for browser settings.

Answer

A device restrictions profile blocking access to other apps

Answer

A compliance policy requiring the app to be installed

Answer

A configuration profile for Microsoft Edge in kiosk mode

Question 3

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

Accepted Answer

The detection runs in 32-bit context and does not see the 64-bit registry key. Option C is correct. The registry path uses 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot' but on a 64-bit system, a 32-bit app (like the detection agent) may be redirected to WOW6432Node. The check32BitOn64System is false, so it does not check the WOW6432Node path. Option A is wrong because the path is correct on 64-bit systems for 64-bit Office. Option B is wrong because Office does install that key. Option D is wrong because the detection type 'exists' is correct.

Answer

The detection type 'exists' is not supported for registry detection

Answer

The registry key path is incorrect for a 64-bit system

Answer

The app did not create the registry key during installation

Question 4

Contoso has iOS/iPadOS devices managed by Intune. They need to prevent users from installing apps from outside the Apple App Store and ensure that devices with a jailbreak are blocked from accessing corporate email. Which two policies should they combine?

Accepted Answer

Device compliance policy and Conditional Access. Option D is correct: Device compliance policy can detect jailbroken devices and mark them noncompliant; Conditional Access then blocks access. Option A (App protection policy) can restrict app installation to managed apps but not detect jailbreak. Option B (Device configuration profile) can enforce restrictions but jailbreak detection is a compliance feature. Option C (Autopilot) is for provisioning only.

Answer

Windows Autopilot and Intune enrollment

Answer

Device configuration profile and Microsoft Defender XDR

Answer

App protection policy and Conditional Access

Question 5

You need to deploy a custom Microsoft Edge extension to managed Windows 10 devices via Intune. Which policy type should you use?

Accepted Answer

Administrative Templates profile (ADMX-backed policies). Option A is correct. An Administrative Templates profile can configure Edge policies including extension installation. Option B is wrong because a device restrictions profile does not manage extensions. Option C is wrong because a compliance policy is not for configuration. Option D is wrong because a PowerShell script is not the recommended method for extension deployment.

Answer

Device restrictions profile

Answer

Compliance policy

Answer

PowerShell script deployment

Question 6

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor on the devices. Option A is correct: Microsoft Defender for Endpoint relies on its agent (sensor) to collect vulnerability data. If the sensor is not installed or running, vulnerability data won't be reported. Option B (Intune MDM) manages device configuration but not vulnerability reporting. Option C (Microsoft Purview) is for compliance and data loss prevention. Option D (Microsoft Sentinel) ingests data from Defender but is not the source.

Answer

Microsoft Sentinel workspace

Answer

Intune MDM authority

Answer

Microsoft Purview compliance portal

Question 7

Your company deploys Microsoft Defender for Endpoint (Defender XDR) to all Windows devices. You need to create a custom detection rule that triggers an alert when a specific PowerShell script is executed on any device. Which action should you take in the Microsoft 365 Defender portal?

Accepted Answer

Create a new custom detection rule based on an Advanced hunting query.. Option B is correct because custom detection rules are created using Advanced hunting queries. Option A is wrong because custom detection rules are not created with attack simulation training. Option C is wrong because Indicators of compromise are for blocking or allowing, not creating detection rules. Option D is wrong because policies are for settings, not custom detections.

Answer

Configure a Device control policy to block PowerShell.

Answer

Add an Indicator of compromise for the script hash.

Answer

Create a new attack simulation training campaign.

Question 8

Your organization uses Microsoft Intune to manage Windows devices. You are deploying a Win32 app that requires a reboot to complete installation. You want to control the reboot behavior to minimize user disruption. Which TWO settings can you configure in the Intune Win32 app properties to manage reboot? (Choose two.)

Accepted Answer

Allow restart after installation (in assignment). Options B and D are correct. Device restart behavior controls if restarts are suppressed or blocked. The 'Allow restart after installation' option in the app assignment can also be set. Option A is for Android. Option C is for macOS. Option E is for iOS.

Answer

Restart deadline

Answer

Restart grace period

Answer

Restart notification text

Question 9

Your organization uses Windows Defender Application Control (WDAC) to allow only approved apps. After deploying a WDAC policy via Intune, some users report that a critical line-of-business app is blocked. How should you troubleshoot?

Accepted Answer

Review CodeIntegrity/Operational logs in Event Viewer. Option C is correct: WDAC policies generate block events in Event Viewer under Microsoft-Windows-CodeIntegrity/Operational. Option A (AppLocker) is a different technology. Option B (Device Management Events) may not contain WDAC details. Option D (Microsoft 365 Defender portal) shows alerts but not per-app block details.

Answer

Check AppLocker logs in Event Viewer

Answer

Review Intune device management events for policy errors

Answer

Check Microsoft 365 Defender portal for WDAC alerts

Question 10

Your organization uses Microsoft Intune to manage mobile devices. You need to configure compliance policies that trigger conditional access. Which TWO conditions can be used in a device compliance policy?

Accepted Answer

Minimum OS version is 14.0.. Options A and D are correct. Device compliance policies can check for jailbroken/rooted devices (A) and require a minimum OS version (D). Option B is wrong because app protection policies, not compliance policies, manage app-level restrictions. Option C is wrong because device compliance policies do not enforce encryption of SD cards; they can require device encryption but not specifically SD card. Option E is wrong because device compliance policies do not require a specific MDM authority; they assume Intune.

Answer

Device is enrolled in a specific MDM authority.

Answer

App must have a minimum version.

Answer

SD card encryption is enabled.

Question 11

A company wants to prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. What should they configure?

Accepted Answer

Intune app protection policy. Option B is correct: Intune app protection policies (MAM) control data transfer between managed and unmanaged apps. Option A (Device compliance policy) enforces device health but not app-level data movement. Option C (Conditional Access) controls access but not copy/paste. Option D (Microsoft Defender for Cloud Apps) is for cloud app security, not local app data protection.

Answer

Device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access policy

Question 12

You configure Windows Update for Business policies in Intune. Users report that updates are not installing during configured active hours. You verify that the policy is applied. What is the most likely cause?

Accepted Answer

Update notification level is set to 'Disable all notifications' and 'Automatic Updates behavior' is set to 'Notify download'.. Option D is correct because the 'Update notification level' set to 'Disable all notifications' can prevent users from seeing restart prompts, but updates still install during active hours. However, if 'Automatic Updates behavior' is set to 'Notify download', updates are not automatically downloaded, causing the issue. Option A is wrong because 'Deadline for feature updates' does not affect active hours. Option B is wrong because 'Active hours start/end' is configured correctly. Option C is wrong because 'Quality update deferral period' does not prevent installation during active hours.

Answer

Deadline for feature updates is set to 7 days.

Answer

Quality update deferral period is set to 0 days.

Answer

Active hours start is set to 8:00 AM and end to 5:00 PM.

Question 13

You deploy a Windows Update for Business policy in Intune. You need to ensure that devices install quality updates within 2 days of release and feature updates within 30 days. Which THREE settings should you configure?

Accepted Answer

Quality update deferral period (days): 2. Options B, D, and E are correct. Quality update deferral period (B) and feature update deferral period (D) set the number of days to wait before offering updates. Quality update deadline (E) forces installation within a set number of days after the update is offered. Option A is wrong because 'Quality update pause' halts updates. Option C is wrong because 'Feature update uninstall period' controls how long users can roll back, not installation.

Answer

Feature update uninstall period (2-60 days): 30

Answer

Quality update pause start date

Question 14

Contoso uses Microsoft Defender for Endpoint on Windows servers. They need to ensure that antivirus definitions are always up-to-date even if the server is disconnected from the internet for extended periods. What should they configure?

Accepted Answer

Configure a network file share as an internal update source for Microsoft Defender Antivirus. Option A is correct: Microsoft Defender for Endpoint can use a file share as an internal definition update source. Option B (Windows Update) requires internet. Option C (Intune) manages client devices, not servers typically. Option D (Microsoft Update Catalog) is for manual download, not automatic updates.

Answer

Enable Windows Update for Business group policy

Answer

Use Intune to deliver definition updates

Answer

Download definitions from Microsoft Update Catalog and install manually

Question 15

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to ensure that when a device is offboarding, all collected forensic data is deleted from Microsoft 365. What should you do?

Accepted Answer

Use the 'Remove device from organization' action in Microsoft Defender XDR console.. Option B is correct because the 'Remove device from organization' action in Microsoft Defender XDR triggers deletion of the device's data from the service. Option A is wrong because disabling the onboarding policy only stops future data collection. Option C is wrong because uninstalling the sensor does not remove existing data. Option D is wrong because there is no 'Data Purge' action for individual devices.

Answer

Disable the device's onboarding policy in Intune.

Answer

Run a PowerShell script to execute 'Remove-MpPreference -DisableRealtimeMonitoring $true'.

Answer

Uninstall the Microsoft Defender for Endpoint sensor from the device.