MD-102 Practice Test 40 — 15 Questions

Question 1

You need to deploy a custom Win32 app to Windows 10 devices. The app installation is silent and requires a reboot. You set the installation behavior to 'system' and the device restart behavior to 'Allow'. After deployment, users report that the app is installed but not working properly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device was not restarted after installation. When the device restart behavior is set to 'Allow', Intune will request a reboot but does not force it; the user can postpone or ignore the prompt. If the app requires a reboot to complete its installation or initialize properly, skipping the restart leaves the app in a partially installed state, causing it to appear installed but malfunction. This is the most likely reason the app is not working correctly after deployment.

Answer

The app requires user interaction to complete setup

Answer

The detection rule is misconfigured

Answer

The app was not wrapped correctly with the Intune Win32 Content Prep Tool

Question 2

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Accepted Answer

Non-compliant, because the firewall is disabled.. The device is non-compliant because the compliance policy explicitly requires the firewall to be enabled. Even though the OS version (10.0.19044) falls within the allowed range of 10.0.17763 to 10.0.19045, the firewall requirement is a separate condition that must be met. In Microsoft Intune, if any required setting is not satisfied and no grace period is configured for that setting, the device is marked non-compliant immediately.

Answer

Non-compliant, because the OS version is not within the allowed range.

Answer

Compliant, because the policy includes a grace period for firewall.

Answer

Compliant, because the OS version is within the allowed range.

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

Accepted Answer

Use the remote lock action in Intune and provide a custom message.. The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Answer

Enable lost mode on the device via Apple Business Manager.

Answer

Configure a device compliance policy to wipe the device on non-compliance.

Answer

Initiate a remote assistance session to lock the device.

Question 4

You are troubleshooting a Windows 10 device that is showing as non-compliant in Intune. The exhibit shows the PowerShell output from the Microsoft Graph API. Based on the output, what is the most likely reason for the non-compliance?

Accepted Answer

BitLocker drive encryption is not enabled on the device. The output shows the non-compliance reason is 'RequireEncryption', indicating BitLocker is not enabled. Option A is incorrect because the reason is about encryption, not operating system version. Option C is incorrect because the reason is about encryption, not the Windows version. Option D is incorrect because the reason is about encryption, not antivirus.

Answer

The device does not have a compliant operating system version

Answer

The device is not running a supported version of Windows 10

Answer

The device has a third-party antivirus installed

Question 5

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Accepted Answer

Retire (selective wipe). A Retire (selective wipe) in Microsoft Intune removes managed corporate data and policies from a Windows 10 device while preserving the user's personal data. This is achieved by unenrolling the device from Intune and removing company-managed apps, certificates, and profiles, leaving the device in a usable state for the user. Option E is also correct: a Full wipe (remote wipe) restores the device to its factory default settings, erasing all data including personal files and applications. This is used when the device is lost or stolen, or when it needs to be completely reset.

Answer

Factory reset from Windows Settings

Answer

Remote lock

Answer

Delete device from Intune

Question 6

You need to deploy a Microsoft Store app (e.g., Microsoft Whiteboard) to Windows 10 devices managed by Intune. Which app type should you use?

Accepted Answer

Microsoft Store app (Windows). To deploy a Microsoft Store app like Microsoft Whiteboard to Windows 10 devices managed by Intune, you must use the 'Microsoft Store app (Windows)' app type. This type directly integrates with the Microsoft Store catalog, allowing you to select and deploy store apps without needing offline licensing or manual packaging. It supports both online and offline licensing models, but for a standard store app deployment, this is the correct and simplest choice.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store for Business (offline licensed)

Question 7

Refer to the exhibit. You configure an Enrollment Status Page (ESP) policy as shown. During Windows Autopilot deployment, a device fails to install one of the required apps. What happens to the device?

Accepted Answer

The device blocks use and the user cannot proceed. The Enrollment Status Page (ESP) policy is configured with the 'Show error when installation takes longer than specified number of minutes' option set to 'Block device use until all required apps and profiles are installed.' When a required app fails to install, the ESP enters an error state and, because the policy is set to block use, the device remains locked at the ESP screen, preventing the user from proceeding to the desktop. This behavior is enforced by the Autopilot client, which monitors the installation status of required apps and profiles and will not allow the user to bypass the ESP until all required items are successfully installed or the timeout is reached.

Answer

The device automatically resets and retries

Answer

The user can skip the installation and use the device

Answer

The user can retry the installation

Question 8

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows devices? (Choose two)

Accepted Answer

View hardware inventory of a device.. The Microsoft Intune admin center provides a hardware inventory view for managed Windows devices, displaying details such as processor, RAM, disk space, and firmware version. This data is collected via the Intune Management Extension and device inventory reports, enabling administrators to assess device compliance and readiness without requiring on-premises tools.

Answer

Reset a user's password.

Answer

Manage on-premises Active Directory objects.

Answer

Assign Microsoft 365 licenses to a user.

Question 9

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy an internal web app as a web clip on users' devices. The app requires users to authenticate with their organization credentials. Which configuration is required to ensure a seamless single sign-on experience?

Accepted Answer

Add the web clip with 'Managed App Configuration' including SSO key. Deploying the web clip with 'Managed App Configuration' including an SSO key allows Intune to inject authentication tokens into the web clip, enabling seamless single sign-on (SSO) without requiring the user to re-enter credentials. This leverages the Microsoft Enterprise SSO plug-in or a custom SSO configuration to automatically authenticate against the internal web app using the user's organization credentials.

Answer

Enable 'Use managed browser' in the app assignment

Answer

Deploy a VPN configuration that forces traffic through the corporate network

Answer

Configure the web clip with 'Full screen' option enabled

Question 10

You need to ensure that only compliant devices can access Microsoft 365 resources. You create a Conditional Access policy in Microsoft Entra ID. Which condition should you use?

Accepted Answer

Require device to be marked as compliant.. The question specifically asks to ensure that only compliant devices can access Microsoft 365 resources. In a Conditional Access policy, the 'Require device to be marked as compliant' grant control enforces that the device must be enrolled in Microsoft Intune and meet all compliance policies (e.g., encryption, OS version, threat level) before access is granted. This directly ties device health to resource access, which is the core requirement.

Answer

Locations condition set to trusted IPs.

Answer

Grant access with multi-factor authentication.

Answer

Device platform condition set to all.

Question 11

You need to manage updates for Windows 10 devices using Microsoft Intune. You want to ensure that critical security updates are installed within 7 days of release, while feature updates are deferred for 60 days. Which approach should you use?

Accepted Answer

Create a Windows update ring policy with quality update deferral set to 7 days and feature update deferral set to 60 days.. Windows update ring policies in Microsoft Intune allow granular control over both quality (security) and feature update deferral periods. Setting quality update deferral to 7 days ensures critical security patches are installed within a week, while feature update deferral of 60 days delays non-security feature updates. This directly meets the requirement without additional profiles or compliance policies.

Answer

Create a Windows feature update profile to deploy the latest feature update after 60 days.

Answer

Create a device compliance policy requiring devices to install updates within 7 days.

Answer

Configure Windows Update for Business settings via a configuration profile.

Question 12

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage device threat detection. You have integrated Defender for Endpoint with Intune for compliance. Some devices are showing as non-compliant due to 'active threats' that are actually low-risk. How can you adjust the compliance policy to allow low-risk threats?

Accepted Answer

Set the 'Threat level' in the Intune compliance policy to 'Low'.. The Intune compliance policy includes a 'Threat level' setting that determines the minimum threat severity required for a device to be considered compliant. By setting this value to 'Low', devices with only low-risk threats will be marked as compliant, allowing them to pass the policy check. This directly addresses the scenario where low-risk threats are incorrectly causing non-compliance.

Answer

Modify the Conditional Access policy to require device compliance.

Answer

Configure the 'Machine risk score' in Defender for Endpoint.

Answer

Whitelist the specific threats in Defender for Endpoint.

Question 13

An organization has deployed Microsoft Entra Connect Sync to synchronize on-premises Active Directory to Microsoft Entra ID. Users report that some cloud-only user accounts cannot be assigned licenses. The admin checks the provisioning logs and finds that the cloud accounts have a source of authority of 'Microsoft Entra ID'. What is the most likely cause?

Accepted Answer

The accounts are missing the 'UsageLocation' attribute, which is required for license assignment.. The most likely cause is that the cloud-only user accounts are missing the 'UsageLocation' attribute. In Microsoft Entra ID, a UsageLocation must be set before licenses can be assigned to any user, including cloud-only accounts. Without this attribute, license assignment fails regardless of the user's source of authority.

Answer

The accounts have the 'cloudOnly' attribute set to true, which blocks license assignment.

Answer

The accounts have no proxyAddresses, so licensing fails.

Answer

The users are not synchronized because the sync schedule is set to manual.

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

Accepted Answer

Check if the user has logged in and acknowledged the FileVault prompt.. FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Answer

Ensure that a compliance policy is also assigned requiring encryption.

Answer

Ensure the devices are supervised.

Answer

Verify that the profile is assigned to the correct device group.

Question 15

A company uses Microsoft Intune to manage devices. They have a Windows 10 device that is non-compliant due to missing required updates. The administrator reviews the device and sees the update status shows 'Pending restart'. Which THREE actions should the administrator take to resolve the compliance issue?

Accepted Answer

Check the Update Rings policy for deferral settings.. Update Rings policy deferral settings can delay the installation of required updates, causing the device to show a 'Pending restart' status without actually applying the updates. By checking and adjusting these deferral settings, the administrator can ensure updates are installed promptly, resolving the non-compliance issue.

Answer

Wait for the automatic restart from the compliance policy.

Answer

Re-enroll the device in Intune.