MD-102 Practice Test 40 — 15 Questions

Question 1

You manage devices in Microsoft Intune. You need to generate a report that shows which devices have not checked in with Intune for more than 30 days. What should you use?

Accepted Answer

Devices without recent check-in report. The 'Devices without recent check-in' report in Intune is designed to list devices that have not communicated with the service within a specified period. It allows you to filter by number of days, making it the correct tool to identify devices inactive for more than 30 days.

Answer

Device compliance report

Answer

Windows Update report

Answer

Device configuration report

Question 2

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that devices cannot access corporate email if they are rooted. What should you configure?

Accepted Answer

A device compliance policy with the 'Rooted devices' setting set to 'Block'.. To block rooted Android devices from accessing corporate email, you need a compliance policy that marks rooted devices as non-compliant. Then, a Conditional Access policy can enforce compliance for email access. The compliance policy setting 'Rooted devices' set to 'Block' is the key configuration.

Answer

An app protection policy that blocks jailbroken devices.

Answer

A Conditional Access policy that requires a compliant device.

Answer

A device configuration profile that disables USB debugging.

Question 3

Your organization uses Microsoft Intune to manage Windows 11 devices. You deploy a Win32 app as required to a group of users. After deployment, users report the app shortcut is missing from the Start menu even though the app appears installed in the Company Portal. You review the app properties and confirm the install command succeeded. You need to ensure the shortcut appears for all users on each device. What should you configure?

Accepted Answer

Package the app so the installer writes the shortcut to the all-users Start menu location, and deploy the app in system context.. Start menu shortcut visibility depends on where the shortcut file is written. Per-user locations only show for the installing account, while the common Start menu path is visible to everyone. Combining a package that targets the common path with system-context installation ensures the shortcut is present for all users on the device, resolving the reported symptom.

Answer

Set the app to install in system context and add a requirement rule for the Windows 11 operating system.

Answer

Add a detection rule that checks for the shortcut file in the public Start menu path.

Answer

Configure the app to install in user context and assign it to the device group.

Question 4

You manage 500 Windows 11 devices with Microsoft Intune. Several devices are shared by multiple employees across shifts at a manufacturing plant. You need to configure a policy that automatically removes local user profiles that have not been used for 60 days to conserve disk space, while preserving profiles of users who sign in regularly. What should you configure?

Accepted Answer

An Intune settings catalog policy or custom OMA-URI using the SharedPC CSP with 'InactiveThreshold' set to 60 days.. Shared devices accumulate local profiles over time, and Intune addresses this through the SharedPC CSP, which supports an InactiveThreshold value expressed in days. Configuring this through the settings catalog or a custom OMA-URI deletes dormant profiles automatically while leaving frequently used profiles intact. General device restrictions, compliance policies, and session timeouts do not perform profile cleanup, so they fail to reclaim the disk space consumed by unused accounts.

Answer

A compliance policy that marks devices as noncompliant after 60 days of profile inactivity.

Answer

A device restrictions configuration profile with the 'Inactivity timeout' setting configured to 60 days.

Answer

A Windows 10/11 device restrictions profile with 'Delete inactive user profiles' set to 60 days.

Question 5

You are an Endpoint Administrator for a company using Microsoft Intune. A Windows app (Win32) app has been deployed as Required to a pilot group of 20 devices. Reports show the app installed successfully on 18 devices but failed on 2 devices with the error 'The application was not detected after installation completed successfully.' You confirm the installer runs silently and exits with code 0 on the failing devices. What is the most likely cause?

Accepted Answer

The detection rule configured for the app does not match the state the installer actually produces on those devices.. The message 'not detected after installation completed successfully' is generated when the installer returns a success code but the detection rule evaluation finds nothing matching. Because the same package works on other devices, the detection rule is the component that needs correction for the affected devices.

Answer

The app's requirement rules exclude those two devices because they run an unsupported Windows build.

Answer

The devices are not enrolled in the Intune Management Extension and therefore cannot run Win32 apps.

Answer

The install command line for the app is incorrect and causes the installer to silently skip installation.

Question 6

You manage a group of iOS devices enrolled in Microsoft Intune. Users report that they are unable to receive email on their devices after you deployed a new configuration profile. You need to identify the cause quickly. What should you use?

Accepted Answer

Intune configuration profile assignment status. The configuration profile assignment status in Intune provides per-device deployment details, including success or failure and error messages. This helps quickly identify if the email profile was not applied correctly or if there was a conflict, directly addressing the user's inability to receive email.

Answer

Intune device compliance report

Answer

Azure AD sign-in logs

Answer

Intune audit logs

Question 7

You manage a set of Windows 11 devices with Microsoft Intune. You need to configure attack surface reduction (ASR) rules to block Office applications from creating child processes. You want to ensure the rules are enforced and cannot be bypassed by users. Which Intune profile type should you use?

Accepted Answer

Endpoint security > Attack surface reduction policy. The Attack surface reduction policy in Intune is the correct choice for configuring ASR rules. It provides a dedicated, user-friendly interface to set rules to Block, Audit, or Warn. When set to Block, the rules are enforced by Defender Antivirus and cannot be overridden by users, ensuring the desired protection.

Answer

Devices > Compliance policies

Answer

Devices > Configuration profiles > Templates > Endpoint protection

Answer

Devices > Configuration profiles > Templates > Custom

Question 8

You are setting up Microsoft Intune for a new subsidiary. The subsidiary has an existing on-premises Active Directory Domain Services (AD DS) and uses Microsoft Entra Connect to synchronize users to Microsoft Entra ID. You need to enable automatic enrollment of Windows 10 devices into Intune for users who are synchronized from AD DS. What should you configure first?

Accepted Answer

In Microsoft Entra ID, configure the Mobility (MDM and MAM) settings to enable automatic MDM enrollment for Windows devices.. Automatic Intune enrollment for Windows devices is enabled through the Mobility (MDM and MAM) configuration in Microsoft Entra ID. This setting, when scoped to users or groups, allows synchronized users to automatically enroll their Windows devices. Enrollment restrictions and Autopilot profiles serve different purposes and do not initiate automatic enrollment, while device writeback is unrelated to MDM enrollment.

Answer

In Microsoft Intune, create a Windows Autopilot deployment profile and assign it to all devices.

Answer

In Microsoft Intune, create a device enrollment restriction that allows Windows devices and assign it to all users.

Answer

In Microsoft Entra Connect, enable device writeback and synchronize device objects to Microsoft Entra ID.

Question 9

You manage Windows 11 devices with Microsoft Intune. After a Windows quality update is deployed to a pilot ring, several devices report installation failures in the Update reports. You need to identify the exact error code returned by the update installation on a specific device without accessing the device directly. What should you do?

Accepted Answer

In the Microsoft Intune admin center, open the device's Windows Update for Business reports and view the 'Update installation failures' report.. Windows Update for Business reports in Microsoft Intune include detailed update installation data, including failure codes and reasons. These reports are accessible from the Intune admin center and provide per-device information without requiring direct device access. The other options either report unrelated data or require additional infrastructure that does not surface update error codes.

Answer

From the Intune admin center, select the device and review the device compliance policy status.

Answer

In Microsoft Intune, review the device's discovered apps report to identify the update failure.

Answer

Use Microsoft Endpoint Configuration Manager to create a device collection and run a hardware inventory cycle.

Question 10

You manage Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app named App1 that requires a specific command-line switch during installation. The app's installer is an .exe file that does not support silent installation by default. You must ensure the app installs without user interaction. What should you do?

Accepted Answer

Package the app as a Win32 app and specify the silent install command in the install command field.. Win32 apps in Intune are designed for custom .exe installers and allow you to specify the exact install command, including silent switches. After packaging with the Microsoft Win32 Content Prep Tool, you provide the silent install command in the app configuration. This ensures the app installs without user interaction and is tracked by Intune with detection and reporting.

Answer

Add the app as a Microsoft Store app (new) and upload the .exe file.

Answer

Create a PowerShell script that runs the installer with the required switch and deploy it as a platform script.

Answer

Deploy the app as a line-of-business app and upload the .exe file directly.

Question 11

You are a Microsoft 365 Endpoint Administrator. You need to remotely wipe a lost Windows 11 device that is enrolled in Microsoft Intune. The device is currently offline. What happens when you initiate a wipe action from the Intune admin center?

Accepted Answer

The wipe command is queued and will execute the next time the device checks in with Intune.. Intune queues remote actions for devices that are offline. When the device next connects to the Intune service, it receives the pending wipe command and executes it. This ensures that lost or stolen devices can be wiped even if they are currently disconnected. The other options incorrectly suggest immediate failure, expiration, or push notification delivery to offline devices. The correct behavior is to queue the command until the device checks in.

Answer

The wipe command is sent via push notification and will execute even if the device is offline.

Answer

The wipe fails immediately because the device is offline, and you must retry once it is online.

Answer

The device is marked as wiped in Intune immediately, but the actual wipe occurs only if the device comes online within 24 hours.

Question 12

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant, it loses access to corporate email and Teams within 15 minutes. You have already configured a compliance policy and assigned it to all users. What should you do next to meet the requirement?

Accepted Answer

Configure a Conditional Access policy that requires compliant devices and set the grant control to require device compliance.. To block access to corporate resources like email and Teams when a device is noncompliant, you must use Conditional Access. A Conditional Access policy that requires the device to be marked as compliant will deny access if the device is not compliant. Intune updates the compliance status, and Conditional Access enforces it. This typically takes effect within minutes, satisfying the 15-minute window. Other options do not provide the required enforcement.

Answer

Configure a device compliance policy to automatically retire noncompliant devices after 15 minutes.

Answer

Configure an app protection policy that requires a PIN and blocks access to email and Teams on noncompliant devices.

Answer

Configure a Conditional Access policy that requires compliant devices and set the grant control to require multi-factor authentication.

Question 13

You manage Windows 11 devices with Microsoft Intune. Security requires that when a device is marked as noncompliant, access to Microsoft 365 services is blocked within 5 minutes, even if the user is already signed in. You configure a Conditional Access policy that requires a compliant device. What else must you configure to achieve this near-real-time enforcement?

Accepted Answer

Configure the Conditional Access policy to use 'Require device to be marked as compliant' and enable continuous access evaluation (CAE).. Continuous access evaluation (CAE) is the feature that enables near-real-time enforcement of Conditional Access policies. When a device becomes noncompliant, Intune updates the device compliance state, and CAE allows Microsoft Entra ID to revoke access tokens immediately. Without CAE, access remains until token expiry, which can be up to an hour. Therefore, enabling CAE alongside the compliant device requirement achieves the 5-minute block.

Answer

Decrease the compliance policy's 'Compliance status validity period' to 5 minutes.

Answer

Set the device compliance policy's action for noncompliance to 'Retire the device' immediately.

Answer

Set the compliance policy's 'Mark devices with no compliance policy assigned as' setting to 'Not compliant'.

Question 14

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to prevent users from installing apps from unknown sources on their personally-owned work profile devices. Which configuration profile type should you use?

Accepted Answer

Device restrictions. To prevent installation of apps from unknown sources on Android Enterprise personally-owned work profile devices, you should use a device restrictions profile. This profile type includes a setting under 'Work Profile Settings' or 'Device Settings' to block unknown sources. It is the built-in, recommended method. Other profile types either do not apply to Android or do not have the specific setting.

Answer

Custom

Answer

Endpoint protection

Answer

Identity protection

Question 15

You are the endpoint administrator for a company using Microsoft Intune. The IT director asks you to generate a report that shows which Windows devices have not installed the latest security update in the past 14 days. What should you use?

Accepted Answer

Microsoft Intune Reports > Windows updates > Windows quality updates report.. The Windows quality updates report in Intune provides detailed per-device status for monthly security and quality updates. It allows administrators to see which devices have not installed specific updates within a given timeframe, making it the correct tool for identifying devices missing recent security patches.

Answer

Microsoft Intune Reports > Windows updates > Feature updates report.

Answer

Microsoft Intune Devices > Monitor > Noncompliant devices report.

Answer

Microsoft Intune Endpoint security > Windows updates report.