MD-102 Practice Test 41 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a PowerShell script via Intune management extension to install a legacy application. The script runs successfully on most devices, but fails on devices that have the 'LocalSystem' account disabled. What should you do to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the script to run in the user context by modifying the script settings in Intune. The Intune Management Extension runs PowerShell scripts under the LocalSystem account by default. When this account is disabled, the script cannot execute. Configuring the script to run in the user context (option A) bypasses this dependency by executing the script under the logged-on user's security context, which is still active even if LocalSystem is disabled.

Answer

Change the script to run as the logged-on user using a scheduled task

Answer

Deploy the script using Microsoft Configuration Manager instead

Answer

Re-enable the LocalSystem account on the affected devices

Question 2

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

Accepted Answer

Add a compliance policy setting: 'Require the device to be at or under the machine risk score' with a low score.. Microsoft Defender for Endpoint integrates with Intune compliance policies via the 'Require the device to be at or under the machine risk score' setting. When a device stops reporting to Defender, its risk score escalates above the 'Low' threshold, causing Intune to mark it as non-compliant. This directly meets the requirement to flag non-reporting devices without additional scripting or conditional access complexity.

Answer

Create a Conditional Access policy requiring device compliance and blocking access if not compliant.

Answer

Enable 'Require BitLocker' compliance setting.

Answer

Deploy a PowerShell script via Intune that checks the Defender service status and reports to Intune custom compliance.

Question 3

You have a hybrid Microsoft Entra ID joined Windows 10 device that is co-managed with Configuration Manager and Intune. You want Intune to manage Windows Update for Business settings. Which slider setting should you configure in Configuration Manager?

Accepted Answer

Move the slider for 'Windows Update policies' to 'Intune'. In a co-management scenario, workload sliders in Configuration Manager determine which authority manages specific workloads. To have Intune manage Windows Update for Business settings, you must move the slider for 'Windows Update policies' to Intune. This shifts the policy authority from Configuration Manager to Intune, allowing Intune's Update Rings and feature update policies to control Windows Update behavior on the device.

Answer

Move the slider for 'Endpoint protection' to 'Intune'

Answer

Move the slider for 'Resource access' to 'Intune'

Answer

Move the slider for 'Device configuration' to 'Intune'

Question 4

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

Accepted Answer

The detection script incorrectly reports the app as installed.. The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Answer

The app is assigned to a different device group.

Answer

The app was installed but later removed by the user.

Answer

The device is not syncing with Intune.

Question 5

Which TWO conditions in a Conditional Access policy can be used to enforce device compliance for access to Microsoft 365 services?

Accepted Answer

Client apps (Browser, Mobile apps and desktop clients). The 'Client apps' condition in a Conditional Access policy allows you to target specific client application types (e.g., browser, mobile apps, and desktop clients) to enforce device compliance. Option E is correct because the 'Device state' condition directly checks whether a device is marked as compliant in Microsoft Intune or is domain-joined (hybrid Azure AD join), which is the primary mechanism for enforcing device compliance for access to Microsoft 365 services.

Answer

Sign-in risk

Answer

Locations (trusted IPs)

Answer

Applications (e.g., Exchange Online)

Question 6

You are designing a Windows Autopilot deployment for a global organization. Devices are purchased from multiple OEMs and shipped directly to users. Some users report that their devices do not register in Autopilot automatically. You confirm the devices have Windows 11 Pro preinstalled and meet hardware requirements. What is the most likely reason for the registration failure, and what should you do to resolve it?

Accepted Answer

The devices are not registered in Autopilot by the OEM; collect the hardware hash using a script. The most likely reason is that the OEM did not register the devices in Windows Autopilot by uploading their hardware hashes to the Microsoft Partner Center. Without this registration, the devices will not be recognized during OOBE and will not automatically receive the Autopilot deployment profile. To resolve this, you must collect the hardware hash from each device using a PowerShell script (e.g., Get-WindowsAutopilotInfo.ps1) and manually upload it to Intune or the Partner Center.

Answer

The devices have a TPM chip that is not compliant with Autopilot requirements

Answer

The Autopilot deployment profile is assigned to a dynamic device group that excludes these devices

Answer

The devices are not connected to the internet during OOBE

Question 7

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are planning to upgrade them to Windows 11. The devices must meet the Windows 11 hardware requirements. You need to identify which devices are eligible for upgrade and then deploy Windows 11 using a feature update policy in Intune. You have the following requirements: (1) Generate a report of devices that are not eligible due to TPM 2.0 or CPU incompatibility. (2) Deploy Windows 11 to eligible devices using a phased approach: first to IT department (200 devices), then to pilot users (500 devices), and finally to all remaining devices. (3) Ensure that devices in the IT department receive the update within 7 days of Microsoft's release, while pilot users receive it after 30 days, and remaining devices after 60 days. (4) Monitor deployment progress and roll back if critical issues are detected. What should you do?

Accepted Answer

Create feature update policies for Windows 10 and later, targeting each group with appropriate deferral settings. Use the Windows 11 readiness report to identify eligible devices.. Feature update policies in Intune allow you to deploy Windows 11 to specific groups with deferral settings (days after release). The Windows 11 readiness report identifies devices that are not eligible due to TPM 2.0 or CPU incompatibility. Option B is incorrect because Windows Update for Business group policies in on-premises AD are not managed via Intune and cannot use the readiness report. Option C is incorrect because update rings are for quality updates, not feature updates. Option D is incorrect because Windows Autopilot is used for initial provisioning, not for upgrading existing devices.

Answer

Configure Windows Update for Business group policies in on-premises AD.

Answer

Use update rings with different deferral periods for each group.

Answer

Use Windows Autopilot to deploy Windows 11 images to devices.

Question 8

A company uses Microsoft 365 with hybrid identity. Users report that after changing their on-premises passwords, they cannot access SharePoint Online for up to 30 minutes, but Outlook on the web works immediately. You need to reduce the delay for SharePoint Online access. What should you do?

Accepted Answer

Run a Delta Sync in Azure AD Connect.. The delay occurs because password changes are synchronized only during the next Azure AD Connect sync cycle, which by default runs every 30 minutes. Running a Delta Sync immediately replicates the new password hash to Azure AD, eliminating the wait for SharePoint Online authentication.

Answer

Configure password writeback in Azure AD Connect.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

In Azure AD, configure the user to require password change at next sign-in.

Question 9

You manage a hybrid Microsoft Entra ID environment with 5,000 Windows 10 devices enrolled in Microsoft Intune. You need to deploy a critical security update that requires a reboot to all devices within the next 4 hours. Users must be able to postpone the reboot for up to 8 hours. You configure a device restart policy in Intune. Which deadline and grace period settings should you use?

Accepted Answer

Deadline: 4 hours, Grace period: 8 hours. The deadline (4 hours) matches the required deployment window for the critical update, and the grace period (8 hours) allows users to postpone the reboot for up to 8 hours after the deadline. In Intune device restart policies, the deadline specifies when the update must be installed and the reboot initiated, while the grace period defines how long users can delay the restart after the deadline. With a 4-hour deadline and 8-hour grace period, the update is enforced within 4 hours, and users can postpone the reboot for up to 8 hours from that point, meeting both requirements.

Answer

Deadline: 8 hours, Grace period: 4 hours

Answer

Deadline: 2 hours, Grace period: 12 hours

Answer

Deadline: 4 hours, Grace period: 30 minutes

Question 10

A company manages 500 Windows 11 devices with Microsoft Intune. They use BitLocker encryption with automatic encryption enabled. Several devices report that encryption did not start. The administrator reviews the devices and finds that they are not compliant with the BitLocker policy. What is the most likely cause?

Accepted Answer

Devices do not have a Trusted Platform Module (TPM) chip. BitLocker automatic encryption requires a compatible TPM chip to securely store encryption keys and validate system integrity. Without a TPM, BitLocker cannot start the encryption process automatically, leading to non-compliance with the policy. The other options do not directly prevent encryption from starting.

Answer

Devices do not have a secure boot enabled

Answer

Devices are not Azure AD joined

Answer

BitLocker startup key is not saved to Azure AD

Question 11

You are troubleshooting a Windows 11 device that is enrolled in Microsoft Intune. The device shows 'Pending' status for a required app deployment. The app is a line-of-business (LOB) app. The device has been online for the past 24 hours. What is the most likely cause?

Accepted Answer

The Intune management extension is not installed on the device.. The Intune management extension is responsible for deploying line-of-business (LOB) apps and PowerShell scripts on Windows devices. If this extension is not installed, the device will show a 'Pending' status for required app deployments because the Intune service cannot initiate the download or installation. Since the device has been online, connectivity is not the issue, and the extension must be present to process the deployment.

Answer

The device does not have internet connectivity to download the app.

Answer

The device's certificate for Intune is expired.

Answer

The device requires a restart to complete previous updates.

Question 12

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

Accepted Answer

Set 'Allow application store' to 'Block' for non-admin users.. The 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Answer

Enable 'Private store only' in Microsoft Store for Business settings.

Answer

Disable 'Automatic app updates' in the device restriction policy.

Answer

Configure 'Require a password for app purchases' to 'Yes'.

Question 13

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.. Conditional Access policies in Microsoft Entra ID can evaluate device compliance status from Intune to grant or block access to corporate resources like Exchange Online. When a device is marked non-compliant (e.g., missing BitLocker, outdated OS, jailbroken/rooted), the Conditional Access policy blocks access and can display a notification. Option A is incorrect because device enrollment restrictions only control whether a device can enroll in Intune or join Azure AD; they do not enforce access after enrollment. Option B is incorrect because device configuration policies apply settings but do not enforce access control. Option C is incorrect because app protection policies protect data within apps but rely on device compliance for access decisions.

Answer

Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

Answer

Create a device configuration policy that blocks access to corporate resources.

Answer

Create an app protection policy in Intune to block access to apps.

Question 14

An organization uses Microsoft Intune to manage Windows devices. They need to configure a policy to enforce disk encryption on devices. Which TWO of the following are valid encryption options?

Accepted Answer

BitLocker. BitLocker is a full-disk encryption feature built into Windows Pro and Enterprise editions, and it can be managed via Microsoft Intune using the 'Endpoint Protection' profile under the 'Windows Encryption' category. Device encryption is available on Windows devices that support InstantGo (modern standby) and is enabled by default on many devices. In contrast, FileVault is a macOS-specific encryption feature and is not applicable to Windows devices. Encrypting File System (EFS) provides file-level encryption, not full-disk encryption. APFS encryption is also macOS-specific. Therefore, only BitLocker (A) and Device encryption (C) are valid encryption options for Windows devices managed by Intune.

Answer

Encrypting File System (EFS)

Answer

FileVault

Answer

APFS encryption

Question 15

Refer to the exhibit. You are reviewing a Windows 10 update ring configuration JSON. What does the 'automaticUpdateBehavior' setting control?

Accepted Answer

Whether updates are installed automatically and if the user can control reboot timing. The 'automaticUpdateBehavior' setting in a Windows 10 update ring configuration JSON controls whether updates are downloaded and installed automatically, and whether the user can control reboot timing. When set to 'autoInstallAndRebootWithNoUserControl', updates install automatically and reboots occur without user interaction; when set to 'autoInstallAndRebootWithUserControl', the user can schedule or postpone reboots. This directly matches option C, as it governs both automatic installation and reboot control.

Answer

The level of update notifications

Answer

How long to defer feature updates

Answer

The branch readiness level