MD-102 Practice Test 41 — 15 Questions

Question 1

A user reports that their Windows 11 device cannot install a required line-of-business (LOB) app from Company Portal. The app is assigned to the user and shows as 'Available' in Intune. The device is compliant and managed. What is the most likely cause?

Accepted Answer

The Company Portal app on the device is outdated.. Option C is correct because the Company Portal app on the device might be outdated, causing it to not display the app correctly. Option A is wrong because the user is assigned the app. Option B is wrong because the device is compliant. Option D is wrong because the app is assigned.

Answer

The app is not assigned to the user.

Answer

The app is not assigned to the device group.

Answer

The device is non-compliant with security policies.

Question 2

Which THREE features are available in Microsoft Intune for managing Windows 10/11 device updates?

Accepted Answer

Update rings for Windows 10 and later. Options A, B, and D are correct. Intune supports Update rings, Feature update policies, and Windows Autopatch. Option C is wrong because Windows Update for Business is a service, not an Intune feature. Option E is wrong because WSUS is on-premises, not Intune.

Answer

Windows Update for Business

Answer

Windows Server Update Services (WSUS)

Question 3

You manage Windows 10 devices with Intune. You need to ensure that only approved apps can run on corporate devices. You configure AppLocker via a custom OMA-URI. However, users can still run unapproved apps. What is the most likely reason?

Accepted Answer

The policy is assigned to a device group instead of a user group.. Option D is correct because AppLocker rules are applied per user, not per device. If the policy is assigned to user groups but the user is not in the scope, the rules do not apply. Option A is wrong because AppLocker can be configured via OMA-URI. Option B is wrong because AppLocker works on Windows 10/11 Enterprise and Education editions. Option C is wrong because uninstalling the app does not enforce rules.

Answer

The device must be running Windows 10 Pro edition.

Answer

AppLocker rules can only be configured via Group Policy, not OMA-URI.

Answer

The AppLocker policy is set to 'Audit only' mode.

Question 4

Your organization uses Microsoft Defender for Cloud Apps (part of Microsoft Defender XDR). You need to detect when users access cloud apps from unauthorized locations. Which log source should you integrate to get location information?

Accepted Answer

Microsoft Entra ID sign-in logs. Option A is correct because Microsoft Defender for Cloud Apps can integrate with Microsoft Entra ID (Azure AD) to receive sign-in logs, which include IP address and location. Option B is wrong because Microsoft Sentinel is a SIEM, not a source of location data. Option C is wrong because Microsoft Purview is for compliance, not real-time access. Option D is wrong because Intune enrollment logs do not contain app access location.

Answer

Microsoft Intune device enrollment logs

Answer

Microsoft Purview audit logs

Answer

Microsoft Sentinel

Question 5

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Company Portal app from their devices. Which configuration should you apply?

Accepted Answer

Assign the Company Portal app as 'Required' with 'Removable' set to No.. Option A is correct because setting the app as 'Required' and making it 'Removable' = No will prevent removal. Option B is wrong because 'Available' allows removal. Option C is wrong because 'Uninstall' is not an assignment type. Option D is wrong because 'Block removal' is not an assignment setting.

Answer

Assign the Company Portal app as 'Available for enrolled devices' with 'Removable' set to Yes.

Answer

Assign the Company Portal app as 'Uninstall' for all devices.

Answer

Create a device restriction policy that blocks removal of the Company Portal app.

Question 6

You need to configure BitLocker encryption for Windows 10 devices managed by Intune. You create a device configuration profile for endpoint protection. After assigning, devices show 'BitLocker not enabled' in the Intune console. What is the most likely cause?

Accepted Answer

The devices do not have a TPM chip.. Option B is correct because BitLocker requires a TPM chip on the device. If the device does not have TPM or it is disabled, BitLocker cannot be enabled. Option A is wrong because the profile is assigned to devices. Option C is wrong because BitLocker is available on Windows 10 Pro and Enterprise. Option D is wrong because Windows 10 can be encrypted with or without Secure Boot.

Answer

The profile is assigned to a user group instead of a device group.

Answer

Secure Boot is not enabled on the devices.

Answer

The devices are running Windows 10 Home edition.

Question 7

A user has a Windows 10 device that is managed by Intune. The device is compliant but the user reports that they cannot access corporate email on their device. The email profile is deployed via Intune. Other users can access email successfully. What should you check first?

Accepted Answer

Check if the user's certificate is valid and assigned.. Option B is correct because a certificate issue could prevent the email profile from working. Option A is wrong because device compliance is fine. Option C is wrong because the issue is specific to one user. Option D is wrong because the email profile is deployed.

Answer

Check if the email profile is assigned to the user.

Answer

Re-create the email profile for all users.

Answer

Verify device compliance status.

Question 8

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

Accepted Answer

Work profile. Option C is correct because Android Enterprise work profile creates a separate profile on the device that isolates work apps and data from personal apps. Option A is wrong because device administrator mode is legacy and does not provide strong separation. Option B is wrong because corporate-owned personally enabled (COPE) uses work profile but is for corporate-owned devices, not BYOD. Option D is wrong because fully managed is for corporate-owned without personal space.

Answer

Fully managed

Answer

Device administrator

Answer

Corporate-owned personally enabled (COPE)

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting. You check the BitLocker policy and it is assigned correctly. What is the most likely reason?

Accepted Answer

The device does not have a TPM chip.. Option C is correct because BitLocker requires a TPM and if the device does not have one, encryption will not start. Option A is wrong because the policy is assigned correctly. Option B is wrong because the device is compliant. Option D is wrong because BitLocker does not require a specific Windows edition for basic encryption.

Answer

The device is running Windows 10 Home edition.

Answer

The BitLocker policy is not assigned to the users.

Answer

The device is non-compliant and encryption is blocked.

Question 10

You are deploying Windows 10 devices using Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are blocked from bypassing the sign-in screen by clicking 'Skip for now'. Which setting should you configure in the Enrollment Status Page (ESP) profile?

Accepted Answer

Block user from signing in automatically. The correct answer is B because the ESP profile can block device setup failure and force sign-in. Option A is wrong because blocking local installation is not directly related. Option C is wrong because blocking Windows Setup is not an ESP setting. Option D is wrong because requiring compliance is separate from OOBE sign-in.

Answer

Block Windows Setup page

Answer

Require device compliance

Answer

Block device setup failure

Question 11

You have a Microsoft Intune environment with devices running Windows 10 and 11. You need to configure a policy that enforces BitLocker drive encryption with a TPM protector and stores recovery key in Microsoft Entra ID. Which three settings must you configure in the endpoint protection profile? (Choose three.)

Accepted Answer

Store recovery key in Microsoft Entra ID. Options A, B, and D are correct. To enforce BitLocker with TPM and store recovery key in Entra ID, you need to enable BitLocker, configure TPM as protector, and specify Entra ID as the recovery key storage. Option C is wrong because encryption of OS drive is a separate setting. Option E is wrong because the encryption method does not affect recovery key storage.

Answer

Require encryption of OS drive

Answer

Choose encryption method (XTS-AES 128-bit)

Question 12

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

Accepted Answer

Microsoft 365 Apps (Windows) configuration policy. Option B is correct. Intune uses 'Microsoft 365 Apps (Windows)' configuration policies specifically for Microsoft 365 Apps. Option A is for general app deployment. Option C is for Windows settings. Option D is for device configuration.

Answer

Device configuration profile (settings catalog)

Answer

Managed apps policy

Answer

Windows update ring policy

Question 13

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

Accepted Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}. Option A is correct because the 'deviceHealth' condition with 'defenderSensorVersion' and 'defenderSensorHealth' is the correct syntax for conditional launch in Intune app protection policies. Option B is wrong because 'minimumVersion' is not a valid key. Option C is wrong because 'clientVersion' is used for the app itself, not the sensor. Option D is wrong because the syntax is incorrect.

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": "healthy"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"version": "10.8049.22439.1043"}, "defenderSensorHealth": {"state": "enabled"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

Answer

{"deviceHealth": {"clientVersion": {"minimumVersion": "10.8049.22439.1043"}, "clientHealth": {"minimumVersion": 1}}}

Question 14

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data is separated from personal data on the device. Which management approach should you use?

Accepted Answer

Android Enterprise work profile. Option A is correct because Android Enterprise work profile provides a separate container for corporate data. Option B is wrong because device administrator is legacy and does not separate data. Option C is wrong because fully managed devices do not have personal space. Option D is wrong because kiosk mode is for single-app use.

Answer

Android Enterprise kiosk mode

Answer

Android Enterprise fully managed

Answer

Android device administrator

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically install critical updates from Windows Update for Business within 3 days of release. Which configuration should you use?

Accepted Answer

Update rings for Windows 10 and later. Option B is correct because 'Update rings' in Intune allow you to configure deferral periods for quality updates. Option A is wrong because Windows Autopatch is for automated patching but not for deferral periods. Option C is wrong because Feature updates are for feature updates, not quality updates. Option D is wrong because Windows 10/11 device configuration policies do not directly manage update rings.

Answer

Windows Autopatch deployment policy

Answer

Windows feature update policy

Answer

Device configuration policy for Windows 10/11