MD-102 Practice Test 42 — 15 Questions

Question 1

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app that has a complex installation requiring multiple command-line parameters. The app must be available to users in the Company Portal. What is the best way to handle the installation parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Intune Win32 app packaging to specify the installation command with parameters.. Intune's Win32 app packaging allows you to specify the full installation command, including complex parameters, directly in the 'Install command' field. This method ensures the installer runs with the exact parameters needed, and the app is then published to the Company Portal for user self-service. PowerShell scripts or detection rules do not handle the installation parameters themselves, and administrative templates are for configuring settings, not installation commands.

Answer

Deploy a PowerShell script via Intune that runs the installer with parameters.

Answer

Configure detection rules to run a script that passes parameters.

Answer

Use an administrative template to set parameters before installing.

Question 2

Refer to the exhibit. You have configured a Windows Update for Business policy in Intune. Based on the JSON, what is the effect on devices?

Accepted Answer

Quality updates are paused from June 1 to June 30, and feature updates are paused from July 1 to July 15. The JSON policy specifies 'qualityUpdatesPauseStartDate': '2023-06-01' and 'qualityUpdatesPauseEndDate': '2023-06-30', meaning quality updates are paused during that period. Similarly, 'featureUpdatesPauseStartDate': '2023-07-01' and 'featureUpdatesPauseEndDate': '2023-07-15' pause feature updates from July 1 to July 15. Option A is incorrect because devices will still receive feature updates before July 1. Option B is incorrect because quality updates are paused starting June 1. Option D is incorrect because pause dates for different update types can overlap; only pause dates for the same type cannot overlap.

Answer

Devices will not receive any updates from June 1 to July 15

Answer

Devices will receive all updates normally until July 15

Answer

The policy is invalid because pause dates cannot overlap

Question 3

Which THREE steps are required to configure a Windows 10 device for kiosk mode using Microsoft Intune? (Choose three)

Accepted Answer

Create a device configuration profile with the kiosk settings.. A device configuration profile in Microsoft Intune is the mechanism used to define the specific kiosk settings, such as the user account, app type (e.g., single-app or multi-app kiosk), and browser configuration. This profile applies the kiosk mode configuration to the device via the Windows 10/11 kiosk policy CSP (Policy Configuration Service Provider).

Answer

Configure Autopilot for the device.

Answer

Create a device compliance policy to enforce kiosk mode.

Question 4

You are troubleshooting a Windows 10 device that fails to enroll in Microsoft Intune. The device shows error code 0x8018000b. You verify that the user has a valid Intune license and that the device is running Windows 10 Pro. What is the most likely cause of the enrollment failure?

Accepted Answer

MDM enrollment is blocked by a local Group Policy or registry setting.. Error 0x8018000b indicates that the device is not allowed to enroll, typically because MDM enrollment is blocked by a local Group Policy or registry setting. Even with a valid license and Windows 10 Pro, if the 'MDM Enrollment' policy is disabled or the 'Enrollment automatic' registry key is misconfigured, the enrollment attempt will fail with this specific error.

Answer

The device is running Windows 10 Home edition.

Answer

The device is not connected to the internet.

Answer

The device has an expired certificate required for enrollment.

Question 5

A company plans to deploy Windows 11 to 500 devices using Microsoft Deployment Toolkit (MDT). The deployment must be fully automated with minimal user interaction. Which configuration should be used in the CustomSettings.ini file?

Accepted Answer

SkipWizard=YES. `SkipWizard=YES` in the CustomSettings.ini file tells MDT to bypass all deployment wizard pages, enabling a fully unattended, zero-touch deployment. This is the specific setting required to achieve minimal user interaction during the MDT deployment process.

Answer

SkipApps=YES

Answer

UserDataLocation=AUTO

Answer

DoNotCreateExtraPartition=YES

Question 6

Which TWO methods can you use to enroll macOS devices in Microsoft Intune?

Accepted Answer

User-initiated enrollment via Company Portal. The Company Portal app on macOS allows users to initiate enrollment themselves, which registers the device with Microsoft Intune and applies compliance policies. This method is suitable for bring-your-own-device (BYOD) scenarios where the user controls enrollment. Option E is correct because Automated Device Enrollment (ADE), formerly DEP, uses Apple Business Manager to silently enroll corporate-owned macOS devices during initial setup, enforcing Intune management without user intervention.

Answer

Google Zero Touch Enrollment

Answer

Windows Autopilot

Answer

Apple Configurator

Question 7

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app that is signed by a developer certificate that is not yet trusted on the devices. What must you do to allow the installation?

Accepted Answer

Use a device configuration policy to trust the developer certificate before deploying the app.. MacOS requires that the developer certificate of a .pkg app be trusted at the system level before installation can proceed. By deploying a device configuration policy in Intune that adds the developer certificate to the trusted root store, you establish the necessary trust chain, allowing the .pkg to install without user intervention. This approach aligns with macOS Gatekeeper and security policies, which block unsigned or untrusted packages by default.

Answer

Deploy the app as a line-of-business app with the 'Allow user to bypass' option enabled.

Answer

Instruct users to manually approve the installation in System Preferences.

Answer

Convert the .pkg to a .dmg and deploy via Microsoft Store for Business.

Question 8

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices to authenticate to a corporate Wi-Fi network. Which TWO methods can you use to deploy the certificate?

Accepted Answer

Create a SCEP certificate profile in Intune.. A SCEP certificate profile in Intune allows iOS/iPadOS devices to request a certificate from a Simple Certificate Enrollment Protocol (SCEP) server, which can then be used for Wi-Fi authentication. This method supports automated enrollment and renewal of certificates without manual intervention, making it suitable for large-scale deployments.

Answer

Create a device compliance policy that includes the certificate.

Answer

Create a Wi-Fi profile and embed the certificate in the profile.

Answer

Create a VPN profile that includes the certificate.

Question 9

You need to enforce encryption on Windows 10 devices managed by Intune. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile. Endpoint Protection profiles in Intune include the 'Windows Encryption' settings category, which allows you to enforce BitLocker Drive Encryption on Windows 10 devices. This profile directly manages encryption policies such as requiring BitLocker on OS and fixed drives, configuring encryption methods (e.g., XTS-AES 128-bit), and setting recovery password options. It is the correct policy type for enforcing encryption because it specifically targets security settings like device encryption and BitLocker.

Answer

Device compliance policy

Answer

Windows Update for Business policy

Answer

Device configuration profile (settings catalog)

Question 10

You are the compliance administrator for a large organization using Microsoft 365 E5 licenses. The company has a hybrid identity configuration with Azure AD Connect syncing on-premises Active Directory to Azure AD. The security team requires that all mobile devices accessing corporate email and documents must be enrolled in Microsoft Intune and compliant with company device policies. Recently, several users reported that they cannot access Outlook on their iOS devices, receiving a message: 'Your organization requires this device to be managed by Intune. Please install the Company Portal app and enroll your device.' However, after installing Company Portal and completing enrollment, they still cannot access Outlook and see the same error. Upon investigation, you find that the devices are showing as 'Compliant' in the Microsoft Intune admin center. You also verify that the Conditional Access policy requiring device compliance is correctly configured and assigned to all users. What should you do to resolve the issue?

Accepted Answer

Verify that the devices are properly registered in Azure AD and, if not, ask users to unenroll and re-enroll their devices.. The issue is that the devices are compliant in Intune but not properly registered in Azure AD, which is a prerequisite for Conditional Access policies to evaluate device compliance. Even after enrollment, if the device registration fails or is incomplete, the Conditional Access policy will still block access. Option D addresses this by verifying and fixing the Azure AD registration, typically requiring unenrollment and re-enrollment to trigger a fresh registration.

Answer

Disable the Conditional Access policy, wait 10 minutes, and then re-enable it.

Answer

Recreate the Conditional Access policy with the same settings and assign it to the affected users.

Answer

Check if the affected users have an Intune license assigned; if not, assign one.

Question 11

Which THREE actions can you perform on a managed device from the Microsoft Intune admin center?

Accepted Answer

Change the primary user. The Microsoft Intune admin center supports several remote actions on managed devices. Changing the primary user (A), Restart (C), and Sync (D) are all valid remote actions. Options B (Change the enrolled user) and E (Change the device name) are not available remotely.

Answer

Change the enrolled user

Answer

Change the device name

Question 12

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. Forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration. Option D is wrong because the device is already joined.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 13

Refer to the exhibit. A Windows 10 device is enrolled in Intune and has the above compliance policy assigned. The device reports as non-compliant. The device has TPM version 2.0, Secure Boot enabled, and a password of 8 characters. Which of the following is the most likely reason for non-compliance?

Accepted Answer

The OS version is outside the allowed range.. The compliance policy likely specifies a minimum OS version requirement, such as Windows 10 22H2 or a specific build number. Since the device reports as non-compliant despite meeting TPM 2.0, Secure Boot, and password length requirements, the most probable cause is that the OS version is below the allowed minimum. Intune evaluates OS version against the 'Minimum OS version' setting in the compliance policy, and failure to meet this threshold results in non-compliance.

Answer

The device does not have a TPM chip.

Answer

Secure Boot is not enabled.

Answer

The password length is less than 6 characters.

Question 14

Refer to the exhibit. You run this PowerShell command using the Microsoft Graph PowerShell SDK. What is the primary purpose of this command?

Accepted Answer

To retrieve a list of all Windows managed devices with their compliance status.. The PowerShell command uses `Get-MgDeviceManagementManagedDevice` with a filter for `operatingSystem eq 'Windows'` and selects properties including `complianceState`. This retrieves all Windows managed devices and their compliance status, making option D correct. The command does not filter by compliance state, so it returns both compliant and non-compliant devices, and it does not enforce any compliance action.

Answer

To list only non-compliant Windows devices.

Answer

To retrieve all managed devices regardless of operating system.

Answer

To enforce compliance on Windows devices.

Question 15

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with TPM 2.0 and UEFI Secure Boot enabled can enroll. Which configuration profile setting should you configure?

Accepted Answer

Enable Device Health Attestation (DHA) in enrollment restrictions. Device Health Attestation (DHA) in enrollment restrictions allows you to block enrollment for devices that do not meet specific hardware security requirements, such as TPM 2.0 and UEFI Secure Boot enabled. When configured, Intune verifies these attestation claims during the enrollment process and rejects non-compliant devices before they can enroll. This is the only setting that enforces hardware prerequisites at the enrollment stage, not after the device is already managed.

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Configure a BitLocker policy in Endpoint Security

Answer

Set a compliance policy for device health