MD-102 Practice Test 43 — 15 Questions

Question 1

Which THREE factors can cause a required app deployment to fail on a Windows 10 device managed by Intune? (Choose three.)

Accepted Answer

The device is not connected to the internet.. Intune requires a device to have internet connectivity to communicate with the Microsoft Intune service and download required app deployments. Without internet access, the Intune Management Extension cannot retrieve the app assignment policy or download the application content from the cloud, causing the deployment to fail.

Answer

The device has an app update policy that blocks updates.

Answer

The user is not assigned to the app.

Question 2

Which FOUR of the following are valid detection rules for a Win32 app in Intune?

Accepted Answer

PowerShell script (custom detection). For Win32 apps in Intune, the valid detection rules are: PowerShell script (custom detection), MSI product code, Registry (key or value exists), and File system (file or folder exists). Network share access is not a detection rule. Therefore, options A, B, C, and D are correct.

Answer

Network share access

Question 3

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

Accepted Answer

Create an Autopilot deployment profile with 'Assign to' set to 'All devices' and ensure the device is registered in Autopilot.. Windows Autopilot requires both a registered device (identified by hardware hash) and an assigned deployment profile to trigger automatic enrollment in Microsoft Intune during the first power-on. Setting 'Assign to' to 'All devices' ensures the profile applies to any registered Autopilot device, and the device registration step links the hardware identity to your tenant. Without this combination, the device will not automatically enroll.

Answer

Join the device to Azure AD hybrid by configuring a domain join profile.

Answer

Configure the Enrollment Status Page (ESP) to require device enrollment.

Answer

Manually add the device serial number to Intune via the admin center.

Question 4

Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

Accepted Answer

The device OS version exceeds the maximum allowed version.. The compliance policy sets a maximum OS version. The device's OS version (10.0.22621.1) is higher than the maximum allowed version specified in the policy, causing the device to be marked as noncompliant. Therefore, option C is correct.

Answer

The device does not have BitLocker encryption enabled.

Answer

The device does not have a password set.

Answer

The password type is not set to alphanumeric.

Question 5

You need to deploy a line-of-business (LOB) iOS app to company-owned devices using Microsoft Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

iOS/iPadOS LOB app.. An iOS/iPadOS LOB app deployment in Intune is specifically designed for line-of-business apps that are signed with an enterprise certificate and distributed internally. This method allows you to upload the .ipa file directly to Intune and deploy it to company-owned devices without requiring the Apple App Store or a Volume Purchase Program.

Answer

Managed Browser app.

Answer

iOS/iPadOS store app.

Answer

Volume Purchase Program (VPP) app.

Question 6

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Windows Update for Business policy is not applying to some devices. You verify the devices are assigned the correct update ring. What should you check first?

Accepted Answer

Ensure the Windows Update service is not disabled on the devices.. The Windows Update for Business policy requires the Windows Update service to be enabled. If the service is disabled, updates cannot be applied regardless of update ring assignment. Option A is incorrect: increasing sync frequency may speed up policy delivery but does not prevent the policy from applying; the issue is likely a service issue, not sync timing. Option B is incorrect: device compliance policies are separate from update rings; non-compliant devices can still receive update policies. Option D is incorrect: the Intune Management Extension is used for Win32 app deployment, not for Windows Update policy; update rings rely on the Windows Update service directly.

Answer

Increase the sync frequency for the devices.

Answer

Check if the devices are compliant with device compliance policies.

Answer

Verify the Intune Management Extension is installed.

Question 7

Which TWO actions are required to deploy a Win32 app using Microsoft Intune? (Choose two.)

Accepted Answer

Upload the .intunewin package file.. Uploading the .intunewin package file is mandatory for deploying a Win32 app via Intune; this file encapsulates the app's installation files and metadata. Option B is correct because configuring detection rules is essential to verify the app's installation status and reapply policies as needed. Both actions are required for successful deployment.

Answer

Connect to Managed Google Play.

Answer

Assign a Microsoft Store license.

Answer

Sign the app with a macOS developer certificate.

Question 8

You have a Windows 10 device running OS version 10.0.19043.1234. The device is compliant with all settings except password requirements. The device does not have a password set. What is the compliance status?

Accepted Answer

Noncompliant because passwordRequired is true and no password set.. The device is noncompliant due to the passwordRequired policy setting being set to true while no password is configured on the device. In Microsoft Intune, compliance policies evaluate each setting independently; if a required setting like passwordRequired is not met, the device is marked noncompliant regardless of other compliant settings. The OS version 10.0.19043.1234 is within a supported range, and storage encryption is not evaluated unless explicitly required by a policy, so only the missing password triggers noncompliance.

Answer

Noncompliant because storage encryption is not enabled.

Answer

Noncompliant because OS version is not within range.

Answer

Compliant

Question 9

You need to ensure that users can access corporate resources on their personal iOS devices only if they are jailbroken. Which Intune policy should you configure?

Accepted Answer

Device Compliance Policy. Device Compliance Policy in Microsoft Intune allows you to set rules that devices must meet to be considered compliant, including a jailbreak detection rule for iOS devices. When a device is detected as jailbroken, you can mark it as non-compliant and then use Conditional Access to block access to corporate resources. This directly addresses the requirement to control access based on jailbreak status.

Answer

App Protection Policy

Answer

Device Configuration Policy

Answer

Conditional Access Policy

Question 10

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

Accepted Answer

An enterprise certification authority (CA) must be deployed and all devices must be Azure AD joined or hybrid Azure AD joined.. Certificate-based Windows Hello for Business requires an enterprise PKI to issue and validate certificates for authentication. Devices must be Azure AD joined or hybrid Azure AD joined to enroll these certificates and support the certificate trust model. On-premises Active Directory and Azure AD Connect provide the hybrid identity foundation, but the CA and appropriate device join state are the critical prerequisites.

Answer

All users must have the Microsoft Authenticator app installed.

Answer

Conditional Access policies must be configured to require Windows Hello for Business.

Answer

All users must be configured for passwordless sign-in.

Question 11

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

Accepted Answer

Restart the Microsoft Intune Management Extension service on the device.. The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Answer

Unenroll and re-enroll the device.

Answer

Verify that the device is compliant with BitLocker encryption requirements.

Answer

Check the device's compliance policy assignment.

Question 12

You need to deploy Windows 10 Enterprise to 100 new computers using Microsoft Intune. The computers are not yet joined to Microsoft Entra ID. What is the recommended method?

Accepted Answer

Register the devices in Windows Autopilot and deploy an Autopilot profile.. Windows Autopilot is the recommended method for deploying Windows 10 Enterprise to new devices that are not yet joined to Microsoft Entra ID because it automates the entire provisioning process—from joining Entra ID to enrolling in Intune—without requiring any manual intervention or imaging. By registering the devices in Autopilot and deploying an Autopilot profile, the out-of-box experience (OOBE) is customized to join Entra ID and enroll in Intune automatically, ensuring a zero-touch deployment that aligns with modern management best practices.

Answer

Join each device to Entra ID manually and then enroll in Intune.

Answer

Create a provisioning package using Windows Configuration Designer and deploy via USB.

Answer

Use a Configuration Manager task sequence to deploy the OS.

Question 13

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Accepted Answer

Allows end users to set up their own devices with minimal IT involvement.. Windows Autopilot leverages the device's hardware identity (hash) to automatically enroll it in Microsoft Entra ID and join it to a domain or tenant, allowing end users to complete the setup process themselves with minimal IT intervention. This reduces helpdesk calls and streamlines the out-of-box experience (OOBE) by presenting only necessary screens.

Answer

Eliminates the requirement for a Microsoft Entra ID subscription.

Answer

Enables device provisioning over a VPN connection.

Answer

Supports deployment without any internet connectivity.

Question 14

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

Accepted Answer

The user risk policy is set to 'Report-only' mode instead of 'On'.. When a user risk policy is set to 'Report-only' mode, it evaluates risk and generates reports but does not enforce any actions such as blocking sign-ins. For automatic blocking to occur, the policy must be set to 'On' (enabled). The administrator likely configured the policy correctly in terms of risk level but overlooked the enforcement mode, which is a common misconfiguration in Microsoft Entra ID Protection.

Answer

The sign-in risk policy is overriding the user risk policy.

Answer

The users have MFA enabled, so they are exempt from risk policies.

Answer

The policy is configured to apply only to a test group, and the affected users are not members.

Question 15

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Accepted Answer

The app is signed with a different certificate than the one uploaded to Intune.. Error 0x87D1041C in Intune indicates a signature mismatch. When a line-of-business (LOB) app is deployed as a device-required install, the app binary must be signed with a certificate that has been uploaded to the Intune console. If the signing certificate used to sign the app differs from the one uploaded, Intune rejects the installation because it cannot verify the app's integrity and trust chain.

Answer

The user is not assigned to the app deployment.

Answer

The app is not compliant with the device's OS version.

Answer

The device does not have the required app configuration policy.