MD-102 Practice Test 44 — 15 Questions

Question 1

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Windows Autopilot for new devices. Which prerequisite must be met for Autopilot to work with Entra ID?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Devices must be registered in Autopilot using hardware hash. Windows Autopilot requires that each device be registered in the Autopilot service using its unique hardware hash (also known as a hardware ID). This hash is collected from the device's firmware and uploaded to the Autopilot deployment service, which then associates the device with the target tenant. Without this registration, Autopilot cannot identify the device during the out-of-box experience (OOBE) and cannot automatically enroll it into Microsoft Entra ID.

Answer

Devices must be domain-joined to on-premises AD

Answer

An Azure AD Premium P2 license must be assigned

Answer

Configuration Manager must be deployed for OS imaging

Question 2

Refer to the exhibit. The JSON shows a managed device's properties retrieved from Microsoft Graph. The device's complianceState is 'noncompliant'. Which step should you take next to investigate why the device is noncompliant?

Accepted Answer

Query the device's compliance policy status via Graph API or Intune console.. The compliance policy details will show which specific policy is failed. Option A is incorrect because the device is already enrolled. Option C is incorrect because last sync time is recent. Option D is incorrect because jailbreak is not applicable to Windows.

Answer

Verify the last sync time to ensure the device is communicating.

Answer

Check if the device is properly enrolled by verifying azureADRegistered.

Answer

Check if the device is jailbroken or rooted.

Question 3

You are designing a Windows Autopilot deployment for a new fleet of devices. The devices will be shipped directly to users from the vendor. You need to ensure that the devices automatically enroll in Microsoft Intune and receive a standard set of applications during the out-of-box experience (OOBE). Which Autopilot deployment profile should you assign?

Accepted Answer

User-Driven mode (Azure AD joined) with user-assigned apps.. User-Driven mode with Azure AD joined and user-assigned apps is correct because the devices are shipped directly to users, who will perform the OOBE themselves. This mode requires a user to sign in with Azure AD credentials, which triggers automatic enrollment in Microsoft Intune and applies the assigned user-targeted apps during the enrollment process.

Answer

Pre-provisioning (White Glove) mode with device-assigned apps.

Answer

Self-Deploying mode (Azure AD registered) with device-assigned apps.

Answer

Self-Deploying mode (Azure AD joined) with user-assigned apps.

Question 4

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

Accepted Answer

The user does not have an Intune license assigned.. The device showing as 'Not compliant' in the Intune console indicates it is enrolled in Intune. The most likely cause for compliance policies not being applied is that the user does not have a valid Intune license assigned. Without a license, the device can be enrolled but compliance policies will not be evaluated or enforced. Option B is incorrect because the device is enrolled (as evidenced by its appearance in the console). Option C is incorrect because a stale policy would still apply if the device is enrolled and licensed. Option D is incorrect because network connectivity would affect policy retrieval but the device would still be enrolled and licensed.

Answer

The device is not enrolled in Intune.

Answer

The compliance policy is stale and needs to be re-assigned.

Answer

The device has no network connectivity.

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Accepted Answer

Disable screen capture.. To restrict screenshots on Android Enterprise devices, only the 'Disable screen capture' setting directly prevents the device from taking screenshots by using the FLAG_SECURE window flag. Options B and C ('Disable copy and paste' and 'Disable camera') do not prevent screen capture; they restrict clipboard operations and camera usage respectively. Therefore, the only correct setting is A.

Answer

Disable copy and paste.

Answer

Disable camera.

Answer

Disable Bluetooth.

Answer

Disable Wi-Fi.

Question 6

Which TWO of the following are valid enrollment methods for Windows 10 devices in Microsoft Intune?

Accepted Answer

Windows Autopilot. Windows Autopilot (Option A) is a valid enrollment method that enables zero-touch deployment and automatic enrollment of Windows 10 devices into Intune. Azure AD Join (Option B) is also a valid method, where devices are joined directly to Azure AD and automatically enrolled in Intune for management. Option C is incorrect: Device Enrollment Manager (DEM) is an administrative role used for bulk enrollment, not an enrollment method itself. Option D is incorrect: Bulk enrollment using a provisioning package is a method for enrolling many devices at once, but it is not listed as a distinct enrollment method like Autopilot or Azure AD Join in this context. Option E is incorrect because Apple Business Manager is designed for enrolling Apple devices (iOS, iPadOS, macOS), not Windows 10 devices.

Answer

Device enrollment manager (DEM)

Answer

Bulk enrollment with provisioning package

Answer

Apple Business Manager

Question 7

Your organization recently deployed Windows 11 devices managed by Microsoft Intune. You need to ensure that only approved third-party drivers are installed on these devices. What is the best approach?

Accepted Answer

Configure a Windows Defender Application Control policy to block unsigned drivers.. Windows Defender Application Control (WDAC) allows you to configure code integrity policies that restrict driver installation to only those that are signed by approved publishers or have known-good hashes. This ensures that only approved third-party drivers, as defined by your organization's policy, can be installed, regardless of the installation source (Windows Update, manual, or otherwise). Option C is insufficient because blocking driver updates from Windows Update does not prevent manual installation of unapproved drivers. Options A and B do not provide a comprehensive enforcement mechanism for driver approval.

Answer

Deploy a Windows Driver Frameworks (WDF) Coinstaller to enforce driver signing.

Answer

Use Device Installation Restrictions to allow only approved hardware IDs.

Answer

Configure Windows Update for Business group policy settings to block driver updates from Windows Update.

Question 8

You need to ensure that all corporate-owned Windows 11 devices automatically install critical security updates as soon as they are released by Microsoft. Which Intune feature should you configure?

Accepted Answer

Expedited quality updates in a Windows 10 update ring.. Expedited quality updates in a Windows 10 update ring allow you to push critical security updates immediately, bypassing any deferral periods or gradual rollout settings. This feature uses the Windows Update for Business service to force the installation of a specific update as soon as it is released by Microsoft, ensuring compliance with security requirements for corporate-owned devices.

Answer

A WSUS policy pushed via Group Policy.

Answer

Windows 10 update rings with a deferral period of 0 days.

Answer

Windows Autopatch.

Question 9

Your organization requires that all managed Windows devices have Microsoft Defender Antivirus enabled and running. Which TWO methods can you use to verify this compliance?

Accepted Answer

Create an Intune compliance policy for Windows Defender.. Intune compliance policies include a 'Microsoft Defender for Endpoint' category that allows you to require Defender Antivirus to be enabled and running. When a device reports its Defender status via the Intune Management Extension, the compliance policy evaluates the real-time protection state and marks the device as noncompliant if Defender is off or disabled. Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides device health reports that aggregate antivirus status across all enrolled devices, including whether Defender is active and up to date.

Answer

Check Microsoft Entra ID device settings.

Answer

Review the Local Group Policy Editor on each device.

Answer

Run a Configuration Manager hardware inventory.

Question 10

You are reviewing a custom device configuration profile in Intune. The exhibit shows an OMA-URI setting. What is the purpose of this setting?

Accepted Answer

Disables the camera on the lock screen. The OMA-URI setting ./Vendor/MSFT/Policy/Config/DeviceLock/PreventLockScreenCamera is used to disable the camera on the Windows lock screen. This policy prevents users from accessing the camera while the device is locked, enhancing security by mitigating privacy risks such as unauthorized camera use. It does not affect camera functionality once the user logs in.

Answer

Enables the camera on the lock screen

Answer

Disables the camera on the device entirely

Answer

Disables the microphone on the lock screen

Question 11

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

Accepted Answer

Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs. Apple Automated Device Enrollment (ADE) with supervision and allowing personal Apple IDs meets the school's requirements: devices are automatically enrolled in Intune, supervision enables full management control (e.g., blocking activation lock bypass), and allowing personal Apple IDs lets students install apps using their own accounts. This combination ensures devices are managed while preserving user flexibility.

Answer

Apple Automated Device Enrollment (ADE) with user affinity

Answer

Apple Device Enrollment (ADE) with Shared iPad mode

Answer

Apple User Enrollment

Question 12

A company manages devices with Microsoft Intune. They need to deploy a line-of-business (LOB) app to iOS devices. Which TWO of the following are required?

Accepted Answer

The app package must be in .ipa format. IOS line-of-business (LOB) apps must be packaged in the .ipa format, which is the standard iOS app package that Intune can deploy directly to devices. Intune uses the .ipa file to install the app on supervised or unsupervised iOS devices via the MDM channel, and the app must be signed with an Apple Developer Enterprise certificate or a distribution certificate.

Answer

The deployment must use 'Required' installation purpose

Answer

The app must be assigned to a user group only

Answer

Apple MDM push certificate must be configured

Question 13

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running build 10.0.22621.1000. The device has BitLocker enabled, Secure Boot enabled, and code integrity enabled. The device is compliant?

Accepted Answer

No, the device's OS version exceeds the maximum allowed.. The compliance policy specifies a maximum OS version of 10.0.22621.0, but the device runs build 10.0.22621.1000, which is higher. Therefore, the device is non-compliant due to exceeding the allowed OS version range, regardless of other security settings.

Answer

No, the device does not have a password set.

Answer

Yes, the device meets all requirements.

Answer

Yes, but only if the device is Windows 10 Pro.

Question 14

Refer to the exhibit. A Windows 11 device assigned to this update ring is running a released version. What is the immediate behavior after the policy applies?

Accepted Answer

The device will be offered the latest Windows Insider Dev Channel build.. The exhibit shows an update ring policy configured with the 'Windows Insider Program' enabled and the 'Insider Channel' set to 'Dev Channel'. Since the device is currently on a released version, applying this policy will enroll it in the Windows Insider Program and offer the latest Dev Channel build. This is the immediate behavior because the policy triggers a check for the specified Insider build, not a deferral or quality update.

Answer

The device will uninstall the current Insider build and revert to the released version.

Answer

The device will defer all updates by 10 days.

Answer

The device will install the latest released quality update immediately.

Question 15

A company uses Microsoft Intune to manage devices. They need to report on which devices have a specific Windows update installed. Which reporting method should be used?

Accepted Answer

Use the Microsoft Intune admin center to view the Windows Update for Business report. The Windows Update for Business report in the Microsoft Intune admin center provides a dedicated view of update compliance, including which devices have installed specific Windows updates. This report aggregates data from the Windows Update service and displays it per device, making it the correct method for identifying devices with a particular update installed.

Answer

Use Microsoft 365 Lighthouse

Answer

Use the Device compliance report in Intune

Answer

Use Microsoft Defender for Endpoint's advanced hunting