MD-102 Practice Test 45 — 15 Questions

Question 1

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

Accepted Answer

Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment. Option B is correct because requiring Microsoft Entra join or registration forces device identity in Entra ID before Intune enrollment. Option A is wrong because automatic enrollment doesn't enforce registration first. Option C is wrong because device type restrictions affect allowed platforms, not identity. Option D is wrong because enrollment restrictions apply to enrolling users/devices, not identity prerequisites.

Answer

Configure enrollment restrictions to require corporate ownership

Answer

Set device type restrictions to block unregistered devices

Answer

Configure automatic enrollment via Group Policy

Question 2

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Accepted Answer

Intune licenses assigned to users. Option A, Option B, and Option D are correct because Microsoft Entra ID, Intune, and licensing are required for automatic enrollment. Option C is wrong because Configuration Manager is optional. Option E is wrong because Apple Push Notification service is only for iOS device management, not for automatic enrollment across all platforms.

Answer

Apple Push Notification service certificate (for iOS)

Answer

Configuration Manager (for co-management)

Question 3

You need to ensure that all corporate-owned Windows devices automatically receive security updates as soon as they are released by Microsoft. Which update ring policy setting should you configure in Microsoft Intune?

Accepted Answer

Set 'Defer quality updates' to 0 days.. Option D is correct because the 'Defer feature updates' and 'Defer quality updates' settings control how long updates are delayed; setting them to 0 ensures immediate installation. Option A is incorrect because it is a service channel, not a deferral setting. Option B is incorrect because 'Semi-Annual Channel' delays feature updates by 4 months. Option C is incorrect because 'Windows Insider' is for preview builds.

Answer

Set the 'Microsoft product updates' setting to 'Allow'.

Answer

Select the 'Windows Insider' channel for quality updates.

Answer

Select the 'Semi-Annual Channel' for feature updates.

Question 4

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Accepted Answer

Verify that the Company Portal app is installed and updated on the device.. Option C is correct because Android enrollment often requires the Company Portal app to be installed from Google Play. If the device has Google Play Services disabled or the app is missing, enrollment fails. Option A is wrong because the issue is specific to work profiles, not device administrator. Option B is wrong because the enrollment token is for Android Enterprise dedicated devices, not personally-owned work profiles. Option D is wrong because Intune Service to Service Connector is not relevant to this enrollment type.

Answer

Confirm that the Intune Service to Service Connector is configured.

Answer

Check that the enrollment token has not expired.

Answer

Ensure Device Administrator enrollment is enabled.

Question 5

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

Accepted Answer

The device will be blocked from completing OOBE.. Option B is correct because the setting "deviceEnrollmentFailureAction": "block" will block the device from proceeding if enrollment fails. Option A is wrong because the status is "notStarted". Option C is wrong because the block settings for notApplicable, pendingRetry, and timeout are false, but the failure action is block. Option D is wrong because the device will not retry automatically.

Answer

The device will be allowed to proceed because enrollment status is notStarted.

Answer

The device will retry enrollment automatically.

Answer

The device will be blocked until retry due to pendingRetry setting.

Question 6

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome. Option A is correct because Conditional Access policies often require a specific app (e.g., Outlook, Edge) and can block access if the wrong app is used, even if the device is compliant. Option B is wrong because if the device is compliant, the CA policy should allow it. Option C is wrong because network locations can be a factor but are less likely if the device is compliant. Option D is wrong because app protection policies are separate from SharePoint access via browser.

Answer

The SharePoint site is configured to allow access only from specific IP ranges

Answer

The device compliance policy has a grace period for non-compliance, and the device is still within that period

Answer

An app protection policy is blocking access to SharePoint from the browser

Question 7

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Accepted Answer

Enables the Windows Firewall for the public network profile. Option A is correct because the setting ID references Windows Firewall public profile enable firewall, and the value '1' means enabled. Option B is wrong because it's firewall, not Defender. Option C is wrong because it's public profile, not domain. Option D is wrong because it enables, not disables.

Answer

Disables the Windows Firewall for all network profiles

Answer

Enables Microsoft Defender Antivirus real-time protection

Answer

Disables the Windows Firewall for the domain network profile

Question 8

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

Accepted Answer

Microsoft 365 Apps. Option B is correct because Microsoft 365 Apps for Windows is a built-in app type in Intune. Option A is wrong because Windows app (Win32) is for custom applications. Option C is wrong because Microsoft Store app is for store-based apps. Option D is wrong because the web link is for linking to external sources.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 9

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

Accepted Answer

To list the IDs of Microsoft Entra ID joined Windows devices.. Option C is correct because the script filters for devices with enrollment type 'windowsAzureADJoin' (Microsoft Entra ID joined) and outputs their IDs. Option A is wrong because it outputs IDs, not device names. Option B is wrong because it does not check the autopilot profile. Option D is wrong because it does not update any properties.

Answer

To output the device names of all Windows devices.

Answer

To list devices that are registered in Autopilot.

Answer

To update the enrollment type of all Windows devices.

Question 10

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

Accepted Answer

The policy has not been assigned to the device or its user group.. The compliance policy has BitLockerEnabled set to $true, which should require BitLocker. However, the device might be showing as compliant because the policy has not been assigned to the device, or the device has not evaluated the policy. But the most likely reason from the options is that the device is not subject to the policy because it is not assigned. Option C is correct. Option A is wrong because the policy was created. Option B is wrong because the setting is correct. Option D is wrong because TPM is required but not related to BitLocker compliance directly.

Answer

The BitLocker setting is not supported on Windows 11.

Answer

The policy was not saved correctly due to a syntax error.

Answer

The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

Question 11

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

Accepted Answer

Add a shell script under Devices > Scripts. Option A is correct because Intune supports shell scripts for macOS via the Scripts blade. Option B is wrong because PowerShell is for Windows. Option C is wrong because macOS does not have a Company Portal equivalent for scripts. Option D is wrong because there is no Bash script type in Intune; shell scripts are used.

Answer

Use Company Portal to distribute the script

Answer

Add a PowerShell script under Devices > Scripts

Answer

Create a custom configuration profile with Bash script

Question 12

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode longer than six characters can access corporate email. Which type of policy should you configure?

Accepted Answer

Device compliance policy. Option B is correct because device compliance policies evaluate security settings like passcode length and are used with Conditional Access. Option A is wrong because configuration profiles set settings but don't enforce access. Option C is wrong because app protection policies manage data at the app level. Option D is wrong because enrollment restrictions control which devices can enroll.

Answer

Device configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 13

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

Accepted Answer

Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.. In Configuration Manager, the 'Provision Microsoft Entra ID' step in a task sequence can be used to perform a bulk token-based join. This is the recommended approach for Windows 10 devices. Option B is correct. Option A is wrong because it's not for bulk OSD. Option C is wrong because Autopilot is for user-driven scenarios. Option D is wrong because MDM enrollment via GPO is not typically used during OSD.

Answer

Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

Answer

Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

Answer

Configure Windows Autopilot for existing devices and redeploy them.

Question 14

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Option A is correct because requiring devices to be marked as compliant in Intune filters for corporate-owned devices. Option B is wrong because Hybrid Azure AD join does not distinguish corporate vs. personal. Option C is wrong because multi-factor authentication does not check device ownership. Option D is wrong because approval of the client app is not about device ownership.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 15

Which THREE actions can be taken from the Intune admin center when a device is retired?

Accepted Answer

Retire. Options B, C, and D are correct. When retiring a device, you can wipe the device (factory reset), delete the device from Intune, and also retire it which removes management. Option A is wrong because remote lock is available but not during retirement; it's a separate action. Option E is wrong because resetting the passcode is not an option for retired devices.

Answer

Remote lock

Answer

Reset passcode