MD-102 Practice Test 45 — 15 Questions

Question 1

You are configuring Microsoft Intune to manage Windows 10 devices. Which TWO actions are required to enable BitLocker encryption on devices?

Accepted Answer

Create a device configuration profile for endpoint protection and enable BitLocker settings.. BitLocker settings are configured via a device configuration profile for endpoint protection in Microsoft Intune. This profile includes policies such as requiring TPM startup PIN or startup key, encryption method, and OS drive encryption. Without this profile, BitLocker cannot be enforced or configured on managed Windows 10 devices.

Answer

Create a compliance policy that requires BitLocker.

Answer

Configure a device cleanup rule.

Answer

Deploy a Windows 10 update ring.

Question 2

Your organization uses Microsoft Intune to manage Windows 10 and iOS devices. You need to deploy a certificate-based authentication solution for Wi-Fi and VPN access. You have set up a Certificate Connector for Microsoft Intune and issued a root CA certificate. You have created a trusted certificate profile for the root CA and a SCEP certificate profile for client certificates. However, iOS devices are failing to enroll for client certificates. You verify that the SCEP profile is correctly configured and assigned. What is the most likely cause?

Accepted Answer

The SCEP profile does not reference the trusted certificate profile for the root CA, or the trusted certificate profile is not assigned to iOS devices.. For SCEP certificate enrollment on iOS devices, the trusted root CA certificate profile must be deployed first and the SCEP profile must reference it. If the reference is missing or the trusted profile is not assigned to the iOS devices, the SCEP enrollment will fail. Option A is incorrect because the Certificate Connector supports iOS devices. Option B is incorrect because SCEP certificate profiles for device enrollment do not require user affinity; user affinity is only needed for user certificates. Option D is incorrect because device compliance policy is not a prerequisite for SCEP certificate enrollment; non-compliant devices can still enroll for certificates.

Answer

The Certificate Connector is not configured to support iOS devices.

Answer

iOS devices require user affinity for SCEP enrollment, which is not configured.

Answer

The iOS devices are not compliant with the compliance policy.

Question 3

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

Accepted Answer

The AUMID for Microsoft Edge is not specified.. The most likely issue is that the AUMID for Microsoft Edge is not specified in the kiosk profile. For a single-app kiosk on Windows 11, Intune requires the Application User Model ID (AUMID) to launch the app correctly. Without it, the kiosk shell cannot identify which executable to run, resulting in a blank screen instead of the Edge browser.

Answer

The kiosk profile is not correctly assigned.

Answer

The device is not assigned to a user.

Answer

The device is not running Windows 10/11 Enterprise.

Question 4

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

Accepted Answer

Configure a device restriction policy to allow only managed Google Play apps.. A device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Answer

Set the device to 'Fully managed' and disable unknown sources.

Answer

Deploy an app configuration policy that blocks sideloading.

Answer

Use a compliance policy to block non-compliant apps.

Question 5

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

Accepted Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.. The scenario requires a user-driven deployment where the user signs in with Azure AD credentials during OOBE, and the device is automatically enrolled in Intune. Setting 'Deployment mode' to 'User-Driven' ensures the user authenticates during OOBE, and 'Join to Azure AD as' to 'Azure AD joined' makes the device Azure AD-joined, which triggers automatic Intune enrollment via the MDM enrollment authority configured in Azure AD.

Answer

Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.

Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.

Answer

Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.

Question 6

You are configuring Microsoft Entra Conditional Access for a company that requires all employees to use multi-factor authentication (MFA) when accessing the Azure portal. The company also wants to block access from devices that are not compliant. You create a Conditional Access policy. Which two assignments must you configure to meet these requirements? (Choose two.)

Accepted Answer

Grant access, require multi-factor authentication. The requirement to enforce multi-factor authentication (MFA) for Azure portal access is met by configuring the 'Grant' control to 'Require multi-factor authentication'. Option D is correct because blocking access from non-compliant devices is achieved by selecting 'Require device to be marked as compliant' under Grant controls, which ensures only devices that meet compliance policies (e.g., Intune-managed) are allowed. Both assignments are necessary to satisfy the two distinct requirements.

Answer

Grant access, require Microsoft Entra hybrid joined device

Answer

Grant access, block access for non-compliant devices

Question 7

An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?

Accepted Answer

Endpoint security disk encryption policy. The Endpoint security disk encryption policy in Intune is specifically designed to enforce encryption (e.g., BitLocker) on Windows 10/11 devices. It provides a dedicated, streamlined interface for configuring encryption settings and monitoring compliance, unlike general device configuration profiles which require manual setup via the settings catalog. This policy type is the correct choice because it directly targets disk encryption as a security baseline, aligning with the organization's goal to enforce encryption across all managed devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (settings catalog)

Question 8

You are troubleshooting a Windows 11 device that fails to install a required Win32 app deployed via Intune. Which THREE logs or locations should you review?

Accepted Answer

Intune Management Extension logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs. The Intune Management Extension (IME) is the agent responsible for processing Win32 app deployments on Windows 11 devices. Its logs, located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs, provide detailed information about the download, detection, and installation phases of Win32 apps, making them the primary source for troubleshooting installation failures.

Answer

Windows Update log (C:\Windows\WindowsUpdate.log)

Answer

Windows Registry under HKLM\Software\Microsoft\Intune

Question 9

Which THREE factors should you consider when planning a Microsoft Intune migration from Configuration Manager?

Accepted Answer

The use of co-management to gradually move workloads.. Co-management allows you to attach your existing Configuration Manager deployment to Microsoft Intune, enabling a gradual migration of workloads (e.g., compliance policies, device configuration, Windows Update policies) at your own pace. This hybrid approach lets you keep some management functions on-premises while testing and shifting others to the cloud, minimizing disruption and providing a rollback path.

Answer

The ability to manage on-premises servers with Intune.

Answer

The need for an on-premises Intune server.

Question 10

Which TWO actions can you take to improve the performance of Microsoft Intune management for Windows devices that are geographically distributed and have limited bandwidth?

Accepted Answer

Enable Delivery Optimization to use peer-to-peer sharing within the same network.. Options C and D are correct. Enabling Delivery Optimization (C) allows Windows devices to download updates from other devices on the same network using peer-to-peer, reducing internet bandwidth usage. Configuring Windows Update for Business to use 'Download only' mode (D) ensures that updates are downloaded only once from Microsoft and then shared via Delivery Optimization, further reducing bandwidth consumption. Option A is incorrect because deploying a Configuration Manager site server at each location adds infrastructure complexity and does not directly improve performance for Intune-managed devices; Peer Cache is not a native Intune feature. Option B is incorrect because increasing sync intervals increases network traffic, worsening bandwidth issues. Option E is incorrect because disabling real-time scanning compromises security without any significant bandwidth benefit.

Answer

Deploy a Configuration Manager site server at each location to act as a peer cache.

Answer

Increase the frequency of device sync intervals to ensure policies are applied quickly.

Answer

Disable Windows Defender real-time scanning on devices.

Question 11

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

Accepted Answer

The administrative template does not configure the update channel; you must use the Office Deployment Tool.. When you configure the update channel for Microsoft 365 Apps via an Intune administrative template (ADMX), the setting is applied as a Group Policy preference but does not actually trigger the update mechanism. Microsoft 365 Apps updates require the Office Deployment Tool (ODT) or the Office CDN to deliver the correct channel bits. The administrative template only sets the registry key for the channel; without the ODT or a corresponding update policy, devices remain on their current channel and do not receive new updates.

Answer

Devices are not configured for Windows Update for Business.

Answer

Devices need to be in the Semi-Annual Channel (Targeted) to receive updates.

Answer

The Semi-Annual Enterprise Channel is not supported for Microsoft 365 Apps.

Question 12

You are an enterprise administrator for Contoso Ltd. You need to configure Microsoft 365 tenant-wide settings for external collaboration. Which TWO actions should you take to meet the following goals: (1) allow only specific external domains to collaborate with your organization, and (2) ensure that external users are required to sign in with multi-factor authentication (MFA) before accessing shared resources?

Accepted Answer

Configure the SharePoint and OneDrive domain allowlist to include only the approved external domains.. Configuring the SharePoint and OneDrive domain allowlist restricts external sharing to only the approved external domains, meeting the first goal. Option D is correct because a Conditional Access policy in Azure AD can require MFA for all external users, satisfying the second goal by enforcing authentication requirements before access to shared resources.

Answer

Disable external sharing in the Microsoft 365 admin center for all workloads.

Answer

Configure the SharePoint and OneDrive domain blocklist to exclude all external domains except the approved ones.

Answer

Enable B2B direct connect in the cross-tenant access settings for the approved external domains.

Question 13

Which TWO actions can you perform using Microsoft Intune to manage Windows 10 devices?

Accepted Answer

Remotely wipe a device. Microsoft Intune supports a remote wipe action that can be triggered from the Intune console to reset a Windows 10 device to factory settings or selectively remove corporate data. This is a core device management capability used for data protection when a device is lost or stolen, leveraging the Windows 10 reset functionality via the Intune management channel.

Answer

Create local user accounts on the device

Answer

Configure DHCP settings

Answer

Add the device to an Active Directory group

Question 14

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.. Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.

Answer

Set up a device compliance policy in Microsoft Purview to block non-compliant devices.

Answer

Configure a device filter in Exchange Online to block devices that are not managed by Intune.

Answer

Deploy an email security policy via Intune to block access from non-compliant devices.

Question 15

Refer to the exhibit. You have the following compliance policy assigned to a Windows 10 device running version 10.0.22000.0. The device has a password of 8 characters and is encrypted. What is the compliance status of the device?

Accepted Answer

Compliant. The device is running Windows 10 version 10.0.22000.0, which is between the minimum (10.0.19041.0) and maximum (10.0.22621.0) allowed. The password length is 8 characters, which meets the minimum requirement of 6. The device is encrypted. Therefore, all compliance policy conditions are satisfied, making the device Compliant. Option C is correct. Options A, B, and D are incorrect because password length meets the requirement, encryption is enabled, and OS version is within the allowed range.

Answer

Noncompliant due to password length

Answer

Noncompliant due to encryption

Answer

Noncompliant due to OS version