MD-102 Practice Test 46 — 15 Questions

Question 1

You configure a Windows 10 device compliance policy in Intune that requires 'Firewall' to be enabled. The device has Windows Defender Firewall enabled, but the device reports as non-compliant. You verify that the firewall is active. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall is enabled only on the Domain profile but not on Public or Private profiles. Intune compliance policies for firewall require that the firewall is enabled on all network profiles (Domain, Private, Public). If the firewall is only enabled on the Domain profile but not on Public or Private, the device will report as non-compliant. Option A is irrelevant because allowing inbound connections does not affect compliance status. Option B is incorrect because the question states the device uses Windows Defender Firewall, not a third-party firewall. Option D is incorrect because the firewall status per adapter is not checked; the policy checks the firewall status per profile.

Answer

The firewall is configured to allow all inbound connections

Answer

The device uses a third-party firewall that Intune does not recognize

Answer

The device has multiple network adapters and the firewall is disabled on one

Question 2

Which TWO components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select two.)

Accepted Answer

Device registration in the Autopilot service using hardware hash.. For a user-driven Windows Autopilot deployment with Microsoft Entra ID join, the required components are device registration in the Autopilot service using hardware hash and a Windows Autopilot deployment profile in Intune. The Enrollment Status Page (ESP) is optional and not required for a successful deployment. On-premises Active Directory domain join is not needed because the device joins Microsoft Entra ID, and Configuration Manager co-management is optional.

Answer

Enrollment Status Page (ESP) configuration.

Answer

On-premises Active Directory domain join.

Answer

Microsoft Configuration Manager co-management.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?

Accepted Answer

Require device to be marked as compliant.. Conditional access in Microsoft Entra ID includes the grant control 'Require device to be marked as compliant,' which ensures that only devices meeting compliance policies can access corporate Exchange Online email. Option A is correct because this setting directly enforces compliance. Option B (Require multi-factor authentication) is separate—it adds identity verification but does not check device compliance. Option C (Require app protection policy) applies to mobile app management, not device-level access. Option D (Require device to be enrolled in Intune) ensures enrollment but does not guarantee compliance; a device could be non-compliant even if enrolled. Therefore, only the compliance requirement meets the goal.

Answer

Require multi-factor authentication.

Answer

Require app protection policy.

Answer

Require device to be enrolled in Intune.

Question 4

Contoso Ltd. is a financial services company with 2,000 users. They use Microsoft Intune to manage Windows 10 devices. The company has a strict security policy that requires all devices to have a specific set of security applications installed: an antivirus (AV) app, a disk encryption app, and a VPN client. These apps are all line-of-business (LOB) Win32 apps packaged as .intunewin files. The administrator created a Win32 app for each and assigned them as 'Required' to all devices. After the deployment, the administrator notices that the apps are not installing on approximately 10% of devices. The devices are online and have connectivity. The Intune Management Extension is running. When the administrator checks the Intune Management Extension logs on a failing device, they see the following error: 'Failed to download content. Error: 0x80070002 - The system cannot find the file specified.' What is the most likely cause?

Accepted Answer

The content for the Win32 app was not uploaded correctly or is missing from Intune.. The error 0x80070002 ('The system cannot find the file specified') in the Intune Management Extension logs indicates that the client is attempting to download the Win32 app content from Intune, but the content blob is missing or inaccessible. This typically occurs when the .intunewin file was not uploaded correctly, the upload was interrupted, or the content was deleted from Intune after assignment. Since the extension is running and connectivity is confirmed, the issue is server-side content availability, not client-side permissions or detection logic.

Answer

The Intune Management Extension does not have permission to install apps on those devices.

Answer

The user is not logged in, so the app cannot be installed.

Answer

The app detection rules do not match the installed version.

Question 5

Your organization uses Microsoft Intune to manage Android enterprise devices. You need to ensure that only approved apps from the managed Google Play store can be installed on work profiles. Which configuration should you use?

Accepted Answer

Configure a device compliance policy that requires 'Allow installation from unknown sources' to be disabled. A device compliance policy that requires 'Allow installation from unknown sources' to be disabled ensures that only apps from the managed Google Play store can be installed on Android Enterprise work profiles. This setting prevents side-loading of apps from untrusted sources, which is the primary mechanism to enforce app approval in a managed environment. Intune compliance policies evaluate this setting and can trigger conditional access or mark devices as non-compliant if unknown sources are enabled.

Answer

Use a conditional access policy to block unapproved apps

Answer

Create an app configuration policy that blocks side-loading

Answer

Assign a device restriction policy that sets 'Allow all apps' to false

Question 6

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

Accepted Answer

MDM user scope in Microsoft Entra ID. The MDM user scope setting in Microsoft Entra ID (formerly Azure AD) controls which users can automatically enroll their Windows 10 devices into Intune when they join Entra ID. When set to 'All' or 'Some', the device triggers automatic MDM enrollment during the Entra ID join process using the MDM enrollment protocol (MS-MDE), eliminating the need for manual enrollment steps.

Answer

Compliance policies in Intune

Answer

Co-management slider in Configuration Manager

Answer

Enrollment device platform restrictions in Intune

Question 7

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

Accepted Answer

Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.. Microsoft Defender for Endpoint can integrate with Microsoft Intune to automatically trigger remediation actions when critical vulnerabilities are found. Option A is incorrect because Microsoft Sentinel is a SIEM and SOAR platform; while it can automate responses, it is not the direct integration for Intune remediation. Option B is incorrect because Microsoft Foundry is an AI platform, not used for device remediation. Option C is incorrect because Microsoft Purview focuses on data governance and compliance, not device remediation.

Answer

Configure a Microsoft Sentinel playbook.

Answer

Configure a Microsoft Foundry AI model.

Answer

Configure a Microsoft Purview data loss prevention policy.

Question 8

You are deploying a Win32 app that requires administrator privileges to install. The app runs on Windows 11 devices. How should you configure the app in Intune to ensure it installs with elevated privileges?

Accepted Answer

Set the app install behavior to 'System'.. Setting the install behavior to 'System' in Intune for a Win32 app ensures the installer runs with the SYSTEM account, which inherently has administrator privileges. This is required for apps that demand elevated rights during installation, as the SYSTEM account bypasses user account control (UAC) and can write to protected system locations like Program Files or the registry.

Answer

Set the app to run in user context.

Answer

Use a PowerShell script to run the installer.

Answer

Configure a detection rule to check for admin rights.

Question 9

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

Accepted Answer

Hybrid Azure AD join. Hybrid Azure AD join is the correct approach because it allows devices that are joined to on-premises Active Directory to also register with Microsoft Entra ID, enabling Intune management while maintaining access to on-premises resources via Kerberos/NTLM authentication. This configuration synchronizes the device object from AD to Entra ID using Azure AD Connect, creating a device identity that can be managed by Intune and can authenticate against both cloud and on-premises services without requiring a VPN.

Answer

Entra ID registered with on-premises domain join

Answer

Windows Autopilot self-deploying mode

Answer

Entra ID joined with VPN to on-premises

Question 10

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

Accepted Answer

passwordMinimumLength. The compliance policy requires a minimum password length, and the device's 6-character password does not meet that requirement, making it non-compliant. The passwordMinimumLength setting directly controls the minimum number of characters a password must have, so a password shorter than the configured value triggers non-compliance.

Answer

requireCodeIntegrity

Answer

requireDeviceEncryption

Answer

requireSecureBoot

Question 11

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Accepted Answer

Verify that the Company Portal app is installed and updated on the device.. In Android Enterprise personally-owned work profiles, the Company Portal app is required to initiate and complete the enrollment process. If the app is missing or outdated, the device cannot receive the management profile, even if enrollment restrictions allow Android Enterprise. Ensuring the Company Portal is installed and updated is the immediate next step after verifying that Android Enterprise is allowed.

Answer

Confirm that the Intune Service to Service Connector is configured.

Answer

Check that the enrollment token has not expired.

Answer

Ensure Device Administrator enrollment is enabled.

Question 12

You have an Intune-managed Windows 10 device that is not receiving app updates. The app was deployed as a Win32 app with a detection rule. You verify that the device is online and the Intune Management Extension is running. What should you check first?

Accepted Answer

The app assignment schedule is configured to update.. The app update frequency is controlled by the app assignment schedule. Option D is correct because Win32 apps in Intune update based on the assignment schedule; if it is not configured to update, the app will not receive updates. Option A is incorrect because detection rules are used for installation detection, not update scheduling. Option B is incorrect because even if the app is assigned as 'Required', updates only occur if the schedule allows. Option C is incorrect because the Intune Management Extension being up to date does not control update frequency.

Answer

The detection rule is set to 'File exists'.

Answer

The app is assigned as 'Required' in the assignment.

Answer

The Intune Management Extension is up to date.

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Accepted Answer

Verify the device is a member of the assigned device group.. The most common reason a kiosk mode profile fails to apply is that the device is not a member of the assigned device group. Intune evaluates policy targeting based on group membership; if the device is missing from the group, the profile will never be delivered. Verifying group membership is the first logical troubleshooting step before investigating device-level issues.

Answer

Ensure the device is running Windows 10 Enterprise.

Answer

Run the Policy Manager tool on the device.

Answer

Check the device's notification area for a policy update prompt.

Question 14

You manage iOS devices with Microsoft Intune. You need to deploy an app that is not available in the Apple App Store. The app is developed internally and signed with an enterprise certificate. Which app type should you use?

Accepted Answer

iOS/iPadOS Line-of-business app. For internally developed iOS apps not in the App Store, use the iOS/iPadOS Line-of-business app type. Option D is correct. Option A is wrong because the iOS app store app type is for apps from the App Store. Option B is wrong because the Web link type is for web shortcuts. Option C is wrong because the Built-in app type is for pre-installed system apps.

Answer

iOS/iPadOS app store app

Answer

Web link

Answer

Built-in app

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned Windows 10 devices are allowed to access Microsoft 365 services. You have configured a conditional access policy to require compliant devices. What else must you do to identify corporate-owned devices?

Accepted Answer

Add corporate device identifiers (e.g., serial numbers) in Intune.. Corporate device identifiers, such as serial numbers or IMEI numbers, are the specific mechanism in Microsoft Intune used to mark a device as corporate-owned. While a conditional access policy requiring compliant devices ensures only compliant devices can access Microsoft 365, it does not distinguish between corporate and personal devices. By uploading corporate identifiers, Intune automatically sets the ownership type to 'Corporate' upon enrollment, which can then be used in conditional access policies to restrict access to only those devices.

Answer

Configure a device compliance policy to require corporate ownership.

Answer

Set enrollment restrictions to block personally owned devices.

Answer

Deploy an app protection policy to block personal devices.