MD-102 Practice Test 47 — 15 Questions

Question 1

Your organization uses Microsoft Intune to deploy apps to Windows 11 devices. You need to ensure that a Win32 app installs only when the device has at least 4 GB of RAM. What should you configure?

Accepted Answer

A requirement rule that specifies minimum RAM. To enforce a hardware prerequisite like minimum RAM for a Win32 app in Microsoft Intune, you configure a requirement rule. Requirement rules define the device conditions (e.g., operating system architecture, disk space, or RAM) that must be met before the app can install. Option C is correct because it directly specifies a minimum RAM value as a requirement rule, ensuring the app installs only on devices with at least 4 GB of RAM.

Answer

A dependency rule that includes a RAM check

Answer

A return code for insufficient RAM

Answer

A detection rule for RAM

Question 2

You are deploying Windows 10 devices using Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are blocked from bypassing the sign-in screen by clicking 'Skip for now'. Which setting should you configure in the Enrollment Status Page (ESP) profile?

Accepted Answer

Block user from signing in automatically. The correct setting is 'Block user from signing in automatically' in the Enrollment Status Page (ESP) profile. This setting prevents users from bypassing the sign-in screen by clicking 'Skip for now' during OOBE. When enabled, the device forces the user to complete authentication before proceeding, ensuring proper enrollment.

Answer

Block Windows Setup page

Answer

Require device compliance

Answer

Block device setup failure

Question 3

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

Accepted Answer

Endpoint security > Disk encryption policy. To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Answer

Compliance policy for Windows 10

Answer

Windows Update for Business policy

Answer

Device configuration profile for Windows 10

Question 4

You are deploying a line-of-business (LOB) app to iOS devices managed by Intune. The app requires a specific configuration to access internal resources. Which approach should you use to deliver the configuration?

Accepted Answer

Create an App Configuration Policy targeting managed devices. An App Configuration Policy targeting managed devices is the correct approach because it allows you to supply XML or JSON settings directly to the LOB app on iOS devices enrolled in Intune. This policy is applied when the app runs, enabling it to access internal resources without requiring a separate device profile or user interaction.

Answer

Assign a custom device configuration profile

Answer

Deploy an App Protection Policy

Answer

Use Apple Volume Purchase Program (VPP) tokens

Question 5

A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?

Accepted Answer

Review the Intune management extension logs on the device.. The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.

Answer

Verify the device compliance policy.

Answer

Check the Company Portal app version.

Answer

Reassign the app to the user.

Question 6

Your organization uses Microsoft Intune to manage Windows 11 devices. You have a requirement to ensure that all devices have BitLocker Drive Encryption enabled with a TPM protector and a recovery key escrowed to Azure AD. Additionally, you need to configure a policy that prevents users from changing the BitLocker settings. You create a device configuration profile using the 'Endpoint Protection' template for Windows 10 and later. After deploying the policy to a test group, you notice that BitLocker is not enabled on some devices. The devices meet the hardware requirements and are Azure AD joined. What is the most likely reason for the failure, and how should you resolve it?

Accepted Answer

The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.. The 'Endpoint Protection' template for Windows 10 and later requires explicit configuration of the 'Enable full disk encryption' setting and the encryption method (e.g., XTS-AES 128-bit) under the 'Windows Encryption' section. Without these settings, the policy does not trigger BitLocker to start encryption on the device, even if other settings like TPM protector and recovery key escrow are configured. The devices are Azure AD joined and meet hardware requirements, so the missing encryption enablement is the most likely cause.

Answer

Devices are not hybrid Azure AD joined; convert them to hybrid join for BitLocker policy to apply.

Answer

The policy does not specify a recovery key escrow location; configure it to escrow to Azure AD.

Answer

Devices are not co-managed with Configuration Manager; enable co-management to apply BitLocker policy.

Question 7

Which TWO are valid methods to enroll Windows devices in Microsoft Intune?

Accepted Answer

Manual enrollment using work or school account. Manual enrollment using a work or school account is a standard Intune enrollment method where users sign in with their Azure AD credentials on the Windows device, which triggers automatic MDM enrollment via the Enrollment Status Page (ESP) and the MDM enrollment URL (https://enrollment.manage.microsoft.com). This method works for both Azure AD joined and hybrid Azure AD joined devices, and it is the most common fallback when automated methods like Autopilot are not used.

Answer

Apple Business Manager

Answer

Android Enterprise

Answer

Azure AD Join

Question 8

A user reports that a required app is not installing on their Android Enterprise device. The device is enrolled in Intune and shows as compliant. The app is assigned to the user. What is the most likely cause?

Accepted Answer

The user does not have the Company Portal app installed.. On Android Enterprise devices enrolled in Intune, the Company Portal app is required to install line-of-business (LOB) apps or manage app installations via the Intune console. Without the Company Portal app, the device cannot receive app assignment push notifications or initiate the installation process, even if the device is compliant and the app is assigned to the user. This is a prerequisite for app deployment on Android Enterprise work profiles.

Answer

The device is not compliant with conditional access policies.

Answer

The app is not available on Managed Google Play.

Answer

The device does not have a work profile configured.

Question 9

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

Accepted Answer

Quality updates are paused until March 15, 2025.. The JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Answer

The quality update deferral of 7 days has not yet elapsed since the last update.

Answer

The quality update pause has expired, but quality updates are still blocked.

Answer

Feature updates are deferred for 30 days, preventing all updates.

Question 10

You are troubleshooting an Android Enterprise device that fails to install a required app from the Managed Google Play store. The device is compliant and has a valid work profile. What should you check first?

Accepted Answer

Ensure the Managed Google Play app is enabled and active on the device.. The Managed Google Play app is the client-side component that processes app installation requests on Android Enterprise devices. Even if the device is compliant and has a valid work profile, if the Managed Google Play app is disabled, frozen, or not active, it cannot receive or execute the installation command from the EMM console. This is the first thing to verify because it is a prerequisite for any app deployment via Managed Google Play.

Answer

Check that the device is enrolled in Android Enterprise and has a work profile.

Answer

Confirm the user has approved the app installation in the Managed Google Play store.

Answer

Verify the device compliance policy allows app installation from unknown sources.

Question 11

Your company deploys Microsoft Defender for Endpoint to Windows devices managed by Microsoft Intune. You need to ensure that all devices send diagnostic data at the 'Optional diagnostic data' level. Which configuration profile type should you use?

Accepted Answer

Device restrictions. The correct configuration profile type is 'Device restrictions' (Option B). In Microsoft Intune, the Device restrictions profile for Windows 10/11 includes the 'Diagnostic data' setting under the General category, which allows you to configure the level of diagnostic data sent to Microsoft, including 'Optional diagnostic data'. Option A (Administrative templates) is used for ADMX-backed policies but is not the simplest method for this specific setting. Option C (Endpoint protection) focuses on security settings like Microsoft Defender Antivirus and does not contain diagnostic data settings. Option D (Custom) could be used but is not the recommended or simplest approach.

Answer

Administrative templates

Answer

Endpoint protection

Answer

Custom

Question 12

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 update ring that delays feature updates by 60 days and quality updates by 14 days. You create the update ring and assign it to a device group. After a week, you notice that devices are not receiving the quality updates as expected. What should you verify first?

Accepted Answer

Verify that Windows Update for Business is enabled on the devices.. Windows Update for Business must be enabled on Windows 10 devices for Intune update rings to apply. If it is disabled, devices ignore the update ring policy. Verifying this setting is the first troubleshooting step. Option A is incorrect because the deferral period is set correctly according to the requirement. Option B is incorrect because the update ring is already assigned; if the assignment were wrong, no updates would apply at all, but the issue is specific to quality updates. Option D is incorrect because device compliance status does not directly affect update ring application.

Answer

Ensure the deferral period for quality updates is set to 14 days.

Answer

Check that the update ring is assigned to the correct group.

Answer

Review the device compliance status.

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. They want to prevent users from installing unapproved applications. Which approach provides the most granular control?

Accepted Answer

Deploy AppLocker rules via Intune to allow only approved publishers.. AppLocker allows creating rules based on publisher, path, or hash, enabling granular control to allow only approved applications. Intune policies can deploy AppLocker rules to Windows 10 devices. Option A is wrong because the Microsoft Store for Business only controls store apps, not all applications. Option C is wrong because SmartScreen only warns about unknown apps but does not block installation. Option D is wrong because UAC only prompts for elevation and does not prevent installation.

Answer

Use the Microsoft Store for Business to deploy only approved apps.

Answer

Enable Windows Defender SmartScreen to block unknown apps.

Answer

Configure User Account Control (UAC) to always notify.

Question 14

Your organization uses Microsoft Intune to deploy apps to Windows 11 devices. You need to ensure that a Win32 app installs only when the device has at least 4 GB of RAM. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the compliance policy is assigned to the correct Windows version.. The correct first step is to verify that the compliance policy is assigned to the correct Windows version. After a Windows update, the OS version may change, and if the policy targets a specific version that no longer matches, devices may stop receiving it. Option B is incorrect because connectivity issues would affect all Intune communication, not just compliance policy receipt. Option C is incorrect because group membership does not directly affect policy delivery to already-enrolled devices. Option D is incorrect because re-enrollment is unnecessary and disruptive; the issue is likely a policy targeting mismatch.

Answer

Check if the devices can connect to the Intune service.

Answer

Ensure the users are members of the correct Azure AD group.

Answer

Re-enroll the devices in Intune.

Question 15

You need to block users from enrolling personal Android devices in Microsoft Intune. Which enrollment restriction should you configure?

Accepted Answer

Set the 'Block personally owned devices' restriction for Android.. The 'Block personally owned devices' restriction in Intune prevents users from enrolling personal (BYOD) Android devices. Option B is incorrect because the 'Block Android' platform restriction blocks all Android devices regardless of ownership, not just personal ones. Option C is incorrect because 'Block Android Enterprise' restricts Android Enterprise enrollment, not personally owned devices. Option D is incorrect because device compliance policies evaluate devices after enrollment, they do not block enrollment itself.

Answer

Set the 'Block Android' platform restriction.

Answer

Set the 'Block Android Enterprise' device type restriction.

Answer

Configure a device compliance policy to mark personal devices as non-compliant.