MD-102 Practice Test 47 — 15 Questions

Question 1

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Accepted Answer

Configure a BitLocker policy in Intune that enables key escrow to Azure AD.. Options A, C, and D are correct. Intune management enables remote wipe. BitLocker policy with key escrow stores keys in Azure AD. Azure AD join is required for key escrow. Option B is not required because key escrow works without on-premises AD. Option E is for on-premises AD joined devices.

Answer

Join devices to on-premises Active Directory.

Answer

Configure a Group Policy to escrow BitLocker keys to Active Directory.

Question 2

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

Accepted Answer

Set 'Enable Windows Hello for Business' in the Autopilot profile.. Option A is correct because Autopilot profiles have settings for Windows Hello for Business. Option B is incorrect because the Enrollment Status Page does not configure Hello. Option C is incorrect because a separate policy is not required; it can be set in the profile. Option D is incorrect because Azure AD join is a prerequisite, not a configuration for Hello.

Answer

Ensure the device is Azure AD joined.

Answer

Create a separate Windows Hello for Business policy and assign it to the device group.

Answer

Configure the Enrollment Status Page to show Hello setup.

Question 3

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which THREE settings can you use?

Accepted Answer

Disable screen capture.. In Intune, for Android Enterprise, you can restrict screenshots using a device restrictions profile. The settings include 'Disable screen capture' (which prevents screenshots), 'Disable camera', and 'Disable copy and paste' can also help but are not directly about screenshots. However, the question asks for 'restricts the device from taking screenshots'. The actual setting is 'Disable screen capture'. Additionally, you can use 'Microsoft Defender for Endpoint' or 'Mobile Threat Defense' to detect screenshot attempts? No, that's not typical. The correct settings are: 'Disable screen capture' in device restrictions, 'Allow screenshots' (set to block), and possibly 'Disable Assistant'? No. The typical setting is 'Disable screen capture'. Since it's a 'Which THREE' and only one setting directly blocks screenshots, the other two could be 'Disable camera' and 'Disable copy and paste'? Not directly. Actually, there is also 'Disable screen share'? Not in Intune. I need to adjust: For Android, the device restrictions profile includes 'Disable screen capture' (under General). There is also 'Disable camera' and 'Disable copy and paste' under General. These three can be used together to restrict data leakage. So options: A, B, D. Option C is wrong because 'Disable Wi-Fi' does not restrict screenshots. Option E is wrong because 'Disable Bluetooth' does not.

Answer

Disable Bluetooth.

Answer

Disable Wi-Fi.

Question 4

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?

Accepted Answer

Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'. Option A is correct because dynamic device groups in Microsoft Entra ID can use rules based on device properties, including MDE threat level. Option B is wrong because MDE machine groups are not used for compliance policies. Option C is wrong because Intune groups cannot be dynamic based on MDE threat level. Option D is wrong because security groups are static.

Answer

Create a security group in Microsoft Entra ID and manually add devices with high threat

Answer

Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy

Answer

Create a dynamic device group in Microsoft Intune using a rule based on threat level

Question 5

You are reviewing an Intune endpoint protection profile for Windows 10. The exhibit shows a JSON snippet of the configuration. A user reports that a device detected malware with moderate severity, but the action taken was 'quarantine'. However, the desired action is 'clean'. Which setting should you modify?

Accepted Answer

defenderDetectedMalwareActions for moderateSeverity. Option A is correct because the JSON shows 'moderateSeverity': 'quarantine'. To change it to 'clean', modify the defenderDetectedMalwareActions setting. Option B is wrong because scan type does not affect actions. Option C is wrong because schedule does not affect actions. Option D is wrong because it is not a global setting.

Answer

defenderScheduleScanDay and defenderScheduleScanTime

Answer

A global setting to override all actions

Answer

defenderScanType

Question 6

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

Accepted Answer

It uses the password type configured in the device's local policy. Option C is correct. 'deviceDefault' means the device's own password settings are used, which may not enforce the Intune password requirements. Option A is wrong because it does not require a specific type. Option B is incorrect. Option D is incorrect.

Answer

It requires a password that meets the minimum length but no complexity

Answer

It does not require a password at all

Answer

It requires a password that contains at least one number and one letter

Question 7

A user reports that their Windows 10 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which of the following is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently.. The device is not syncing with Intune, so compliance policies are not evaluated. Option A is correct because the Intune Management Extension handles policy retrieval and compliance evaluation. Option B is incorrect because BitLocker is not related to policy evaluation. Option C is incorrect because stale policies do not prevent evaluation; the device would still evaluate. Option D is incorrect because the MDM authority is already set to Intune.

Answer

The MDM authority is set to Configuration Manager.

Answer

The compliance policy is set to 'Not applicable' due to OS version.

Answer

BitLocker encryption is enabled on the device.

Question 8

Which THREE of the following are features of Microsoft Defender for Endpoint that help protect devices?

Accepted Answer

Attack surface reduction rules. Attack surface reduction, next-generation protection, and endpoint detection and response are core features. Option A is correct because attack surface reduction rules reduce vulnerabilities. Option B is correct because next-generation protection includes antivirus. Option C is correct because EDR detects and responds to threats. Option D is incorrect because 'Conditional access' is a Microsoft Entra ID feature. Option E is incorrect because 'Data loss prevention' is a Microsoft Purview feature.

Answer

Data loss prevention

Answer

Conditional access policies

Question 9

Your organization wants to use Microsoft Intune to manage Windows devices that are joined to an on-premises Active Directory domain. The devices will be hybrid Azure AD joined. Which tool should you use to configure automatic enrollment into Intune?

Accepted Answer

Group Policy. Option D is correct because Group Policy is used to configure automatic enrollment for hybrid AD-joined devices. Option A is wrong because CMG is for co-management, not enrollment. Option B is wrong because autopilot is for new devices. Option C is wrong because SCUP is for updates.

Answer

Windows Autopilot

Answer

System Center Updates Publisher (SCUP)

Answer

Configuration Manager Cloud Management Gateway (CMG)

Question 10

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to configure a Windows Autopilot deployment for new devices that are shipped directly to users. The devices must be automatically enrolled in Intune and configured with your organization's standard settings. What is the minimum requirement for the device to be recognized by Windows Autopilot?

Accepted Answer

The device must have its hardware hash uploaded to Microsoft Intune.. Option D is correct because Windows Autopilot requires the device's hardware hash to be uploaded to the Autopilot service. Option A is incorrect because devices do not need to be joined to on-premises AD first. Option B is incorrect because Azure AD join is configured during the Autopilot process, not a prerequisite. Option C is incorrect because the hardware hash is the minimum requirement, not a Microsoft Entra ID Premium license (though some features may require it).

Answer

The device must have a Microsoft Entra ID Premium P2 license assigned.

Answer

The device must be Azure AD registered before shipping.

Answer

The device must be joined to on-premises Active Directory first.

Question 11

Refer to the exhibit. A PowerShell command is used to create a device category in Microsoft Intune. After running the command, you want to automatically assign devices to this category based on their Azure AD group membership. How should you configure this?

Accepted Answer

Create a dynamic device group in Azure AD that includes devices based on rules, then use that group to assign category via Intune.. Option D is correct because dynamic device groups in Azure AD can use rules to assign devices to categories based on attributes. Option A is incorrect because manual assignment is not automated. Option B is incorrect because there is no direct mapping between Azure AD groups and Intune categories. Option C is incorrect because configuration profiles do not assign categories.

Answer

Use a device configuration profile to set the device category.

Answer

Map an Azure AD group to the Intune device category in the Intune console.

Answer

Create a PowerShell script that runs daily to assign devices to the category based on group membership.

Question 12

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Accepted Answer

A Microsoft Defender for Endpoint license must be assigned.. Options A and D are correct. Devices must be enrolled in Intune to receive the configuration. A Defender for Endpoint license is required. Option B is not required because Defender is built into Windows 10. Option C is not a prerequisite. Option E is not required for deployment.

Answer

Devices must be joined to Azure AD.

Answer

Devices must have a third-party antivirus uninstalled.

Answer

An Azure AD Premium license must be assigned.

Question 13

You are planning the enrollment of 500 Android Enterprise personally-owned work profile devices. Management requires that users must not be able to remove the work profile from their device. Which enrollment method should you use?

Accepted Answer

Android Enterprise dedicated devices. Option C is correct because Android Enterprise dedicated devices are fully managed and cannot have the work profile removed by the user. Option A is wrong because personally-owned work profile allows users to remove the work profile. Option B is wrong because corporate-owned work profile is for company-owned devices. Option D is wrong because fully managed is for corporate-owned devices.

Answer

Android Enterprise corporate-owned work profile

Answer

Android Enterprise fully managed

Answer

Android Enterprise personally-owned work profile

Question 14

Refer to the exhibit. You configure an Enrollment Status Page (ESP) policy as shown. During Windows Autopilot deployment, a device fails to install one of the required apps. What happens to the device?

Accepted Answer

The device blocks use and the user cannot proceed. Option D is correct because 'allowDeviceUseOnInstallFailure' is set to false, so the device will block use on install failure. Additionally, 'allowDeviceResetOnInstallFailure' is false, so the device will not reset. 'blockDeviceSetupRetryByUser' is true, so the user cannot retry. Option A is wrong because the user cannot retry. Option B is wrong because the device will not reset. Option C is wrong because the user cannot skip.

Answer

The device automatically resets and retries

Answer

The user can skip the installation and use the device

Answer

The user can retry the installation

Question 15

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Accepted Answer

An on-premises Active Directory environment.. Options B and D are correct. Group Policy enrollment requires an on-premises AD and automatic enrollment via GPO. Option A is not required because hybrid join is not mandatory. Option C is incorrect because Azure AD Connect is needed for hybrid join but not for pure AD enrollment. Option E is incorrect because Intune subscription is required, but the question asks for prerequisites for Group Policy enrollment, which includes automatic enrollment policy.

Answer

A Microsoft Intune subscription must be active.

Answer

Azure AD Connect must be configured.

Answer

Devices must be Azure AD hybrid joined.