MD-102 Practice Test 48 — 15 Questions

Question 1

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

Accepted Answer

Windows Hello for Business. Option C is correct because the 'Windows Hello for Business' setting in the Autopilot profile controls this behavior. Option A is wrong because the 'Language' setting is for locale. Option B is wrong because 'Skip privacy settings' bypasses privacy, not Hello. Option D is wrong because 'Device name template' is for naming.

Answer

Skip privacy settings

Answer

Device name template

Answer

Language (Region)

Question 2

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

Accepted Answer

Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs. Option C is correct because Device Enrollment (via Apple Business Manager) allows supervised enrollment while still allowing personal Apple IDs if configured. Option A is wrong because user enrollment limits management. Option B is wrong because it uses a shared device mode without Apple IDs. Option D is wrong because ADE is the same as Device Enrollment, but the key is allowing personal Apple IDs.

Answer

Apple Automated Device Enrollment (ADE) with user affinity

Answer

Apple Device Enrollment (ADE) with Shared iPad mode

Answer

Apple User Enrollment

Question 3

You are troubleshooting a Windows 10 device that fails to enroll in Microsoft Intune. The device shows error code 0x8018000b. You verify that the user has a valid Intune license and that the device is running Windows 10 Pro. What is the most likely cause of the enrollment failure?

Accepted Answer

MDM enrollment is blocked by a local Group Policy or registry setting.. Option C is correct because error 0x8018000b typically indicates that MDM enrollment is blocked via Group Policy or registry. Option A is incorrect because the error is specific to MDM enrollment blocking. Option B is incorrect because the device edition is Pro, which supports enrollment. Option D is incorrect because certificate issues usually produce different errors.

Answer

The device is running Windows 10 Home edition.

Answer

The device is not connected to the internet.

Answer

The device has an expired certificate required for enrollment.

Question 4

Refer to the exhibit. A detection script for a Win32 app in Intune uses a WMI query. The script is expected to detect if BitLocker is not enabled. What will the script return if BitLocker is enabled on the device?

Accepted Answer

It returns no results, indicating that BitLocker is enabled.. Option C is correct because the query returns volumes where ProtectionStatus = 0 (not protected). If BitLocker is enabled, ProtectionStatus = 1, so no results are returned, meaning the script would return a non-detection (often $false or exit 1 depending on script). Option A is incorrect because the query does not return when protection is on. Option B is incorrect because no results are returned. Option D is incorrect because the query is valid.

Answer

It returns the protection status as 1.

Answer

It returns the drive letter of the protected volume.

Answer

It returns an error because the query is invalid.

Question 5

Your company is deploying iOS devices using Apple Business Manager and Intune. You need to ensure that devices are automatically configured with Wi-Fi settings, email profiles, and a list of required apps during the initial setup. Which THREE configurations should you create in Intune?

Accepted Answer

A device configuration profile for Wi-Fi settings.. Options B, C, and D are correct. Device configuration profiles can push Wi-Fi and email settings. Required apps can be assigned as mandatory. Option A is not used for iOS. Option E is for compliance, not configuration.

Answer

A Windows configuration designer provisioning package.

Answer

A device compliance policy for iOS.

Question 6

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a PowerShell script via Intune management extension to install a legacy application. The script runs successfully on most devices, but fails on devices that have the 'LocalSystem' account disabled. What should you do to resolve the issue?

Accepted Answer

Configure the script to run in the user context by modifying the script settings in Intune. Option D is correct because the Intune management extension runs scripts in the system context, but if the LocalSystem account is disabled, the script may fail. Running the script in the user context may bypass this issue. Option A is wrong because changing the script to run as a different user is not directly supported. Option B is wrong because the management extension is required. Option C is wrong because re-enabling LocalSystem is not recommended and may have security implications.

Answer

Change the script to run as the logged-on user using a scheduled task

Answer

Deploy the script using Microsoft Configuration Manager instead

Answer

Re-enable the LocalSystem account on the affected devices

Question 7

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

Accepted Answer

Create an Autopilot deployment profile with 'Assign to' set to 'All devices' and ensure the device is registered in Autopilot.. Option A is correct because the Enrollment Status Page (ESP) is not required for enrollment; Autopilot profile with Intune enrollment is the key. Option B is incorrect because the ESP is a separate configuration. Option C is incorrect because Azure AD hybrid join is not required for Autopilot. Option D is incorrect because for new devices, the Autopilot profile triggers enrollment.

Answer

Join the device to Azure AD hybrid by configuring a domain join profile.

Answer

Configure the Enrollment Status Page (ESP) to require device enrollment.

Answer

Manually add the device serial number to Intune via the admin center.

Question 8

You are configuring Microsoft Intune device compliance policies for Windows 10. Which THREE settings can be evaluated by compliance policies? (Choose three.)

Accepted Answer

Minimum OS version. Options A, B, and E are correct. Compliance policies can evaluate threat level, OS version, and password settings. Option C is incorrect because BitLocker is evaluated by device configuration policies, not compliance. Option D is incorrect because firewall status is a configuration policy, not typically a compliance setting.

Answer

Windows Firewall status

Answer

BitLocker encryption status

Question 9

You are troubleshooting a Windows 11 device that fails to enroll in Intune via Group Policy. The device is domain-joined and you have configured the 'Enable automatic MDM enrollment using default Azure AD credentials' GPO. The user has a valid Microsoft 365 license. What is the most likely reason for the failure?

Accepted Answer

The device is not registered in Azure AD.. Option D is correct because the GPO trigger requires the device to be registered in Azure AD; domain-join alone is not enough. Option A is wrong because the user license is present. Option B is wrong because the GPO is correct. Option C is wrong because the service connection point is for SCCM.

Answer

The GPO is not linked to the correct organizational unit.

Answer

The user does not have an Intune license assigned.

Answer

The device does not have a service connection point configured.

Question 10

Your organization uses Microsoft Intune for device management. You need to ensure that only corporate-owned devices can enroll in Intune. Which configuration should you use?

Accepted Answer

Use Device Enrollment Manager (DEM) accounts to enroll devices.. Option C is correct because Device Enrollment Manager (DEM) accounts allow designated users to enroll corporate-owned devices without the device needing to be pre-registered as corporate. Option A is wrong because enrollment restrictions can block personal devices but do not designate corporate ownership. Option B is wrong because a compliance policy is applied after enrollment. Option D is wrong because device categories are used for grouping, not enrollment control.

Answer

Assign a compliance policy that requires the device to be corporate-owned.

Answer

Create a device category for corporate devices and instruct users to select it during enrollment.

Answer

Configure enrollment restrictions to block personally owned devices.

Question 11

Your organization uses Microsoft Intune to manage devices. You need to configure a compliance policy for Windows devices that requires the device to be at a specific OS version and have antivirus enabled. Which TWO settings should you configure in the compliance policy?

Accepted Answer

Require antivirus (Windows Defender). Option A and Option D are correct because 'Minimum OS version' and 'Require antivirus' are compliance policy settings for Windows. Option B is wrong because 'Maximum OS version' is not a typical setting; usually min version is used. Option C is wrong because 'Device type' is not a compliance setting. Option E is wrong because 'Storage encryption' is typically covered by BitLocker, not separate.

Answer

Maximum OS version

Answer

Device type

Answer

Storage encryption

Question 12

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a compliance policy requiring devices to have BitLocker enabled. Some devices report as non-compliant even though BitLocker appears to be on. You discover these devices are using software-based encryption instead of hardware-based encryption. What should you do to resolve the compliance failure?

Accepted Answer

Modify the compliance policy to include 'BitLocker hardware encryption' as 'not configured' or set to 'allow software encryption'.. Option C is correct because the compliance policy can be configured to accept both hardware and software encryption. Option A is incorrect because the TPM is used regardless of encryption type. Option B is incorrect because the policy does not need to be changed to 'required' if it already requires encryption. Option D is incorrect because BitLocker is available on Windows 10 Pro and Enterprise.

Answer

Configure the compliance policy to require TPM attestation.

Answer

Upgrade the devices to Windows 10 Enterprise edition.

Answer

Change the compliance policy setting from 'require' to 'allow' for BitLocker.

Question 13

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Accepted Answer

Set 'Defer quality updates (days)' to 0.. Options B and D are correct. Setting deferral for quality updates to 0 ensures immediate installation. Setting feature update deferral to 60 days delays feature updates. Option A is not a setting in update rings. Option C is incorrect because feature updates should be deferred, not quality. Option E is a service channel, not a deferral setting.

Answer

Set 'Feature update channel' to 'Semi-Annual Channel'.

Answer

Set 'Update notification level' to 'Turn off notifications'.

Answer

Set 'Defer quality updates (days)' to 60.

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a Windows 10 feature update policy to keep devices on a specific version. After deployment, some devices report that the update is not being offered. The devices are not in a maintenance window. What is the most likely cause?

Accepted Answer

Windows Update for Business deferral or pause settings are blocking the update. Option D is correct because feature update policies require that devices are not paused for updates. Option A is wrong because the policy is assigned. Option B is wrong because the devices are not in a maintenance window. Option C is wrong because feature update policies do not require a specific build.

Answer

The devices are running a build that is newer than the target version

Answer

The policy is not assigned to the correct group

Answer

The devices are in a maintenance window that blocks updates

Question 15

Your organization is implementing Microsoft Entra ID join for Windows devices. You need to ensure that when users sign in with their Microsoft Entra ID credentials, they automatically get access to company resources without additional authentication. Which feature should you enable?

Accepted Answer

Primary Refresh Token (PRT). Option C is correct because Microsoft Entra ID joined devices use Primary Refresh Token (PRT) for SSO. Option A is incorrect because Windows Hello for Business provides passwordless sign-in but is not required for automatic resource access. Option B is incorrect because Conditional Access policies control access, not automatic authentication. Option D is incorrect because device compliance policies are for compliance, not SSO.

Answer

Device compliance policies

Answer

Windows Hello for Business

Answer

Conditional Access policies