MD-102 Practice Test 49 — 15 Questions

Question 1

You are using Microsoft Intune to deploy a Win32 app (MyApp.exe) to Windows 10 devices. The app requires .NET Framework 4.8 as a dependency. You have created a Win32 app for .NET Framework 4.8 and set it as a dependency for MyApp. However, when you assign MyApp to a device group, the installation fails because .NET Framework is not installed first. The detection rules for MyApp are correctly configured. What should you do to ensure that the dependency is installed before MyApp?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Auto-install dependency' in the dependency settings of MyApp.. In Microsoft Intune, dependencies are not automatically installed unless you enable the 'Auto-install dependency' setting in the dependency configuration of the parent app (MyApp). This setting ensures that Intune installs the dependency before the parent app. Option A is incorrect because assignment priority does not control installation order; all assigned apps are installed independently. Option B is incorrect because modifying detection rules only affects how Intune detects whether an app is installed, not the installation order. Option C is incorrect because requiring pre-installation is impractical and not the intended use of dependencies.

Answer

Assign the dependency app to the same device group with a higher priority.

Answer

Modify the detection rule for the dependency app to check a different file.

Answer

Require that all devices have .NET Framework 4.8 pre-installed before enrollment.

Question 2

Your organization uses Intune to manage Windows 10 devices. You have deployed a Win32 app named 'FinanceApp' with a detection rule that checks for the existence of a registry key. After deployment, you find that the app is not being detected on some devices, causing Intune to attempt reinstallation. You suspect the detection rule is incorrect.

You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule.

What should you do to apply the updated detection rule to existing devices?

Accepted Answer

Increment the app version in the app properties. After modifying the detection rule, you must increment the app version number in the app properties. This forces the Intune management extension on existing devices to re-evaluate the detection rule and apply the updated logic. Options B, C, and D are unnecessary and overly disruptive.

Answer

Remove and re-add the assignment

Answer

Delete the app and recreate it with the new detection rule

Answer

Uninstall the app from all devices and redeploy

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom vertical market app that is not available in the Apple App Store. The app is distributed as an .ipa file signed with an enterprise certificate. You have uploaded the .ipa file to Intune. However, when you assign the app to a user group, the installation fails on devices with the error 'Unable to download app'. The devices are enrolled as user-affinity devices with Device Enrollment Program (DEP). You have verified that the enterprise certificate is trusted on the devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in Supervised mode.. Enterprise-signed apps require the device to be in Supervised mode for silent installation without user prompts. Without supervision, the user must manually trust the enterprise certificate or the installation may fail. Option A is incorrect because the icon file is not critical for installation. Option B is incorrect because a VPN configuration profile is not required for downloading enterprise apps. Option C is incorrect because VPP is for store apps, not enterprise-signed line-of-business apps.

Answer

The app package does not include an icon file.

Answer

The devices do not have a VPN configuration profile installed.

Answer

The app is not purchased through the Volume Purchase Program (VPP).

Question 4

Your company has 200 iOS devices that are enrolled in Microsoft Intune via Apple Business Manager. The devices are used by field sales representatives who need access to the corporate CRM app and email. You need to ensure that if a device is lost or stolen, the corporate data can be removed without affecting personal data. The devices are configured with user affinity. What should you do?

Accepted Answer

Perform a selective wipe (corporate data removal) from Intune.. Performing a selective wipe (corporate data removal) from Intune removes only corporate data while leaving personal data intact on devices with user affinity. Option A is incorrect because a full wipe removes all data, including personal data. Option B is incorrect because retiring the device removes it from management but does not remove corporate data. Option D is incorrect because a compliance policy marks the device as noncompliant but does not remove data.

Answer

Perform a full wipe on the device from Intune.

Answer

Retire the device from Intune.

Answer

Create a device compliance policy to mark the device as noncompliant.

Question 5

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

Accepted Answer

One of the required apps failed to install.. The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Answer

The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

Answer

The user attempted to retry the setup and it was blocked.

Answer

The device reset on failure is enabled, causing a reset loop.

Question 6

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

Accepted Answer

The OMA-URI path is incorrect for an ADMX-backed policy.. The OMA-URI path for an ADMX-backed policy must follow the exact format: `./Device/Vendor/MSFT/Policy/Config/ADMX_/`. If the path is incorrect—for example, missing the `ADMX_` prefix or using a wrong category name—the policy will fail to apply on Windows 10 devices. Custom configuration policies do support ADMX-backed policies, but the URI must precisely match the ADMX administrative template structure.

Answer

The value must be an integer, not a string.

Answer

The OMA-URI targets the user, not the device.

Answer

Custom configuration policies are not supported on Windows 10.

Question 7

Refer to the exhibit. You have configured the compliance policy shown above. A user reports that their Windows 11 device is compliant with all settings except the threat level. The device has no threat protection agent installed. What will happen when the user tries to access corporate resources?

Accepted Answer

Access is blocked immediately.. The compliance policy requires a minimum threat level, which cannot be evaluated because the device has no threat protection agent installed. In Microsoft Intune, when a required compliance setting cannot be assessed (e.g., no agent), the device is treated as non-compliant, and access is blocked immediately. There is no grace period for missing required agents, and conditional access enforces the block at the time of the access request.

Answer

Access is granted but the user receives a warning notification.

Answer

Access is blocked only after a 24-hour grace period.

Answer

Access is granted because the device meets all other compliance requirements.

Question 8

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

Accepted Answer

Configure Conditional Access policies in Microsoft Entra ID that require compliant devices. Conditional Access policies in Microsoft Entra ID can require that devices accessing Microsoft 365 services be marked as compliant by Intune. This ensures that only devices meeting your security policies (e.g., encryption, antivirus, OS patch level) are granted access, directly addressing the security team's concern about unmanaged devices on public Wi-Fi.

Answer

Deploy Windows Autopilot for all devices and require Entra ID join

Answer

Configure a VPN profile in Intune and enforce device compliance on the VPN server

Answer

Create a compliance policy in Intune and assign it to all users

Question 9

A company uses Microsoft Intune to manage macOS devices. They need to enforce FileVault encryption on all Macs. What should they configure?

Accepted Answer

A device configuration profile with FileVault settings.. FileVault encryption on macOS is enforced through a device configuration profile in Microsoft Intune. Specifically, you create a settings catalog or a custom profile that includes the FileVault settings under the 'System Preferences' > 'Security & Privacy' category, which allows you to require FileVault and escrow the recovery key to Intune. This is the native Intune method for managing macOS disk encryption, as endpoint security policies for disk encryption are designed for Windows BitLocker, not macOS.

Answer

An endpoint security policy for disk encryption.

Answer

A device compliance policy that requires FileVault.

Answer

An app protection policy.

Question 10

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

Accepted Answer

Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.. Using a 'Provision Microsoft Entra ID' step with a bulk token in a Configuration Manager task sequence directly enables automatic Microsoft Entra ID join and Intune enrollment during OSD. The bulk token, generated from Microsoft Entra ID, allows devices to be joined without user interaction, which is essential for unattended, large-scale deployments.

Answer

Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

Answer

Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

Answer

Configure Windows Autopilot for existing devices and redeploy them.

Question 11

A company is using Windows Autopilot for user-driven deployments. Users report that after OOBE, the device is not Azure AD joined. The enrollment status page shows 'Securing your device' for over an hour. What should you check first?

Accepted Answer

Ensure the device's hardware hash is uploaded and an Autopilot profile is assigned. The device must have its hardware hash uploaded to Intune and an Autopilot profile assigned before it can join Azure AD during OOBE. Without this, the device falls back to a generic provisioning state, causing the 'Securing your device' screen to hang indefinitely as it waits for the Autopilot profile to trigger the Azure AD join.

Answer

Verify that the device has internet connectivity

Answer

Confirm that the enrollment status page timeout is set correctly

Answer

Check that the user has Intune license

Question 12

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

Accepted Answer

Assign the app to users as 'Available' in the Company Portal. The 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Answer

Configure the app as 'Required' for all users

Answer

Add the app to the Windows Autopilot deployment profile

Answer

Grant users local administrator rights on their devices

Question 13

You have the following JSON compliance policy for Windows 10 devices in Intune. A device with OS version 10.0.19042.0, build 19042, with BitLocker enabled, Secure Boot enabled, but Code Integrity disabled reports as non-compliant. Which setting is causing the non-compliance?

Accepted Answer

requireCodeIntegrity. The device reports as non-compliant because the compliance policy requires `requireCodeIntegrity` to be enabled, but the device has Code Integrity disabled. Even though BitLocker and Secure Boot are enabled, and the OS version meets the minimum requirement, the absence of Code Integrity enforcement triggers non-compliance. In Intune, Windows 10 compliance policies evaluate each setting independently, and a failure on any required setting results in overall non-compliance.

Answer

minimumOsVersion

Answer

requireSecureBoot

Answer

requireDeviceEncryption

Question 14

A company uses Microsoft Intune to manage Windows 10 devices. They have a compliance policy that requires BitLocker to be enabled. Some devices are marked as non-compliant even though BitLocker appears to be on. The administrator runs 'manage-bde -status' on a non-compliant device and sees that the protection status is 'Protection Off'. What is the most likely cause?

Accepted Answer

The BitLocker key protectors are missing or have been removed.. The compliance policy requires BitLocker to be enabled, but 'manage-bde -status' shows 'Protection Off'. This indicates that while the drive is encrypted, BitLocker is not actively protecting the data because the key protectors (such as the TPM protector) are missing or have been removed. Intune checks the protection status, not just encryption state, so when protectors are absent, the device is marked non-compliant.

Answer

The TPM is not initialized.

Answer

The device has a recovery password protector but no TPM protector.

Answer

The device uses a different encryption method (e.g., XTS-AES 256 vs AES 128).

Question 15

A company uses Configuration Manager to deploy Windows 11. During the deployment, the task sequence fails at the 'Apply Operating System' step. The error log shows 'Failed to find a valid operating system image package'. You verify that the operating system image package exists and is distributed to the distribution point. What is the most likely cause?

Accepted Answer

The operating system image package is not enabled for use with task sequences. When an operating system image package exists and is distributed to distribution points but the task sequence fails with 'Failed to find a valid operating system image package', the most common cause is that the image package is not enabled for use with task sequences. In Configuration Manager, each OS image package has a property 'Enable this operating system image for use in task sequences' that must be checked; if unchecked, the task sequence engine cannot reference the package during the Apply Operating System step, even though the package is present and distributed.

Answer

The client computer does not have enough disk space

Answer

The task sequence is not associated with the correct boot image

Answer

The distribution point is not configured to support PXE boot