MD-102 Practice Test 49 — 15 Questions

Question 1

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

Accepted Answer

The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.. Option D is correct because 'Show recovery key: Not configured' means the user is not prompted to escrow the key. Option A is incorrect because encryption is enabled. Option B is incorrect because rotation is enabled. Option C is incorrect because the key type is personal.

Answer

FileVault encryption is not enabled on the device.

Answer

The recovery key type should be 'Institutional recovery key'.

Answer

Personal recovery key rotation is enabled, causing a conflict.

Question 2

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

Accepted Answer

Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.. Option A is correct because Defender for Endpoint can integrate with Intune to trigger remediation actions. Option B is wrong because Microsoft Sentinel is for SIEM, not automatic remediation. Option C is wrong because Microsoft Purview focuses on compliance. Option D is wrong because Microsoft Foundry is an AI platform.

Answer

Configure a Microsoft Sentinel playbook.

Answer

Configure a Microsoft Foundry AI model.

Answer

Configure a Microsoft Purview data loss prevention policy.

Question 3

Refer to the exhibit. You have configured a Windows Update for Business policy in Intune. Based on the JSON, what is the effect on devices?

Accepted Answer

Quality updates are paused from June 1 to June 30, and feature updates are paused from July 1 to July 15. Option B is correct because quality updates are paused until June 30 and feature updates are paused until July 15. Devices will not receive quality updates after June 1 until June 30. Option A is wrong because feature updates are paused later. Option C is wrong because both types are paused. Option D is wrong because there are specific pause dates.

Answer

Devices will not receive any updates from June 1 to July 15

Answer

Devices will receive all updates normally until July 15

Answer

The policy is invalid because pause dates cannot overlap

Question 4

You need to configure Microsoft Intune to automatically retire a device if it has not checked in for 30 days. Where would you configure this setting?

Accepted Answer

Intune device cleanup rules. Option D is correct because device cleanup rules in Intune allow you to automatically retire devices that have not communicated for a specified period. Option A is incorrect because compliance policies handle non-compliance, not retirement based on inactivity. Option B is incorrect because conditional access controls access, not device cleanup. Option C is incorrect because configuration policies set settings, not cleanup rules.

Answer

Conditional access policy

Answer

Device compliance policy

Answer

Device configuration profile

Question 5

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Accepted Answer

Check that Secure Boot is enabled.. Options A, B, and C are correct. TPM 2.0, Secure Boot, and 4GB RAM are minimum requirements. Option D is incorrect because the requirement is 64GB storage. Option E is incorrect because the requirement is 1GHz or faster with 2 cores.

Answer

Check that the processor is at least 1GHz with 1 core.

Answer

Check that the device has at least 32GB of storage.

Question 6

Your company deploys Microsoft Defender for Endpoint to Windows devices managed by Microsoft Intune. You need to ensure that all devices send diagnostic data at the 'Optional diagnostic data' level. Which configuration profile type should you use?

Accepted Answer

Device restrictions. Option A is correct because 'Device restrictions' includes the 'Diagnostic data' setting to control the level of diagnostic data sent to Microsoft. Option B is wrong because 'Endpoint protection' focuses on security settings like Defender Antivirus, not diagnostic data. Option C is wrong because 'Administrative templates' are for ADMX-backed policies, but the diagnostic data setting is available in device restrictions. Option D is wrong because 'Custom' is not the simplest way.

Answer

Administrative templates

Answer

Endpoint protection

Answer

Custom

Question 7

You have deployed the compliance policy shown in the exhibit. A Windows 10 device reports as non-compliant. The device has Windows 10 version 21H2 (build 19044.1288), password is set with 8 characters and includes numbers only, firewall is active, Defender is enabled, and BitLocker is on. Which setting is causing non-compliance?

Accepted Answer

passwordRequiredType. Option C is correct because the policy requires 'alphanumeric' password (letters and numbers), but the device uses numbers only. Option A is wrong because the device build 19044.1288 is within the allowed range (19042.0 to 19045.999). Option B is wrong because password length of 8 meets the minimum. Option D is wrong because the firewall is active.

Answer

passwordMinimumLength

Answer

osMinimumVersion

Answer

activeFirewallRequired

Question 8

A user has an Android Enterprise fully managed device. The device is enrolled in Microsoft Intune and all policies are applied. However, the user cannot install a required app from the managed Play Store. The app appears in the company portal but fails to install. What should you check first?

Accepted Answer

Verify that the app has been approved in the managed Google Play store.. Option B is correct because managed Play Store apps require approval. Option A is incorrect unless the app is not available in the managed store. Option C is incorrect because enrollment token is for enrollment, not app installation. Option D is incorrect because unapproved apps are not blocked by default.

Answer

Ensure that the device has a policy to allow installation of unapproved apps.

Answer

Check if the device's enrollment token is still valid.

Answer

Check if the app is available in the unmanaged Play Store.

Question 9

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

Accepted Answer

Client apps. Option B is correct because the 'Client apps' workload enables automatic enrollment to Intune. Option A is wrong because 'Windows Update policies' is for update management. Option C is wrong because 'Endpoint Protection' is separate. Option D is wrong because 'Resource access' is not the correct workload.

Answer

Endpoint Protection

Answer

Windows Update policies

Answer

Resource access

Question 10

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

Accepted Answer

The policy will block access to the Microsoft Store and Cortana.. Option A is correct because the policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device. Option D is wrong because the policy does not affect app installation from other sources.

Answer

The policy will apply only to the primary user of the device.

Answer

The policy will prevent users from installing apps from outside the Microsoft Store.

Answer

The policy will block the camera on all devices.

Question 11

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

Accepted Answer

Shared iPad enrollment using Apple Business Manager and Intune.. Option B is correct because Shared iPad mode allows multiple users to sign in with Managed Apple IDs while data is kept separate. Option A is incorrect because User Enrollment is for personally owned devices. Option C is incorrect because Device Enrollment is for single-user corporate devices. Option D is incorrect because it is not a standard enrollment type.

Answer

Automated Device Enrollment with user affinity.

Answer

User Enrollment

Answer

Device Enrollment (DEP) without user affinity.

Question 12

You are planning device management for a corporate environment with Windows 10, iOS, and Android devices. You need to implement a solution that allows users to access corporate email and documents securely on their personal devices without IT managing the entire device. Which THREE components should you include?

Accepted Answer

Azure AD application proxy for on-premises apps. Options A, B, and C are correct. MAM policies protect app data at the application level without full device management. Conditional access controls access based on compliance. Azure AD app proxy provides secure remote access to on-premises apps. Option D is not needed because device enrollment is not required. Option E is for device-level management, not app-level.

Answer

Device enrollment into Intune

Answer

Device compliance policies

Question 13

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

Accepted Answer

Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center. Option A is correct because you can upload the hardware hashes directly to the Autopilot devices page in Intune. Option B is wrong because the OEM can register devices for you, but you already have the hashes. Option C is wrong because Microsoft Store for Business is deprecated. Option D is wrong because Windows Configuration Designer is for provisioning packages, not Autopilot registration.

Answer

Use the Microsoft Store for Business to automatically register devices

Answer

Contact the OEM to register the devices using the device serial numbers

Answer

Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings

Question 14

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

Accepted Answer

The device has a non-compliant component that prevents policy application.. Option D is correct because a non-compliant component can cause the device to show 'Not evaluated' if the policy is not applied. Option A is incorrect because a valid token is required for enrollment; if it were expired, the device would not be enrolled. Option B is incorrect because the Intune management extension handles Win32 apps, not compliance policies. Option C is incorrect because a certificate profile is not required for compliance evaluation.

Answer

The device does not have a valid certificate profile.

Answer

The Intune Management Extension is not installed.

Answer

The device's enrollment token has expired.

Question 15

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

Accepted Answer

Ensure the password includes characters from at least 3 character sets.. Option C is correct because passwordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers. Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Answer

Increase passwordMinimumLength to 10.

Answer

Set passwordExpirationDays to 0 to never expire.

Answer

Set passwordRequiredType to 'alphanumeric' (it is already set).

MD-102 Practice Test 49 — 15 Questions

Exhibit

MD-102 Practice Test 49 — 15 Questions

Exhibit