MD-102 Practice Exam 51 — 20 Questions

Question 1

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a device compliance policy that uses Defender for Endpoint risk level, then use Conditional Access.. It combines a device compliance policy that evaluates the Defender for Endpoint risk level with a Conditional Access policy that blocks access when the device is noncompliant. This is the only supported method to automatically block corporate resource access based on real-time risk assessment from Defender for Endpoint.

Answer

Configure a device compliance policy with 'Require Defender for Endpoint' setting.

Answer

Configure a device configuration policy to block access based on risk.

Answer

Configure an app protection policy to block access based on device risk.

Question 2

A multinational organization uses Microsoft Entra ID joined devices with Intune. The security team wants to block enrollment of devices from non-corporate networks unless they have a compliant certificate. Which enrollment restriction should you configure?

Accepted Answer

Enrollment device restrictions with certificate requirement. Enrollment device restrictions in Intune allow you to block enrollment from non-corporate networks unless a compliant certificate is present. This is configured under 'Enrollment device restrictions' where you can set a 'Block' action for devices not on trusted networks and require a certificate for compliance, ensuring only authenticated devices can enroll from untrusted locations.

Answer

Device platform restrictions

Answer

Conditional Access policy requiring hybrid Azure AD join

Answer

Compliance policy for device health

Question 3

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

Accepted Answer

The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.. If the 'Show recovery key' setting is not configured (set to 'Not configured'), the user is not prompted to escrow the recovery key during encryption. FileVault encryption is enabled on the device (option A is incorrect). The recovery key type is personal, not institutional (option B is incorrect). Personal recovery key rotation does not cause a conflict (option D is incorrect).

Answer

FileVault encryption is not enabled on the device.

Answer

The recovery key type should be 'Institutional recovery key'.

Answer

Personal recovery key rotation is enabled, causing a conflict.

Question 4

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft 365 Apps for enterprise suite to all devices. Which app type should you use in Intune?

Accepted Answer

Microsoft 365 Apps for Windows 10 and later. To deploy Microsoft 365 Apps for enterprise, use the 'Microsoft 365 Apps for Windows 10 and later' app type in Intune. This pre-configured app type handles the installation and updates of the Office suite. Option C is correct. Option A (Web link) is wrong because it only creates a shortcut, not installs the app. Option B (Windows app (Win32)) is wrong because it is used for standalone .exe or .msi installers, not for the Office suite which has its own dedicated type. Option D (Line-of-business app) is wrong because it is intended for custom or in-house developed apps, not for Microsoft 365 Apps.

Answer

Web link

Answer

Windows app (Win32)

Answer

Line-of-business app

Question 5

An organization uses Configuration Manager to manage Windows 10 devices. The administrator is configuring a phased deployment for a software update. Which THREE conditions can be used to define the phases?

Accepted Answer

Collection membership. Collection membership (A) is correct because Configuration Manager phased deployments allow you to specify a target collection for each phase, such as a collection containing pilot devices for the first phase and a broader collection for subsequent phases. This enables granular control over which devices receive the update at each stage, based on existing collection membership rules.

Answer

Time-based delay between phases

Answer

Device compliance status

Question 6

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. The user has confirmed that the device is enrolled and connected to the internet. Which is the most likely cause?

Accepted Answer

The Intune Management Extension is not installed or not running.. The Intune Management Extension (IME) is the component responsible for processing and applying compliance policies on Windows devices. If the IME is not installed or not running, the device cannot evaluate compliance policies, resulting in a 'Not evaluated' status in the Intune admin center, even though the device is enrolled and connected to the internet.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device has a Device Lock policy applied that blocks evaluation.

Answer

The user does not have a Microsoft 365 E3 license assigned.

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate applications. Which TWO configurations should you implement?

Accepted Answer

Create a device compliance policy. A device compliance policy defines the security requirements (e.g., encryption, OS version, jailbreak detection) that a device must meet to be considered compliant. Option E is correct because a Conditional Access policy can enforce that only compliant devices are granted access to corporate applications, using the 'Require device to be marked as compliant' grant control. Together, these two configurations ensure that non-compliant devices are blocked from accessing corporate apps.

Answer

Deploy an App Protection Policy

Answer

Configure a device configuration profile

Answer

Enable multifactor authentication (MFA) for all users

Question 8

A user's Android device is enrolled in Microsoft Intune. The device reports as 'Compliant' but the user cannot access corporate resources that require compliant devices. The conditional access policy is configured to require a compliant device. What is the most likely cause?

Accepted Answer

The conditional access policy requires an approved client app.. Even if the device reports as compliant, the conditional access policy may have additional requirements, such as requiring an approved client app (option C). Option C is correct because the policy might require both a compliant device and an approved client app. Option A is incorrect because the compliance policy not being refreshed would typically cause the device to show as non-compliant, not compliant. Option B is incorrect because the Company Portal app is not required for access; it's used for enrollment and management. Option D is incorrect because the device is reported as compliant, so non-compliance is not the issue.

Answer

The compliance policy has not been refreshed on the device.

Answer

The user does not have the Company Portal app installed.

Answer

The device is not compliant with the compliance policy.

Question 9

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) to a group of users. Which TWO requirements must be met?

Accepted Answer

The device must be Azure AD joined or hybrid Azure AD joined. Microsoft Store apps (new) require the device to be Azure AD joined or hybrid Azure AD joined to support license enforcement and user-based app assignment via Intune. This ensures the device can authenticate with the Microsoft Store for Business and Education to download and install the app under the user's identity.

Answer

The device must be joined to an on-premises Active Directory domain

Answer

The device must have the Microsoft Intune Management Extension installed

Answer

The device must have sideloading enabled

Question 10

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a compliance policy with device health rules.. To ensure devices meet TPM 2.0 and Secure Boot requirements, create an Intune compliance policy with device health rules. This policy evaluates device health and marks devices compliant only when they meet the configured hardware requirements. Windows Hello for Business (Option B) is a passwordless sign-in method and does not restrict corporate email access based on Secure Boot or TPM. Option C is incorrect because a conditional access policy only enforces an existing compliance state and does not define the TPM/Secure Boot health rules. Option D is incorrect because a device configuration policy applies settings but does not enforce compliance for accessing corporate email.

Answer

Configure Windows Hello for Business with TPM requirement.

Answer

Create a conditional access policy that requires compliant device.

Answer

Create a device configuration policy to enable Secure Boot.

Question 11

You are troubleshooting a Windows 10 device that is not receiving Intune policies. The device is enrolled and shows as 'Active' in the Intune admin center. You run the Get-MgDeviceManagementManagedDevice cmdlet and the device's managementAgent is 'mdm'. Which of the following is the most likely cause of the issue?

Accepted Answer

The device's last sync time is more than 24 hours ago.. The device's last sync time being more than 24 hours ago indicates that the device has not checked in with Intune within the required interval. Intune policies are delivered during a sync cycle, and if the device hasn't synced recently, it will not receive new or updated policies. The managementAgent being 'mdm' confirms the device is MDM-managed, so the sync interval is critical for policy delivery.

Answer

The device is co-managed and the workload is set to Configuration Manager.

Answer

The device's enrollment certificate has expired.

Answer

The device is retired from Intune.

Question 12

Your organization is implementing a zero-trust security model using Microsoft Intune. Devices must be compliant before accessing corporate resources. You need to deploy compliance policies for Windows 10 devices that require BitLocker encryption and a minimum OS version. Which two policy settings should you configure? (Choose two.)

Accepted Answer

Minimum OS version.. The 'Minimum OS version' setting in a Windows 10 compliance policy ensures that devices must be running at least a specified build number (e.g., 10.0.19041 for Windows 10 20H1). This directly enforces the zero-trust requirement that only devices with a supported, up-to-date OS can access corporate resources, reducing exposure to known vulnerabilities. Option D is correct because the 'Require encryption of data storage on device' setting mandates BitLocker encryption on the system drive, which is a core data protection control in a zero-trust model.

Answer

Require device health attestation.

Answer

Require firewall (Windows Defender Firewall).

Answer

Maximum OS version.

Question 13

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 14

You need to ensure that Windows 10 devices in your organization receive the latest quality updates within 7 days of release. You configure a Windows Update for Business policy in Intune with a deferral period of 7 days. After two weeks, some devices have not installed the updates. What is the most likely reason?

Accepted Answer

Devices have not synced with Intune to receive the updated policy.. Windows Update for Business policies in Intune are not applied in real time; devices must check in with the Intune service to receive the updated policy. The default sync interval for Intune-managed Windows 10 devices is approximately 8 hours, and if a device has not synced since the policy was configured, it will not yet have the new deferral settings. This explains why some devices have not installed the updates even after two weeks, as they may have missed the sync window or have a longer check-in cycle.

Answer

The devices are configured to receive updates from WSUS instead of Windows Update.

Answer

The deferral period is too short; Microsoft recommends 14 days.

Answer

The policy is configured to apply only to devices in a specific Azure AD group.

Question 15

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Test and remediate feature to apply a temporary configuration to a subset of devices.. The correct first action is to use the 'Test and remediate' feature in Intune, which allows you to apply a temporary configuration to a test group of devices to identify and resolve conflicts without affecting the broader device population. This approach isolates the issue, preserves existing settings, and provides a controlled rollback if needed, aligning with best practices for troubleshooting configuration conflicts in Intune-managed Windows devices.

Answer

Create a new device configuration profile that overrides the conflicting settings.

Answer

Reset the devices remotely using Intune.

Answer

Perform a selective wipe on the affected devices.

Question 16

You manage Windows 10 devices with Intune. You need to ensure that only approved apps can run on corporate devices. You configure AppLocker via a custom OMA-URI. However, users can still run unapproved apps. What is the most likely reason?

Accepted Answer

The AppLocker policy is set to 'Audit only' mode.. When AppLocker is configured via custom OMA-URI in Intune, the policy is device-based and can be assigned to device groups. However, if the policy is set to 'Audit only' mode, it only logs events without actually blocking applications. This allows users to still run unapproved apps. Option D is incorrect because assigning the policy to a device group does enforce AppLocker rules; the issue here is mode enforcement, not assignment type.

Answer

The device must be running Windows 10 Pro edition.

Answer

AppLocker rules can only be configured via Group Policy, not OMA-URI.

Answer

The policy is assigned to a device group instead of a user group.

Question 17

You are configuring Microsoft Intune device compliance policies for Windows 10. Which FOUR settings can be evaluated by compliance policies? (Choose four.)

Accepted Answer

Minimum OS version. Compliance policies in Microsoft Intune can evaluate minimum OS version (B), password policy (D), threat level from Microsoft Defender for Endpoint (E), and BitLocker encryption status (C). Windows Firewall status (A) is not evaluated by compliance policies but by device configuration policies. Therefore, all options except A are valid compliance policy settings.

Answer

Windows Firewall status

Question 18

Which TWO of the following are valid reasons to use Windows Autopilot Reset? (Select TWO.)

Accepted Answer

To reassign a device to a new user without re-imaging.. Options A and E are correct. Windows Autopilot Reset returns an already-enrolled device to a clean, ready-to-use state without re-imaging, preserving hardware identity and enrollment. Option A is correct because it allows reassigning a device to a new user quickly. Option E is correct because it resolves performance issues by resetting to a clean state. Options B, C, and D are incorrect: Autopilot Reset does not enroll new devices (B), does not change Azure AD join type (C), and does not deploy custom images (D).

Answer

To enroll a new device that was not purchased through an OEM.

Answer

To change a device from Azure AD joined to Hybrid Azure AD joined.

Answer

To deploy a custom Windows image to a device.

Question 19

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires specific installation parameters. Which app type should you select?

Accepted Answer

macOS app (PKG). The macOS app (PKG) type is correct for deploying a custom .pkg app that requires specific installation parameters. Intune's native PKG app type allows you to define a custom installation command (e.g., installer -pkg MyApp.pkg -target /) with the required flags, providing full control over the installation. In contrast, the DMG app type is designed for .dmg disk images, not standalone .pkg files.

Answer

Line-of-business app

Answer

macOS app (DMG)

Answer

Windows app (Win32)

Question 20

You need to ensure that only devices that have a specific set of approved iOS apps can access company resources. Which Intune feature should you use?

Accepted Answer

Device compliance policy with required apps. Device compliance policy with required apps allows you to specify a list of iOS apps that must be installed for a device to be compliant. By combining this with conditional access, you can block non-compliant devices from accessing corporate resources, ensuring that only devices with the approved apps gain access.

Answer

Selective wipe

Answer

App protection policy

Answer

App configuration policy