MD-102 Practice Exam 51 — 20 Questions

Question 1

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

Accepted Answer

Obtain the hardware hash from the device manufacturer or reseller.. Option A is correct because the OEM or reseller can upload the hardware hash directly to Intune via the OEM API or Partner Center. Option B is wrong because running a PowerShell script on the device requires it to be powered on, which delays the process. Option C is wrong because Configuration Manager can upload hashes but requires the device to be on the network. Option D is wrong because Microsoft Entra ID does not store hardware hashes.

Answer

Add the device to Microsoft Entra ID before shipping.

Answer

Use Microsoft Configuration Manager to collect the hardware hash.

Answer

Run a PowerShell script on each device to capture the hardware hash.

Question 2

Your organization uses Microsoft Intune to manage corporate-owned iOS devices. You need to ensure that devices are supervised and can be configured with restrictions that cannot be removed by the user. Which THREE steps must you take?

Accepted Answer

Add devices to Apple Business Manager (ABM).. Options A, B, and C are correct. Supervising devices requires Apple Business Manager, automated enrollment, and a supervision profile. Option D is not required because supervised devices do not need user affinity for supervision. Option E is for device compliance, not supervision.

Answer

Assign a user to each device during enrollment.

Answer

Create a device compliance policy that requires supervision.

Question 3

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Accepted Answer

Microsoft Defender for Endpoint license assigned to the user or device. Options A and C are correct. A: Microsoft Defender for Endpoint requires a license for each device. C: The macOS device must be enrolled in Intune to receive the configuration profile. Option B is wrong because Microsoft Defender for Endpoint does not require a VPN. Option D is wrong because Microsoft Intune management extension is for Windows only. Option E is wrong because onboarding to Microsoft Defender for Cloud is optional.

Answer

Microsoft Intune management extension installed on the device

Answer

Onboarding to Microsoft Defender for Cloud

Answer

A VPN connection to the corporate network

Question 4

You are troubleshooting a Windows 10 device that fails to install a required application from Microsoft Intune. The device shows the application as 'Enforced' but never installs. The application is a line-of-business (LOB) app. What should you check first?

Accepted Answer

Check if the application package has a valid code signing certificate.. Option A is correct because LOB apps require a valid code signing certificate. Option B is incorrect because the Intune Management Extension handles Win32 apps, not LOB apps. Option C is incorrect because LOB apps do not require a specific distribution method. Option D is incorrect because the app may not be in the catalog but can still be uploaded.

Answer

Ensure the app is assigned to a device group using 'Required' intent.

Answer

Verify that the Intune Management Extension is installed on the device.

Answer

Check if the app is available in the Microsoft Store for Business.

Question 5

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

Accepted Answer

The device has not been successfully registered in Windows Autopilot.. Option A is correct because 'NotRegistered' indicates the device is not properly registered in Autopilot. Option B is incorrect because if the profile were not assigned, it would show 'NotAssigned' but still registered. Option C is incorrect because the diagnostics show registration status. Option D is incorrect because the device can still be registered even if it has been imaged.

Answer

The Autopilot profile is not assigned to the device group.

Answer

The device was previously manually imaged.

Answer

The device is not connected to the internet during OOBE.

Question 6

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Accepted Answer

TPM 2.0 chip. Options B and C are correct. Self-deploying mode requires a physical TPM 2.0 chip for attestation and network connectivity to Microsoft Intune. Option A is wrong because a user account is not required. Option D is wrong because a product key is not needed. Option E is wrong because a mobile device management (MDM) user affinity is not required.

Answer

A user account with Intune license

Answer

A Windows product key

Answer

MDM user affinity

Question 7

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

Accepted Answer

Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.. Option A is correct because platform restrictions allow you to set minimum OS versions for enrollment. Option B is wrong because compliance policies are applied after enrollment. Option C is wrong because device configuration profiles manage settings, not enrollment. Option D is wrong because the enrollment profile specifies enrollment method, not OS version restrictions.

Answer

Create a device configuration profile that requires iOS 16.0.

Answer

Modify the enrollment profile to require iOS 16.0.

Answer

Create a compliance policy that requires iOS 16.0 or later.

Question 8

You have devices enrolled in Microsoft Intune. You need to configure a policy that requires a PIN of at least 6 characters for accessing Microsoft Entra ID resources. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Option C is correct because Conditional Access policies can require a PIN for access to resources. Option A is wrong because compliance policies do not enforce PIN requirements. Option B is wrong because device configuration policies are for device settings, not access policies. Option D is wrong because app protection policies are for mobile app management.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration policy

Question 9

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to ensure that devices are enrolled automatically without user interaction and that the enrollment status page (ESP) is configured to block device use until required apps are installed. What should you configure?

Accepted Answer

Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile. Option C is correct because Windows Autopilot with self-deploying mode allows zero-touch enrollment, and the Enrollment Status Page (ESP) can be configured to block device use until required apps are installed. Option A is wrong because co-management requires Configuration Manager and does not provide zero-touch enrollment. Option B is wrong because DEM is for Android and iOS, not Windows. Option D is wrong because GPO does not provide automatic enrollment into Intune.

Answer

Configure a Group Policy to auto-enroll devices into Intune

Answer

Configure a device enrollment manager (DEM) account

Answer

Configure co-management with Microsoft Configuration Manager

Question 10

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a set of Line-of-Business (LOB) apps using the Microsoft Intune Management Extension. Which THREE conditions must be met?

Accepted Answer

The Microsoft Intune Management Extension must be installed on the device. Options B, C, and D are correct. B: The Intune Management Extension is required to deploy PowerShell scripts and Win32 apps. C: The device must be Azure AD joined or hybrid Azure AD joined. D: The device must have connectivity to Intune. Option A is wrong because LOB apps can be deployed to Intune-managed devices without Configuration Manager. Option E is wrong because the management extension runs as SYSTEM, not user context.

Answer

The app must be deployed in user context

Answer

The devices must be co-managed with Microsoft Configuration Manager

Question 11

Your organization uses Microsoft Intune to manage macOS devices. You need to configure FileVault disk encryption for all devices. After deploying the policy, some devices report that encryption is pending. What is the most likely reason?

Accepted Answer

The user has not approved the recovery key escrow.. Option B is correct because FileVault encryption requires the user to approve the recovery key escrow. Option A is incorrect because macOS devices can be encrypted via Intune. Option C is incorrect because user enrollment does not affect FileVault policy applicability. Option D is incorrect because a PIN is not required for FileVault; it uses a password.

Answer

The devices are enrolled using user enrollment.

Answer

The devices require a PIN to be set for recovery.

Answer

The devices are not supervised.

Question 12

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

Accepted Answer

The devices must be registered in Microsoft Intune via the hardware vendor or manually.. Option A is correct because Autopilot requires the device to be registered in Microsoft Intune (or Entra ID) before it can be automatically enrolled. Option B is wrong because a local admin account is not required. Option C is wrong because a hybrid join configuration is optional. Option D is wrong because BitLocker is not a prerequisite for enrollment.

Answer

The organization must have a hybrid Azure AD join configuration in place.

Answer

BitLocker must be enabled on the devices before they are shipped.

Answer

A local administrator account must be created on each device prior to deployment.

Question 13

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Accepted Answer

Microsoft Intune tenant. Options A, B, and D are correct. Co-management requires Azure AD (Entra ID) for identity, Intune tenant for enrollment, and Configuration Manager current branch for management. Option C is not required; a service connection point is needed for cloud attach, but not specifically for co-management. Option E is not required; a PKI is optional.

Answer

Service connection point (Cloud Attach)

Answer

Public key infrastructure (PKI) certificates

Question 14

You have an Intune-managed device that is not receiving compliance policies. You check the Intune console and see the device status is 'Pending'. The device is connected to the internet and can sync. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune for more than 7 days. Option A is correct because a pending status often indicates that the device has not checked in recently. Option B is wrong because a certificate issue would show an error. Option C is wrong because incorrect time zone would not cause pending. Option D is wrong because the device is connected and can sync, so network connectivity is not the issue.

Answer

The device's time zone is incorrect

Answer

The device's certificate has expired

Answer

The device is not connected to the internet

Question 15

You need to ensure that devices enrolled in Microsoft Intune automatically receive Windows quality updates as soon as they are released. Which update ring setting should you configure?

Accepted Answer

Set 'Microsoft product updates' to 'Allow'. Option A is correct. The 'Microsoft product updates' setting, when set to 'Allow', ensures that Windows quality updates are installed. Option B is for feature updates. Option C is for driver updates. Option D is for update deferral periods.

Answer

Set 'Driver update deferral period (days)' to 0

Answer

Set 'Quality update deferral period (days)' to 0

Answer

Set 'Feature update deferral period (days)' to 0

Question 16

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

Accepted Answer

The device has not checked in for more than 7 days, causing Intune to mark it as inactive.. Option C is correct because if the device has not checked in for more than 7 days, it may be considered inactive and policies won't be delivered. Option A is wrong because a VPN can still allow check-in if internet is available. Option B is wrong because the enrollment was successful. Option D is wrong because the Intune connector is for on-premises scenarios.

Answer

The device is connected through a VPN that blocks Intune traffic.

Answer

The device has been unenrolled from Intune.

Answer

The Intune Connector for Active Directory is not configured.

Question 17

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Accepted Answer

Retain the Autopilot registration. Options B and D are correct. Autopilot reset can remove personal files and apps, and retain the device's Autopilot registration. Option A is wrong because Autopilot reset does not reinstall Windows from scratch; it uses the existing OS. Option C is wrong because it does not remove the device from Intune. Option E is wrong because it does not change the primary user.

Answer

Change the primary user of the device

Answer

Reinstall Windows 11 from scratch

Answer

Remove the device from Microsoft Intune

Question 18

You need to ensure that Windows 10 devices automatically receive Microsoft Defender antivirus definition updates from Microsoft. Which update channel should you configure in the endpoint protection profile?

Accepted Answer

Microsoft Update. Option D is correct because the 'Microsoft Update' channel delivers definition updates from Microsoft. Option A is wrong because Windows Update is for OS updates. Option B is wrong because WSUS is for on-premises managed updates. Option C is wrong because Microsoft Update for Business is a service, not a channel in the profile.

Answer

Microsoft Update for Business

Answer

Windows Update

Answer

WSUS

Question 19

Which TWO settings can be configured in a Windows 10 device restriction profile in Intune to enhance security?

Accepted Answer

Disable the camera. Options A and D are correct. Disabling the camera and requiring a password are security measures. Option B is about updates, not device restrictions. Option C is about encryption. Option E is about copy/paste.

Answer

Require BitLocker encryption

Answer

Disable copy and paste between apps

Answer

Configure Windows Update for Business settings

Question 20

A user's Android device is enrolled in Microsoft Intune. The device reports as 'Compliant' but the user cannot access corporate resources that require compliant devices. The conditional access policy is configured to require a compliant device. What is the most likely cause?

Accepted Answer

The conditional access policy requires an approved client app.. Even if the device is compliant, the conditional access policy may also require a specific client app or location. Option C is correct because the conditional access policy might have additional requirements like 'Require approved client app'. Option A is incorrect because the device is compliant. Option B is incorrect because stale compliance is not the issue if it shows compliant. Option D is incorrect because the Company Portal app is not required for access.

Answer

The compliance policy has not been refreshed on the device.

Answer

The user does not have the Company Portal app installed.

Answer

The device is not compliant with the compliance policy.