MD-102 Practice Exam 52 — 20 Questions

Question 1

Refer to the exhibit. You see the following Intune device properties for a Windows device. The device is noncompliant and the grace period expires on 2025-02-20. Today is 2025-02-15. The compliance policy requires a minimum OS version of 10.0.19041 but the device is on 10.0.18363. What will happen if the device does not become compliant before the grace period expires?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device will be retired after the grace period expires. When a noncompliant device's grace period expires, Intune enforces the compliance policy by retiring the device. Retirement removes the device from Intune management and revokes access to corporate resources, but it does not immediately block access or force an OS update. The grace period allows a window for remediation; after expiration, the device is marked for retirement.

Answer

The device will automatically update to the required OS version

Answer

The device will be blocked from accessing corporate resources

Answer

The device will be retired immediately

Question 2

During a Windows 10 in-place upgrade using Configuration Manager, the task sequence fails with error code 0x800706BE. The smsts.log shows 'Failed to run the action: Upgrade Operating System'. What is the most likely cause?

Accepted Answer

Antivirus software blocking the upgrade process. Error code 0x800706BE is a generic 'The remote procedure call failed' error, which in the context of a Configuration Manager task sequence during an in-place upgrade is most commonly caused by antivirus software interfering with the setup process. Antivirus real-time scanning can lock files or block critical RPC calls that the Windows Setup engine requires, leading to the 'Failed to run the action: Upgrade Operating System' failure in smsts.log.

Answer

Incompatible third-party drivers

Answer

Corrupted setup files in the OS upgrade package

Answer

Insufficient disk space on the system drive

Question 3

Your company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a configuration that requires users to use Windows Hello for Business (WHfB) and prohibits the use of FIDO2 security keys. Which CSP and value should you configure?

Accepted Answer

Set 'UseFIDO2' to 0 in the PassportForWork CSP.. The 'UseFIDO2' setting in the PassportForWork CSP controls whether FIDO2 security keys can be used as a credential. Setting it to 0 explicitly disables FIDO2 keys, which meets the requirement to prohibit their use. The question also requires users to use Windows Hello for Business (WHfB), but that is a separate prerequisite—the 'UseFIDO2' value directly addresses the prohibition of FIDO2 keys.

Answer

Set 'EnableWindowsHelloForBusiness' to true in the PassportForWork CSP.

Answer

Set 'RequireSecurityDevice' to true in the PassportForWork CSP.

Answer

Set 'UseFIDO2' to 1 in the PassportForWork CSP.

Question 4

Which TWO methods can you use to enroll a Windows 10 device in Microsoft Intune?

Accepted Answer

Sign in to Settings > Accounts > Access work or school and connect.. Enrolling a Windows 10 device via Settings > Accounts > Access work or school and clicking 'Connect' initiates a device enrollment that registers the device with Azure AD and automatically enrolls it in Intune (if auto-enrollment is configured via GPO or MDM discovery). This method uses the MDM enrollment protocol over the Enrollment REST service, requiring only a work or school account.

Answer

Navigate to the Intune enrollment URL in a browser.

Answer

Use the Company Portal website to enroll.

Answer

Enroll from the Microsoft 365 admin center.

Question 5

Which TWO app types can be deployed to iOS/iPadOS devices using Microsoft Intune?

Accepted Answer

iOS LOB app. iOS LOB (Line-of-Business) apps are custom-built applications that can be deployed to iOS/iPadOS devices via Microsoft Intune. Intune supports deploying LOB apps by uploading the .ipa package file directly, allowing organizations to distribute internal apps without going through the public App Store. This makes option B correct.

Answer

Web link

Answer

Win32 app

Answer

Android store app

Question 6

Your company uses Microsoft Intune to manage Windows 10 devices. You need to ensure that all devices have Windows Defender Antivirus real-time protection enabled. What should you configure?

Accepted Answer

Create a device configuration policy for Windows Defender Antivirus and enable Real-time protection.. A device configuration policy is the most direct method to enforce Windows Defender Antivirus real-time protection, using the Defender CSP to set 'AllowRealtimeMonitoring'. While the Endpoint security node provides a dedicated Antivirus policy, device configuration policies are the straightforward administrative path for granular settings like real-time protection. A compliance policy only checks for antivirus but does not enforce the setting. Administrative Templates can also configure this via GPO-style settings, but they are less direct for this specific requirement in Intune. Therefore, Option B is the best single answer.

Answer

Create a device compliance policy requiring antivirus.

Answer

Use Administrative Templates to configure Windows Defender Antivirus.

Answer

Use the Endpoint security node to configure Antivirus policies.

Question 7

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Mail app that is required for corporate email. What configuration should you apply?

Accepted Answer

Configure a Managed App Configuration with the key 'preventManagedAppRemoval' set to true.. A Managed App Configuration with the 'preventManagedAppRemoval' key set to true prevents users from removing the Mail app from their device. Option A is incorrect because deploying the Mail app as a required volume-purchased app via Apple Business Manager only ensures the app is installed but does not prevent users from deleting it. Option C is incorrect because hiding the Mail app from the home screen does not prevent uninstall; it only removes the icon. Option D is incorrect because an app protection policy that blocks removal of corporate data applies to data within the app, not to the app itself.

Answer

Deploy the Mail app as a required volume-purchased app using Apple Business Manager.

Answer

Set a device restriction policy to hide the Mail app from the home screen.

Answer

Assign an app protection policy that blocks the removal of corporate data.

Question 8

Which THREE conditions must be met for a Windows device to be able to enroll in Microsoft Intune using Microsoft Entra ID join? (Choose three.)

Accepted Answer

The device must be running Windows 10 or later. Microsoft Entra ID join requires a minimum of Windows 10 (any edition) to support the modern authentication and device registration protocols. Devices running earlier versions like Windows 8.1 or Windows 7 lack the necessary components (e.g., the Device Registration Service client) to complete the join process. This requirement ensures the device can communicate using OAuth 2.0 and the Microsoft Entra ID device registration endpoint.

Answer

The device must have a TPM 2.0 chip

Answer

The device must be joined to an on-premises Active Directory domain

Question 9

You need to onboard devices to Microsoft Defender for Endpoint using Microsoft Intune. Which THREE methods are supported?

Accepted Answer

Group Policy with administrative templates. Group Policy with administrative templates is supported for onboarding devices to Microsoft Defender for Endpoint because the Defender for Endpoint onboarding policy can be delivered via Group Policy objects (GPOs) using the 'Onboard' administrative template (WindowsDefenderATP.admx). This method allows domain-joined Windows devices to receive the onboarding configuration through standard Active Directory Group Policy processing, making it a valid deployment method for on-premises managed devices.

Answer

Microsoft 365 Apps admin center

Answer

Windows Server Update Services

Question 10

A user reports that their Windows device is not appearing in the Intune console after enrollment. The device is joined to Microsoft Entra ID and the user has an Intune license. What should you check first?

Accepted Answer

Ensure that the MDM user scope in Microsoft Entra ID is set to 'All' or 'Some'.. The most common reason a device fails to appear in the Intune console after enrollment is that the MDM user scope in Microsoft Entra ID is not configured to include the user. The MDM user scope determines which users can automatically enroll their devices into Intune; if it is set to 'None', enrollment is blocked entirely. Since the device is already joined to Microsoft Entra ID and the user has an Intune license, the first step is to verify this scope setting.

Answer

Assign an Intune license to the device.

Answer

Verify that enrollment restrictions are not blocking the device.

Answer

Check if the device is compliant.

Question 11

Which TWO actions can you perform in Microsoft Intune to remediate a noncompliant Windows device that has been marked as noncompliant due to missing antivirus? (Choose two.)

Accepted Answer

Deploy a proactive remediation script to detect and install antivirus.. Proactive remediations in Microsoft Intune allow you to deploy a detection and remediation script pair that can automatically detect the absence of antivirus and install it, ensuring compliance without user intervention. This leverages Intune's built-in remediation capabilities for Windows devices, which run on a schedule and can fix common compliance issues like missing security software.

Answer

Send a sync command to the device to re-evaluate compliance.

Answer

Send a notification to the user to install antivirus via Windows Security.

Answer

Create a Conditional Access policy to block the device until fixed.

Question 12

A user reports that their iOS device is unable to access corporate email after updating to a new iOS version. Other iOS devices are working fine. The device is enrolled in Intune and shows as compliant. What should you check?

Accepted Answer

Check the conditional access policy in Microsoft Entra ID to ensure the device platform is still supported.. When a device is compliant but still fails to access corporate email after an iOS update, the most likely cause is that the conditional access policy in Microsoft Entra ID (formerly Azure AD) has been updated to block the new iOS version. Conditional access policies can specify allowed device platforms and OS versions; if the new iOS version is not explicitly permitted, access will be denied even though the device is compliant. This is a common scenario after major OS updates, as administrators must update the policy to include the new version.

Answer

Ensure the email profile is configured correctly.

Answer

Confirm that the device is still enrolled in Intune.

Answer

Verify that the device compliance policy includes the new iOS version.

Question 13

A company uses Microsoft Intune to manage devices. They want to use a script to collect inventory data from Windows devices. Which TWO methods can be used?

Accepted Answer

Proactive remediations. Proactive remediations (B) are correct because they allow you to run PowerShell scripts on a schedule to detect and remediate issues, and the detection script can output custom inventory data that is collected and reported in Intune. Custom compliance policies (C) are correct because they can execute a PowerShell script to evaluate compliance settings, and the script's output (e.g., registry values, file versions) can be used to gather inventory data as part of the compliance check.

Answer

Device configuration profile

Answer

PowerShell script deployment

Answer

App protection policy

Question 14

Which THREE of the following are valid methods to deploy Microsoft 365 Apps for enterprise using Microsoft Intune?

Accepted Answer

Use the built-in Microsoft 365 Apps app type in Intune.. Intune includes a built-in app type specifically for Microsoft 365 Apps for enterprise. This native integration allows you to configure installation settings (e.g., update channel, excluded apps, and language) directly in the Intune console without needing to create a custom package or script.

Answer

Assign the apps via Azure AD application registration.

Answer

Deploy the MSI version of Office via Intune.

Question 15

Which TWO actions are supported by Microsoft Intune for managing macOS devices?

Accepted Answer

Apply device compliance policies.. Microsoft Intune supports device compliance policies for macOS devices, allowing administrators to define rules (e.g., OS version, encryption status, firewall settings) that devices must meet to be considered compliant. These policies are evaluated by the Intune Company Portal app on macOS and can trigger conditional access controls to block non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business.

Answer

Enable BitLocker encryption.

Answer

Deploy .app applications.

Question 16

An administrator uses Configuration Manager to manage Windows 10 devices. The administrator wants to deploy a custom Windows application as an Application model deployment type. The application requires a reboot. Which deployment purpose should the administrator use to allow users to control the installation timing?

Accepted Answer

Available. The Available deployment purpose allows users to see the application in Software Center and choose when to install it, including scheduling the required reboot at their convenience. This gives users control over installation timing, which is the stated requirement. Required and Mandatory deployments force installation according to a schedule, removing user choice.

Answer

Mandatory

Answer

Pre-deploy

Answer

Required

Question 17

Your organization uses Microsoft Intune to manage macOS devices. You need to configure FileVault disk encryption for all devices. After deploying the policy, some devices report that encryption is pending. What is the most likely reason?

Accepted Answer

The user has not approved the recovery key escrow.. For FileVault encryption via Intune, the user must approve the escrow of the personal recovery key. If the user has not approved it, encryption may remain pending. Option B is incorrect: user enrollment does support FileVault policy, as long as the device is managed. Option C is incorrect: FileVault does not require a PIN; it uses a password set during encryption. Option D is incorrect: FileVault encryption is available on both supervised and unsupervised macOS devices when managed by Intune.

Answer

The devices are enrolled using user enrollment.

Answer

The devices require a PIN to be set for recovery.

Answer

The devices are not supervised.

Question 18

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app to iOS devices. The app is signed with an enterprise certificate. Some devices report installation failure with error code 0x87D13B9F. What is the most likely cause?

Accepted Answer

The enterprise signing certificate is not trusted on the device.. Error code 0x87D13B9F in Microsoft Intune typically indicates a signing certificate trust issue. Since the app is signed with an enterprise certificate, the device must have that certificate installed and trusted in its trusted root store. If the certificate is not trusted, iOS will reject the installation, producing this specific error.

Answer

The app package is not signed.

Answer

The app is not available in the Apple App Store.

Answer

The device does not have enough storage space.

Question 19

Refer to the exhibit. You execute this PowerShell script to wipe noncompliant Windows devices. After running, you find that some compliant devices were also wiped. What is the most likely reason?

Accepted Answer

The script uses the wrong Graph API endpoint, causing all devices to be wiped.. The script uses the wrong Graph API endpoint. The correct endpoint for wiping a device is `/deviceManagement/managedDevices/{deviceId}/wipe`, but the script likely uses an incorrect or generic endpoint (e.g., `/devices/{deviceId}/wipe` or a non-existent path), which causes the API to misinterpret the request or apply the wipe action to all devices in the tenant, including compliant ones. This is a common misconfiguration when targeting the Microsoft Graph API for Intune device actions.

Answer

The filter 'operatingSystem eq 'Windows'' does not match any devices, so the script wiped all devices.

Answer

The script wipes only noncompliant devices, but some compliant devices had a null compliance state.

Answer

The script does not check the device's compliance state before wiping.

Question 20

A company manages Windows 10 and Windows 11 devices using Microsoft Intune. They need to ensure that devices that have not checked in with Intune for more than 30 days are automatically marked as inactive and excluded from compliance policies. Which configuration should be used?

Accepted Answer

Configure the Intune device cleanup rule to delete devices inactive for 30 days. The Intune device cleanup rule is specifically designed to automatically remove or mark devices as inactive when they have not checked in for a configurable number of days (default 30). Once a device is deleted by this rule, it is excluded from compliance policies and no longer evaluated. This directly meets the requirement to mark devices inactive after 30 days of no check-in and exclude them from compliance.

Answer

Configure a compliance policy with a grace period of 30 days

Answer

Create a conditional access policy blocking devices inactive for 30 days

Answer

Set the device compliance status to 'not compliant' after 30 days of inactivity