MD-102 Practice Exam 52 — 20 Questions

Question 1

Refer to the exhibit. An Autopilot device registration JSON. What does the '%RAND:5%' placeholder do?

Accepted Answer

It generates a random 5-character string.. Option C is correct because %RAND:5% generates a random 5-character string to ensure unique device names. Option A is wrong because it's not based on serial. Option B is wrong because it's not the model. Option D is wrong because it's not user-specific.

Answer

It inserts the device's model name.

Answer

It inserts the device's serial number.

Answer

It inserts the user's principal name.

Question 2

You are troubleshooting a Windows 10 device that is showing as non-compliant in Intune. The exhibit shows the PowerShell output from the Microsoft Graph API. Based on the output, what is the most likely reason for the non-compliance?

Accepted Answer

BitLocker drive encryption is not enabled on the device. Option B is correct because the output shows the non-compliance reason is 'RequireEncryption', indicating BitLocker is not enabled. Option A is wrong because the reason is specifically about encryption. Option C is wrong because the reason is not about antivirus. Option D is wrong because the reason is specific to encryption.

Answer

The device does not have a compliant operating system version

Answer

The device is not running a supported version of Windows 10

Answer

The device has a third-party antivirus installed

Question 3

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

Accepted Answer

App protection policy (MAM). Option B is correct. App protection policies (MAM) protect data in apps without requiring device enrollment. Option A is for MDM. Option C is for compliance. Option D is for device configuration.

Answer

Device compliance policy

Answer

Device configuration profile

Answer

Conditional Access policy

Question 4

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with a Trusted Platform Module (TPM) version 2.0 and Secure Boot enabled can access corporate email. What should you configure?

Accepted Answer

Create a compliance policy with device health rules.. Compliance policies in Intune can check device health attestation, including TPM and Secure Boot. Option A is correct because a compliance policy with device health rules enforces these requirements. Option B is incorrect because conditional access policies apply after compliance. Option C is incorrect because configuration policies do not enforce access. Option D is incorrect because Windows Hello for Business is for authentication, not device health.

Answer

Configure Windows Hello for Business with TPM requirement.

Answer

Create a conditional access policy that requires compliant device.

Answer

Create a device configuration policy to enable Secure Boot.

Question 5

Which TWO of the following are required to configure Windows Hello for Business using Microsoft Intune?

Accepted Answer

A Trusted Platform Module (TPM) chip on the device. A trusted TPM and a key trust model are required. Option A is correct because Windows Hello for Business requires a TPM for hardware-based key protection. Option B is correct because the key trust model is one of the trust models required for deployment. Option C is incorrect because Azure AD Premium P1 is not required. Option D is incorrect because certificate-based authentication is optional. Option E is incorrect because the Company Portal is not required for configuration.

Answer

Company Portal app installed

Answer

Azure AD Premium P1 licenses

Answer

Certificate-based authentication

Question 6

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. After deploying, users report that the app is not available in the work profile. What is the most likely cause?

Accepted Answer

The app has not been approved in the managed Google Play store.. Option A is correct because the app must be approved in the managed Google Play store. Option B is wrong because if it's a managed Google Play app, the work profile is required. Option C is wrong because device type (corporate vs personal) does not block the app if targeted correctly. Option D is wrong because enablement status affects whether the work profile exists, but if it exists, the app should be available if approved.

Answer

The app is only available for corporate-owned devices.

Answer

Android Enterprise enrollment is not enabled in Intune.

Answer

The device does not have a work profile configured.

Question 7

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

Accepted Answer

The device is not enrolled in Intune.. Option B is correct because if the device is not enrolled in Intune, it cannot receive policies. Option A is wrong because even if the user is not licensed, the device may still enroll but policies may not apply. Option C is wrong because a stale policy would still apply. Option D is wrong because network connectivity affects policy retrieval, not enrollment.

Answer

The user does not have an Intune license assigned.

Answer

The compliance policy is stale and needs to be re-assigned.

Answer

The device has no network connectivity.

Question 8

A user reports that their Windows 11 device cannot access corporate resources after a recent update. The device is enrolled in Intune. You check the device compliance status and find it is marked as non-compliant. Which two actions should you take?

Accepted Answer

Request the user to run the 'Sync' action from the Company Portal. Option A and C are correct. Option A resets the compliance state to force re-evaluation. Option C triggers a sync to apply any pending policies. Option B is for BitLocker issues. Option D is for device wipe.

Answer

Perform a 'Retire' action on the device

Answer

Use the 'Reset' action to re-enroll the device

Question 9

Refer to the exhibit. An Intune administrator finds this configuration on a Windows 10 device. What is the purpose of this setting?

Accepted Answer

Define the Intune MDM discovery URL. The correct answer is that it sets the Intune management endpoint for the device. Option A is incorrect because the MDM discovery URL is not for Windows Update. Option B is incorrect because the enrollment server URL is not for compliance policy. Option D is incorrect because the URL is for device management, not Defender ATP.

Answer

Set the compliance policy evaluation URL

Answer

Configure Windows Update service endpoint

Answer

Specify the Microsoft Defender ATP tenant

Question 10

Which TWO actions should you take to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with a work account on Windows 10/11?

Accepted Answer

Set the MDM user scope to 'All' or 'Some' in Azure AD.. Options A and D are correct. Option A: Configuring automatic MDM enrollment via Group Policy enables automatic enrollment. Option D: Adding a user scope in Azure AD join enables automatic enrollment for users. Option B is wrong because enabling Azure AD registration is for BYOD, not automatic enrollment. Option C is wrong because co-management requires existing Configuration Manager. Option E is wrong because the MDM user scope in Intune is configured in Azure AD, not Intune alone.

Answer

In Intune, set the enrollment restriction to allow Windows devices.

Answer

Enable automatic Azure AD registration for Windows devices.

Answer

Enable co-management with Configuration Manager.

Question 11

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. Devices that do not meet the policy are marked as non-compliant. Which diagnostic step would you take to identify why a specific device is non-compliant despite having BitLocker enabled?

Accepted Answer

Review the device's hardware security features: Secure Boot and Code Integrity.. Option B is correct because the policy requires Secure Boot and Code Integrity, which might not be enabled even if BitLocker is on. Option A is wrong because the device compliance status is correct. Option C is wrong because the policy is already assigned. Option D is wrong because the policy settings are as shown.

Answer

Verify the compliance policy is assigned to the device's group.

Answer

Check the device's compliance status in Intune for details.

Answer

Modify the policy to remove the requireSecureBoot and requireCodeIntegrity settings.

Question 12

Refer to the exhibit. You have configured the above enrollment restriction in Microsoft Intune. A user attempts to enroll a personal Windows 11 device. What will be the outcome?

Accepted Answer

The device will be blocked from enrolling.. Option D is correct because the restriction blocks personal device enrollment for Windows. The device will be blocked during enrollment regardless of OS version. Option A is wrong because OS version is not checked since the restriction blocks personal devices. Option B is wrong because the restriction is not a compliance policy. Option C is wrong because the device is not allowed.

Answer

The device will be prompted to confirm enrollment.

Answer

The device will enroll but will be marked as non-compliant.

Answer

The device will enroll successfully because it meets the OS requirements.

Question 13

Your organization uses Microsoft Defender for Endpoint (now part of Defender XDR) and Intune. You need to create a device compliance policy that triggers automatic remediation when a device has a 'Medium' severity alert from Defender. Which setting should you configure?

Accepted Answer

Configure 'Device threat level' to 'Medium' and mark as noncompliant. Option C is correct. The 'Device threat level' compliance setting uses the Defender for Endpoint threat score to mark devices non-compliant. Option A is for integration enablement. Option B is for non-compliance actions. Option D is for conditional access.

Answer

Set 'Noncompliance action' to 'Mark device noncompliant'

Answer

Create a Conditional Access policy to block devices with medium alerts

Answer

Enable 'Require the device to be at or under the Machine Risk Score'

Question 14

An administrator needs to ensure that only devices with a specific manufacturer are allowed to enroll in Intune. Which setting should the administrator configure?

Accepted Answer

Enrollment restrictions. The correct answer is Enrollment restrictions. Option A is incorrect because compliance policies do not block enrollment. Option C is incorrect because conditional access works after enrollment. Option D is incorrect because device categories are for grouping, not blocking enrollment.

Answer

Conditional Access policy

Answer

Device category

Answer

Device compliance policy

Question 15

Your organization uses Microsoft Entra ID joined devices and Microsoft Intune for mobile device management. A user reports that their device is not receiving compliance policies. The device shows as 'Compliant' in Intune but the Conditional Access policy still blocks access. What should you verify first?

Accepted Answer

Confirm the device is enrolled in Intune.. Option C is correct because the most common cause of this issue is that the device is not enrolled in Intune, so compliance policies are not applied. Option A is wrong because the device shows as compliant, so the compliance policy is applied. Option B is wrong because the user is a member of the group. Option D is wrong because Conditional Access policies require compliance data; the issue is that the device lacks the policy.

Answer

Check if the compliance policy is assigned to the device's group.

Answer

Review the Conditional Access policy to ensure it requires compliant device.

Answer

Verify the user is in the correct Azure AD group for Conditional Access.

Question 16

Which THREE conditions can be used in a Conditional Access policy to require a compliant device?

Accepted Answer

Client apps. Options B, C, and E are correct. Option B: Device platform can be selected to target specific OS. Option C: Client apps condition can apply to mobile apps and desktop clients. Option E: Locations condition can be used to require compliance only from specific IP ranges. Option A is wrong because risk is a separate condition but not a 'device condition' per se; it's a signal. Option D is wrong because device state is used for hybrid Azure AD joined, not compliance.

Answer

Device state

Answer

Sign-in risk

Question 17

Your organization uses Microsoft Intune to manage iOS and Android devices. You have a compliance policy that requires a minimum OS version: iOS 16.0 and Android 12.0. You also have a Conditional Access policy that requires compliant devices. Several users report that they cannot access corporate email on their personal Android devices. The devices are Android 11.0. You need to allow these users to access email while ensuring that corporate data is protected. What should you do?

Accepted Answer

Create a Conditional Access policy that grants access but requires app protection policies and session controls.. Option C is correct because you can grant access with a session control to limit access to web only, ensuring data protection while allowing access. Option A is wrong because changing the compliance policy would lower security. Option B is wrong because Conditional Access policies are still effective for managed devices. Option D is wrong because excluding the users would remove all protection.

Answer

Remove the Conditional Access policy for these users.

Answer

Update the compliance policy to accept Android 11.0.

Answer

Ask users to upgrade their devices to Android 12.0.

Question 18

Your company uses Microsoft Intune to manage 1,000 Windows 10 devices. You need to deploy a security baseline that includes BitLocker encryption, Windows Defender Antivirus settings, and firewall rules. You create a security baseline policy in Intune and assign it to a group containing all devices. After 48 hours, you notice that only 800 devices have applied the baseline. The remaining 200 devices show 'Pending' status. These devices are online and have network connectivity. What is the most likely cause and solution?

Accepted Answer

The devices need a reboot to apply the baseline settings; schedule a reboot.. Option D is correct because the security baseline uses Configuration Service Provider (CSP) settings that require a reboot to apply. Scheduling a reboot during maintenance hours will apply the baseline. Option A is wrong because the baseline is assigned. Option B is wrong because the devices are online. Option C is wrong because re-creating the policy won't help if the devices need a reboot.

Answer

The devices are not in the correct group; re-assign the policy.

Answer

Re-create the security baseline and assign again.

Answer

The devices have low battery; plug them in.

Question 19

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is Azure AD joined and enrolled in Intune. The device is compliant, but the user cannot access corporate resources due to a Conditional Access policy requiring a compliant device. The user can access other cloud apps that do not require compliance. You check the Conditional Access policy and find it is configured correctly. What is the most likely issue?

Accepted Answer

The device's certificate is expired or missing; re-register the device in Intune.. Option D is correct because if the device is compliant but Conditional Access still blocks, the device might not have the correct certificate, or the token might be stale. Re-registering the device with Intune refreshes the certificate. Option A is wrong because the policy is correct. Option B is wrong because the device is compliant. Option C is wrong because the user is probably in the correct group.

Answer

The Conditional Access policy is not applied to the user.

Answer

The device is not enrolled in Intune.

Answer

The user is not in the correct group.

Question 20

A company uses Microsoft Intune to manage Windows 10 devices. They deployed a Win32 app as 'required' but some devices show 'pending install'. The app is configured with a detection rule that checks for a registry key. What should you check first?

Accepted Answer

Check if the detection rule is incorrectly marking the app as installed.. Option D is correct because the most common reason for a 'pending install' status when a detection rule is configured is that the rule is incorrectly detecting the app as already installed. Intune evaluates the detection rule before attempting installation; if the rule finds the registry key (even if the app is not fully functional), Intune skips the installation and reports 'pending' or 'installed' without actually deploying the app. This is a frequent misconfiguration where the detection rule is too broad or references a key that exists from a previous installation or unrelated software.

Answer

Increase the app installation timeout.

Answer

Ensure the device has connectivity to Intune.

Answer

Reassign the app to a different security group.

MD-102 Practice Exam 52 — 20 Questions

Exhibit

MD-102 Practice Exam 52 — 20 Questions

Exhibit