MD-102 Practice Exam 53 — 20 Questions

Question 1

Refer to the exhibit. You deploy this endpoint protection configuration to a Windows 10 device. A user reports that they cannot connect to the device via RDP. What is the most likely cause?

Accepted Answer

The firewall rule 'Allow RDP' is configured to block traffic.. The exhibit shows that the 'Allow RDP' firewall rule has its 'Action' set to 'Block', which overrides any other configuration. Windows Defender Firewall processes rules in order of priority, and a block action explicitly denies inbound RDP traffic (TCP port 3389), preventing any RDP connection to the device. This is the most direct cause of the user's inability to connect via RDP.

Answer

The firewall rule is for outbound traffic, not inbound.

Answer

The malware actions are blocking RDP traffic.

Answer

The firewall rule 'Allow RDP' is configured to allow traffic.

Question 2

Your company uses Microsoft Defender for Cloud Apps (Microsoft 365 Defender). You need to create a session policy that monitors and controls access to a specific cloud app. Which three components must you configure? (Select THREE.)

Accepted Answer

Policy template (e.g., block download). Session policies in Microsoft Defender for Cloud Apps require a policy template to define the action to enforce, such as 'block download' or 'monitor only'. The template provides the pre-configured settings for controlling data exfiltration or access behavior during a session, which is essential for the policy to function.

Answer

Conditional Access policy assignment

Answer

Device group assignment

Question 3

Refer to the exhibit. You run the PowerShell command shown to create a compliance policy. However, when you check the compliance status of a Windows 11 device, it shows as compliant even though the device does not have BitLocker enabled. What is the most likely reason?

Accepted Answer

The policy has not been assigned to the device or its user group.. The most likely reason is that the compliance policy was created but never assigned to the device or its user group. In Microsoft Intune, a compliance policy must be assigned to a security group that contains the device or its user; otherwise, the policy is not evaluated against the device, and the device will default to a compliant status. The PowerShell cmdlet shown only creates the policy object; it does not assign it.

Answer

The BitLocker setting is not supported on Windows 11.

Answer

The policy was not saved correctly due to a syntax error.

Answer

The device does not have a TPM chip, which is required for BitLocker, but the compliance policy does not check TPM.

Question 4

An organization is deploying Windows 10 using Configuration Manager task sequences. During a pilot deployment, the task sequence fails with error code 0x80070002. What is the most likely cause?

Accepted Answer

The boot image is missing or corrupted. Error code 0x80070002 translates to 'The system cannot find the file specified.' In the context of a Configuration Manager task sequence, this typically indicates that the boot image (WIM file) referenced by the task sequence is missing from the distribution point or is corrupted. The boot image is required to start Windows PE and initiate the OS deployment; if it cannot be located or loaded, the task sequence fails immediately.

Answer

The device does not meet minimum hardware requirements

Answer

The task sequence includes a duplicate step

Answer

The distribution point is unreachable

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices that have a BitLocker encryption status of 'fully encrypted' are allowed to access corporate resources. They create a device compliance policy that requires BitLocker. However, some devices are still accessing resources even though they are not fully encrypted. What should you check?

Accepted Answer

The compliance policy is not assigned to the user or device groups.. A device compliance policy must be assigned to the appropriate user or device groups to take effect. If the policy is not assigned, Intune will not evaluate the devices against the BitLocker requirement, and non-compliant devices will continue to access corporate resources. The scenario indicates that the policy was created but not enforced, which points directly to a missing assignment.

Answer

The devices are running Windows 10 Home edition, which does not support BitLocker.

Answer

The compliance policy is set to 'Report non-compliant' instead of 'Block non-compliant'.

Answer

The compliance policy has a grace period configured that allows access for non-compliant devices.

Question 6

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only users in the Sales department can enroll their devices. What should you configure?

Accepted Answer

Enrollment restrictions that allow only users in the Sales group.. Enrollment restrictions in Intune can be configured to allow device enrollment only for users in specific groups, such as the Sales group. Option A is incorrect because RBAC roles control administrative permissions, not who can enroll devices. Option B is incorrect because device configuration profiles apply settings after enrollment, they do not control enrollment eligibility. Option C is incorrect because Conditional Access policies control access to resources after enrollment, not the enrollment process itself.

Answer

An Intune role-based access control (RBAC) role for Sales users.

Answer

A device configuration profile assigned to Sales users.

Answer

A Conditional Access policy that requires device compliance.

Question 7

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

Accepted Answer

Update the expirationDateTime property of the token.. The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Answer

Modify the tokenType to a different type.

Answer

Create a new bulk enrollment token with a later expiration date.

Answer

Re-create the token with the same name but later expiration.

Question 8

Refer to the exhibit. The Intune device compliance policy shown is assigned to a group of Windows 10 devices. A user reports that their device is marked as noncompliant. The device has a password set, BitLocker enabled, Secure Boot on, and code integrity (HVCI) enabled. What is the most likely reason?

Accepted Answer

The device uses a biometric sign-in method instead of a password. The device has a password set, but the compliance policy likely requires a 'password' type credential, not a biometric one. In Intune, the 'Require a password to unlock mobile devices' setting specifically checks for a numeric or alphanumeric password, not biometric methods like Windows Hello face or fingerprint. If the user relies solely on biometric sign-in without a fallback password, the device is marked noncompliant.

Answer

Secure Boot is not properly configured in UEFI

Answer

Code integrity (HVCI) is not enabled

Answer

Device encryption is using a software-based method

Question 9

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use Group Policy to configure MDM enrollment. C) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. D) Use a provisioning package (PPKG) to enroll devices. Which option should you choose?

Accepted Answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. Use the 'Switch to Intune' option in the device's 'Access work or school' settings. This feature is specifically designed for migrating devices from a legacy on-premises MDM to Intune without requiring a device reset. It is available on Windows 10 devices that are already joined to Microsoft Entra ID and enrolled in another MDM. Option A is incorrect because Windows Autopilot resets the device, which is not desired. Option B (Group Policy) can force enrollment to Intune but does not handle the migration from an existing MDM; it would likely cause a conflict or require manual steps. Option D (provisioning package) is typically used for initial bulk enrollment and may also require a reset or clean installation. Therefore, Option C is the only non-destructive migration method.

Answer

Use Windows Autopilot to reset the devices and re-enroll

Answer

Use Group Policy to configure MDM enrollment

Answer

Use a provisioning package (PPKG) to enroll devices

Question 10

A company uses Microsoft Intune to manage Android Enterprise personally-owned work profile devices. They need to deploy a managed app that restricts data transfer between work and personal profiles. Which app configuration policy should they use?

Accepted Answer

Managed app configuration policy. For Android Enterprise personally-owned work profile devices, a managed app configuration policy (option B) is used to deploy managed apps with specific settings, such as restricting data transfer between the work and personal profiles. This policy applies configuration keys directly to the app at runtime, enabling controls like copy/paste restrictions or data sharing boundaries without requiring device-level enforcement.

Answer

Compliance policy

Answer

App protection policy

Answer

Device configuration policy

Question 11

Refer to the exhibit. You are reviewing a Win32 app deployment configuration in Microsoft Intune. The detection rule checks for a registry key under HKLM. The app is set to install in user context. A user reports that the app appears as 'Installed' for some users but not others on the same device. What is the most likely cause?

Accepted Answer

The detection rule uses HKLM but the app installs per user, so the key may not exist for all users.. The detection rule is configured to check for a registry key under HKLM (HKEY_LOCAL_MACHINE), but the app is set to install in user context. When a Win32 app is deployed per user, the installation runs in the user's context and writes to HKCU (HKEY_CURRENT_USER) or user-specific locations, not HKLM. Therefore, the HKLM key may exist only for the user who installed the app (or for system-level installations), causing the detection rule to fail for other users on the same device, making the app appear as 'Installed' for some but not others.

Answer

The detection type 'exists' should be 'value' to check the DisplayName.

Answer

The install experience should be 'system' to write to HKLM.

Answer

The 'check32BitOn64System' flag is set to false, causing detection to fail on 64-bit systems.

Question 12

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

Accepted Answer

Create an App Protection Policy (MAM) that restricts the transfer of corporate data to other apps and a Device Configuration Profile that sets the default mail app to Outlook.. An App Protection Policy (MAM) can restrict corporate data access to only managed apps like Outlook, preventing the native Mail app from opening corporate data. Additionally, a Device Configuration Profile can set Outlook as the default mail app on iOS/iPadOS devices, effectively blocking the native Mail app from handling corporate email. Option B is incorrect because a device compliance policy requiring Outlook installation does not prevent the native Mail app from accessing data. Option C is incorrect because device enrollment restrictions are for initial enrollment, not controlling app usage. Option D is incorrect because a conditional access policy can block the native Mail app from Exchange Online but does not set Outlook as the default mail app.

Answer

Create a device compliance policy that requires the device to have Outlook installed.

Answer

Use device enrollment restrictions to block devices that have the native Mail app installed.

Answer

Create a conditional access policy for Exchange Online that blocks the native Mail app and allows only Outlook.

Question 13

Your company plans to deploy Microsoft 365 Apps to 500 devices using Microsoft Intune. You want to ensure that the Office suite is installed with only Word, Excel, and PowerPoint. Which approach should you use?

Accepted Answer

Use Microsoft Intune to deploy Office by configuring a Win32 app with the Office Deployment Tool and a custom XML.. The Office Deployment Tool (ODT) with a custom XML allows you to specify exactly which Office applications (Word, Excel, PowerPoint) are installed, and deploying it as a Win32 app via Microsoft Intune gives you full control over the installation parameters, including exclusion of other apps like Outlook or OneNote. The built-in Office 365 app type in Intune does not support granular selection of individual applications; it only allows you to choose the update channel and language, not a custom subset of apps.

Answer

Use Microsoft Intune to deploy Office by selecting the built-in Office 365 app type and then modify the installation options.

Answer

Use the Microsoft 365 admin center to assign licenses and then have users install from the portal.

Answer

Use Microsoft Configuration Manager to deploy Office with a task sequence.

Question 14

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to investigate a device. The result shows RiskScore = 0. What does this indicate about the device?

Accepted Answer

The device has no detected threats. In Microsoft Defender XDR, the RiskScore property (0–100) reflects the device's vulnerability level based on active threats and exposures. A RiskScore of 0 indicates that no threats or vulnerabilities have been detected on the device, meaning it is currently clean. This aligns with option D being correct because the absence of detected threats results in the lowest possible risk score.

Answer

The risk score cannot be calculated for this device

Answer

The device is not enrolled in Defender for Endpoint

Answer

The device is highly vulnerable

Question 15

Which TWO methods can you use to deploy Microsoft Defender for Endpoint on Windows Server 2019? (Choose two.)

Accepted Answer

Use Group Policy to configure and enable the service. Microsoft Defender for Endpoint on Windows Server 2019 can be enabled and configured using Group Policy. Specifically, you deploy the 'Windows Defender Antivirus' and 'Windows Defender Advanced Threat Protection' administrative templates, then configure the 'Turn on Windows Defender Antivirus' policy and the 'Configure Windows Defender Advanced Threat Protection' policy to point to your onboarding blob. This method is supported for servers that are domain-joined and managed via Active Directory Group Policy.

Answer

Install from Microsoft Store

Answer

Enable via Windows Update

Answer

Install manually from Microsoft 365 admin center

Question 16

Refer to the exhibit. You have assigned the above compliance policy to a Windows 10 device group. A user reports that their device is non-compliant even though BitLocker is enabled on the system drive. Which of the following is the most likely reason?

Accepted Answer

A removable USB drive is not encrypted with BitLocker.. The compliance policy in the exhibit requires encryption of all drives, not just the system drive. Option D is correct because the policy explicitly includes a setting for 'Encryption of removable drives,' and if a USB drive is not encrypted with BitLocker, the device will be marked non-compliant even if the system drive is fully encrypted.

Answer

BitLocker recovery password rotation is not enabled.

Answer

The device does not have a TPM 2.0 chip.

Answer

The system drive is not encrypted with BitLocker.

Question 17

A user reports that their Windows 11 device cannot install a required line-of-business (LOB) app from Company Portal. The app is assigned to the user and shows as 'Available' in Intune. The device is compliant and managed. What is the most likely cause?

Accepted Answer

The Company Portal app on the device is outdated.. The most likely cause is that the Company Portal app on the device is outdated. When Company Portal is outdated, it may fail to properly communicate with Intune to initiate app installation, even though the app assignment is correct. Option B is incorrect because the app is assigned to the user and shows as 'Available'. Option C is incorrect because the app is assigned to the user, not the device group, but that does not prevent installation; the issue is with Company Portal. Option D is incorrect because the device is compliant.

Answer

The app is not assigned to the user.

Answer

The app is not assigned to the device group.

Answer

The device is non-compliant with security policies.

Question 18

Refer to the exhibit. An administrator retrieves a list of Win32 apps. They notice that one app shows installExperience as 'system' and detectionRules as 'fileVersion' with version '1.0.0'. The app fails to install on some devices. The event viewer on a failing device shows 'The app was installed but detection rule did not match'. What is the most likely cause?

Accepted Answer

The detection rule expects version 1.0.0 but the installed version is different. The detection rule is configured to check for file version '1.0.0', but the installed version on the failing device does not match this value. When Intune deploys a Win32 app, it uses the detection rule to verify successful installation; if the rule does not match, the app is marked as failed even though the installation itself completed. This mismatch is the most likely cause of the event viewer message.

Answer

The PowerShell cmdlet is deprecated

Answer

The installExperience should be 'user' instead of 'system'

Answer

The app requires a reboot that is not handled

Question 19

You need to deploy an Android Enterprise app to corporate-owned work profile devices. The app is available on Google Play. Which deployment method should you use?

Accepted Answer

Managed Google Play. Managed Google Play is the correct deployment method for Android Enterprise corporate-owned work profile devices because it provides a curated, enterprise-specific app catalog that integrates directly with Intune. Google Play hosts the app, and Intune uses Managed Google Play to approve, deploy, and manage apps on these devices without requiring user interaction.

Answer

Microsoft Store for Business

Answer

Apple Business Manager

Answer

Side-loading via Intune

Question 20

Your organization uses Microsoft Defender for Endpoint. You need to ensure that all Windows devices have the Defender Antivirus platform update installed. Which Intune app type should you use?

Accepted Answer

Microsoft Defender for Endpoint app type. The Microsoft Defender for Endpoint app type in Intune is specifically designed to manage and deploy Defender platform updates, including the antivirus platform update, to Windows devices. This app type ensures that the Defender components are kept up to date through Intune's integration with the Microsoft Defender for Endpoint service, providing a streamlined update mechanism that other app types do not offer.

Answer

Windows app (Win32)

Answer

Microsoft 365 Apps for enterprise

Answer

Line-of-business app