MD-102 Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. An Intune administrator configured a Win32 app with the settings shown. What is the expected behavior when the app installation exits with return code 3010?

Accepted Answer

The device may restart after installation outside of active hours. Return code 3010 is a standard Windows Installer code indicating a reboot is required. In Intune, a Win32 app that exits with 3010 is treated as a successful installation, but the device may be restarted outside of active hours to apply changes. This behavior aligns with the 'Device restart behavior' setting configured in the app's properties, which defers the restart to a maintenance window.

Answer

The device restarts immediately

Answer

The installation is marked as failed

Answer

The app is not installed

Question 2

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Accepted Answer

Run a detection script to identify issues.. Proactive remediations in Microsoft Intune are designed to detect and automatically fix common issues on Windows devices without requiring user intervention. Option A is correct because the workflow begins with a detection script that runs on the device to identify specific problems, such as registry misconfigurations or missing files. This script must return an exit code indicating whether an issue exists, which then triggers the remediation script if needed.

Answer

Send email alerts when issues are detected.

Answer

Mark devices as non-compliant if remediation fails.

Question 3

Your organization uses Microsoft Intune to manage Windows devices. You are deploying a Win32 app that requires a reboot to complete installation. You want to control the reboot behavior to minimize user disruption. Which TWO settings can you configure in the Intune Win32 app properties to manage reboot? (Choose two.)

Accepted Answer

Allow restart after installation (in assignment). The correct answers are A and B. Option A ('Allow restart after installation') is a setting in the app assignment that, when enabled, permits the device to restart after the app installs. Option B ('Device restart behavior') controls whether restarts are suppressed or blocked during the app installation. Option C ('Restart deadline') is not a configurable setting for Win32 apps in Intune; it is used for Windows Update rings. Option D ('Restart grace period') is not available for Win32 apps; it is used for update compliance policies. Option E ('Restart notification text') is not a setting for Win32 apps; it is used for device restart notifications in update policies.

Answer

Restart deadline

Answer

Restart grace period

Answer

Restart notification text

Question 4

Which TWO of the following are device configuration settings you can manage with Microsoft Intune? (Choose two.)

Accepted Answer

Device restrictions (e.g., camera, Bluetooth). Device restrictions, such as disabling the camera or Bluetooth, are a core configuration setting in Microsoft Intune. These are managed through device configuration profiles that enforce policies on devices, regardless of the user logged in. Option B is correct because Intune's device restrictions profile allows administrators to control hardware and system features at the device level.

Answer

Application settings for Microsoft 365 Apps

Answer

Wi-Fi profiles

Answer

Email profiles for Exchange Online

Question 5

You run the above PowerShell script to change the Windows Autopilot group tag for devices currently tagged as 'Sales' to 'Marketing'. You have assigned different deployment profiles to the 'Sales' and 'Marketing' group tags. After running the script, you check the Autopilot devices in Intune and see that the group tag for the devices has changed. However, the devices still apply the 'Sales' deployment profile during OOBE. What is the most likely reason?

Accepted Answer

The deployment profile assignment is based on the group tag at the time of enrollment; existing devices retain the original profile.. The group tag is evaluated at the time of enrollment to determine which deployment profile to assign. Changing the group tag on an already-enrolled device does not retroactively change the profile assignment; the device retains the profile that was applied during its original OOBE. This is by design in Windows Autopilot, as the profile is bound to the device record at enrollment.

Answer

The deployment profile is assigned to the device by device ID, not group tag.

Answer

The script needs to include a step to remove the device from Autopilot and re-import it.

Answer

The script did not sync the device details to Intune after changing the group tag.

Question 6

Which THREE conditions can be used to create a dynamic device group in Microsoft Entra ID for Intune management? (Choose three.)

Accepted Answer

Enrollment profile name (e.g., 'Autopilot Profile'). Microsoft Entra ID dynamic device groups can use the 'enrollmentProfileName' property as a rule attribute. This allows you to target devices based on the specific Autopilot profile assigned during enrollment, enabling precise management of devices that underwent a particular provisioning process.

Answer

Last sign-in time of the user

Answer

Installed application version

Question 7

You have deployed the above Endpoint Protection configuration profile to Windows 10 devices. Some users report that their devices are not encrypted. You verify that the devices have TPM 2.0 and meet hardware requirements. What is the most likely cause?

Accepted Answer

The policy does not configure recovery key escrow to Azure AD.. When BitLocker encryption is enabled via an Endpoint Protection configuration profile in Microsoft Intune, the policy must include recovery key escrow to Azure AD for encryption to proceed. Without this setting, BitLocker will not encrypt the drive, even if the device meets TPM and hardware requirements. The policy in question likely has the 'Require BitLocker recovery key to be stored in Azure AD' option set to 'Not configured' or 'No', which prevents encryption from starting.

Answer

The policy disables encryption for the OS drive.

Answer

The devices do not have a TPM chip.

Answer

The encryption method is not supported by the devices.

Question 8

A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a device compliance policy that requires BitLocker.. A device compliance policy in Microsoft Intune can include the setting to require BitLocker on Windows 10 devices. This policy evaluates the device's BitLocker status and marks it as noncompliant if BitLocker is not enabled, which is a prerequisite for Conditional Access to block access to corporate resources.

Answer

Assign the device compliance policy to all users.

Answer

Enable Windows Hello for Business.

Answer

Create a device configuration profile to enable BitLocker.

Question 9

You are troubleshooting an iPhone that cannot enroll in Microsoft Intune. The user receives an error stating 'This device is already enrolled in another MDM.' What is the most likely cause?

Accepted Answer

The device is already enrolled in Apple Business Manager or another MDM.. The error 'This device is already enrolled in another MDM' indicates that the iPhone has an existing MDM profile that conflicts with Intune enrollment. This typically occurs when the device is already enrolled in Apple Business Manager (ABM) or another MDM solution, as iOS enforces a single MDM enrollment per device. Intune cannot overwrite an existing MDM profile without first removing it.

Answer

The device has a VPN configuration installed.

Answer

The device is not running the latest iOS version.

Answer

The user's license is expired.

Question 10

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

Accepted Answer

Create a Conditional Access policy requiring device to be marked as compliant.. A Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Answer

Create an app protection policy for Windows 365 app.

Answer

Configure the Cloud PC provisioning policy to allow only compliant devices.

Answer

Assign a device compliance policy to all users.

Question 11

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Accepted Answer

Windows Defender Application Control (WDAC).. Windows Defender Application Control (WDAC) is a code integrity feature that restricts which executables, scripts, and installers can run on Windows 10 devices. It uses a trust-based model where only binaries signed by approved publishers or with specific hash values are allowed, making it a core component for application control in an Intune-managed environment.

Answer

Windows Information Protection (WIP).

Answer

BitLocker drive encryption.

Question 12

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

Accepted Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}. Option E correctly implements the conditional launch policy. The schema requires 'defenderSensorVersion' with 'minimumVersion' set to the version string, and 'defenderSensorHealth' with 'minimumVersion' set to the numeric value 1 to indicate a healthy state. Option A uses the string 'healthy' instead of numeric 1. Option B uses 'version' and 'state' which are incorrect property names. Option D uses 'clientVersion' and 'clientHealth' which are incorrect. Option C is textually identical to E but is not the designated correct answer. Therefore, only option E is correct.

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": "healthy"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"version": "10.8049.22439.1043"}, "defenderSensorHealth": {"state": "enabled"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

Answer

{"deviceHealth": {"clientVersion": {"minimumVersion": "10.8049.22439.1043"}, "clientHealth": {"minimumVersion": 1}}}

Question 13

You manage devices with Microsoft Intune. A user reports that their Windows 11 device is not receiving updates from Windows Update for Business. The device shows as compliant in Intune. You verify that update rings are assigned to the device. What should you check next?

Accepted Answer

Check the device's delivery optimization settings.. Delivery optimization settings control how Windows Update for Business downloads updates, and misconfigured settings (e.g., peer caching or bandwidth throttling) can prevent updates from being received even when update rings are properly assigned. Since the device is compliant and update rings are assigned, the next logical step is to verify that delivery optimization is not blocking or delaying the download. This aligns with Intune's troubleshooting workflow for Windows Update for Business issues.

Answer

Check if the device has a compliance policy that blocks updates.

Answer

Ensure that the device is not configured for dual scan.

Answer

Verify that the update ring is assigned to the correct Azure AD group.

Question 14

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to a device. The app appears in the managed Google Play store but the deployment status shows 'Failed'. What is the most likely cause?

Accepted Answer

The device does not have Google Play Services installed.. The most likely cause of a 'Failed' deployment status for a managed Google Play app is that the device does not have Google Play Services installed. Google Play Services is a prerequisite for accessing and installing apps from the managed Google Play store. Without it, the device cannot complete the deployment, even if the app is approved and the device is enrolled correctly. Option A is incorrect because personally-owned work profiles do support app deployment; the failure is not inherently due to the profile type.

Answer

The device is enrolled in a personally-owned work profile.

Answer

The device is not allowed to access the managed Google Play store.

Answer

The app is not approved in the managed Google Play store.

Question 15

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a custom security baseline that includes blocking PowerShell scripts from running unless they are signed by a trusted publisher. Which configuration should be applied?

Accepted Answer

Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.. Setting the PowerShell Execution Policy to 'AllSigned' via Administrative Templates in Intune ensures that PowerShell scripts can only run if they are signed by a trusted publisher. This policy is enforced through Group Policy or Intune's Settings Catalog, directly controlling the PowerShell execution policy at the machine level, which meets the requirement for a custom security baseline.

Answer

Create a Windows Defender Application Control (WDAC) policy that blocks unsigned scripts.

Answer

Enable BitLocker with Secure Boot to validate script integrity.

Answer

Configure AppLocker rules to deny execution of PowerShell scripts.

Question 16

Your company has a Microsoft 365 E5 subscription. You are planning to deploy Windows 11 using Microsoft Intune. You need to ensure that devices automatically receive English (US) language pack and regional settings during the provisioning process. You plan to use a provisioning package (PPKG) created with Windows Configuration Designer. What should you include in the PPKG?

Accepted Answer

Include the 'Language' and 'RegionalSettings' settings in the PPKG.. Windows Configuration Designer (WCD) directly supports configuring language and regional settings within a provisioning package (PPKG) through built-in settings. Including the 'Language' and 'RegionalSettings' settings in the PPKG ensures these configurations are applied during the out-of-box experience (OOBE) or provisioning process, without requiring additional scripts or policies. This is the most efficient and supported method for offline or Autopilot pre-provisioning scenarios.

Answer

Add a PowerShell script that runs during Autopilot to set language and region.

Answer

Assign an Intune Language Pack policy to the device group.

Answer

Create a Group Policy Object that sets language and region, and link it to the device OU.

Question 17

You are designing an app protection policy (APP) for Microsoft 365 mobile apps accessing corporate data on iOS devices. The security team requires that when a user opens a work document in the Microsoft Word app, the user must authenticate with Face ID or a passcode. Which setting should you configure?

Accepted Answer

Require PIN or Face ID for access (iOS). The 'Require PIN or Face ID for access (iOS)' setting enforces biometric or passcode authentication specifically when a user launches a managed app or resumes it from the background. This directly meets the requirement that opening a work document in Word triggers Face ID or passcode verification, as the app protection policy (APP) intercepts the app launch and prompts for authentication before granting access to corporate data.

Answer

Block managed apps from running on jailbroken devices

Answer

Encrypt app data

Answer

Require app PIN when device PIN is not set

Question 18

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

Accepted Answer

Enable the TPM in the device's BIOS settings.. The device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Answer

Replace the device's motherboard.

Answer

Assign a grace period for the device.

Answer

Remove the tpmRequired setting from the compliance policy.

Question 19

A user's Windows 11 device is not receiving the Company Portal app after enrollment. The device is enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The device is not connected to the internet.. The Company Portal app is delivered to enrolled devices via Intune, but the initial download and installation require an active internet connection to reach Microsoft's cloud services. If the device is not connected to the internet, the enrollment process may complete locally, but the Company Portal app will not be pushed or installed until connectivity is restored. This is the most likely cause because the question states the device is already enrolled, ruling out licensing or compliance issues that would prevent enrollment itself.

Answer

The device is not compliant with security policies.

Answer

The device is running Windows 10 instead of Windows 11.

Answer

The user does not have an Intune license.

Question 20

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

Accepted Answer

Automated device enrollment (with user affinity). Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Answer

User enrollment

Answer

Device enrollment (without user affinity)

Answer

Bring your own device (BYOD) enrollment