MD-102 Practice Exam 55 — 20 Questions

Question 1

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work profile apps are encrypted and that the device owner cannot uninstall the Company Portal app. Which configuration profile should you deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device restrictions for Android Enterprise work profile. The 'Device restrictions for Android Enterprise work profile' profile includes settings to enforce encryption of work profile apps and to prevent the uninstallation of the Company Portal app. Specifically, the 'Require work profile encryption' setting ensures that work profile data is encrypted, and the 'Block uninstall of Company Portal' setting prevents the device owner from removing the Company Portal app. These settings are only available within the work profile restrictions profile, not in other profile types.

Answer

Device configuration profile with custom OMA-URI

Answer

Device restrictions for Android Enterprise fully managed

Answer

Compliance policy for Android Enterprise

Question 2

Which TWO are valid methods to deploy Windows 10/11 using Microsoft Intune?

Accepted Answer

Windows Autopilot. Windows Autopilot is a valid Intune deployment method because it uses cloud-based configuration to transform a new or existing device into a business-ready state without manual imaging. It leverages hardware hashes uploaded to Intune, which then applies policies, apps, and settings during the out-of-box experience (OOBE). This eliminates the need for traditional imaging infrastructure.

Answer

PXE boot from a distribution point

Answer

Network boot via WDS

Answer

Bootable USB media with Windows Setup

Question 3

A company wants to prevent corporate data from being copied from managed apps to personal apps on iOS devices. Which Intune policy should the administrator configure?

Accepted Answer

App protection policy. App Protection Policies (APP) in Microsoft Intune are specifically designed to manage and protect corporate data within applications, regardless of the device enrollment state. On iOS, you can configure data transfer settings such as 'Allow app to transfer data to other apps' to restrict copying corporate data from managed apps to personal apps, using the iOS native inter-app control mechanisms like the Open-In management feature.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

Enrollment restrictions

Question 4

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Accepted Answer

Set 'Defer quality updates (days)' to 0.. To receive quality updates immediately, set 'Defer quality updates (days)' to 0 (option A). To defer feature updates for 60 days, set 'Defer feature updates (days)' to 60 (option E). Option B is incorrect because 'Feature update channel' is a channel selection, not a deferral setting. Option C is about notification level, unrelated to update timing. Option D would defer quality updates, which is the opposite of the requirement.

Answer

Set 'Feature update channel' to 'Semi-Annual Channel'.

Answer

Set 'Update notification level' to 'Turn off notifications'.

Answer

Set 'Defer quality updates (days)' to 60.

Question 5

Refer to the exhibit. The JSON snippet shows the Azure AD Identity Protection MFA registration policy configuration for the Contoso tenant. A new user, Jane, joins the company and is assigned a license. Jane attempts to access the Azure portal and is prompted to register for MFA. She registers successfully. However, the next day, she is again prompted to register for MFA. What is the most likely cause?

Accepted Answer

The user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory.. The most likely cause is that the user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory. When Azure AD Connect synchronizes a user object from on-premises AD, it can overwrite the cloud MFA registration state if the on-premises attribute (such as 'StrongAuthenticationMethods' or 'StrongAuthenticationTime') is not set or is reset. This causes the user to be treated as unregistered, prompting MFA registration again despite a previous successful registration.

Answer

The MFA registration policy is disabled.

Answer

The policy is not including all users.

Answer

The policy excludes the user Jane.

Question 6

Match each Microsoft Entra ID (Azure AD) join type to its description.

Accepted Answer

Azure AD Join: Devices are joined directly to Azure AD, no on-premises AD required. Azure AD Join is cloud-only; Hybrid Azure AD Join requires on-premises AD with sync; Azure AD Registered is for personal or bring-your-own devices.

Answer

Azure AD Join: Devices are joined to on-premises AD and automatically registered with Azure AD

Answer

Azure AD Registered: Devices require on-premises AD infrastructure

Question 7

A user reports that Microsoft 365 Apps for enterprise is not installing on their Windows 10 device. The app is assigned as 'Available' to the user group. What must the user do to trigger the installation?

Accepted Answer

Open the Company Portal app and install from there. Available app installs require user interaction via the Company Portal. Option A is wrong because the app is not required. Option C is wrong because the user can initiate install anytime. Option D is wrong because no restart is needed before install.

Answer

Wait for the next device sync

Answer

Restart the device

Answer

Log off and log back in

Question 8

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Accepted Answer

The script references a file path that does not exist on the failing devices.. Error code 0x80070002 indicates 'File not found'. This occurs when the script references a file path that does not exist on the failing devices, making option C correct. Option A is incorrect because the PowerShell execution policy is bypassed by Intune when running scripts. Option B is incorrect because Intune runs scripts in the system context (Local System account), not requiring user local admin privileges. Option D is incorrect because a script timeout would result in a different error (e.g., 0x80070057).

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 9

You are planning the deployment of Microsoft 365 Apps for enterprise to Windows 10 devices. You need to minimize network bandwidth during installation. Which THREE actions should you take?

Accepted Answer

Use the Office Deployment Tool with a local source. The Office Deployment Tool (ODT) can be configured with a local source path (SourcePath attribute in configuration.xml) to store installation files on a network share or local cache. This eliminates repeated downloads from the internet for each client, significantly reducing WAN bandwidth usage during deployment.

Answer

Configure BranchCache

Answer

Download the full installation files from the internet

Question 10

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

Accepted Answer

In the Intune portal, select the devices and click 'Sync'.. The Intune 'Sync' action sends a direct MDM policy refresh command to the device via the Microsoft Intune service. This triggers the device's enrollment client to immediately check in with the MDM server, download the latest policies, and apply them without waiting for the next scheduled sync interval. Since the devices are online and have connectivity, this remote sync forces an immediate policy refresh.

Answer

Ask users to restart their devices.

Answer

Ask users to run Windows Update.

Answer

Adjust the MDM sync interval in Intune.

Question 11

An administrator deploys an iOS app as 'Required' to a group of devices using Intune. The app fails to install on some devices with error '0x87D13B9F'. What is the most likely cause?

Accepted Answer

The devices are not supervised. Error 0x87D13B9F in Intune indicates that the device is not supervised. For iOS/iPadOS, Intune requires devices to be in Supervised mode to install 'Required' apps silently without user interaction. Without supervision, the device cannot accept managed app installations pushed by MDM, causing the deployment to fail.

Answer

The devices have insufficient storage space

Answer

The app is not compatible with the iOS version on those devices

Answer

The app is not signed with an Apple Enterprise Developer certificate

Question 12

Refer to the exhibit. A user attempts to sign in to Microsoft Graph PowerShell and receives the error shown. What is the most likely cause?

Accepted Answer

The user does not have an appropriate Microsoft Entra ID license assigned.. The error shown indicates that the user lacks the required license for Microsoft Entra ID (formerly Azure AD) features needed to sign in to Microsoft Graph PowerShell. Microsoft Graph PowerShell requires an appropriate Microsoft Entra ID license (such as Premium P1 or P2) to access directory-level APIs and authentication methods. Without this license, the service cannot validate the user's identity for Graph API calls, resulting in the sign-in failure.

Answer

The user is not registered for MFA.

Answer

The device is not registered in Microsoft Entra ID.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 13

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work profile apps are encrypted and that the device owner cannot uninstall the Company Portal app. Which configuration profile should you deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an app protection policy to the user for the corporate apps.. App protection policies (APP) in Microsoft Intune provide the ability to selectively wipe corporate data from managed apps without affecting personal data on Android devices. This is achieved through the selective wipe action, which removes only the organization's data from apps that have the policy applied, leaving personal data intact. Compliance policies, as described in the scenario, enforce device-level settings like encryption and lock screen but do not offer granular data separation for selective wipe.

Answer

Enable remote lock on the device.

Answer

Configure a device compliance policy to wipe the device if non-compliant.

Answer

Use a device configuration profile to enable selective wipe.

Question 14

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

Accepted Answer

User-driven deployment with Microsoft Entra ID join.. The enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Answer

Self-deploying mode where no user interaction is required.

Answer

Hybrid Microsoft Entra ID join with on-premises domain controller.

Answer

On-premises Active Directory domain join only.

Question 15

You are configuring Windows Information Protection (WIP) in Microsoft Intune. You want to protect corporate data from being accidentally shared to personal locations while still allowing the user to work productively. Which THREE settings should you configure?

Accepted Answer

Define network boundaries (corporate IP ranges, DNS suffixes).. Options C, D, and E are correct. To protect corporate data with Windows Information Protection (WIP) in Intune, you must define network boundaries (C) to identify corporate network locations, configure a data recovery agent certificate (D) to allow encrypted data recovery, and add protected apps (E) that are allowed to access corporate data. Option A is incorrect because WIP is enabled through a Windows Information Protection policy, not a device configuration profile. Option B is incorrect because setting 'Share over' to 'Block' would prevent all sharing, which is not productive; WIP uses data transfer policies to allow controlled sharing.

Answer

Configure a device configuration profile to enable WIP.

Answer

Set the 'Share over' data transfer policy to 'Block'.

Question 16

Which TWO troubleshooting steps should you take when a Windows 11 device fails to enroll in Intune with error code 0x80180014?

Accepted Answer

Check if the device is already enrolled in another MDM provider.. Error code 0x80180014 typically indicates that the device is already enrolled with another MDM provider, such as Microsoft Configuration Manager (with co-management) or a third-party MDM like VMware Workspace ONE. Intune enforces a single-MDM enrollment policy per device; if a prior MDM enrollment is detected, the new enrollment attempt fails. Checking for existing MDM enrollment is therefore the correct first step.

Answer

Ensure that the device is in the correct enrollment profile group.

Answer

Recreate the device compliance policy.

Answer

Check if the device has TPM 2.0 enabled.

Question 17

Which TWO actions can you perform using the Microsoft Intune admin center to manage a Windows device that is enrolled in Intune?

Accepted Answer

Restart the device. The Microsoft Intune admin center provides a 'Restart' remote action that triggers a reboot on a managed Windows device. This action is useful for applying pending updates or troubleshooting without requiring end-user interaction, and it leverages the Intune management extension to execute the restart command.

Answer

Format the hard disk

Answer

Install a printer driver

Answer

Change BIOS settings

Question 18

You have deployed the compliance policy shown in the exhibit. A Windows 10 device reports as non-compliant. The device has Windows 10 version 21H2 (build 19044.1288), password is set with 8 characters and includes numbers only, firewall is active, Defender is enabled, and BitLocker is on. Which setting is causing non-compliance?

Accepted Answer

passwordRequiredType. The compliance policy requires an alphanumeric password (letters and numbers), but the device uses a password with numbers only. Option A is incorrect because a password length of 8 meets the minimum length requirement. Option C is incorrect because the device's OS build (19044.1288) falls within the allowed range (19042.0 to 19045.999). Option D is incorrect because the firewall is active.

Answer

passwordMinimumLength

Answer

osMinimumVersion

Answer

activeFirewallRequired

Question 19

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

Accepted Answer

Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker. Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Answer

Device configuration profile to enable BitLocker

Answer

Device compliance policy with a noncompliance action to mark device as non-compliant

Answer

PowerShell script deployment with assignment to all devices

Question 20

Your organization uses Windows Autopilot for device provisioning. Users report that after initial setup, devices are not automatically enrolled in Microsoft Intune. What should you verify?

Accepted Answer

That the devices are registered in Windows Autopilot with a valid hardware hash.. Windows Autopilot requires devices to be registered in the Autopilot service with a valid hardware hash (or other unique identifier like PKID or serial number) so that the service can match the device during OOBE and trigger the enrollment process into Intune. Without a valid hardware hash, the device will not be recognized by Autopilot and will proceed through standard OOBE without automatic Intune enrollment.

Answer

That a device configuration profile is assigned to the devices.

Answer

That a Conditional Access policy is in place requiring Intune enrollment.

Answer

That a device compliance policy is assigned to the Autopilot devices.