MD-102 Practice Exam 56 — 20 Questions

Question 1

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the device to a different update ring with a 0-day deferral.. The device is assigned to an update ring that defers updates by 30 days, which is why it is not receiving the latest security updates despite being compliant. To immediately receive the latest updates, you must assign the device to a different update ring with a 0-day deferral, as update rings in Microsoft Intune control the deferral period for Windows Update for Business. Changing the ring triggers the device to check for updates based on the new policy, ensuring immediate availability of security updates.

Answer

Change the compliance policy to require immediate updates.

Answer

Run Windows Update manually on the device.

Answer

Re-enroll the device in Intune.

Question 2

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not connected to the cloud service.. The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Answer

The device is not compliant with Intune compliance policies.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device does not have Microsoft Defender Antivirus enabled.

Question 3

A user has an iOS device enrolled in Intune. The device is lost, and you need to immediately prevent unauthorized access to corporate data. The device contains both corporate and personal data. Which action should you take?

Accepted Answer

Use Remote Lock to lock the device. Remote Lock immediately locks the iOS device, preventing unauthorized access to both corporate and personal data without altering the device's content. This is the correct first step to secure data while preserving the ability to recover the device later, as it does not remove any data or accounts.

Answer

Disable the user's account in Microsoft Entra ID

Answer

Initiate a selective wipe

Answer

Initiate a full wipe

Question 4

An organization uses Microsoft Intune to manage Windows devices. They want to ensure that only devices with a TPM 2.0 chip can access corporate email. Which policy should be configured?

Accepted Answer

Device compliance policy with a condition for TPM 2.0, combined with a conditional access policy. A device compliance policy can evaluate whether a device has TPM 2.0 (via the TPM specification version check), and when combined with a Conditional Access policy, it can block access to corporate email for non-compliant devices. This is the standard Microsoft approach for enforcing hardware-based security requirements for cloud app access.

Answer

Device enrollment restriction to require TPM 2.0

Answer

Device configuration profile to enable TPM 2.0

Answer

App protection policy to require TPM 2.0

Question 5

You are troubleshooting an app deployment issue. A Win32 app fails to install on some Windows 10 devices. The Intune management extension logs show error code 0x80070643. What is the most likely cause?

Accepted Answer

A pending reboot from a previous installation is blocking the install. Error code 0x80070643 translates to 'ERROR_INSTALL_FAILURE' and is commonly associated with a pending reboot that blocks the installation of a Win32 app via Intune. The Intune Management Extension checks for pending reboot status before executing app installations; if a reboot is required, the installation fails with this error to prevent system instability.

Answer

The app package is corrupted

Answer

The device does not meet the minimum OS version requirement

Answer

The user does not have admin privileges

Question 6

You are planning a Windows 11 deployment for 500 new devices using Windows Autopilot. The devices will be shipped directly to users from the manufacturer. You need to ensure that the devices are automatically enrolled in Intune and joined to Microsoft Entra ID. What should you do?

Accepted Answer

Register the device hashes in Intune and assign an Autopilot deployment profile. Windows Autopilot uses device hashes (hardware IDs) to identify devices in Intune. By registering these hashes and assigning an Autopilot deployment profile, the devices are automatically enrolled in Intune and joined to Microsoft Entra ID during the out-of-box experience (OOBE), without requiring manual intervention or additional infrastructure.

Answer

Pre-install the Intune Management Extension on each device

Answer

Configure a provisioning package and include it with the shipment

Answer

Create a hybrid Azure AD join configuration in Intune

Question 7

You apply the custom policy shown in the exhibit to a Windows 11 device. Users report that they cannot use Bluetooth devices (e.g., mouse, keyboard) after the policy applies. Which setting in the policy is causing this issue?

Accepted Answer

allowBluetooth set to false. The `allowBluetooth` setting set to `false` explicitly disables the Bluetooth radio on the device, preventing any Bluetooth peripherals (mouse, keyboard, etc.) from pairing or connecting. This is a common policy in Windows CSP (Policy CSP – Bluetooth/AllowBluetooth) that controls the Bluetooth stack at the OS level, and setting it to false blocks all Bluetooth functionality.

Answer

allowStorageCard set to false

Answer

allowCopyPaste set to false

Answer

allowCamera set to false

Question 8

A company uses Microsoft Intune to manage iOS/iPadOS devices. They need to enforce a policy that requires users to set a device passcode of at least 6 characters. Which type of policy should they create?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune evaluates whether iOS/iPadOS devices meet specific security requirements, such as a minimum passcode length of 6 characters. When a device is noncompliant, Intune can trigger actions like blocking access to corporate resources or sending a notification to the user. This is the correct policy type because passcode enforcement for device-level security is a compliance condition, not a configuration or app-level setting.

Answer

Device configuration profile

Answer

Conditional access policy

Answer

App protection policy

Question 9

You are troubleshooting a user's Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is managed by Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The certificate is issued by your internal CA. The device shows 'No internet access' though it connects. What is the most likely issue?

Accepted Answer

The root CA certificate is not deployed to the device. The device connects to the Wi-Fi network but shows 'No internet access,' indicating the SSID and connectivity are functional. With SCEP certificate authentication, the client must trust the issuing CA's root certificate to validate the server-side certificate during the EAP-TLS handshake. If the root CA certificate is not deployed to the device via Intune, the certificate chain cannot be verified, causing the connection to fail at the authentication layer even though the Wi-Fi association succeeds.

Answer

The SSID in the profile is incorrect

Answer

The user does not have an Intune license

Answer

The Wi-Fi profile is not assigned to the device

Question 10

Your organization wants to use Windows Autopilot for user-driven deployment. Users should be able to self-deploy their devices by signing in with their corporate credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven (Azure AD join). User-driven (Azure AD join) deployment mode is correct because it allows users to self-deploy their devices by signing in with their corporate credentials during the out-of-box experience (OOBE). This mode joins the device to Azure AD and enrolls it in Microsoft Intune, enabling the user to complete the setup without IT intervention.

Answer

Pre-provisioned deployment

Answer

Hybrid Azure AD join

Answer

Self-deploying (Azure AD join)

Question 11

Refer to the exhibit. The ARM template snippet attempts to deploy a Windows 10 Security Baseline policy in Intune. The deployment fails. What is the most likely reason?

Accepted Answer

Intune configuration policies cannot be deployed via ARM templates.. Intune does not support deploying Windows 10 Security Baseline policies via ARM templates because ARM templates are designed for Azure resource management (e.g., Azure VMs, storage accounts) and cannot directly manage Intune workloads. Intune policies, including Security Baselines, must be configured through Microsoft Graph API, PowerShell, or the Intune portal, not through Azure Resource Manager.

Answer

The apiVersion is not supported.

Answer

The templateId is incorrect.

Answer

The setting value is invalid.

Question 12

You need to remotely wipe a lost corporate-owned iOS device that is managed by Intune. Which action should you use?

Accepted Answer

Wipe. The 'Wipe' action in Microsoft Intune performs a factory reset on a corporate-owned iOS device, removing all data and settings to protect sensitive information. This is the appropriate action for a lost device because it restores the device to its out-of-box state, ensuring no corporate data remains accessible.

Answer

Reset

Answer

Delete

Answer

Retire

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting even though the policy is assigned. What should you check first?

Accepted Answer

Confirm that the device has a compatible TPM chip and that it is enabled.. BitLocker requires a compatible TPM (Trusted Platform Module) chip, version 1.2 or 2.0, that is enabled and activated in the BIOS/UEFI. If the TPM is missing, disabled, or not initialized, the BitLocker policy will apply but encryption will fail silently or remain pending. This is the most common root cause for devices not encrypting despite policy assignment.

Answer

Verify that Secure Boot is disabled in BIOS.

Answer

Ensure devices are marked as compliant in Intune.

Answer

Check if the BitLocker policy is using the Settings catalog.

Question 14

A user's mobile device is lost. You need to remotely wipe the device using Microsoft Intune. What is the correct sequence of actions?

Accepted Answer

In the Microsoft Intune admin center, select the device and choose Retire/Wipe.. The Retire/Wipe action in the Microsoft Intune admin center is the direct, administrator-initiated method to remotely wipe a lost device. This action sends a wipe command to the device via the Intune service, which the device's management agent (Company Portal or MDM agent) processes to perform a factory reset, removing all corporate and personal data.

Answer

Ask the user to reset the device from the Company Portal app.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Remote wipe'.

Answer

Remove the device from Microsoft Entra ID and it will automatically wipe.

Question 15

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the corporate Wi-Fi profile no longer connects automatically. You verify the profile is still assigned and the device shows 'Not compliant' in Intune. What should you check first?

Accepted Answer

Review the device's compliance policy status and resolve any non-compliance.. The device shows 'Not compliant' in Intune, which directly prevents the Wi-Fi profile from applying or connecting automatically. Intune enforces compliance before allowing configuration profiles to take effect; resolving the non-compliance will restore automatic connectivity. This is the most direct and likely cause given the scenario.

Answer

Re-enroll the device in Intune.

Answer

Create a new Wi-Fi profile and assign it.

Answer

Verify the device's certificate for the Wi-Fi profile is still valid.

Question 16

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device has not checked in to Intune within the last 8 hours.. The 'Pending' status in Intune for a Wi-Fi configuration profile indicates that the policy has been assigned but not yet applied to the device. This typically occurs when the device has not performed a recent check-in with the Intune service. By default, devices check in every 8 hours, so if the device has not checked in within that window, the profile remains in a 'Pending' state until the next successful sync.

Answer

The device does not have the required root certificate installed.

Answer

The Wi-Fi profile is not assigned to the user's group.

Answer

The Wi-Fi profile requires user affinity and the device is shared.

Question 17

Which TWO of the following can be used to deploy Microsoft 365 Apps to Windows devices managed by Microsoft Intune? (Select TWO.)

Accepted Answer

Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type. Both B and E are correct. The Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type (B) provides the native deployment mechanism within Intune. The Microsoft 365 Apps admin center (E) is used to configure the deployment settings (e.g., update channel, languages, architecture), which are then applied when the Intune app type is assigned to devices. Together, they enable the deployment of Microsoft 365 Apps to Windows devices managed by Intune.

Answer

Configuration Manager

Answer

Group Policy

Answer

Win32 app wrapper

Question 18

You are configuring a Microsoft Intune app configuration policy for a managed iOS app. Which THREE types of settings can you include in the policy?

Accepted Answer

Permissions such as location or camera. Intune app configuration policies for managed iOS apps can include permissions settings (e.g., location, camera, contacts) to control whether the app can access device features. These are defined using the iOS managed app configuration schema, which allows you to specify permission behaviors such as 'Allow,' 'Deny,' or 'Prompt' for each protected resource.

Answer

Compliance rules for the app

Answer

Network requirements like VPN

Question 19

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

Accepted Answer

The device is connected through a VPN that blocks Intune traffic.. The most likely cause is that the device is connected through a VPN that blocks Intune traffic. Intune requires direct internet access to communicate with its service. If the VPN restricts or filters this traffic, the device may remain enrolled but unable to check in or receive policies. Option B is incorrect because the device last checked in 5 days ago, which is within the 7-day window, so it would not be marked inactive. Option C is incorrect because the device shows as 'Enrolled'. Option D is incorrect because the Intune Connector for Active Directory is used for hybrid Azure AD join scenarios, not for direct policy delivery to enrolled devices.

Answer

The device has not checked in for more than 7 days, causing Intune to mark it as inactive.

Answer

The device has been unenrolled from Intune.

Answer

The Intune Connector for Active Directory is not configured.

Question 20

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires a kernel extension. The app is signed with a Developer ID certificate. The devices are enrolled in Intune and are supervised. You have uploaded the .pkg to Intune and assigned it to a user group. The installation fails on devices with the error 'The app could not be installed because the kernel extension is not approved'. You have already configured a kernel extension profile that allows the specific team identifier. What else is likely missing?

Accepted Answer

The app is not notarized by Apple.. Starting with macOS 10.14.5, Apple requires all kernel extensions (kexts) to be notarized by Apple. Even if the kernel extension profile allows the team identifier, the app itself must be notarized to install on macOS 10.14.5+ systems. Without notarization, the installation fails with the given error. Option C is incorrect because the 'Allow user to approve kernel extensions' setting is for user approval after installation, not the root cause here. Options A and B are unrelated.

Answer

System Integrity Protection (SIP) is enabled on the devices.

Answer

FileVault is enabled on the devices.

Answer

The kernel extension profile does not include the 'Allow user to approve kernel extensions' setting.