MD-102 Practice Exam 56 — 20 Questions

Question 1

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

Accepted Answer

The devices have TPM version 1.2 instead of 2.0.. The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Answer

The devices are not joined to Microsoft Entra ID.

Answer

The BitLocker policy is configured only for Windows 11 Enterprise devices.

Answer

The devices are running Windows 10 instead of Windows 11.

Question 2

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

Accepted Answer

Use the remote lock action in Intune and provide a custom message.. The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Answer

Enable lost mode on the device via Apple Business Manager.

Answer

Configure a device compliance policy to wipe the device on non-compliance.

Answer

Initiate a remote assistance session to lock the device.

Question 3

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

Accepted Answer

Configuration profiles. Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Answer

Update rings

Answer

Device enrollment profiles

Answer

Compliance policies

Question 4

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Accepted Answer

The device has not checked in with the Intune service recently.. When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Answer

The device is marked as non-compliant.

Answer

The device does not have a valid device certificate.

Answer

The device enrollment profile has expired.

Question 5

Your organization uses Microsoft Defender for Endpoint. You need to ensure that devices onboarding to Microsoft Defender for Endpoint are automatically assigned to a specific device group based on their operating system version. What should you use?

Accepted Answer

Configure device group rules in Microsoft Defender for Endpoint using OS version condition.. Device group rules in Microsoft Defender for Endpoint allow you to automatically assign devices to groups based on conditions such as operating system version. This is the correct approach because it uses the built-in grouping engine that evaluates device attributes during onboarding, ensuring consistent and automated assignment without manual intervention.

Answer

Manually tag each device in the Microsoft 365 Defender portal.

Answer

Use Microsoft Entra ID dynamic groups based on device OS.

Answer

Create a Microsoft Intune compliance policy that tags devices by OS version.

Question 6

You manage devices with Microsoft Intune. A user reports that their Windows 11 device is not receiving updates from Windows Update for Business. The device shows as compliant in Intune. You verify that update rings are assigned to the device. What should you check next?

Accepted Answer

Check the device's delivery optimization settings.. Option C is correct because delivery optimization settings control how Windows Update for Business downloads updates, and misconfigured settings (e.g., peer caching or bandwidth throttling) can prevent updates from being received even when update rings are properly assigned. Since the device is compliant and update rings are assigned, the next logical step is to verify that delivery optimization is not blocking or delaying the download. This aligns with Intune's troubleshooting workflow for Windows Update for Business issues.

Answer

Check if the device has a compliance policy that blocks updates.

Answer

Ensure that the device is not configured for dual scan.

Answer

Verify that the update ring is assigned to the correct Azure AD group.

Question 7

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

Accepted Answer

Quality updates are paused until March 15, 2025.. Option C is correct because the JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Answer

The quality update deferral of 7 days has not yet elapsed since the last update.

Answer

The quality update pause has expired, but quality updates are still blocked.

Answer

Feature updates are deferred for 30 days, preventing all updates.

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

Accepted Answer

Set feature update deferral to 120 days and quality update deferral to 30 days.. Option C is correct because the Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Answer

Set feature update deferral to 180 days and quality update deferral to 0 days.

Answer

Set feature update deferral to 30 days and quality update deferral to 120 days.

Answer

Set both feature and quality update deferrals to 60 days.

Question 9

Which THREE components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select three.)

Accepted Answer

Enrollment Status Page (ESP) configuration.. The Enrollment Status Page (ESP) configuration is required because it provides visibility into the provisioning process and enforces device compliance before the user can access the desktop. In a user-driven Microsoft Entra ID join Autopilot deployment, the ESP ensures that required policies, apps, and certificates are installed, preventing users from bypassing critical setup steps. Without ESP, users might gain early access to an incompletely configured device, leading to support issues.

Answer

On-premises Active Directory domain join.

Answer

Microsoft Configuration Manager co-management.

Question 10

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

Accepted Answer

Create a Windows feature update profile targeting Windows 11.. A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Answer

Deploy a configuration profile with the Windows 11 installation script.

Answer

Create a Windows update ring profile targeting Windows 11.

Answer

Configure a device compliance policy requiring Windows 11.

Question 11

Which TWO actions should you take to prepare infrastructure for devices running macOS in your organization? (Select two.)

Accepted Answer

Deploy the Company Portal app to macOS devices.. Option A is correct because the Company Portal app is the primary interface for users to enroll macOS devices in Microsoft Intune, access corporate resources, and manage compliance. Deploying it ensures users can initiate enrollment and receive policies. Option B is correct because enrolling macOS devices in Intune is the foundational step to apply management policies, deploy apps, and enforce compliance settings via MDM.

Answer

Configure Windows Autopilot for macOS devices.

Answer

Join macOS devices to Microsoft Entra ID.

Answer

Use Group Policy to manage macOS settings.

Question 12

You need to deploy Microsoft 365 Apps to 500 Windows 10 devices managed by Intune. The deployment must be automatic and should not require user interaction. What is the best method?

Accepted Answer

Create a Win32 app in Intune with the installation command for Microsoft 365 Apps.. Option C is correct because creating a Win32 app in Intune allows you to use the Office Deployment Tool (ODT) with a custom configuration.xml to install Microsoft 365 Apps silently. This method supports automatic, unattended deployment to 500 Windows 10 devices managed by Intune, as Win32 apps can be assigned with required intent and run in system context without user interaction.

Answer

Create a Configuration Manager application and deploy to the devices.

Answer

Use the Office Deployment Tool (ODT) to create a package and deploy via Intune as a line-of-business (LOB) app.

Answer

Assign the Microsoft 365 Apps from the Microsoft Store for Business.

Question 13

You are troubleshooting an Autopilot deployment where devices are not receiving the expected configuration policies after enrollment. The devices show as enrolled in Intune but are stuck in a 'pending' state for policy application. What is the most likely cause?

Accepted Answer

The user does not have an assigned Intune license.. When a device is enrolled in Intune but stuck in a 'pending' state for policy application, the most common cause is that the user account lacks an assigned Intune license. Without a license, the user cannot synchronize policies from the Intune service, even though the device itself appears in the console. This is a prerequisite for policy delivery and is often overlooked during troubleshooting.

Answer

The device is not registered in Autopilot.

Answer

The device has a slow internet connection.

Answer

The Autopilot profile is set to 'offline' mode.

Question 14

Your organization is planning to deploy Microsoft Entra hybrid joined devices. What is a prerequisite for this configuration?

Accepted Answer

Microsoft Entra Connect must be installed and configured.. Microsoft Entra hybrid joined devices require synchronization of on-premises Active Directory identities to Microsoft Entra ID. Microsoft Entra Connect (or Microsoft Entra Connect Sync) is the tool that performs this identity synchronization, making it a mandatory prerequisite. Without it, the on-premises AD objects cannot be linked to Entra ID for hybrid join.

Answer

Azure AD Premium P1 license is required.

Answer

Microsoft Intune must be enabled for auto-enrollment.

Answer

Microsoft Defender for Endpoint must be deployed.

Question 15

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

Accepted Answer

Use a provisioning package (PPKG) to reset the device and register it for Autopilot.. Option C is correct because using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Answer

Assign an Autopilot deployment profile to the device group in Intune.

Answer

Export the hardware hash from each device and upload it manually to Intune.

Answer

Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

Question 16

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

Accepted Answer

Screen timeout exceeds the policy setting. The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Answer

Device threat protection level is not set to high

Answer

Storage encryption is not enabled

Answer

OS version is above the maximum allowed

Question 17

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can access company resources, while allowing users to enroll personal devices for limited access. You plan to use enrollment restrictions and compliance policies. What should you configure?

Accepted Answer

Set enrollment device platform restrictions to block personally owned devices, and create a compliance policy to mark personal devices as noncompliant.. Option A is correct because enrollment device platform restrictions can block personally owned devices from enrolling, while a compliance policy can mark personal devices that do enroll as noncompliant. This combination ensures corporate-owned devices get full access, and personal devices are either blocked or flagged for limited access via conditional access policies.

Answer

Configure enrollment restrictions to block all devices from enrolling.

Answer

Configure a compliance policy that requires devices to be corporate-owned.

Answer

Create a conditional access policy that requires devices to be marked as compliant.

Question 18

Your company has iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot remove the Microsoft Intune Company Portal app from their devices. What should you configure?

Accepted Answer

Configure a Required app assignment with removal prevention.. Option C is correct because configuring a Required app assignment with removal prevention in Microsoft Intune ensures that the Company Portal app is installed as a required app and users cannot uninstall it. This setting is specifically designed to prevent removal of managed apps on iOS/iPadOS devices enrolled in Intune, leveraging the MDM channel to enforce the policy.

Answer

Configure an App Configuration policy for Company Portal.

Answer

Configure an App Protection policy for Company Portal.

Answer

Configure a Device Compliance policy to require Company Portal installation.

Question 19

Which THREE are valid Windows Autopilot deployment scenarios?

Accepted Answer

Self-deploying. Windows Autopilot self-deploying is a valid deployment scenario where a device can be automatically configured without user interaction, using a hardware hash to enroll in Azure AD and Intune. This scenario is ideal for kiosks, digital signage, or shared devices that require zero-touch provisioning.

Answer

App-driven

Answer

Policy-driven

Question 20

You are planning to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. Which TWO methods can you use to deploy Microsoft 365 Apps? (Choose two.)

Accepted Answer

Windows Installer (Win32) app type using the Office Deployment Tool.. Option B is correct because the Windows Installer (Win32) app type in Intune allows you to deploy Microsoft 365 Apps using the Office Deployment Tool (ODT), which provides granular control over installation settings, languages, and update channels. Option E is correct because Intune includes a dedicated 'Microsoft 365 Apps for Windows' app type that simplifies deployment by automatically configuring the ODT XML and handling the installation process without manual scripting.

Answer

Android store app type.

Answer

Web link app type pointing to the Office website.

Answer

iOS store app type.