MD-102 Practice Exam 57 — 20 Questions

Question 1

You are troubleshooting a Microsoft 365 Apps for enterprise deployment on Windows 10 devices managed by Intune. Users report that the apps are not installing, but the deployment status in Intune shows 'Success' for some devices and 'Failed' for others. On a failing device, you discover that the Office Deployment Tool (ODT) logs indicate '0x80070005 - Access denied'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Office Deployment Tool is running in user context instead of system context.. The error code 0x80070005 (Access denied) in Office Deployment Tool (ODT) logs indicates a permissions issue. When Intune deploys Microsoft 365 Apps, it runs the ODT in the system context via the Intune Management Extension. If the ODT is inadvertently executed in the user context (e.g., due to a misconfigured detection script or deployment script that doesn't elevate), it lacks the necessary privileges to write to the Program Files directory or modify system registry keys, causing the access denied error.

Answer

The device has insufficient disk space for the installation.

Answer

The configuration.xml file has an invalid Channel attribute.

Answer

The device does not have internet connectivity to download Office installation files.

Question 2

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. If the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 3

A user has a Windows 10 device that is managed by Intune. The device is compliant but the user reports that they cannot access corporate email on their device. The email profile is deployed via Intune. Other users can access email successfully. What should you check first?

Accepted Answer

Check if the user's certificate is valid and assigned.. When an email profile is deployed via Intune and the device is compliant, the most likely cause of a single user's failure to access corporate email is an issue with certificate-based authentication. Intune often uses SCEP or PKCS certificates to authenticate email access, and if the user's certificate is missing, expired, or not properly assigned, the email profile will fail to connect even though the device is compliant and the profile is assigned.

Answer

Check if the email profile is assigned to the user.

Answer

Re-create the email profile for all users.

Answer

Verify device compliance status.

Question 4

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. When devices show as 'Inactive' in the Microsoft Defender XDR portal after onboarding, it typically indicates that the Microsoft Defender for Endpoint service (Sense) is not running or has stalled. Restarting the service forces the sensor to reinitialize and re-establish communication with the cloud backend, resolving the inactive state without requiring a full re-onboarding.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 5

You have devices enrolled in Microsoft Intune. You need to configure a policy that requires a PIN of at least 6 characters for accessing Microsoft Entra ID resources. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies (Option B) can require a PIN for accessing Microsoft Entra ID resources. Option A is incorrect because device compliance policies evaluate device health but do not enforce PIN requirements for resource access. Option C is incorrect because app protection policies manage app-level data protection, not PIN requirements for Entra ID access. Option D is incorrect because device configuration policies manage device settings like email profiles, not access policies.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration policy

Question 6

An Intune administrator needs to ensure that Windows 10 devices are compliant with security requirements. Which TWO options are valid compliance settings for Windows 10?

Accepted Answer

Require BitLocker. Require BitLocker is a valid compliance setting in Microsoft Intune for Windows 10 devices. It ensures that BitLocker drive encryption is enabled on the system drive, which is a critical security requirement for data protection. This setting can be enforced via a compliance policy to mark devices as noncompliant if encryption is not active.

Answer

Device category must be 'Corporate'

Answer

Device enrollment type must be 'Corporate'

Answer

Require app protection policy

Question 7

Which TWO conditions must be met for a Windows 10 device to be considered compliant with an Intune compliance policy that requires BitLocker and Secure Boot?

Accepted Answer

Secure Boot is enabled.. Secure Boot is a required condition in an Intune compliance policy that mandates Secure Boot. Intune checks that Secure Boot is enabled on the device to ensure that only trusted firmware and OS components are loaded during startup, which is a core security requirement for compliance.

Answer

TPM is present and enabled.

Answer

All fixed drives are encrypted with BitLocker.

Answer

Windows Defender Antivirus is active.

Question 8

Your organization uses Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices for accessing an internal web app. Which profile type should you use?

Accepted Answer

Trusted certificate profile. A Trusted certificate profile is used to deploy a root or intermediate CA certificate that the device must trust for certificate-based authentication, such as accessing an internal web app over HTTPS. This profile type simply installs the certificate into the device's trusted root store without generating a private key, which is exactly what is needed when you only need to establish trust for the server certificate presented by the web app.

Answer

PKCS certificate profile

Answer

SCEP certificate profile

Answer

Custom configuration profile (preferences)

Question 9

Refer to the exhibit. The JSON shows a device queried from Microsoft Graph. The device shows as compliant, but the user reports that they are unable to access corporate resources. The conditional access policy requires device compliance. What is a likely reason for the access issue?

Accepted Answer

The device has not synced recently, so the compliance state may be outdated.. The device's compliance state is determined at the time of the last check-in with Microsoft Intune. If the device has not synced recently, the compliance state shown in Microsoft Graph may be stale, and the Conditional Access policy will evaluate the last known state. Even though the device was compliant at last check-in, changes in device health, configuration, or user context since then could cause access to be denied until a fresh compliance evaluation occurs.

Answer

The device compliance state is actually non-compliant.

Answer

The device is managed by MAM instead of MDM.

Answer

The device enrollment date is too recent.

Question 10

A company uses Microsoft Intune to manage macOS devices. A security audit requires that all macOS devices must have FileVault encryption enabled. Compliance policy reports show that 90% of devices are compliant, but 10% are non-compliant. You review the non-compliant devices and find that FileVault is enabled on them. What is the most likely cause of the non-compliance?

Accepted Answer

The recovery key is not escrowed to Intune.. The most likely cause is that the recovery key is not escrowed to Intune. Even though FileVault is enabled on the device, Intune's compliance policy checks for the presence of the FileVault recovery key in its escrow database. If the key is missing, the device is marked non-compliant because Intune cannot verify full management and recovery capability, which is a key security requirement.

Answer

FileVault is not actually enabled on those devices.

Answer

The devices are not supervised.

Answer

The compliance policy is not assigned to those devices.

Question 11

Which THREE permissions are required for a service account to register devices in Windows Autopilot? (Select THREE.)

Accepted Answer

Intune Administrator role. The Intune Administrator role is required because it grants the necessary permissions to manage Windows Autopilot deployment profiles, upload device hashes, and assign profiles to devices within the Microsoft Intune admin center. Without this role, a service account cannot configure or monitor the Autopilot registration process, as it is a core Intune workload.

Answer

Security Reader role

Answer

Global Administrator role

Question 12

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

Accepted Answer

Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.. The device is hybrid Azure AD joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Answer

Re-enroll the device in Intune.

Answer

Ensure the device has internet connectivity.

Answer

Assign a compliance policy to the device.

Question 13

Which TWO of the following are required to deploy an iOS line-of-business app via Microsoft Intune? (Select TWO.)

Accepted Answer

iOS app package file (.ipa). An .ipa file is the app package. A provisioning profile is needed for app installation. An MDM push certificate is for device management, not app deployment. A VPP token is for volume purchasing. A signing certificate is needed for development, but the provisioning profile includes signing info. So the two required are .ipa and provisioning profile.

Answer

Apple Developer signing certificate

Answer

Volume purchase program (VPP) token

Answer

MDM push certificate

Question 14

You configure Windows Update for Business policies in Intune. Users report that updates are not installing during configured active hours. You verify that the policy is applied. What is the most likely cause?

Accepted Answer

Update notification level is set to 'Disable all notifications' and 'Automatic Updates behavior' is set to 'Notify download'.. When 'Automatic Updates behavior' is set to 'Notify download' and 'Disable all notifications' is enabled, the user never receives the notification to approve the download, so updates are never downloaded or installed. This overrides the active hours configuration because the update process never begins, even though the policy is applied.

Answer

Deadline for feature updates is set to 7 days.

Answer

Quality update deferral period is set to 0 days.

Answer

Active hours start is set to 8:00 AM and end to 5:00 PM.

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

Accepted Answer

Deploy a local AppLocker policy using Intune.. AppLocker, when deployed via Intune as a local policy, allows you to create rules that restrict application execution to only approved Microsoft Store apps. This policy is enforced at the kernel level and does not require users to have local administrator privileges, as the rules are applied system-wide and cannot be overridden by standard users.

Answer

Enable Conditional Access to block non-approved apps.

Answer

Configure Windows Defender Application Control (WDAC) policy.

Answer

Assign an Intune App Protection Policy (APP) for Windows.

Question 16

Your organization uses Microsoft Intune to manage Windows 10 devices. They deploy a Win32 app using detection rules. The app installs but the detection rule incorrectly reports failure, causing repeated installation attempts. What is the best way to resolve this?

Accepted Answer

Update the detection rule to accurately reflect installed state. The detection rule is the mechanism Intune uses to determine whether a Win32 app is already installed. If the rule incorrectly reports failure despite successful installation, Intune will repeatedly attempt to reinstall the app. Updating the detection rule to accurately reflect the installed state (e.g., checking for the correct file, registry key, or version) stops the unnecessary reinstall loop without requiring manual intervention or reconfiguration of the deployment.

Answer

Uninstall and redeploy the app

Answer

Reinstall the app manually

Answer

Modify the installation command to suppress output

Question 17

You need to enable users to install company apps from a private store on their iOS devices. Which Microsoft Intune feature should you use?

Accepted Answer

Volume Purchase Program (VPP). The Volume Purchase Program (VPP) is the correct feature because it allows organizations to purchase app licenses in bulk from Apple and distribute them to users' iOS devices through a private store. By integrating VPP with Microsoft Intune, you can assign licensed apps to users or devices, enabling them to install company-approved apps from a private store without requiring an Apple ID or personal payment.

Answer

Mobile Application Management (MAM) policies

Answer

Certificate profiles

Answer

Company Portal app

Question 18

You deploy a Microsoft 365 Apps for enterprise suite via Intune to Windows devices. Users report that updates are not being applied automatically. You need to ensure that updates are installed from the Office Content Delivery Network (CDN) without user intervention. What should you configure?

Accepted Answer

Configure the Office update channel via an Intune administrative template (ADMX).. Configuring the Office update channel via an Intune administrative template (ADMX) directly sets the registry policy that controls which update channel (e.g., Monthly Enterprise) Office 365 Apps use, and by default, those updates are delivered from the Office Content Delivery Network (CDN) without user intervention. This policy ensures updates are applied automatically in the background, meeting the requirement for no user interaction.

Answer

Configure Delivery Optimization to download from peers.

Answer

Enable Windows Update for Business to manage Office updates.

Answer

Use the Office Deployment Tool to set update settings.

Question 19

Which TWO of the following are supported app types for deploying to iOS devices via Microsoft Intune?

Accepted Answer

iOS line-of-business app. iOS store apps and iOS line-of-business apps are supported. Web links are for any device but not an app type. Win32 and Android are not for iOS.

Answer

Web link

Answer

Android app

Answer

Win32 app

Question 20

Refer to the exhibit. The JSON snippet shows a device compliance policy for Windows 10. You assign this policy to a device group. Some devices report as noncompliant even though they have BitLocker enabled and meet password requirements. What is the most likely cause?

Accepted Answer

The devices are not enrolled in Microsoft Defender for Endpoint.. The deviceThreatProtectionEnabled setting requires devices to be enrolled in Microsoft Defender for Endpoint to report threat levels. Without this enrollment, the compliance policy cannot evaluate the threat status, causing devices to be marked as noncompliant even if BitLocker and password policies are satisfied.

Answer

The deviceThreatProtectionEnabled setting should be false.

Answer

The password minimum length is too short.

Answer

The storageRequireEncryption setting conflicts with BitLocker.