MD-102 Practice Exam 57 — 20 Questions

Question 1

Refer to the exhibit. You apply this Intune custom OMA-URI policy to a Windows 10 device. What is the expected outcome?

Accepted Answer

VPN connections over cellular are blocked.. The OMA-URI ./Device/Vendor/MSFT/Policy/Config/Connectivity/AllowCellularData refers to the policy that controls whether cellular data is allowed for VPN connections. When set to 0, it blocks VPN connections over cellular networks, enforcing that VPN traffic must use Wi-Fi or Ethernet. This is a device-level policy, not user-specific, and the OMA-URI is valid for Windows 10 devices managed by Intune.

Answer

VPN connections are allowed over cellular networks.

Answer

The policy will fail to apply due to an invalid OMA-URI.

Answer

The policy applies only to users, not devices.

Question 2

You are configuring Windows Hello for Business in Microsoft Intune. Which THREE settings are required to enable Windows Hello for Business on Windows 10 devices?

Accepted Answer

Set minimum PIN length to at least 4 digits.. Option B is correct because Windows Hello for Business requires a minimum PIN length of at least 4 digits when configured via Intune's identity protection policy. This setting is mandatory to enforce a baseline level of security for the PIN-based authentication method, and Intune will not enable Windows Hello for Business without a defined minimum PIN length.

Answer

Configure a certificate enrollment policy for smart cards.

Answer

Enable biometric authentication.

Question 3

Which TWO of the following are required to configure Windows Autopilot for existing devices?

Accepted Answer

A hardware hash (4K HH) from the device.. Option D is correct because the hardware hash (4K HH) is the unique identifier that Windows Autopilot uses to associate a device with an Autopilot deployment profile. This hash must be harvested from the existing device (e.g., via a PowerShell script or a provisioning package) and uploaded to the Autopilot service to register the device. Without the hardware hash, the device cannot be recognized as an Autopilot device during the out-of-box experience (OOBE).

Answer

A Windows product key.

Answer

A local administrator account on the device.

Answer

An Azure AD Premium P1 license.

Question 4

Which TWO settings can be configured in a Microsoft Intune device compliance policy for iOS/iPadOS?

Accepted Answer

Require a password. Option C is correct because Intune device compliance policies for iOS/iPadOS include a setting to require a password on the device, which can enforce specific password complexity rules such as minimum length, number of complex characters, and lockout behavior. This setting is a core compliance requirement for securing devices that access corporate resources.

Answer

Allow app installation from App Store only

Answer

Block USB devices

Answer

Jailbroken devices

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a custom security baseline that includes blocking PowerShell scripts from running unless they are signed by a trusted publisher. Which configuration should be applied?

Accepted Answer

Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.. Option A is correct because setting the PowerShell Execution Policy to 'AllSigned' via Administrative Templates in Intune ensures that PowerShell scripts can only run if they are signed by a trusted publisher. This policy is enforced through Group Policy or Intune's Settings Catalog, directly controlling the PowerShell execution policy at the machine level, which meets the requirement for a custom security baseline.

Answer

Create a Windows Defender Application Control (WDAC) policy that blocks unsigned scripts.

Answer

Enable BitLocker with Secure Boot to validate script integrity.

Answer

Configure AppLocker rules to deny execution of PowerShell scripts.

Question 6

You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?

Accepted Answer

Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.. Option D is correct because enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.

Answer

Configure a device compliance policy to mark the device as non-compliant.

Answer

Enable 'Manual investigation' in the endpoint security policy.

Answer

Create an alert rule in Microsoft Defender XDR to notify administrators.

Question 7

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

Accepted Answer

A device with OS version 10.0.17134.2 (build 1803).. The compliance policy targets Windows 10 version 1803 (build 17134.1). A device with OS version 10.0.17134.2 (build 1803) is non-compliant because its build number (17134.2) is higher than the policy's specified minimum version (17134.1), and compliance policies typically enforce a minimum OS version, not an exact match. Any device with a build number greater than the policy's defined version is marked non-compliant unless the policy explicitly allows higher versions.

Answer

A device with OS version 10.0.16299.0 (build 1709).

Answer

A device with OS version 10.0.17134.1 (build 1803).

Answer

A device with OS version 10.0.15063.0 (build 1703).

Question 8

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

Accepted Answer

Create a custom device preparation profile with delegated admin privileges.. Option D is correct because a custom device preparation profile with delegated admin privileges allows a hardware vendor to register devices in your tenant via Autopilot without granting them full user privileges. This profile grants the vendor scoped permissions to upload device hashes and associate them with your tenant, using delegated administration in Microsoft Entra ID to limit access to only the necessary actions for device enrollment.

Answer

Export the device list from the vendor and import it via CSV in Microsoft Intune.

Answer

Add the vendor as a global administrator in Microsoft Entra ID.

Answer

Provide the vendor with a bulk enrollment token and URL.

Question 9

You need to enroll macOS devices into Microsoft Intune. What is the required enrollment method?

Accepted Answer

Company Portal app. The Company Portal app is the required enrollment method for macOS devices when using user-driven enrollment with Intune. It allows users to authenticate, download management profiles, and register their device via the Intune Company Portal, which is the standard approach for bring-your-own-device (BYOD) scenarios or when automated enrollment is not configured.

Answer

Device Enrollment Manager (DEM)

Answer

Apple Automated Device Enrollment (ADE)

Answer

Apple Configurator

Question 10

Refer to the exhibit. You are reviewing a JSON policy for Windows 10 compliance. Which of the following is required by this policy?

Accepted Answer

A TPM chip present and enabled. The JSON policy includes the setting 'requireTPM' with a value of 'true', which mandates that a Trusted Platform Module (TPM) chip must be present and enabled on the device to be compliant. TPM provides hardware-level security for cryptographic operations and is a key requirement for features like BitLocker, but the policy itself specifically enforces TPM presence, not encryption status.

Answer

Secure Boot disabled

Answer

BitLocker drive encryption enabled

Answer

A password of at least 8 characters

Question 11

You need to configure device compliance policies in Microsoft Intune for Windows 10 devices. Which THREE settings can you include in a compliance policy? (Choose three.)

Accepted Answer

Require BitLocker.. Option A is correct because BitLocker is a built-in Windows 10 encryption feature that can be required via a device compliance policy in Microsoft Intune. When you configure a compliance policy for Windows 10, you can set the 'Require BitLocker' setting to 'Require' to ensure the device's operating system drive is encrypted, which is a common security baseline for corporate devices.

Answer

Maximum OS version.

Answer

Allow camera.

Question 12

You are reviewing an ARM template for Intune device configuration. The exhibit shows a snippet. What will be the effect on Windows 10 devices?

Accepted Answer

Automatic updates will be disabled.. The ARM template snippet configures the 'UpdateNotificationLevel' setting to '1' (Disable all notifications), which is part of the 'Update' policy CSP. This setting disables automatic update checks and notifications, effectively preventing Windows 10 devices from automatically downloading and installing updates. The 'AllowAutoUpdate' setting is not present or set to '0', which would explicitly disable automatic updates, but the 'UpdateNotificationLevel' of '1' achieves the same outcome by suppressing all update-related notifications and background checks.

Answer

Users can sideload trusted apps.

Answer

Devices will receive updates from WSUS.

Answer

Developer unlock is allowed.

Question 13

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Accepted Answer

Assign to a device group.. Option D is correct because Microsoft Intune supports assigning Microsoft 365 Apps for enterprise directly to device groups, which ensures the application is installed on the specified devices regardless of which user signs in. This method is useful for shared or kiosk devices where user-based assignment would not apply. Option E is correct because assigning to a Microsoft Entra ID user group is the standard method for user-based deployment, allowing the apps to be provisioned based on user identity.

Answer

Assign to individual users directly.

Answer

Assign to a distribution group.

Answer

Assign to a dynamic group using device attributes.

Question 14

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. Some devices running Windows 10 22H2 (build 19045.3803) are marked as noncompliant. What is the most likely reason?

Accepted Answer

The device has a password length of 6 characters, not meeting the minimum of 8.. Option A is correct because the compliance policy specifies a minimum password length of 8 characters, and devices with a password length of 6 characters fail this requirement. In Microsoft Intune, compliance policies evaluate device settings against defined rules, and a password length below the minimum is a common reason for noncompliance. The devices are running Windows 10 22H2 (build 19045.3803), which is within the allowed OS version range, so the issue is specifically the password policy.

Answer

The policy requires a firewall, but Windows Defender Firewall is disabled on the device.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device is running a build outside the allowed OS version range specified in the policy.

Question 15

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

Accepted Answer

The update ring is not assigned to the device's group.. Option D is correct because the device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Answer

The update ring is configured with an incorrect deferral period.

Answer

The device is not compliant with the security baseline.

Answer

Windows Update is blocked by the corporate firewall.

Question 16

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Accepted Answer

The Microsoft Intune agent installed on the Linux device.. Option A is correct because the Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

An Azure Active Directory Premium P2 license for each user.

Question 17

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

Accepted Answer

Microsoft 365 Apps for Windows. The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Answer

Web link

Answer

Windows app (MSI)

Answer

Line-of-business app

Question 18

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

Accepted Answer

The conditional access policy has the grant control set to 'Require device to be marked as compliant'.. Option A is correct because the most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Answer

All users have the required Microsoft 365 license.

Answer

The conditional access policy includes all cloud apps.

Answer

The device platform condition is set to iOS and Android only.

Question 19

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

Accepted Answer

Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.. Option A is correct because a Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Answer

Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

Answer

Set a device compliance policy that requires device name prefix 'CORP-'.

Answer

Modify the Enrollment Status Page (ESP) policy to require device naming.

Question 20

Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Accepted Answer

Bulk enrollment using provisioning package. Option D is correct because Windows provisioning packages (PPKG) created with Windows Configuration Designer allow bulk enrollment of Windows devices into Intune without user interaction. This method is ideal for large-scale deployments where devices are not yet Azure AD joined or Autopilot-registered, as the PPKG contains the enrollment credentials and settings to automatically join the device to Azure AD and enroll it in Intune during the out-of-box experience (OOBE).

Answer

VPN connection

Answer

Cloud Management Gateway

Answer

Azure AD join

MD-102 Practice Exam 57 — 20 Questions

Exhibit

MD-102 Practice Exam 57 — 20 Questions

Exhibit