MD-102 Practice Exam 58 — 20 Questions

Question 1

You are troubleshooting an Intune-managed iOS device that cannot install a VPP (Volume Purchase Program) app. The device shows a 'License Not Found' error. The app is assigned as 'Available' without device enrollment. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device is enrolled without user affinity (device enrollment).. The 'License Not Found' error occurs because VPP app licenses are tied to a user principal name (UPN). When a device is enrolled without user affinity (device enrollment), there is no associated user to which the VPP license can be assigned. Since the app is assigned as 'Available' (requiring user-based licensing), the device cannot retrieve a license, resulting in the error.

Answer

The app is configured to remove when the device leaves management.

Answer

The Apple VPP token has expired.

Answer

The device is not compliant with conditional access policies.

Question 2

Refer to the exhibit. You are reviewing an Intune app protection policy (APP) JSON for Windows. A user complains that they cannot copy data from a managed app. Which setting is causing this?

Accepted Answer

cutCopyAllowed and pasteAllowed are set to false. The `cutCopyAllowed` and `pasteAllowed` settings directly control the ability to transfer data out of managed apps. When both are set to `false`, the Intune App Protection Policy (APP) for Windows explicitly blocks cut, copy, and paste operations from the managed app, which matches the user's complaint. Other settings like encryption, organizational restrictions, or PIN requirements do not prevent clipboard operations.

Answer

encryptAppData is set to true

Answer

orgRestriction is set to true

Answer

requirePin is set to true

Question 3

Your organization uses Microsoft Intune to manage devices. You need to collect diagnostic logs from a remote Windows device without user interaction. Which THREE methods can you use?

Accepted Answer

MDM diagnostic log collection policy. The MDM diagnostic log collection policy is a built-in Intune feature that allows administrators to configure and trigger the collection of device diagnostic logs from Windows devices remotely without any user interaction. This policy leverages the Windows MDM protocol to gather logs such as event viewer logs, registry keys, and network traces, and uploads them to an Azure storage container for analysis.

Answer

Device configuration profile

Answer

Microsoft Support and Recovery Assistant

Question 4

An organization uses Microsoft Defender for Endpoint to detect threats on Windows devices. The security team wants Intune to automatically increase the device's risk score when a threat is detected. Which TWO components are required?

Accepted Answer

Device compliance policy with 'Require device threat level' set to 'Low'. A device compliance policy with 'Require device threat level' set to 'Low' forces Intune to evaluate the threat level reported by Microsoft Defender for Endpoint. When a threat is detected that exceeds the 'Low' threshold, the device is marked as noncompliant, which effectively increases the device's risk score in Intune and can trigger subsequent actions like Conditional Access blocks.

Answer

Device configuration profile

Answer

App protection policy

Answer

Conditional Access policy

Question 5

Your organization uses Microsoft Intune to manage 1,000 Windows 10 devices and 500 iOS devices. You need to enforce device compliance policies. For Windows devices, you require BitLocker encryption and Windows Defender Antivirus enabled. For iOS devices, you require a passcode of at least 6 characters and device encryption. Devices that become noncompliant should be marked as such and users should receive a notification email. After 7 days of noncompliance, the device should be blocked from accessing corporate email. You also need to create a report that shows the compliance status of all devices. Which combination of actions should you take?

Accepted Answer

Create Windows and iOS compliance policies with the required settings. Configure actions for noncompliance: send email immediately and block access after 7 days. Use the built-in compliance report.. Intune compliance policies directly enforce device-level settings like BitLocker and passcode length, and they include built-in actions for noncompliance (e.g., send email, block access after a specified number of days). The built-in compliance report in the Intune portal provides an immediate view of all devices' compliance status without requiring manual scripting or additional tools.

Answer

Create app protection policies to require encryption and passcode. Use conditional access to block noncompliant devices.

Answer

Create device configuration profiles for BitLocker and encryption. Use conditional access to block noncompliant devices. Manually generate reports using PowerShell.

Answer

Use Autopilot to enforce encryption and passcode. Use Intune reporting for compliance status.

Question 6

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned work profile.. Android device administrator (DA) is a legacy enrollment method that is deprecated and not recommended for new enrollments. Option B is incorrect because it is a legacy method and not one of the intended two modern methods. Option C is correct because Android Enterprise corporate-owned work profile is a valid enrollment method that enables management of organization-owned devices with a work profile. Option D is correct because Android Enterprise fully managed is a separate, fully managed enrollment method for corporate-owned devices. Both C and D are distinct Android Enterprise enrollment methods in Intune.

Answer

Apple Device Enrollment Program (DEP).

Answer

Android device administrator.

Answer

Windows Autopilot.

Question 7

Which THREE factors should you consider when planning the deployment of Windows 10 feature updates using Intune?

Accepted Answer

Devices must have sufficient disk space to download the update.. Windows 10 feature updates require sufficient free disk space (typically 20–32 GB depending on the version) to download and stage the update files. If a device lacks adequate space, the update will fail or be blocked by Intune's update readiness checks, which evaluate disk space before initiating the deployment.

Answer

The version of Windows 10 determines which update rings are available.

Answer

The feature update compatibility report is only available for Windows 11.

Question 8

A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?

Accepted Answer

Device compliance policy.. Device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level. Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.

Answer

Device configuration policy (settings catalog).

Answer

Conditional Access policy.

Answer

App protection policy.

Question 9

Your organization uses Windows Autopilot and Microsoft Intune. You need to ensure that during the Autopilot deployment, the device automatically installs a set of required applications (Microsoft 365 Apps, company portal, and a line-of-business app) before the user can access the desktop. Which configuration should you use?

Accepted Answer

Configure the Enrollment Status Page (ESP) to block device use until required apps are installed. The Enrollment Status Page (ESP) in Windows Autopilot can be configured to block device use until specified required apps are installed. This ensures that Microsoft 365 Apps, Company Portal, and line-of-business apps are fully deployed before the user reaches the desktop, meeting the requirement of a controlled, app-ready deployment.

Answer

Set a device compliance policy to require all apps to be installed

Answer

Use a PowerShell script that runs during Autopilot to install apps

Answer

Configure an Autopilot deployment profile with the 'Skip EULA' option

Question 10

You need to deploy a line-of-business (LOB) app to 100 Windows 10 devices managed by Intune. The app is packaged as an .msi file. Which app type should you choose in Intune?

Accepted Answer

Line-of-business app. For deploying a line-of-business (LOB) app packaged as an .msi file to Windows 10 devices managed by Intune, the correct app type is 'Line-of-business app'. This app type is specifically designed for sideloading enterprise internal apps that are not distributed via the Microsoft Store, and it supports .msi, .appx, and .appxbundle file formats. It allows direct upload of the .msi file to Intune and assigns it to users or devices without requiring complex Win32 app preparation.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 11

Your organization uses Microsoft Intune for device management. A user reports that their Android device is not receiving a required app that is assigned as 'Required' for all users. The device shows as 'Compliant' in Intune. What is the most likely cause?

Accepted Answer

The app is not supported on the device's Android version.. The device is compliant and enrolled, and the user has the Company Portal app (required for Android enrollment). The most likely reason the required app is not installing is that the app is not supported on the device's Android version. Intune will skip installation if the minimum OS version requirement defined in the app assignment is not met, even if the device is otherwise compliant.

Answer

The device is marked non-compliant.

Answer

The user has not installed the Company Portal app.

Answer

The device is not enrolled in Intune.

Question 12

You need to configure Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. What is the recommended method to onboard devices?

Accepted Answer

Use a device configuration profile in Intune to deploy the onboarding package.. Intune's device configuration profiles allow you to deploy the Defender for Endpoint onboarding package (a .zip containing the onboarding script and required files) directly to Windows 10 devices. This method is recommended as it integrates seamlessly with Intune's management framework, supports bulk deployment via policies, and ensures devices are properly configured without manual intervention or user interaction.

Answer

Install the Defender for Endpoint client manually on each device.

Answer

Use the Microsoft 365 Defender portal to generate a script that users run.

Answer

Use Group Policy to configure the onboarding registry keys.

Question 13

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

Accepted Answer

The DNS CNAME record for enrollment is missing or incorrect. The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Answer

The user does not have an Intune license assigned

Answer

The MDM authority is not set to Intune

Answer

The device firewall is blocking traffic to manage.microsoft.com

Question 14

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.. Creating a Conditional Access policy in Microsoft Entra ID that requires compliant devices for Exchange Online is the correct integration because it directly enforces device compliance as a condition for accessing corporate email. This policy evaluates the device's compliance status reported by Intune before granting access to Exchange Online, ensuring only compliant devices can use Outlook for Windows.

Answer

Enable App Protection Policies for Outlook for Windows.

Answer

Require all devices to be enrolled in Intune before accessing email.

Answer

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Question 15

You need to deploy Microsoft 365 Apps for enterprise to 500 Windows 10 devices using Microsoft Intune. Devices are in multiple time zones. You want to minimize network impact during business hours. Which deployment approach should you use?

Accepted Answer

Configure dynamic installation from Microsoft 365 Apps admin center with gradual rollout and set maintenance window.. The Microsoft 365 Apps admin center allows you to configure a gradual rollout with a maintenance window, which lets you schedule deployments during off-peak hours across multiple time zones, minimizing network impact during business hours. This approach uses the 'Cloud Update' channel to control update distribution and can be integrated with Intune for policy enforcement, ensuring that devices in different time zones receive the installation at their respective low-activity periods.

Answer

Use Intune 'Microsoft 365 Apps for Windows 10 and later' built-in app type with delivery optimization.

Answer

Deploy the offline installer using Intune Win32 app packaging.

Answer

Assign the app to a device group and set deadline for immediate installation.

Question 16

A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?

Accepted Answer

Conditional Access policies with device compliance. Conditional Access policies with device compliance (Option D) is the correct technology because it integrates Intune compliance policies with Azure AD Conditional Access to enforce access controls on Exchange Online. When a device is marked non-compliant by Intune, Conditional Access blocks or restricts access to Exchange Online, ensuring only compliant devices can connect. This is the standard Microsoft approach for combining device management with identity-driven access control.

Answer

Mobile Application Management (MAM) policies

Answer

Intune compliance policies without Conditional Access

Answer

Azure AD join with automatic enrollment

Question 17

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom PKG file that requires administrative privileges to install. The deployment must be silent without user interaction. What should you do?

Accepted Answer

Deploy the PKG as a line-of-business app in Intune and assign it as required.. Intune supports deploying PKG files as line-of-business (LOB) apps on macOS. When you upload the PKG and assign it as 'Required', Intune silently installs it using the macOS Installer framework with administrative privileges, without requiring user interaction. The Intune management agent on the device handles the installation in the system context, ensuring a silent deployment.

Answer

Use a shell script to run the PKG installer with sudo privileges via a launch daemon.

Answer

Add the PKG to Apple Business Manager and distribute via VPP.

Answer

Place the PKG in a network share and instruct users to install via Company Portal.

Question 18

Which THREE features are available in Microsoft Intune for managing Windows 10/11 device updates?

Accepted Answer

Update rings for Windows 10 and later. Update rings for Windows 10 and later (option B) are a core Intune feature that allows administrators to configure Windows Update for Business settings, such as deferral periods, pause windows, and update deadlines, and then assign these policies to groups of devices. This enables controlled rollout and compliance management of quality and feature updates directly from the cloud without requiring on-premises infrastructure.

Answer

Windows Update for Business

Answer

Windows Server Update Services (WSUS)

Question 19

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom VPN configuration that uses per-app VPN and certificate-based authentication. The certificate is already deployed via a PKCS certificate profile. However, the VPN connection fails. What is the most likely reason?

Accepted Answer

The per-app VPN profile does not include the app bundle IDs or is not associated with the certificate. Per-app VPN on iOS requires a VPN profile that includes the app identifier list and associates it with the certificate, and the certificate must be properly configured. Option A is wrong because the certificate is already deployed. Option C is wrong because per-app VPN does not require a separate MDM profile for each app. Option D is wrong because the VPN server type is not necessarily the issue.

Answer

The certificate is not trusted by the device

Answer

The VPN profile is not assigned to the correct device group

Answer

The VPN server type is not supported by iOS

Question 20

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

Accepted Answer

Screen timeout exceeds the policy setting. The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Answer

Device threat protection level is not set to high

Answer

Storage encryption is not enabled

Answer

OS version is above the maximum allowed