MD-102 Practice Exam 58 — 20 Questions

Question 1

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the system context during automatic enrollment. The script must run before the user logs on. Which approach should you use?

Accepted Answer

Add the script as a device management extension (PowerShell script) in Intune, assigned to 'All Devices'.. Option A is correct because device management extension (PowerShell scripts) in Microsoft Intune run in the system context and execute during automatic enrollment before the user logs on. This is the only Intune method that supports system-context script execution at enrollment time without requiring a user session.

Answer

Assign the script as a compliance policy remediation.

Answer

Deploy the script as a proactive remediation in Microsoft Intune.

Answer

Embed the script in a device configuration profile using a custom OMA-URI.

Question 2

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with TPM 2.0 and UEFI Secure Boot enabled can enroll. Which configuration profile setting should you configure?

Accepted Answer

Enable Device Health Attestation (DHA) in enrollment restrictions. Device Health Attestation (DHA) in enrollment restrictions allows you to block enrollment for devices that do not meet specific hardware security requirements, such as TPM 2.0 and UEFI Secure Boot enabled. When configured, Intune verifies these attestation claims during the enrollment process and rejects non-compliant devices before they can enroll. This is the only setting that enforces hardware prerequisites at the enrollment stage, not after the device is already managed.

Answer

Create a Conditional Access policy requiring compliant devices

Answer

Configure a BitLocker policy in Endpoint Security

Answer

Set a compliance policy for device health

Question 3

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Accepted Answer

Users must have an Intune license assigned.. Option A is correct because Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Answer

Devices must be connected via VPN.

Answer

Tenant must have Azure AD Premium P2.

Question 4

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Accepted Answer

MDM enrollment enabled in Microsoft Entra ID. Option B is correct because Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Answer

A device compliance policy assigned to the device

Answer

Azure AD Premium P1 license

Question 5

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

Accepted Answer

The device's group membership is still being processed, so policies are not yet applied.. Option C is correct because when a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet. The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Answer

The OMA-URI setting is invalid.

Answer

The device is not enrolled.

Answer

The device is not compliant.

Question 6

Refer to the exhibit. You execute this PowerShell script to wipe noncompliant Windows devices. After running, you find that some compliant devices were also wiped. What is the most likely reason?

Accepted Answer

The script uses the wrong Graph API endpoint, causing all devices to be wiped.. Option C is correct because the script uses the wrong Graph API endpoint. The correct endpoint for wiping a device is `/deviceManagement/managedDevices/{deviceId}/wipe`, but the script likely uses an incorrect or generic endpoint (e.g., `/devices/{deviceId}/wipe` or a non-existent path), which causes the API to misinterpret the request or apply the wipe action to all devices in the tenant, including compliant ones. This is a common misconfiguration when targeting the Microsoft Graph API for Intune device actions.

Answer

The filter 'operatingSystem eq 'Windows'' does not match any devices, so the script wiped all devices.

Answer

The script wipes only noncompliant devices, but some compliant devices had a null compliance state.

Answer

The script does not check the device's compliance state before wiping.

Question 7

Your organization is planning to use Microsoft Intune for Windows device management. Which TWO components are required for a successful Windows Autopilot deployment?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is required for Windows Autopilot because it provides the identity and device registration infrastructure. Autopilot uses Entra ID to associate a device with its hardware hash (via the OEM or partner portal) and to authenticate the user during the out-of-box experience (OOBE). Without Entra ID, the device cannot be recognized as an Autopilot device and cannot join the cloud domain.

Answer

Microsoft Endpoint Manager (MDM authority)

Answer

Windows Server Active Directory

Answer

Microsoft Configuration Manager

Question 8

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

Accepted Answer

The device does not meet authentication requirements. The JSON configuration sets 'minimumVersion' to '10.0.22000' (Windows 11) and 'maximumVersion' to '10.0.22621.0' (Windows 11 22H2), which excludes all Windows 10 builds. Since the user is attempting to enroll a Windows 10 device, it falls outside the allowed version range, causing the enrollment block. The error message 'enrollment is blocked' aligns with a version restriction failure, not an authentication issue.

Answer

The enrollment is restricted to Windows Holographic only

Answer

The device type filter excludes Windows 10

Answer

The user already has 5 devices enrolled

Question 9

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app to iOS devices. The app is signed with an enterprise certificate. Some devices report installation failure with error code 0x87D13B9F. What is the most likely cause?

Accepted Answer

The enterprise signing certificate is not trusted on the device.. Error code 0x87D13B9F in Microsoft Intune typically indicates a signing certificate trust issue. Since the app is signed with an enterprise certificate, the device must have that certificate installed and trusted in its trusted root store. If the certificate is not trusted, iOS will reject the installation, producing this specific error.

Answer

The app package is not signed.

Answer

The app is not available in the Apple App Store.

Answer

The device does not have enough storage space.

Question 10

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Accepted Answer

Allows end users to set up their own devices with minimal IT involvement.. Option B is correct because Windows Autopilot leverages the device's hardware identity (hash) to automatically enroll it in Microsoft Entra ID and join it to a domain or tenant, allowing end users to complete the setup process themselves with minimal IT intervention. This reduces helpdesk calls and streamlines the out-of-box experience (OOBE) by presenting only necessary screens.

Answer

Eliminates the requirement for a Microsoft Entra ID subscription.

Answer

Enables device provisioning over a VPN connection.

Answer

Supports deployment without any internet connectivity.

Question 11

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Accepted Answer

Devices enrolled in Microsoft Intune. Option A is correct because devices must be enrolled in Microsoft Intune to establish the co-management authority. Co-management requires that the client is managed by both Configuration Manager and Intune simultaneously, and Intune enrollment is the mechanism that enables the cloud-based management workload. Without Intune enrollment, the device cannot receive policies or apps from Intune, breaking the co-management relationship.

Answer

Configuration Manager current branch

Answer

On-premises Active Directory

Answer

Public Key Infrastructure (PKI)

Question 12

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

Accepted Answer

Trigger a sync from Intune to force the device to check in.. The PowerShell command shown likely runs a compliance evaluation or sync action, but the device remains noncompliant because the evaluation results haven't been reported back to Intune. Triggering a sync from Intune forces the device to check in, upload its latest compliance status, and update the portal, which is the first troubleshooting step before considering re-enrollment or policy changes.

Answer

Re-enroll the device.

Answer

Delete the device from Intune and re-register.

Answer

Assign a new compliance policy to the device.

Question 13

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Accepted Answer

Ensure the device has a Windows 10/11 Pro or Education license. Option A is correct because subscription activation requires a qualifying base license of Windows 10/11 Pro or Education. These editions support the subscription activation feature, which upgrades the device to Windows 10/11 Enterprise without requiring a separate product key. Without this base license, the device cannot be upgraded via subscription activation.

Answer

Enter a MAK key

Answer

Configure a KMS host key

Answer

Install the Azure AD Connect tool

Question 14

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. The app requires installation in the system context. Which deployment method should you use?

Accepted Answer

Win32 app. Win32 apps in Microsoft Intune support installation in the system context via the 'Install behavior' setting, and they can be deployed using a custom installation script that handles certificate trust issues (e.g., by installing the signing certificate first or using a silent install switch). This method also allows the app to run with elevated privileges, which is required for system-context installation, and does not depend on the device trusting the app's signing certificate at deployment time.

Answer

Microsoft Store for Business app

Answer

Microsoft Intune LOB app (msi/appx)

Answer

Web link

Question 15

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

Accepted Answer

Apple Automated Device Enrollment (ADE). Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Answer

Apple Configurator enrollment

Answer

Device Enrollment Manager (DEM) account

Answer

User-initiated enrollment via Company Portal

Question 16

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

Accepted Answer

The DNS CNAME record for enrollment is missing or incorrect. The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Answer

The user does not have an Intune license assigned

Answer

The MDM authority is not set to Intune

Answer

The device firewall is blocking traffic to manage.microsoft.com

Question 17

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Accepted Answer

Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.. Option A is correct because Intune security policies are assigned to Microsoft Entra ID groups. If the device is not a member of the targeted group, it will not receive the policy, resulting in a 'Not compliant' status. Verifying group membership ensures the policy scope is correctly applied.

Answer

Reissue the user's Microsoft 365 license from the admin center.

Answer

Reset the device's enrollment state via the Company Portal.

Answer

Run Invoke-Command to remotely execute gpupdate /force.

Question 18

Refer to the exhibit. You run a PowerShell cmdlet to get managed devices and see the output above. The device is noncompliant. What is the most likely reason?

Accepted Answer

The device has not synced recently.. The device is noncompliant because it has not synced recently. In Microsoft Intune, devices must regularly check in to report their compliance status; if a device fails to sync within the configured grace period (typically 30 days by default), it is marked as noncompliant. The PowerShell output shows the device is enrolled and managed, but the last sync time is missing or outdated, triggering the noncompliant state.

Answer

The device is not enrolled.

Answer

The device name is too long.

Answer

The OS version is not supported.

Question 19

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage endpoint security. You need to ensure that all Windows 10 devices are onboarded to Defender for Endpoint via Microsoft Intune. Which policy type should you use?

Accepted Answer

Endpoint detection and response policy. To onboard Windows 10 devices to Microsoft Defender for Endpoint via Intune, you must use an Endpoint detection and response (EDR) policy. This policy type deploys the required onboarding configuration package (a .cmd script or .xml file) that registers the device with the Defender for Endpoint service, enabling sensor data collection and threat detection. Antivirus, Firewall, and Windows Security experience policies manage separate security features but do not handle the initial onboarding process.

Answer

Antivirus policy

Answer

Firewall policy

Answer

Windows Security experience policy

Question 20

Your organization plans to deploy Windows 11 devices using Windows Autopilot. You need to ensure that each device is automatically enrolled in Intune and receives a custom configuration profile during the out-of-box experience (OOBE). Which two components are required?

Accepted Answer

A device configuration profile assigned to the device. A device configuration profile assigned to the device is required because it defines the custom settings (e.g., security baselines, app restrictions, or network configurations) that must be applied during the out-of-box experience. Without this profile, the device would enroll in Intune but would not receive the specific custom configuration needed for the organization's compliance and operational requirements.

Answer

A Microsoft Defender for Endpoint policy

Answer

A compliance policy

Answer

Windows Autopilot hardware hash