MD-102 Practice Exam 59 — 20 Questions

Question 1

An administrator is troubleshooting why a Win32 app is repeatedly installed on a device. The exhibit shows a log snippet. What is the most likely cause of the repeated installation?

Accepted Answer

The app writes the detection file to a temporary folder that is cleaned periodically. If the Win32 app's detection file is written to a temporary folder (e.g., %TEMP% or C:\Windows\Temp) that is periodically cleaned by disk cleanup policies or the Storage Sense feature, Intune will no longer detect the app as installed after the file is removed. This causes the Microsoft Intune Management Extension to re-run the installation on the next sync cycle, leading to a repeated installation loop. The detection rule relies on the persistent presence of the file, so its removal triggers reinstallation.

Answer

The app requires a reboot to complete installation

Answer

The detection rule runs before the install completes

Answer

The exit code 0 is misinterpreted as failure

Question 2

You are troubleshooting an Intune-managed Windows 10 device that is not receiving a required application. Which THREE steps should you take to diagnose the issue? (Choose three.)

Accepted Answer

Ensure the device has network connectivity. Network connectivity is a prerequisite for Intune-managed devices to communicate with the Microsoft Intune service. Without connectivity, the device cannot check in, download app policies, or retrieve application payloads. You should verify the device can reach endpoints like *.manage.microsoft.com and that the Windows Push Notification Services (WNS) channel is open.

Answer

Verify the device is compliant with compliance policies

Answer

Perform a factory reset on the device

Question 3

You need to deploy a line-of-business app to 100 Windows 10 devices that are managed by Microsoft Intune. The app installer is a .msi file. Which app type should you select when adding the app in Microsoft Intune?

Accepted Answer

Windows app (Win32). D is correct because Win32 app management in Intune supports deploying traditional desktop applications, including .msi files, to Windows 10 devices. Win32 apps can be assigned to devices managed by Intune and allow for complex installation commands, detection rules, and dependencies, making them suitable for line-of-business apps that require full control over the installation process.

Answer

Microsoft Store app (Windows)

Answer

Windows app (Line-of-business)

Answer

Web link

Question 4

You need to configure Microsoft Defender for Endpoint on macOS devices. Which THREE components must be installed?

Accepted Answer

Microsoft Defender for Endpoint daemon. The Microsoft Defender for Endpoint daemon (mdatp) is the core service that runs in the background on macOS, handling threat detection, real-time protection, and communication with the cloud backend. Without this daemon, the product cannot perform its primary security functions, making it a mandatory component for any installation.

Answer

Microsoft Intune management extension

Answer

Configuration Manager client

Question 5

Contoso Ltd. uses Microsoft Intune to manage Windows 11 devices. They need to deploy a Line-of-Business (LOB) app (ContosoApp.msi) to 500 devices in a pilot group. The app requires admin privileges and must be installed in the system context. The deployment must be silent with no user interaction, and the installation status must be reported to Intune. They have created a Win32 app wrapper and uploaded the .intunewin file. Which configuration should they choose in the Intune Win32 app properties to meet the requirements?

Accepted Answer

Install behavior: System, Device restart behavior: No specific action. Setting Install behavior to System ensures the app runs with admin privileges and installs in the system context, while Device restart behavior set to No specific action allows any necessary restarts to occur without blocking installation. This meets the requirements of silent deployment with no user interaction and status reporting to Intune. Option A is incorrect because User install behavior does not provide system-level privileges. Option C is incorrect because Suppress restarts may prevent necessary restarts, potentially causing the installation to fail or not complete properly. Option D is incorrect because User install context with the app requiring admin rights will fail to install correctly.

Answer

Install behavior: User, Device restart behavior: No specific action

Answer

Install behavior: System, Device restart behavior: Suppress restarts

Answer

Install behavior: User, Device restart behavior: Block restarts until installation completes

Question 6

Your organization uses Microsoft Intune to manage 1,500 Windows 10 and 500 macOS devices. You need to deploy Microsoft Edge (Stable channel) to all Windows devices. The deployment must ensure that Edge is set as the default browser, and that the 'SmartScreen' feature is enabled. You also want to ensure that users cannot change the default browser setting. You have created a configuration profile with the required settings. The Edge app is available in the Microsoft Store for Business. Which deployment method should you use to meet all requirements with the least administrative effort?

Accepted Answer

Use the 'Microsoft Edge for Windows 10 and later' built-in app type in Intune, assign it as 'Required' to a device group, and apply the configuration profile.. The built-in 'Microsoft Edge for Windows 10 and later' app type in Intune provides a streamlined deployment for Edge. It allows specifying the channel (Stable), and configuration profiles can enforce the default browser and enable SmartScreen. This requires the least administrative effort as it's fully integrated. Option A (PowerShell script) requires custom scripting and registry manipulation, which is more effort and less manageable. Option B (Win32 app) works but requires downloading the offline installer and applying the configuration profile separately, whereas the built-in type is simpler. Option D (Store for Business app) requires OMA-URI for settings, but the built-in app type already supports configuration profiles, making it unnecessary.

Answer

Use a PowerShell script to install Edge and apply settings via registry.

Answer

Deploy Edge as a Win32 app using the offline installer, and apply the configuration profile separately.

Answer

Deploy Edge as a Microsoft Store for Business app and use OMA-URI to set default browser.

Question 7

You need to configure Windows 10 devices to automatically encrypt their drives using BitLocker when they enroll in Microsoft Intune. You have created a BitLocker policy in Endpoint Security. However, after enrollment, some devices are not encrypted. You verify that the devices have a TPM 2.0 and meet hardware requirements. What is the most likely reason for the failure?

Accepted Answer

The BitLocker policy does not require a recovery password to be saved to Azure AD.. BitLocker requires a recovery key to be escrowed to Azure AD before encryption can proceed when managed via Intune. If the policy does not mandate saving the recovery password to Azure AD, the encryption process will fail silently on devices that meet all hardware prerequisites, including TPM 2.0. This is a common configuration oversight in Endpoint Security BitLocker policies.

Answer

The devices do not have Secure Boot enabled.

Answer

The TPM is not enabled in the BIOS.

Answer

The devices are not compliant with the BitLocker compliance policy.

Question 8

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

Accepted Answer

bitLockerDisableWarningForOtherDiskEncryption set to false. Setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Answer

bitLockerEncryptionMethod set to aes256

Answer

passwordRequired set to true

Answer

bitLockerDisableWarningForOtherDiskEncryption set to true

Question 9

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

Accepted Answer

Set the install context to system.. Setting the install context to 'system' runs the Win32 app installer with the SYSTEM account, which has the highest privileges on a Windows device. This ensures the installer can perform actions requiring admin rights, such as writing to Program Files or modifying system registry keys, without user interaction or credential prompts. In Intune, the system context is the only way to silently deploy apps that demand elevated permissions.

Answer

Set the install context to user.

Answer

Assign the app as required for all users.

Answer

Use a line-of-business app type instead.

Question 10

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

Accepted Answer

Obtain the hardware hash from the device manufacturer or reseller.. The hardware hash can be obtained from the device manufacturer or reseller (OEM) before the device is shipped. This is the recommended approach for new devices as it allows the hardware hash to be uploaded to Intune without needing to power on the device. Option A is wrong because adding the device to Microsoft Entra ID does not upload the hardware hash. Option C is wrong because Configuration Manager can collect hashes but requires the device to be on the network and is typically used for existing devices. Option D is wrong because running a PowerShell script on each device requires the device to be powered on and manually executed, which is less efficient for new devices.

Answer

Add the device to Microsoft Entra ID before shipping.

Answer

Use Microsoft Configuration Manager to collect the hardware hash.

Answer

Run a PowerShell script on each device to capture the hardware hash.

Question 11

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

Accepted Answer

Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.. The issue is likely a misconfiguration of the compliance policy assignment or evaluation. Android Enterprise work profile devices use file-based encryption by default, which Intune considers compliant. If devices are marked non-compliant despite encryption being enabled, you should verify that the compliance policy is correctly assigned to the target groups and re-evaluate the policy. Option A is incorrect because the work profile is already enabled on the device. Option B is incorrect because Intune cannot change the encryption method on Android devices; encryption type is device-specific. Option D is incorrect because device configuration profiles cannot enforce encryption on the work profile; encryption is managed by the device OS.

Answer

Enable the work profile on the devices via a device configuration profile.

Answer

Change the device encryption method to full-disk encryption using a device configuration profile.

Answer

Create a device configuration profile that enforces encryption on the work profile.

Question 12

You are deploying a line-of-business (LOB) app to iOS devices using Microsoft Intune. The app is signed with an enterprise certificate. Users report that the app installs but crashes immediately on launch. What is the most likely cause?

Accepted Answer

The enterprise developer certificate is not trusted on the device.. The most likely cause is that the enterprise developer certificate is not trusted on the device. iOS requires that enterprise-signed apps have their root certificate manually trusted via a profile (e.g., MDM or manual installation) before the app can run. Without this trust, iOS blocks the app from executing, causing an immediate crash on launch.

Answer

The Intune company portal app is not installed.

Answer

The app is not signed.

Answer

The app requires a VPN connection.

Question 13

Which TWO of the following are types of app protection policies (APP) in Microsoft Intune?

Accepted Answer

iOS/iPadOS. In Microsoft Intune, app protection policies (APP) are designed to manage and protect app data on devices that may or may not be enrolled in MDM. The two supported mobile platforms for APP are iOS/iPadOS and Android, as these platforms allow granular control over app-level data through Intune SDK-integrated apps or managed browsers.

Answer

macOS

Answer

Windows 10/11

Answer

Web apps

Question 14

A company uses Microsoft Intune to manage Windows 11 devices. They want to deploy a Win32 app that requires user interaction during installation. The app must be installed with administrative privileges. Which installation behavior setting should you configure?

Accepted Answer

System context (device). The correct setting is 'System context (device)' because the app must be installed with administrative privileges. In Intune, the 'System' installation behavior runs the installer as the SYSTEM account, which inherently has administrative privileges. While this context does not allow user interaction, the requirement for admin privileges takes precedence. If user interaction were absolutely necessary, a different installation method (such as running the installer in user context with self-elevation) would be required, but the question asks for the installation behavior setting that provides administrative privileges, which is System context.

Answer

Installation time (64-bit vs 32-bit)

Answer

Device restart behavior

Answer

User context (user)

Question 15

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a Microsoft 365 Apps for Enterprise to work profiles. Which app type should you select in Intune?

Accepted Answer

Managed Google Play app. For deploying Microsoft 365 Apps for Enterprise to Android Enterprise work profiles, the correct app type is Managed Google Play app. Intune integrates with Managed Google Play to distribute approved apps to work profiles, ensuring compliance with Android Enterprise policies. Web apps, system apps, and line-of-business apps cannot deliver the full Microsoft 365 suite with managed configuration and app protection policies in a work profile context.

Answer

Web app

Answer

Android Enterprise system app

Answer

Line-of-business app

Question 16

You are reviewing an Intune endpoint protection profile for Windows 10. The exhibit shows a JSON snippet of the configuration. A user reports that a device detected malware with moderate severity, but the action taken was 'quarantine'. However, the desired action is 'clean'. Which setting should you modify?

Accepted Answer

defenderDetectedMalwareActions for moderateSeverity. The `defenderDetectedMalwareActions` setting in Intune endpoint protection profiles allows you to specify the remediation action for each threat severity level, including moderate. Since the user wants 'clean' instead of 'quarantine' for moderate severity threats, you must modify the `moderateSeverity` value within this setting. This is the only setting that controls per-severity remediation actions for Microsoft Defender Antivirus.

Answer

defenderScheduleScanDay and defenderScheduleScanTime

Answer

A global setting to override all actions

Answer

defenderScanType

Question 17

Which TWO actions should you take to ensure that only healthy Windows 10/11 devices can access Microsoft 365 services? (Choose two.)

Accepted Answer

Create a device compliance policy that includes health attestation checks. A device compliance policy with health attestation checks uses Windows Health Attestation Service (WHAS) to verify that devices have secure boot, BitLocker enabled, and no kernel-level tampering. This ensures only devices meeting hardware-level security baselines can be marked as compliant, which is a prerequisite for Conditional Access policies that gate access to Microsoft 365 services.

Answer

Configure Intune enrollment

Answer

Use Windows Autopilot to pre-provision devices

Answer

Deploy an app protection policy to M365 apps

Question 18

A company uses Microsoft Intune to manage Windows 10 devices. They are deploying a Win32 app using the Intune Management Extension. The app requires a reboot and must ensure that the installation completes successfully before the device is allowed to restart. Which TWO deployment settings should be configured?

Accepted Answer

Set 'Device restart behavior' to 'No specific action'. Setting 'Device restart behavior' to 'No specific action' allows Intune to complete the Win32 app installation without forcing an immediate reboot, which is necessary when the app itself handles the reboot or when you want to control the restart timing. This setting prevents the Intune Management Extension from triggering a restart before the installation is fully complete, ensuring the app's post-installation processes (e.g., file copies, registry writes) finish successfully.

Answer

Enable 'Delivery optimization' for the app

Answer

Set 'Device restart behavior' to 'Require device restart'

Answer

Configure 'Supersedence' to replace the app

Question 19

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company portal app that allows users to enroll their devices. Which app type should you use?

Accepted Answer

iOS and macOS store app. The Company Portal app for macOS is available in the Apple App Store and is distributed via Intune as an iOS and macOS store app. This app type allows Intune to manage the app installation and assignment from the store, enabling users to enroll their macOS devices into management. Built-in apps are for pre-installed system apps, web links are for shortcuts, and LOB apps are for custom in-house apps, none of which provide the required enrollment functionality.

Answer

Built-in app

Answer

Web link

Answer

macOS LOB app

Question 20

You need to deploy Microsoft Defender for Endpoint to Windows 10 devices using Microsoft Intune. Which TWO methods can you use to deploy the Microsoft Defender for Endpoint client?

Accepted Answer

As a line-of-business (LOB) app in Intune.. You can deploy the Microsoft Defender for Endpoint client as a line-of-business (LOB) app in Intune by uploading the Windows Defender ATP client installation file (e.g., WindowsDefenderATPOnboardingPackage.zip) and targeting it to Windows 10 devices. Option D is correct because you can use a device configuration profile with the 'Microsoft Defender for Endpoint' Configuration Service Provider (CSP) to configure and deploy the client settings, such as onboarding and policy enforcement, directly via Intune.

Answer

Using Group Policy connected to Intune.

Answer

From the Microsoft Store for Business.

Answer

Via Microsoft Configuration Manager.