MD-102 Practice Exam 60 — 20 Questions

Question 1

You have a Microsoft Intune environment with devices running Windows 10 and 11. You need to configure a policy that enforces BitLocker drive encryption with a TPM protector and stores recovery key in Microsoft Entra ID. Which three settings must you configure in the endpoint protection profile? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store recovery key in Microsoft Entra ID. The 'Store recovery key in Microsoft Entra ID' setting ensures that the BitLocker recovery key is automatically backed up to the user's Microsoft Entra ID object. This is essential for recovery scenarios and is a key requirement for managing BitLocker via Intune, as it allows administrators to retrieve the key from the Entra admin center.

Answer

Require encryption of OS drive

Answer

Choose encryption method (XTS-AES 128-bit)

Question 2

Refer to the exhibit. A detection script for a Win32 app in Intune uses a WMI query. The script is expected to detect if BitLocker is not enabled. What will the script return if BitLocker is enabled on the device?

Accepted Answer

It returns no results, indicating that BitLocker is enabled.. The WMI query in the detection script uses the `SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter = 'C:' AND ProtectionStatus = 0` condition. When BitLocker is enabled, `ProtectionStatus` is 1, so no volumes match the query. The script returns no results, which Intune interprets as the application not being detected (i.e., BitLocker is enabled, so the detection condition is not met).

Answer

It returns the protection status as 1.

Answer

It returns the drive letter of the protected volume.

Answer

It returns an error because the query is invalid.

Question 3

Which TWO of the following are prerequisites for deploying a Win32 app via Microsoft Intune?

Accepted Answer

The app must be packaged using the Microsoft Win32 Content Prep Tool.. The Microsoft Win32 Content Prep Tool is required to package Win32 apps into the .intunewin format that Intune can process. This tool pre-processes the installation files and detection logic, ensuring the app can be uploaded and deployed through the Intune console.

Answer

The device must be running Windows 10 version 1803 or later.

Answer

The device must be Azure AD joined.

Answer

The device must have the Company Portal app installed.

Question 4

Which THREE are valid methods to deploy an app as available for users in Microsoft Intune?

Accepted Answer

Assign the app to a user group with the 'Required' setting. Assigning an app with the 'Required' setting to a user group forces the app to be installed on the user's devices, making it available for deployment. In Microsoft Intune, the 'Required' assignment is a valid method to deploy an app as available for users, as it triggers automatic installation based on user identity. This ensures the app is pushed to all devices associated with the user group, aligning with the scenario of making an app available.

Answer

Assign the app to a device group with the 'Available' setting

Answer

Add the app to the Company Portal as a featured app without assignment

Question 5

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

Accepted Answer

Add a shell script under Devices > Scripts. In Microsoft Intune, shell scripts for macOS are managed under Devices > Scripts, where you can add a script with a specific shell (e.g., bash, sh, zsh) and configure its execution frequency, run context, and notifications. This is the correct method because Intune natively supports deploying and running shell scripts on macOS devices via the Intune management agent, without requiring additional infrastructure.

Answer

Use Company Portal to distribute the script

Answer

Add a PowerShell script under Devices > Scripts

Answer

Create a custom configuration profile with Bash script

Question 6

Your organization is planning to use Microsoft Intune to manage Windows 11 devices. Which TWO are prerequisites for enrolling a Windows device in Intune?

Accepted Answer

Network connectivity to https://manage.microsoft.com and other Intune endpoints.. Network connectivity to https://manage.microsoft.com and other Intune endpoints is essential for device enrollment. Without this connectivity, the device cannot communicate with the Intune service to complete registration, policy retrieval, or management tasks. This requirement applies to all enrollment methods, including automatic enrollment via Azure AD join and manual enrollment via the Company Portal.

Answer

Local administrator account on the device.

Answer

Microsoft Copilot for Microsoft 365 license.

Answer

Azure AD Premium P2 license.

Question 7

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

Accepted Answer

It uses the password type configured in the device's local policy. When the password type is set to 'deviceDefault' in a Microsoft Intune compliance policy for Windows 10, the policy does not enforce a specific password type (e.g., alphanumeric or numeric). Instead, it defers to the password type already configured in the device's local security policy (via Local Group Policy or the SAM registry). This means the device can still be compliant even if the local policy requires only a simple PIN or no complexity, as long as the local password type meets the minimum length and other requirements defined in the compliance policy.

Answer

It requires a password that meets the minimum length but no complexity

Answer

It does not require a password at all

Answer

It requires a password that contains at least one number and one letter

Question 8

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are implementing a new security policy that requires all devices to have BitLocker enabled with TPM validation. You create a device configuration profile for BitLocker and assign it to all devices. After two days, you notice that only 3,200 devices are compliant with the BitLocker policy. The remaining devices show 'Not applicable' for the setting. You verify that all devices are Windows 10 Pro or Enterprise and have TPM 2.0. What is the most likely cause of the 'Not applicable' status?

Accepted Answer

The system partition is not configured correctly. BitLocker requires a system partition (active partition) that is of sufficient size (typically at least 100 MB) and properly configured. If the system partition is missing or misconfigured, the BitLocker setting will appear as 'Not applicable' even if the device meets other requirements like TPM 2.0. Option A is incorrect because all devices have TPM 2.0 as stated. Option C is incorrect because Secure Boot is not a prerequisite for BitLocker. Option D is incorrect because the devices are already enrolled in Intune.

Answer

Some devices have TPM 1.2 instead of TPM 2.0

Answer

Secure Boot is disabled on some devices

Answer

The devices are not enrolled in Intune

Question 9

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Accepted Answer

Microsoft Intune licenses. And Option D are correct because Autopilot requires Microsoft Entra ID P1/P2 and Intune licenses. Option A is wrong because on-prem AD is not required. Option C is wrong because Configuration Manager is not required. Option E is wrong because a TPM is only required for self-deploying mode.

Answer

An on-premises Active Directory domain

Answer

Configuration Manager

Answer

TPM 2.0 chip on all devices

Question 10

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

Accepted Answer

The policy will block access to the Microsoft Store and Cortana.. The policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device. Option D is wrong because the policy does not affect app installation from other sources.

Answer

The policy will apply only to the primary user of the device.

Answer

The policy will prevent users from installing apps from outside the Microsoft Store.

Answer

The policy will block the camera on all devices.

Question 11

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

Accepted Answer

Ensure the password includes characters from at least 3 character sets.. PasswordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers. Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Answer

Increase passwordMinimumLength to 10.

Answer

Set passwordExpirationDays to 0 to never expire.

Answer

Set passwordRequiredType to 'alphanumeric' (it is already set).

Question 12

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

Accepted Answer

The user account lacks an Intune license.. Error code 0x80180014 during Intune enrollment specifically indicates a licensing issue. Even though the device is registered in Windows Autopilot and has internet connectivity, the user account performing the enrollment must have a valid Intune license assigned (e.g., Microsoft 365 E3, E5, or standalone Intune). Without the license, the Intune service rejects the enrollment request, returning this error.

Answer

Enrollment restrictions are blocking personal devices.

Answer

The device is not registered in Autopilot.

Answer

TPM attestation failed due to hardware incompatibility.

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to enforce that all devices use a 6-digit passcode and that the device automatically wipes after 10 failed attempts. Which profile type should you configure?

Accepted Answer

Device restrictions profile (iOS). A Device restrictions profile (iOS) in Microsoft Intune includes the 'Password' category where you can set minimum passcode length (e.g., 6 digits) and the number of failed attempts before the device wipes. This profile type directly manages device-level security settings on iOS/iPadOS, making it the correct choice for enforcing passcode complexity and auto-wipe behavior.

Answer

Device compliance policy

Answer

Device configuration profile (custom)

Answer

App protection policy

Question 14

You are the endpoint administrator for Contoso, a company with 5,000 Windows 11 devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to implement a solution that ensures all devices have the latest Windows security updates installed within 7 days of release. Additionally, you must ensure that if a device misses two consecutive update cycles, it is automatically blocked from accessing corporate resources until it is updated. You have the following requirements: 1. Use Intune update rings to control update deployment. 2. Use MDE vulnerability management to identify missing updates. 3. Device compliance policies should check for missing updates and mark devices noncompliant. 4. Conditional Access should block noncompliant devices. Which combination of actions should you take?

Accepted Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.. Configure an update ring with a 7-day deferral to ensure updates are installed within 7 days. Create a device compliance policy that checks for missing updates to mark devices as noncompliant. Configure Conditional Access to require compliant devices, blocking those that are noncompliant. Option A is incorrect because it uses an app protection policy instead of a device compliance policy. Option B is incorrect because it sets no deferral (deferral 0), which would apply updates immediately, not within 7 days as required. Option D is incorrect because it does not configure Conditional Access, so noncompliant devices would not be blocked.

Answer

Configure an update ring with a 7-day deferral. Create an app protection policy that requires minimum OS version. Assign the app protection policy to all users.

Answer

Configure an update ring with no deferral (deferral 0). Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.

Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Assign the compliance policy to all devices. Do not configure Conditional Access.

Question 15

Which THREE actions can you perform from the Microsoft Intune admin center to remediate a non-compliant Windows device?

Accepted Answer

Retire the device. The Retire action removes the device from Intune management and revokes corporate data access, which is a valid remediation for non-compliant Windows devices when the device cannot be brought back into compliance. This action is performed from the Microsoft Intune admin center under the device's compliance status.

Answer

Remote lock

Answer

Assign a compliance policy

Question 16

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the user context on a schedule. Which TWO methods can you use? (Choose two.)

Accepted Answer

Proactive remediation in Microsoft Intune. Proactive remediations in Microsoft Intune allow you to run PowerShell scripts in the user context on a schedule, making option B correct. They are designed for detection and remediation of common support issues, supporting both user and system context execution with configurable schedules.

Answer

Device compliance policy with a custom script

Answer

Line-of-business app deployment package

Answer

PowerShell script deployment from the Intune console

Question 17

A company uses Intune to manage Android Enterprise devices. The administrator deployed a compliance policy that requires encryption and a minimum OS version. Some devices are not showing as compliant even though they meet the requirements. The administrator suspects a time delay. What is the default compliance check interval for Android Enterprise devices in Intune?

Accepted Answer

Every 8 hours. The default compliance check interval for Android Enterprise devices in Intune is every 8 hours. This interval determines how often devices re-evaluate their compliance status against assigned policies, and it is not configurable for Android Enterprise devices. The administrator's suspicion of a time delay is valid because even if a device meets the requirements, it will not report as compliant until the next scheduled check occurs.

Answer

Every 1 hour

Answer

Every 30 minutes

Answer

Every 24 hours

Question 18

Which TWO of the following are benefits of using Microsoft Intune to manage applications on mobile devices?

Accepted Answer

Ability to deploy apps to devices without requiring sideloading.. Microsoft Intune uses the Company Portal app or the Intune app wrapper to deploy line-of-business (LOB) apps directly to devices without requiring users to manually sideload them. This simplifies app distribution by leveraging the MDM channel, which pushes the app package (e.g., .ipa for iOS, .apk for Android) to the device, ensuring it is installed silently or with minimal user interaction. Sideloading typically involves manual installation via USB or enterprise provisioning profiles, which Intune eliminates through its managed deployment capabilities.

Answer

Enforcement of device compliance before app installation.

Answer

Support for user-based licensing only.

Answer

Automatic backup of app data to the cloud.

Question 19

A Windows 10 device is assigned this update ring policy. A new quality update is released today. When will the device install the update?

Accepted Answer

Today. The update ring policy is configured with 'Automatic update behavior' set to 'Auto install and restart without end-user control' and 'Servicing channel' set to 'Current branch (CB)'. When a new quality update is released, devices in this configuration will download and install the update immediately, typically within 24 hours of release, without any deferral period. The policy does not specify any deferral for quality updates, so the installation occurs today.

Answer

In 7 days

Answer

In 30 days

Answer

Never, because automatic update mode requires reboot with warning.

Question 20

A company deploys Windows 10 Enterprise devices managed by Microsoft Intune. Users report that after a recent Windows update, the Start menu layout is reset to default on some devices. The company uses a custom Start menu layout XML policy. How should the administrator ensure the custom layout is reapplied automatically after feature updates?

Accepted Answer

Configure the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar to point to the XML file.. The 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar in a Group Policy Object (GPO) or Intune Administrative Template profile is designed to persistently enforce a custom Start layout XML. When a Windows feature update resets the Start menu to default, this policy automatically reapplies the custom layout at next user logon or policy refresh, ensuring consistency without manual intervention.

Answer

Use a Feature Update policy in Intune to set the 'Start layout XML' setting.

Answer

Deploy a provisioning package with the custom layout to all devices via Intune.

Answer

Reapply the Start layout policy manually after each feature update.