MD-102 Practice Exam 61 — 20 Questions

Question 1

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Accepted Answer

Number of failed attempts before wipe.. Option A is correct because the 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Answer

Maximum passcode age (days).

Answer

Allow simple passcode.

Question 2

Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced recently; the compliance policy may require a more recent check-in.. The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant. Option A correctly identifies this as the most likely cause.

Answer

The device is company-owned, which is noncompliant by default.

Answer

The device is a userless device and cannot be compliant.

Answer

The device's operating system version is not supported.

Question 3

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

Accepted Answer

Remove work profile. The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Answer

Wipe

Answer

Retire

Answer

Delete

Question 4

A user reports that their Windows 11 device is not receiving Microsoft 365 Apps updates from Intune. You verify the device is enrolled and compliant. The device has a Microsoft 365 Apps update policy assigned. What is the most likely cause?

Accepted Answer

The device is in a low-power state and not checking in for updates. The most likely cause is that the device is in a low-power state (e.g., sleep or hibernation) and not checking in for updates. Intune relies on the Microsoft 365 Apps update service, which uses a scheduled task that runs only when the device is awake and connected. If the device is in a low-power state, it cannot execute the update check, even though it is enrolled and compliant.

Answer

The Microsoft 365 Apps update channel is not configured in the policy

Answer

The device is not connected to the internet

Answer

The device has an older version of Office installed that does not support Intune management

Question 5

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

Accepted Answer

Restart the Microsoft Intune Management Extension service on the device.. The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Answer

Unenroll and re-enroll the device.

Answer

Verify that the device is compliant with BitLocker encryption requirements.

Answer

Check the device's compliance policy assignment.

Question 6

Which THREE components are required to deploy a Win32 app via Microsoft Intune?

Accepted Answer

Detection rule. A detection rule is required because Intune needs a method to verify whether the Win32 app is already installed on the device. Without a detection rule, Intune cannot determine if the installation succeeded or if the app needs to be reinstalled. The detection rule can be based on a file, registry key, or custom script, and it is mandatory for any Win32 app deployment.

Answer

PowerShell script for post-installation

Answer

Dependency on another app

Question 7

Which TWO methods can you use to deploy Microsoft 365 Apps to Windows 10 devices managed by Intune?

Accepted Answer

Use the Microsoft 365 Apps (Windows) app type in Intune.. Option A is correct because the 'Microsoft 365 Apps (Windows)' app type in Intune is a built-in deployment method specifically designed to install Office 365 ProPlus (now Microsoft 365 Apps) on managed Windows 10 devices. It allows you to select the installation channel, language, and update settings directly from the Intune console without needing external tools.

Answer

Use the Office Deployment Tool wrapped as a Win32 app.

Answer

Use Group Policy to assign Office installation.

Answer

Deploy the Microsoft Store version of Office.

Question 8

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

Accepted Answer

Set 'Allow application store' to 'Block' for non-admin users.. Option C is correct because the 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Answer

Enable 'Private store only' in Microsoft Store for Business settings.

Answer

Disable 'Automatic app updates' in the device restriction policy.

Answer

Configure 'Require a password for app purchases' to 'Yes'.

Question 9

Your organization manages Windows 10 and 11 devices using Microsoft Intune. Users report that after a recent update, the Microsoft Store for Business app 'Company Portal' fails to launch. You verify that the app is assigned as required to all devices. What should you do first to resolve the issue?

Accepted Answer

Trigger a device sync from the Microsoft Intune admin center.. The correct first step is to trigger a device sync from the Microsoft Intune admin center. This forces the affected devices to check in with Intune, which can push down any pending policy or app configuration updates that may have been missed after the recent Windows update. Since the Company Portal app is assigned as required, a sync ensures the device receives the latest app version or remediation actions without requiring a full reinstall.

Answer

Enable automatic updates for Company Portal in Intune.

Answer

Uninstall and reinstall Company Portal from all devices.

Answer

Run Windows Update troubleshooter on affected devices.

Question 10

You need to enforce encryption on Windows 10 devices managed by Intune. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile. Endpoint Protection profiles in Intune include the 'Windows Encryption' settings category, which allows you to enforce BitLocker Drive Encryption on Windows 10 devices. This profile directly manages encryption policies such as requiring BitLocker on OS and fixed drives, configuring encryption methods (e.g., XTS-AES 128-bit), and setting recovery password options. It is the correct policy type for enforcing encryption because it specifically targets security settings like device encryption and BitLocker.

Answer

Device compliance policy

Answer

Windows Update for Business policy

Answer

Device configuration profile (settings catalog)

Question 11

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

Accepted Answer

A compliance policy was updated requiring a newer OS version or additional security settings.. Option C is correct because Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Answer

The user's Intune license has expired.

Answer

The Outlook app is not installed on the device.

Answer

The device is not enrolled in Intune.

Question 12

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running OS version 10.0.22621.100. The device has a password set, firewall active, and Defender enabled. However, the device is marked as non-compliant. What is the most likely reason?

Accepted Answer

The OS version exceeds the maximum allowed version specified in the policy.. The device OS version 10.0.22621.100 exceeds the maximum OS version specified in the policy (10.0.22621.0). In Microsoft Intune compliance policies, the 'Maximum OS version' setting marks a device as non-compliant if the device's OS build number is greater than the specified value, even if all other conditions are met. This is a common configuration to prevent devices from running untested or incompatible OS builds.

Answer

The password length is exactly 8 characters, but the policy requires more than 8.

Answer

Microsoft Defender is not at the required version 4.18.2207.7.

Answer

The device does not have a password set.

Question 13

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

Accepted Answer

Hybrid Azure AD join. Hybrid Azure AD join is the correct approach because it allows devices that are joined to on-premises Active Directory to also register with Microsoft Entra ID, enabling Intune management while maintaining access to on-premises resources via Kerberos/NTLM authentication. This configuration synchronizes the device object from AD to Entra ID using Azure AD Connect, creating a device identity that can be managed by Intune and can authenticate against both cloud and on-premises services without requiring a VPN.

Answer

Entra ID registered with on-premises domain join

Answer

Windows Autopilot self-deploying mode

Answer

Entra ID joined with VPN to on-premises

Question 14

Your organization is planning to deploy Windows 10 updates using Windows Update for Business. You need to ensure that critical security updates are installed within 7 days of release. Which configuration should you use?

Accepted Answer

Configure a deferral period of 7 days for quality updates. To ensure critical security updates are installed within 7 days of release using Windows Update for Business, you configure a deadline for quality updates. A deadline forces the device to install the update by a specified number of days after the update is published, regardless of any deferral period. Setting the deadline to 7 days ensures that the update is installed within that timeframe, meeting the requirement.

Answer

Create a feature update policy for Windows 10

Answer

Set a deadline for quality updates to 7 days

Answer

Pause quality updates for 7 days

Question 15

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

Accepted Answer

PowerShell scripts (Devices > Scripts). PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Answer

Proactive remediations

Answer

Compliance policy

Answer

Device configuration profile

Question 16

You need to ensure that Windows 10 devices in your organization receive the latest quality updates within 7 days of release. You configure a Windows Update for Business policy in Intune with a deferral period of 7 days. After two weeks, some devices have not installed the updates. What is the most likely reason?

Accepted Answer

Devices have not synced with Intune to receive the updated policy.. Option D is correct because Windows Update for Business policies in Intune are not applied in real time; devices must check in with the Intune service to receive the updated policy. The default sync interval for Intune-managed Windows 10 devices is approximately 8 hours, and if a device has not synced since the policy was configured, it will not yet have the new deferral settings. This explains why some devices have not installed the updates even after two weeks, as they may have missed the sync window or have a longer check-in cycle.

Answer

The devices are configured to receive updates from WSUS instead of Windows Update.

Answer

The deferral period is too short; Microsoft recommends 14 days.

Answer

The policy is configured to apply only to devices in a specific Azure AD group.

Question 17

Refer to the exhibit. You apply this device configuration profile to a group of Windows 10 devices. Users report that they receive update notifications outside of active hours. Which setting should you modify to suppress notifications during active hours?

Accepted Answer

Set updateNotificationLevel to 'turnOffAllNotifications'.. The setting updateNotificationLevel controls whether Windows Update displays notifications to users. Setting it to 'turnOffAllNotifications' suppresses all update notifications, including those that appear outside of active hours. This is the correct configuration to prevent users from seeing update notifications during active hours.

Answer

Modify activeHoursStart and activeHoursEnd to cover the full day.

Answer

Set cloudBlockLevel to 'normal'.

Answer

Set detectionFrequency to a higher value.

Question 18

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

Accepted Answer

Endpoint security > Disk encryption policy. To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Answer

Compliance policy for Windows 10

Answer

Windows Update for Business policy

Answer

Device configuration profile for Windows 10

Question 19

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

Accepted Answer

The root CA certificate required to validate the RADIUS server certificate is not installed on the device.. The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Answer

The user's password has expired.

Answer

The Wi-Fi profile is not assigned to the user's device.

Answer

The device's Wi-Fi adapter driver is outdated.

Question 20

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

Accepted Answer

The app is assigned to users, not devices. When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy. The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Answer

The device is low on storage

Answer

The app is available but not required

Answer

The device has offline files enabled