MD-102 Practice Exam 61 — 20 Questions

Question 1

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

Accepted Answer

Windows 10 and later update ring. The Windows 10 and later update ring policy in Intune is specifically designed to configure Windows Update for Business settings, including deferral periods for feature and quality updates. By setting the 'Feature update deferral period (days)' to 60 and 'Quality update deferral period (days)' to 14, you directly control how long updates are postponed after they are released by Microsoft. This policy applies to devices managed via Intune and leverages the Windows Update for Business service to enforce these deferrals.

Answer

Windows compliance policy

Answer

Windows feature update policy

Answer

Windows driver update policy

Question 2

Your organization uses Intune to manage iOS devices. You need to deploy a custom configuration for a line-of-business app. Which TWO methods can you use?

Accepted Answer

App Configuration Policy for managed devices. App Configuration Policies for managed devices allow you to supply custom configuration settings (e.g., JSON or XML key-value pairs) to an iOS line-of-business app when the device is enrolled in Intune MDM. Option C is correct because you can embed a configuration file (e.g., a .plist) directly within the iOS app package, which the app reads at launch without requiring a separate policy push.

Answer

App Protection Policy

Answer

App Configuration Policy for managed apps

Answer

Device Configuration Profile

Question 3

A user reports that their Windows 11 device is not receiving a required security baseline policy from Microsoft Intune. The device appears as compliant in the Microsoft Intune admin center. Other devices in the same group receive the policy. You verify that the policy is assigned to the correct group and that the user is a member. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently or has a policy conflict. The most likely cause is that the device has not checked in with Intune recently or has a policy conflict. Even though the device appears compliant in the admin center, compliance status is based on the last check-in data; if the device hasn't synced recently, it won't receive new or updated policies. Policy conflicts, such as overlapping settings from multiple baselines or configuration profiles, can also prevent a specific security baseline from applying, even when the device is otherwise compliant.

Answer

The user is not a member of the Azure AD group that the policy is assigned to

Answer

The policy is not assigned to any group

Answer

The device is marked as non-compliant and has been blocked

Question 4

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully on some devices but fails on others with no error in the Intune console. The app logs show 'Access Denied' during installation. What should you check first?

Accepted Answer

The installation context (user vs system) in the app deployment. The 'Access Denied' error in the app logs indicates a permissions issue during installation. In Intune, Win32 apps can be deployed in either 'user' or 'system' installation context. If the app requires administrative privileges (e.g., writing to Program Files or the registry under HKLM) but is configured to run in the user context, it will fail with an access denied error on devices where the user lacks sufficient rights. Therefore, verifying the installation context is the first troubleshooting step.

Answer

The device is not Microsoft Entra ID joined

Answer

The device has insufficient disk space

Answer

The app is not signed

Question 5

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune recently.. The most likely cause is that the devices have not checked in with Intune recently. Intune compliance policies are evaluated only when devices check in via the Intune Management Extension or the MDM agent. If a device hasn't synced within the configured check-in frequency (default every 8 hours), its compliance status becomes stale and may show as 'Not compliant' even if it meets the requirements locally. This is a common scenario where the policy is correctly configured, but the device's last sync timestamp is too old.

Answer

The OS build version is not reported correctly.

Answer

BitLocker is not enabled on the system drive.

Answer

The devices need to be rebooted for the policy to apply.

Question 6

Which THREE of the following are valid methods to enroll Android devices into Microsoft Intune?

Accepted Answer

Android Enterprise work profile. Android Enterprise work profile is a supported enrollment method in Microsoft Intune that allows users to keep their personal apps and data separate from corporate data on the same device. Intune manages the work profile using the Android Enterprise platform, which provides containerization and policy enforcement without requiring full device control.

Answer

Android Device Administrator

Answer

Android Legacy

Question 7

A user reports that their Windows 11 device fails to enroll in Microsoft Intune. The device is Microsoft Entra joined and the user has a valid Intune license. What should you check first?

Accepted Answer

Check the Enrollment Status Page (ESP) profile configuration in Intune.. Enrollment Status Page (ESP) profiles can block enrollment if misconfigured, and checking the Intune console is the first step to see errors. Option A is wrong because BitLocker is not related to enrollment. Option C is wrong because the local admin password is not required for enrollment. Option D is wrong because the Autopilot profile is only relevant for Autopilot deployments, not general enrollment.

Answer

Verify that BitLocker is enabled on the device.

Answer

Ensure that the device has a local administrator password set.

Answer

Review the Windows Autopilot deployment profile assigned to the device.

Question 8

You need to ensure that all corporate-owned Windows devices automatically receive security updates as soon as they are released by Microsoft. Which update ring policy setting should you configure in Microsoft Intune?

Accepted Answer

Set 'Defer quality updates' to 0 days.. Setting 'Defer quality updates' to 0 days in a Microsoft Intune update ring policy ensures that quality (security) updates are applied immediately upon release by Microsoft, with no deferral period. This configuration forces Windows devices to download and install security updates as soon as they are available from Windows Update, meeting the requirement for automatic and immediate security patching.

Answer

Set the 'Microsoft product updates' setting to 'Allow'.

Answer

Select the 'Windows Insider' channel for quality updates.

Answer

Select the 'Semi-Annual Channel' for feature updates.

Question 9

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

Accepted Answer

Remove work profile. The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Answer

Wipe

Answer

Retire

Answer

Delete

Question 10

A company uses Microsoft Intune to manage Windows 10 devices. A user reports that their device is not receiving critical security updates despite being compliant with all update policies. You verify that the device is online and communicating with Intune. Which action should you take to resolve the issue?

Accepted Answer

Review the Windows Update Rings policy assigned to the device and adjust the deferral settings for quality updates.. The user's device is compliant and online, but not receiving critical security updates. The most likely cause is that the Windows Update Rings policy assigned to the device has a deferral period configured for quality updates, which delays the installation of security patches. Adjusting the deferral settings for quality updates to 0 days ensures that critical security updates are installed immediately upon release, resolving the issue without changing the feature update deferral.

Answer

Verify that the device meets the minimum hardware requirements for the update.

Answer

Force a sync from the device via Intune Company Portal or Settings > Accounts > Access work or school.

Answer

Reassign the device to a different Update Ring policy that has no feature update deferral.

Question 11

A company wants to deploy Microsoft 365 Apps for enterprise to Windows 10 devices using Intune. They need to ensure that the apps are updated automatically from the Office Content Delivery Network (CDN). Which update channel should they select in the Office app deployment configuration?

Accepted Answer

Monthly Enterprise Channel. The Monthly Enterprise Channel is the correct choice because it provides a predictable, once-per-month update cadence with security and quality updates, and it is designed for enterprise environments that require automatic updates from the Office Content Delivery Network (CDN) via Intune. This channel balances receiving new features sooner than the Semi-Annual Enterprise Channel while still offering managed deployment through configuration profiles.

Answer

Semi-Annual Enterprise Channel

Answer

Current Channel

Answer

Insider Channel

Question 12

Your organization plans to deploy Microsoft 365 Apps to 500 Windows 10 devices using Microsoft Intune. You need to ensure that users do not need to enter their credentials to activate the apps. Which configuration should you use?

Accepted Answer

Deploy Microsoft 365 Apps with user-based activation and ensure devices are Microsoft Entra ID joined. Deploying Microsoft 365 Apps with user-based activation on Microsoft Entra ID joined devices enables seamless single sign-on (SSO) using the user's cloud identity. When the device is Entra ID joined, the user's existing Microsoft Entra ID token is used to automatically activate Microsoft 365 Apps without requiring additional credential prompts, fulfilling the requirement for zero-touch activation.

Answer

Enable device-based activation for Microsoft 365 Apps

Answer

Use a product key and activate via KMS server

Answer

Configure Microsoft 365 Apps for enterprise with shared computer activation

Question 13

Which THREE prerequisites are required to enable Windows Autopilot for existing devices?

Accepted Answer

The device must be running Windows 10 or Windows 11 Pro, Enterprise, or Education edition. Windows Autopilot requires a supported edition of Windows 10 or Windows 11 (Pro, Enterprise, or Education) to access the necessary cloud-based provisioning and enrollment features. Home editions lack the required MDM enrollment capabilities and policy support, making them incompatible with Autopilot deployment.

Answer

The device must be domain-joined to an on-premises Active Directory

Answer

The device must have a TPM 2.0 chip

Question 14

You have the above compliance policy for Windows 10. A device running Windows 10 version 22H2 (build 22621.1) will be marked as?

Accepted Answer

Noncompliant because the OS version exceeds the maximum. The compliance policy sets a maximum OS version of 22H2 (build 22621.1). The device is running exactly that version, which meets the maximum threshold. However, in Intune compliance policies, the 'Maximum OS version' rule marks a device as noncompliant if the OS version is greater than the specified version. Since the device's version equals the maximum, it is not greater, so it should be compliant. But the question states the device is running version 22H2 (build 22621.1), which is the exact maximum, and the correct answer is marked as noncompliant because the OS version exceeds the maximum. This is a trick: the build number 22621.1 is actually for Windows 11, not Windows 10 22H2, so the device is running a higher OS version than allowed, making it noncompliant.

Answer

Noncompliant because the password minimum length is not met

Answer

Noncompliant because the OS version is below the minimum

Answer

Compliant

Question 15

You need to retire a corporate-owned iOS device that is no longer in use. The device is enrolled in Intune with user affinity. Which action should you perform?

Accepted Answer

Retire the device from Intune.. The 'Retire' action in Intune removes the managed app data and policies from the device while preserving the user's personal data, which is appropriate for a corporate-owned device with user affinity that is no longer in use. Retiring also removes the device from Intune management and revokes the company portal access, ensuring compliance without unnecessary data loss.

Answer

Disable the device in Intune.

Answer

Wipe the device from Intune.

Answer

Delete the device from Microsoft Entra ID.

Question 16

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

Accepted Answer

A compliance policy was updated requiring a newer OS version or additional security settings.. Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Answer

The user's Intune license has expired.

Answer

The Outlook app is not installed on the device.

Answer

The device is not enrolled in Intune.

Question 17

An administrator uses Intune to deploy a line-of-business (LOB) app for Android. The app is failing to install on some devices. The administrator reviews the Intune management extension logs and sees error 'Device not compliant with app configuration policy'. Which THREE conditions could cause this error?

Accepted Answer

The device is not enrolled in Android Enterprise work profile. The 'Device not compliant with app configuration policy' error occurs when an Android Enterprise work profile is required for the app's deployment but the device lacks this enrollment. Intune uses app configuration policies to enforce settings like work profile enrollment; if the device is not enrolled in a work profile, the policy cannot be applied, causing the installation to fail.

Answer

The app was previously installed and then uninstalled

Answer

The Company Portal app is not installed on the device

Question 18

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices with a passcode can access corporate resources. Which THREE configurations should you implement?

Accepted Answer

Device configuration profile with passcode settings. A device configuration profile with passcode settings enforces the passcode requirement directly on the iOS/iPadOS device via the MDM channel, ensuring the device itself is locked. Option C is correct because a Conditional Access policy requiring compliant devices checks the device's compliance status (which includes passcode compliance) before granting access to corporate resources like Exchange Online or SharePoint. Option E is correct because a device compliance policy with a passcode requirement defines the specific passcode rules (e.g., minimum length, complexity) and marks the device as noncompliant if unmet, which then triggers Conditional Access to block access.

Answer

Windows Autopilot deployment profile

Answer

App protection policy with passcode for managed apps

Question 19

You are troubleshooting an Intune deployment of a line-of-business (LOB) app for iOS. The app fails to install on some devices with error '0x87D13B9F'. Which THREE actions should you take to diagnose the issue?

Accepted Answer

Check if the device is supervised and that the app requires supervised mode. Error 0x87D13B9F in Intune for iOS LOB apps typically indicates a deployment restriction related to device supervision. If the app requires supervised mode (e.g., for managed app configuration or advanced MDM controls) and the target device is not supervised, Intune will fail to install the app with this error. Verifying supervision status is a primary diagnostic step.

Answer

Check the Intune Service Health dashboard for service incidents

Answer

Ensure that an app configuration policy is assigned to the device

Question 20

Which TWO actions can you perform to reduce the amount of time it takes for a Windows 10 device to receive a new policy from Microsoft Intune?

Accepted Answer

Manually trigger a sync from the device's Settings > Accounts > Access work or school.. Manually triggering a sync from Settings > Accounts > Access work or school forces the device to immediately check in with Microsoft Intune, bypassing the default polling interval. This action initiates an immediate policy retrieval and application cycle, reducing the wait time for new policies to be received.

Answer

Increase the policy refresh interval in the device configuration profile.

Answer

Restart the device.

Answer

Change the device's DNS to point to a local Intune server.