MD-102 Practice Exam 62 — 20 Questions

Question 1

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

Accepted Answer

Check if the user has logged in and acknowledged the FileVault prompt.. Option A is correct because FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Answer

Ensure that a compliance policy is also assigned requiring encryption.

Answer

Ensure the devices are supervised.

Answer

Verify that the profile is assigned to the correct device group.

Question 2

A company uses Microsoft Intune to manage iOS devices. They need to ensure that corporate data on these devices is protected if a device is lost or stolen. The solution must allow users to continue using personal apps and data after a selective wipe. What should they configure?

Accepted Answer

Initiate a selective wipe from the Intune console.. Option A is correct because a selective wipe from the Intune console removes only corporate data (e.g., managed apps, email profiles, VPN configurations) while preserving personal apps and data on the iOS device. This meets the requirement of protecting corporate data on a lost or stolen device without affecting the user's personal content. Intune uses the iOS Management Profile and the built-in selective wipe capability that targets only the MDM-managed corporate partition.

Answer

Configure a full wipe action in a compliance policy.

Answer

Use Remote Lock from the Intune console.

Answer

Create a device compliance policy that marks the device as noncompliant.

Question 3

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

Accepted Answer

Update Deadline for Quality Updates (days). The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Answer

Grace Period for Restarts (days)

Answer

Defer Quality Updates (days)

Answer

Active Hours

Question 4

The above PowerShell cmdlet returns the following output:

DeviceName: LAPTOP001
LastSyncDateTime: 2025-03-15T08:30:00Z
ComplianceState: noncompliant
ManagementState: managed
OSVersion: 10.0.19044.1288

The device last synced 3 days ago. What is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced in over 24 hours.. The device last synced 3 days ago, and the output shows ComplianceState: noncompliant. In Microsoft Intune, a device that has not checked in for more than 24 hours is automatically marked as noncompliant because the compliance policies cannot be evaluated without a recent sync. The LastSyncDateTime of 2025-03-15T08:30:00Z confirms the device has not synced within the required 24-hour window, making C the correct answer.

Answer

The device is running an outdated OS version.

Answer

The device has been retired or wiped.

Answer

The device has no compliance policy assigned.

Question 5

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

Accepted Answer

Upload the script as a PowerShell script in Intune and assign it to the device group.. Option D is correct because Intune's 'PowerShell scripts' feature allows you to upload and assign scripts that run under the system context during device enrollment, specifically targeting devices in a group. This is the only native Intune method that executes scripts in the system context at enrollment time without additional configuration.

Answer

Deploy the script as a proactive remediation.

Answer

Use a device compliance policy to trigger the script.

Answer

Create a custom configuration profile to run the script.

Question 6

Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

Accepted Answer

The device OS version exceeds the maximum allowed version.. The compliance policy JSON specifies a maximum OS version of 10.0.22621.1555, but the device is running build 22621.1, which is lower than the maximum. However, the device is showing as noncompliant because the policy enforces a maximum OS version, and the device's OS version (22621.1) is actually below the minimum allowed version (which is not explicitly set but implied by the policy's version range logic). In Intune compliance policies, when a maximum OS version is specified, devices with an OS version greater than that maximum are marked noncompliant. Since the device's build 22621.1 is less than the maximum 22621.1555, the noncompliance must be due to the OS version being below the minimum allowed version (which is not shown in the exhibit but is a common configuration). The most likely reason is that the device OS version exceeds the maximum allowed version, as the policy's maximum version is set to 10.0.22621.1555 and the device's version 22621.1 is actually lower, but the policy may also have a minimum version requirement that the device does not meet. Given the options, the correct answer is C because the device's OS version (22621.1) is below the minimum version that is implicitly enforced by the policy's maximum version setting, causing noncompliance.

Answer

The device does not have BitLocker encryption enabled.

Answer

The device does not have a password set.

Answer

The password type is not set to alphanumeric.

Question 7

A user reports that after resetting their Windows 10 device, they cannot re-enroll it in Intune. The device appears as 'Pending' in the admin center. What is the most likely reason?

Accepted Answer

The device has a stale record in Intune that needs to be deleted.. When a Windows 10 device is reset, its existing Intune enrollment record becomes stale. The device attempts to re-enroll but the old record causes a conflict, leaving the device in a 'Pending' state in the admin center. Deleting the stale device record from Intune allows the enrollment to complete successfully.

Answer

The user is trying to enroll with a different Azure AD account.

Answer

The MDM authority is not set to Intune.

Answer

The user does not have an Intune license assigned.

Question 8

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 9

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

Accepted Answer

Sync-IntuneDevice -DeviceId .... The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Answer

Start-DeviceSync -DeviceName PC-001

Answer

Invoke-IntuneDeviceAction -DeviceId ... -Action Sync

Answer

Update-IntuneDevice -DeviceId ...

Question 10

You are troubleshooting a Windows 10 device that shows as 'Noncompliant' in Intune despite having all required compliance policies applied. The device is domain-joined and configured with hybrid Azure AD join. What is the most likely cause?

Accepted Answer

The device's health attestation certificate has expired.. A device that is hybrid Azure AD joined and domain-joined but shows as 'Noncompliant' in Intune, despite having all required compliance policies applied, is most likely failing compliance due to an expired health attestation certificate. Intune uses Windows Health Attestation Service (HAS) to verify device integrity; if the attestation certificate has expired, the device cannot prove its health status, causing it to be marked noncompliant even when policies are correctly assigned.

Answer

The Intune Management Extension is not installed.

Answer

The device is not registered in Microsoft Entra ID.

Answer

The device is not enrolled in Intune.

Question 11

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

Accepted Answer

Verify that the devices can communicate with an on-premises domain controller.. In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Answer

Check the certificate profile assigned to the devices.

Answer

Ensure the devices have a VPN connection to the corporate network.

Answer

Review the conditional access policies for the users.

Question 12

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

Accepted Answer

Update the expirationDateTime property of the token.. The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Answer

Modify the tokenType to a different type.

Answer

Create a new bulk enrollment token with a later expiration date.

Answer

Re-create the token with the same name but later expiration.

Question 13

You need to retire a corporate-owned iOS device that is no longer in use. The device is enrolled in Intune with user affinity. Which action should you perform?

Accepted Answer

Retire the device from Intune.. Option C is correct because the 'Retire' action in Intune removes the managed app data and policies from the device while preserving the user's personal data, which is appropriate for a corporate-owned device with user affinity that is no longer in use. Retiring also removes the device from Intune management and revokes the company portal access, ensuring compliance without unnecessary data loss.

Answer

Disable the device in Intune.

Answer

Wipe the device from Intune.

Answer

Delete the device from Microsoft Entra ID.

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires a kernel extension. The app is signed with a Developer ID certificate. The devices are enrolled in Intune and are supervised. You have uploaded the .pkg to Intune and assigned it to a user group. The installation fails on devices with the error 'The app could not be installed because the kernel extension is not approved'. You have already configured a kernel extension profile that allows the specific team identifier. What else is likely missing?

Accepted Answer

The kernel extension profile does not include the 'Allow user to approve kernel extensions' setting.. Option B is correct because on macOS, even if the kernel extension is allowed via profile, the user must approve it in Security & Privacy settings after installation unless the device is supervised and the profile includes a user-approved configuration. Option A is wrong because the app is already signed. Option C is wrong because SIP is not blocking; the issue is user approval. Option D is wrong because FileVault is unrelated.

Answer

System Integrity Protection (SIP) is enabled on the devices.

Answer

FileVault is enabled on the devices.

Answer

The app is not notarized by Apple.

Question 15

You are using Microsoft Intune to deploy a Win32 app (MyApp.exe) to Windows 10 devices. The app requires .NET Framework 4.8 as a dependency. You have created a Win32 app for .NET Framework 4.8 and set it as a dependency for MyApp. However, when you assign MyApp to a device group, the installation fails because .NET Framework is not installed first. The detection rules for MyApp are correctly configured. What should you do to ensure that the dependency is installed before MyApp?

Accepted Answer

Enable 'Auto-install dependency' in the dependency settings of MyApp.. Option C is correct because dependencies in Intune are automatically installed before the parent app only when Auto-install dependency is enabled. Option A is wrong because order of assignment does not guarantee installation order. Option B is wrong because detection rule is for app existence, not installation order. Option D is wrong because requiring devices to have .NET pre-installed is not feasible.

Answer

Assign the dependency app to the same device group with a higher priority.

Answer

Modify the detection rule for the dependency app to check a different file.

Answer

Require that all devices have .NET Framework 4.8 pre-installed before enrollment.

Question 16

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

Accepted Answer

Create an App Protection Policy (MAM) that restricts the transfer of corporate data to other apps and a Device Configuration Profile that sets the default mail app to Outlook.. Option C is correct because an App Protection Policy can block the native Mail app from opening corporate data, and a Device Configuration Profile can set the default mail app to Outlook. Option A is incorrect because a compliance policy alone does not block the native Mail app. Option B is incorrect because conditional access can block native Mail app from accessing Exchange Online, but it does not set Outlook as default. Option D is incorrect because device enrollment restrictions do not control app usage.

Answer

Create a device compliance policy that requires the device to have Outlook installed.

Answer

Use device enrollment restrictions to block devices that have the native Mail app installed.

Answer

Create a conditional access policy for Exchange Online that blocks the native Mail app and allows only Outlook.

Question 17

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

Accepted Answer

Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.. The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates. Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Answer

Change the update ring policy deadline to 7 days to ensure devices have enough time.

Answer

Create a new feature update policy for KB5001234 and assign it to all devices.

Answer

Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.

Question 18

Adventure Works uses Microsoft Intune for device management. You need to deploy a custom PowerShell script to all Windows 10 devices to configure a registry key for security compliance. The script is already uploaded to Intune as a PowerShell script. However, the script is not running on some devices. You have confirmed that the devices are enrolled, have the Intune Management Extension installed, and are online. What should you check first?

Accepted Answer

Verify that the PowerShell execution policy on the devices allows script execution (e.g., RemoteSigned or Bypass).. The script execution policy may block scripts. The Intune Management Extension runs scripts under the system account, which respects the local execution policy. Checking the execution policy is the first step. The script assignment should be verified if it wasn't assigned, but the question states it is uploaded; assignment is a separate step. The user's role does not affect script execution. The device's OS architecture is unlikely the issue.

Answer

Check that the user has administrative privileges on the device.

Answer

Confirm that the device is running a 64-bit version of Windows.

Answer

Ensure the script is assigned to the device group.

Question 19

Your company has 500 Windows 10 devices that are Hybrid Azure AD joined and managed by Microsoft Intune. You need to deploy a new line-of-business (LOB) app to all devices. The app is packaged as a .msi file. You create a new app in Intune and assign it to a device group containing all devices. After 24 hours, some devices report the app as 'Installed' but others show 'Failed'. You verify that the devices are online and have network connectivity. What should you do next to resolve the installation failures?

Accepted Answer

Check the Intune management extension logs on a failed device.. Option B is correct because the most common cause of .msi installation failures is missing prerequisites or dependencies. Checking the Intune management extension logs on the device will reveal the specific error. Option A is wrong because the app is already assigned; re-assigning won't fix underlying issues. Option C is wrong because the app is already targeted to all devices. Option D is wrong because scripts are not needed; the issue is likely with the app itself.

Answer

Use a PowerShell script to install the app on failed devices.

Answer

Create a new device group and assign the app again.

Answer

Re-assign the app to the device group.

Question 20

Your organization uses Intune to manage Windows 10 devices. You have deployed a Win32 app named 'FinanceApp' with a detection rule that checks for the existence of a registry key. After deployment, you find that the app is not being detected on some devices, causing Intune to attempt reinstallation. You suspect the detection rule is incorrect.

You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule.

What should you do to apply the updated detection rule to existing devices?

Accepted Answer

Increment the app version in the app properties. Option B is correct. After modifying the detection rule, you must increase the app version number to force Intune to reevaluate the detection on existing devices. Option A is wrong because deleting and recreating the app is unnecessary. Option C is wrong because the app is already assigned. Option D is wrong because there is no need to uninstall and reinstall.

Answer

Remove and re-add the assignment

Answer

Delete the app and recreate it with the new detection rule

Answer

Uninstall the app from all devices and redeploy