MD-102 Practice Exam 62 — 20 Questions

Question 1

Refer to the exhibit. An Intune administrator configures an Autopilot deployment profile with the shown settings. During OOBE, a device fails to install a required app and enrollment fails. What will happen to the device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device will be blocked from completing OOBE.. The Autopilot deployment profile shown has the Enrollment Status Page (ESP) configured with 'Block device use until all required apps and profiles are installed' enabled. When a required app fails to install during OOBE, the ESP enforces a hard block, preventing the user from proceeding past the ESP until the failure is resolved. This is why the device is blocked from completing OOBE, making option C correct.

Answer

The device will be allowed to proceed because enrollment status is notStarted.

Answer

The device will retry enrollment automatically.

Answer

The device will be blocked until retry due to pendingRetry setting.

Question 2

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the result?

Accepted Answer

A count of unique Windows devices per device name in the last 7 days.. The KQL query uses `DeviceInfo` (a Microsoft Sentinel table for device inventory), filters with `where` to include only rows where `OperatingSystem` contains 'Windows', then uses `summarize` with `dcount(DeviceName)` to count distinct device names, and `bin(TimeGenerated, 7d)` to group by 7-day intervals. This produces a count of unique Windows devices per device name over the last 7 days, making option C correct.

Answer

A list of all devices regardless of operating system.

Answer

A list of all Windows devices with their last activity.

Answer

A count of security alerts per device.

Question 3

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

Accepted Answer

The root CA certificate required to validate the RADIUS server certificate is not installed on the device.. The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Answer

The user's password has expired.

Answer

The Wi-Fi profile is not assigned to the user's device.

Answer

The device's Wi-Fi adapter driver is outdated.

Question 4

Refer to the exhibit. You apply this configuration profile to Windows 10 devices. A user reports that their device's diagnostic data level is set to 'Full' in Settings > Diagnostics & feedback. What is the most likely reason?

Accepted Answer

The policy is not assigned to the device or the device is not enrolled.. The most common reason for a configuration profile not taking effect is that the policy is not assigned to the device or the device is not enrolled in Intune. Without proper enrollment, the device never receives the policy, so the default or user-chosen diagnostic data level remains. Even if the policy is assigned, if the device is not enrolled, Intune cannot manage it.

Answer

The user manually changed the setting after the policy applied.

Answer

Windows Defender is blocking the policy application.

Answer

A conflicting Group Policy object is overriding the Intune policy.

Question 5

Refer to the exhibit. You manage a Windows 11 device that is marked as compliant and has OS version 10.0.22621.0. You need to upgrade the device to Windows 11 version 23H2. Which Intune feature should you use?

Accepted Answer

Windows feature update profile. A Windows feature update profile is the correct Intune feature to upgrade a Windows 11 device from one version to another (e.g., from 10.0.22621.0 to 23H2). Feature update profiles deploy new OS builds that enable feature-level changes, whereas quality updates deliver only security and cumulative fixes. This profile targets the specific version upgrade required for the device.

Answer

Windows quality update profile

Answer

Driver update policy

Answer

Compliance policy

Question 6

Which THREE components are required to deploy a Win32 app via Microsoft Intune?

Accepted Answer

Detection rule. A detection rule is required because Intune needs a method to verify whether the Win32 app is already installed on the device. Without a detection rule, Intune cannot determine if the installation succeeded or if the app needs to be reinstalled. The detection rule can be based on a file, registry key, or custom script, and it is mandatory for any Win32 app deployment.

Answer

PowerShell script for post-installation

Answer

Dependency on another app

Question 7

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is packaged as an .msi file. Which TWO steps are required to deploy this app via Intune?

Accepted Answer

Assign the app to a group of users or devices.. After preparing the Win32 app, you must assign it to a group of users or devices in Intune to trigger deployment. Without assignment, the app is uploaded but not installed on any target. This step is mandatory for any Intune-managed app deployment.

Answer

Upload the .msi file directly as a Microsoft Store for Business app.

Answer

Install the app on a file server and configure a shortcut.

Answer

Create a PowerShell script to install the app silently.

Question 8

Refer to the exhibit. You configure this Enrollment Status Page (ESP) policy for Windows Autopilot deployments. During a deployment, a device fails to install a required app. What happens?

Accepted Answer

The device will be blocked from use until the app is installed or the device is reset.. The Enrollment Status Page (ESP) policy in Windows Autopilot can be configured to block device use until all required apps are installed. When a required app fails to install, the ESP enters a blocking state, preventing the user from accessing the desktop until the installation succeeds or the device is reset. This behavior is controlled by the 'Block device use until required apps are installed' setting in the ESP profile.

Answer

The user can retry the installation manually.

Answer

The timeout will extend by 60 minutes.

Answer

The device will automatically retry the installation.

Question 9

You need to deploy Microsoft 365 Apps to 500 Windows 10 devices managed by Intune. The deployment must be automatic and should not require user interaction. What is the best method?

Accepted Answer

Create a Win32 app in Intune with the installation command for Microsoft 365 Apps.. Creating a Win32 app in Intune allows you to use the Office Deployment Tool (ODT) with a custom configuration.xml to install Microsoft 365 Apps silently. This method supports automatic, unattended deployment to 500 Windows 10 devices managed by Intune, as Win32 apps can be assigned with required intent and run in system context without user interaction.

Answer

Create a Configuration Manager application and deploy to the devices.

Answer

Use the Office Deployment Tool (ODT) to create a package and deploy via Intune as a line-of-business (LOB) app.

Answer

Assign the Microsoft 365 Apps from the Microsoft Store for Business.

Question 10

Which TWO actions should you take to ensure that Windows Update for Business settings are applied to all Windows 10 devices in your organization? (Choose two)

Accepted Answer

Create an update ring policy in Microsoft Intune.. B is correct because Windows Update for Business (WUfB) policies are configured through update ring policies in Microsoft Intune, which control how and when Windows 10 devices receive updates from Microsoft's update servers. This allows organizations to manage update deployment without needing on-premises infrastructure like WSUS.

Answer

Configure a WSUS server to synchronize updates.

Answer

Enable peer-to-peer content sharing for Windows updates.

Answer

Create a device compliance policy to enforce update installation.

Question 11

A user has a Windows 11 device that is enrolled in Intune. The device is compliant, but the user cannot install apps from the Company Portal. The Company Portal shows 'This app is not available for your device'. The app is assigned to the user and the device meets the minimum requirements. What should you check?

Accepted Answer

Check if the app supports Windows 11.. The error 'This app is not available for your device' in Company Portal typically indicates that the app's installer or metadata does not list Windows 11 as a supported platform. Even if the device meets minimum hardware requirements, the app must be explicitly configured in Intune to support the Windows 11 platform (e.g., by selecting 'Windows 11' under Supported device types or ensuring the app package is compatible).

Answer

Check if the device meets the minimum OS version.

Answer

Check app assignment to user groups.

Answer

Check device compliance policy.

Question 12

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown on a new Windows 11 device. The cmdlet completes successfully, but the device does not appear in Intune under Windows Autopilot devices. What is the most likely cause?

Accepted Answer

The user running the cmdlet does not have the required permissions in Intune.. The Get-WindowsAutopilotInfo cmdlet uploads the device's hardware hash to the Microsoft Intune service. If the user lacks the necessary Intune role permissions (e.g., 'Intune Administrator' or a custom role with 'Enroll and assign devices' permission), the upload succeeds locally but the device hash is rejected by the Intune service, so the device never appears in the Windows Autopilot device list.

Answer

The device does not have internet access.

Answer

The device is already registered in Autopilot, so the cmdlet does nothing.

Answer

The group tag 'Marketing' is invalid.

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices with BitLocker enabled can access corporate email via Exchange Online. Which configuration should the administrator use to enforce this requirement?

Accepted Answer

Create a Conditional Access policy that requires device compliance and assign it to Exchange Online.. A Conditional Access policy in Azure AD can require that devices accessing Exchange Online be marked as compliant in Intune. By combining a Device Compliance policy that requires encryption (BitLocker) with a Conditional Access policy targeting Exchange Online, only compliant devices with BitLocker enabled will be granted access to corporate email.

Answer

Create a Device Compliance policy for Windows 10 with the 'Require encryption of data storage on device' setting enabled.

Answer

Create an App Protection policy for the Outlook mobile app that requires device encryption.

Answer

Configure Windows Defender Firewall to block non-BitLocker encrypted devices.

Question 14

You are planning to deploy a custom line-of-business (LOB) app to 200 Windows 11 devices using Intune. The app requires a specific registry key to be present before installation. What should you do?

Accepted Answer

Add a requirement rule to the app deployment that runs a PowerShell script to check for the registry key.. Intune's requirement rules allow you to run a PowerShell script that checks for the existence of a specific registry key before the app installs. If the script returns a non-zero exit code, Intune will not proceed with the installation, ensuring the prerequisite is met. This is the only option that directly enforces a precondition for the app installation without requiring additional apps or policies.

Answer

Add the app as a dependency for another app that creates the registry key.

Answer

Use an app configuration policy to set the registry key before the app installs.

Answer

Create a custom compliance policy to enforce the registry key.

Question 15

You are planning a Windows 10 deployment using Windows Autopilot. You need to ensure that devices are automatically enrolled in Intune during the out-of-box experience. Which two prerequisites must be met? (Choose two.)

Accepted Answer

Devices must have a valid Windows 10/11 Pro or Enterprise license. Windows Autopilot requires that devices have a valid Windows 10/11 Pro, Enterprise, or Education license to enable the automatic enrollment into Intune during the out-of-box experience (OOBE). Without a qualifying license, the device cannot be properly provisioned with Intune management policies. Option C is correct because devices must be registered in Microsoft Entra ID (formerly Azure AD) as Autopilot devices, which is typically done by uploading a hardware hash CSV file to the Autopilot deployment portal, allowing the device to be recognized and automatically enrolled during OOBE.

Answer

Tenant must have Microsoft Entra ID P1 or P2

Answer

On-premises Active Directory synchronization must be configured

Answer

Users must have a Microsoft 365 E3 license

Question 16

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

Accepted Answer

Use a provisioning package (PPKG) to reset the device and register it for Autopilot.. Using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Answer

Assign an Autopilot deployment profile to the device group in Intune.

Answer

Export the hardware hash from each device and upload it manually to Intune.

Answer

Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

Question 17

Refer to the exhibit. You deploy this custom OMA-URI policy to Windows 10 devices. What is the expected outcome?

Accepted Answer

Telemetry is set to 0 - Security (Enterprise only). The OMA-URI policy sets the 'AllowTelemetry' value to 0, which in Windows 10 corresponds to the 'Security (Enterprise only)' telemetry level. This level sends only essential security data, such as the Malicious Software Removal Tool (MSRT) and Windows Defender information, and is only available in Enterprise editions. Therefore, the expected outcome is that telemetry is set to 0 - Security (Enterprise only).

Answer

Telemetry is set to 1 - Basic

Answer

The policy applies to users, not devices

Answer

The policy fails because value 0 is not allowed

Question 18

You are troubleshooting a Windows 11 device that fails to install an Intune-managed update. The device has been offline for two weeks. After reconnecting, the update does not install. In the Intune console, the update shows 'Failed to install' with error code 0x800f0831. What is the most likely cause?

Accepted Answer

The device's Windows component store is corrupted due to missing prerequisites.. Error code 0x800f0831 indicates that the Windows component store (CBS) is corrupted because a required servicing stack or prerequisite update is missing. When a device has been offline for two weeks, it may lack the necessary baseline updates that the current update depends on, causing the installation to fail even after reconnecting to the network.

Answer

The device does not have internet connectivity.

Answer

The device does not have enough disk space.

Answer

The update is superseded and no longer applicable.

Question 19

You are reviewing the Intune Win32 app configuration for Microsoft Edge. The app is deployed to Windows 10 devices. Users report that Edge is not being installed on some devices. What is the most likely issue with the detection rule?

Accepted Answer

The detection rule requires an exact version match, which may not match if a different version is installed.. The most likely issue is that the detection rule is configured to require an exact version match. If a device already has a different version of Microsoft Edge installed (e.g., a newer or older build), Intune will evaluate the detection rule as 'not detected' and attempt to reinstall the app, which may fail or be skipped because the installer detects an existing version. This is a common misconfiguration in Win32 app deployments where version-specific detection rules cause false negatives.

Answer

The uninstall command is incorrect.

Answer

The install command is missing the --silent flag.

Answer

The detection rule is checking the 32-bit registry on a 64-bit system.

Question 20

Which TWO Windows Update for Business policies can you configure using Microsoft Intune?

Accepted Answer

Feature update version targeting. Microsoft Intune allows you to configure a 'Feature update version targeting' policy, which specifies a target feature update version (e.g., Windows 11 23H2) for devices. Option B is correct because you can configure a 'Quality update deferral period' within an update ring policy to delay quality updates. Option C is incorrect because, although a driver update deferral period can be configured in an update ring policy, it is not a separate Windows Update for Business policy type; the question expects the two distinct policy types: Feature update version targeting and Quality update deferral period. Option D is incorrect because Windows Defender definition update schedule is not a Windows Update for Business policy; it is managed via Microsoft Defender for Endpoint or other settings. Option E is incorrect because Microsoft 365 Apps update channel is not a Windows Update for Business policy; it is configured separately for Office applications.

Answer

Driver update deferral period

Answer

Windows Defender definition update schedule

Answer

Microsoft 365 Apps update channel