MD-102 Practice Exam 63 — 20 Questions

Question 1

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 update ring that delays feature updates by 60 days and quality updates by 14 days. You create the update ring and assign it to a device group. After a week, you notice that devices are not receiving the quality updates as expected. What should you verify first?

Accepted Answer

Verify that Windows Update for Business is enabled on the devices.. Option B is correct because if Windows Update for Business is disabled on the devices, the update ring will not apply. Option A is wrong because the ring is assigned. Option C is wrong because the deferral period is set correctly. Option D is wrong because the group might be correct.

Answer

Ensure the deferral period for quality updates is set to 14 days.

Answer

Check that the update ring is assigned to the correct group.

Answer

Review the device compliance status.

Question 2

Your organization uses Microsoft Intune to manage Windows 11 devices. You have a requirement to ensure that all devices have BitLocker Drive Encryption enabled with a TPM protector and a recovery key escrowed to Azure AD. Additionally, you need to configure a policy that prevents users from changing the BitLocker settings. You create a device configuration profile using the 'Endpoint Protection' template for Windows 10 and later. After deploying the policy to a test group, you notice that BitLocker is not enabled on some devices. The devices meet the hardware requirements and are Azure AD joined. What is the most likely reason for the failure, and how should you resolve it?

Accepted Answer

The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.. Option C is correct because the 'Endpoint Protection' template for Windows 10 and later requires explicit configuration of the 'Enable full disk encryption' setting and the encryption method (e.g., XTS-AES 128-bit) under the 'Windows Encryption' section. Without these settings, the policy does not trigger BitLocker to start encryption on the device, even if other settings like TPM protector and recovery key escrow are configured. The devices are Azure AD joined and meet hardware requirements, so the missing encryption enablement is the most likely cause.

Answer

Devices are not hybrid Azure AD joined; convert them to hybrid join for BitLocker policy to apply.

Answer

The policy does not specify a recovery key escrow location; configure it to escrow to Azure AD.

Answer

Devices are not co-managed with Configuration Manager; enable co-management to apply BitLocker policy.

Question 3

You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes:
- 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune)
- 1,500 iOS devices (corporate-owned, managed via Intune)
- 500 Android devices (BYOD, managed via Intune with work profile)
- 200 macOS devices (corporate-owned, managed via Intune)

You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.

You have the following requirements:
1. Zero-touch enrollment for new Windows 11 devices.
2. Devices must be automatically configured with security policies and required applications.
3. Conditional access to Microsoft 365 resources based on device compliance.
4. Support for both corporate and BYOD devices.

Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?

Accepted Answer

Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.. Option C is correct because Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.

Answer

Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.

Answer

Assign Microsoft Intune licenses to all users who will receive the new devices.

Answer

Create a compliance policy that requires BitLocker encryption and a minimum OS version.

Question 4

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. C) Use a provisioning package (PPKG) to enroll devices. D) Use Group Policy to configure MDM enrollment. Which option should you choose?

Accepted Answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. The 'Switch to Intune' option in the device's 'Access work or school' settings is the correct choice because it allows a seamless migration from a legacy on-premises MDM to Microsoft Intune without requiring a device reset. This feature, available on Windows 10 devices already joined to Microsoft Entra ID, triggers an automatic MDM enrollment switch by communicating with the Intune service, preserving all existing data and settings.

Answer

Use Windows Autopilot to reset the devices and re-enroll

Answer

Use Group Policy to configure MDM enrollment

Answer

Use a provisioning package (PPKG) to enroll devices

Question 5

You are the endpoint administrator for a healthcare organization that uses Intune to manage 500 iOS devices used by clinicians. The devices are enrolled as corporate-owned, user-approved devices via Apple Business Manager (ABM). You need to deploy a new custom electronic health record (EHR) app that is not in the App Store. The app is distributed as an .ipa file signed with an enterprise certificate. The app must be installed silently without user interaction. The devices are supervised and managed with iOS MDM. You have the following options: A) Deploy the app as an iOS LOB app in Intune and assign to device groups. B) Deploy the app as a Volume Purchase Program (VPP) app. C) Use Apple Configurator to sideload the app via USB. D) Distribute the app via a web link to the .ipa hosted on a public CDN. Which option should you choose?

Accepted Answer

Deploy the app as an iOS LOB app in Intune and assign to device groups. Option C is correct because deploying the app as an iOS LOB app in Intune allows you to upload the enterprise-signed .ipa file directly and assign it to device groups. Since the devices are supervised and enrolled via ABM, Intune can silently install the app using MDM commands without user interaction, leveraging the device's trust for enterprise certificates.

Answer

Deploy the app as a Volume Purchase Program (VPP) app

Answer

Use Apple Configurator to sideload the app via USB

Answer

Distribute the app via a web link to the .ipa hosted on a public CDN

Question 6

You are the endpoint administrator for Contoso Ltd., a multinational company with 10,000 Windows 10 and 11 devices managed by Microsoft Intune. The company recently acquired a subsidiary that uses on-premises Active Directory and Configuration Manager. The subsidiary's devices are not joined to Microsoft Entra ID. Your goal is to migrate these devices to cloud management with Intune within six months. The subsidiary has 2,000 devices, all running Windows 10. The devices are currently domain-joined and managed by ConfigMgr. You need to choose the most efficient migration strategy that minimizes user disruption and leverages existing investments. The subsidiary has a high-speed WAN link to the corporate network. You have the following options: A) Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune. B) Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join. C) Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps. D) Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning. Which option should you choose?

Accepted Answer

Use ConfigMgr co-management with Intune, then gradually transition workloads to Intune, and finally switch devices to Entra ID join. Option B is correct because co-management allows you to gradually transition Configuration Manager workloads to Intune without disrupting existing management, leveraging the existing ConfigMgr infrastructure and high-speed WAN link. This minimizes user disruption by keeping devices domain-joined initially, then switching to Entra ID join after workloads are migrated, which is the most efficient path for 2,000 existing domain-joined devices.

Answer

Use a provisioning package (PPKG) to join devices to Entra ID and enroll in Intune, while keeping ConfigMgr client for legacy apps

Answer

Use Windows Autopilot for existing devices by uploading hardware hashes, resetting devices, and re-provisioning

Answer

Use ConfigMgr to deploy a task sequence that performs a wipe-and-load with Windows Autopilot, then enroll in Intune

Question 7

You manage a fleet of 2,000 iOS devices for a healthcare organization. The devices are used by clinicians and must be enrolled in Intune. Due to security requirements, you must ensure that devices are supervised and that the Company Portal app is installed automatically. You have Apple Business Manager (ABM) set up with Intune. You need to configure the enrollment process so that when a new device is unboxed and turned on, it automatically enrolls and receives the required configuration. Which enrollment method should you use?

Accepted Answer

Automated Device Enrollment (ADE) with user affinity. Automated Device Enrollment (ADE) with user affinity is the correct method because it leverages Apple Business Manager (ABM) to supervise devices automatically during the initial setup, enforces the required supervision state, and installs the Company Portal app via a mandatory VPP app assignment. User affinity ensures that each device is associated with a specific clinician, enabling user-based policies and conditional access. This meets the healthcare organization's security requirements for supervised devices and automatic app deployment.

Answer

Device enrollment (without user affinity)

Answer

Company Portal enrollment

Answer

User enrollment (BYOD)

Question 8

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

Accepted Answer

Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.. Option A is correct because configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Azure AD-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Answer

Distribute a script to each user to run manually.

Answer

Deploy Windows Autopilot to reset and re-enroll each device.

Answer

Use the Intune Enrollment Status Page to force enrollment.

Question 9

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

Accepted Answer

Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.. Option D is correct because it leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Answer

Deploy Windows Autopilot for all new devices and ignore existing devices.

Answer

Purchase a third-party MDM tool to manage non-compliant devices.

Answer

Ask all users to manually enroll their devices using the Company Portal app.

Question 10

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

Accepted Answer

Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.. Option D is correct because deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Answer

Modify the existing Windows Update for Business policy to set the deferral period to 0 days.

Answer

Create a compliance policy that requires the update to be installed and assign it to all devices.

Answer

Use Configuration Manager to push the update via on-premises WSUS.

Question 11

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is co-managed with Configuration Manager. You need to configure a policy that requires BitLocker encryption. You create a BitLocker policy in Intune and assign it to the device. After 24 hours, BitLocker is not enabled on the device. You verify that the device is online and the policy is assigned. What is the most likely cause?

Accepted Answer

The encryption workload is set to Configuration Manager.. In a co-managed environment, workload control determines which management authority (Configuration Manager or Intune) handles specific policies. If the encryption workload is set to Configuration Manager, Intune's BitLocker policy will be ignored, even if assigned and the device is online. This is the most likely reason the policy did not take effect after 24 hours.

Answer

The device is not online.

Answer

The device is not enrolled in Intune.

Answer

The BitLocker policy is not assigned to the correct group.

Question 12

You are the Intune administrator for Contoso Ltd., a company with 5,000 Windows 11 devices and 1,000 iOS devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint for threat detection. You need to implement a solution that ensures devices are compliant before they can access corporate resources. You have the following requirements: 1. Windows devices must have Defender for Endpoint running and report a threat level of 'low' or better. 2. iOS devices must have a PIN of at least 6 characters and be jailbreak-detected as 'not jailbroken'. 3. If a device becomes noncompliant, it should be blocked immediately with no grace period. 4. Noncompliant devices should receive a notification to the user. You create compliance policies for Windows and iOS. You also create a conditional access policy in Microsoft Entra ID to require compliant devices. After deploying, you find that some Windows devices that are missing Defender for Endpoint are still able to access email. What should you do to resolve this issue?

Accepted Answer

Enable the 'Require Defender for Endpoint' setting in the Windows compliance policy.. Option C is correct because the Windows compliance policy must explicitly have the 'Require Defender for Endpoint' setting enabled to enforce that the Defender for Endpoint sensor is present and active on the device. Without this setting, the compliance policy only checks the threat level reported by Defender for Endpoint but does not require the sensor to be installed or running. Enabling this setting ensures that devices missing the Defender for Endpoint sensor are marked as noncompliant, which then triggers the conditional access policy to block access to corporate resources like email.

Answer

Configure a notification to users when their device is noncompliant.

Answer

Modify the conditional access policy to require a compliant device and a specific client app.

Answer

Set the required threat level to 'medium' in the Windows compliance policy.

Question 13

Your company uses Intune to manage iOS devices. You need to deploy a new app that is available in the Apple App Store. You create an iOS store app in Intune and assign it as 'Required' to a group of users. After 24 hours, some users report that the app is not installed. You verify that the app is available in the App Store and that the devices are online. The devices are supervised and enrolled via Apple Business Manager. What should you do first to troubleshoot the issue?

Accepted Answer

Verify that a VPP token is configured and assigned. Option B is correct because Volume Purchase Program (VPP) tokens are required for managed app distribution on supervised devices. Option A is incorrect because app configuration policies are not required for installation. Option C is incorrect because iOS restrictions are not blocking installation. Option D is incorrect because the devices are enrolled and online.

Answer

Review the iOS device restrictions policy

Answer

Confirm that the devices are enrolled in Intune

Answer

Check the app configuration policy for the app

Question 14

You are a Microsoft 365 Endpoint Administrator for a mid-sized company with 5,000 Windows 10 devices. The company is planning to migrate to Windows 11. You are tasked with deploying Windows 11 using a phased approach with Windows Autopilot. You have configured an Autopilot deployment profile for self-deploying mode targeting all Windows 10 devices in a dynamic device group. However, during the first wave of deployment, you notice that devices that have been upgraded to Windows 11 via an in-place upgrade are not automatically transitioning to the Autopilot experience. Instead, they boot directly to the existing Windows 10 desktop without any Autopilot enrollment. You verify that the devices are registered in Autopilot and that the deployment profile is assigned correctly. What is the most likely cause of this issue?

Accepted Answer

The devices have not been reset to OOBE state after the in-place upgrade. Windows Autopilot requires the device to be in an Out-of-Box Experience (OOBE) state to trigger the enrollment process. An in-place upgrade to Windows 11 preserves the existing user state and settings, so the device boots directly to the desktop without entering OOBE. Even though the device is registered in Autopilot and the profile is assigned, the Autopilot experience only initiates when the device is reset to OOBE (e.g., via a Windows reset or a fresh start). Therefore, the most likely cause is that the devices have not been reset to OOBE state after the in-place upgrade.

Answer

The Autopilot profile has a pre-provisioning policy that blocks self-deploying mode

Answer

The Autopilot profile is configured for user-driven mode instead of self-deploying mode

Answer

The devices are not connected to the internet during the first boot after upgrade

Question 15

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Intune to manage Windows 10 and iOS devices. The company recently experienced a malware outbreak on several Windows 10 devices. The security team wants to implement a solution that can automatically remediate threats on Windows 10 devices by isolating them from the network and running a full antivirus scan. They also want to be alerted when a threat is detected. You have already configured Microsoft Defender for Endpoint (MDE) and devices are onboarded. What should you configure in Intune to meet these requirements?

Accepted Answer

Create a device compliance policy that marks devices with active threats as non-compliant, and configure the non-compliance action to 'Retire device' and 'Send notification'.. Option B is correct because it leverages Intune's device compliance policy to detect active threats via Microsoft Defender for Endpoint integration. When a device has an active threat, it is marked as non-compliant, and the configured non-compliance action 'Retire device' ensures the device is isolated from corporate resources, while 'Send notification' alerts the security team. This meets the requirements for automatic remediation and alerting without additional manual steps.

Answer

Configure a device compliance policy to require Device Health Attestation (DHA) and set the action for non-compliance to 'Quarantine device'.

Answer

Enable Windows Defender Firewall with advanced security and create an inbound rule to block all traffic.

Answer

Configure AppLocker to block all apps and set the action to 'Run antivirus scan'.

Question 16

A company is using Microsoft Deployment Toolkit (MDT) to deploy Windows 11 to 200 new laptops. The deployment includes applications such as Microsoft 365 Apps for enterprise and a line-of-business (LOB) application. The LOB application requires a specific registry key to be set before installation. You have added a 'Set Registry' step in the task sequence before the application installation step. During a test deployment, the LOB application fails to install. The MDT logs show that the registry key is set correctly, but the application installer still fails. You suspect the application requires a reboot after setting the registry key. The task sequence does not have a reboot step after the registry change. Which step should you add to the task sequence?

Accepted Answer

Add a 'Restart Computer' step immediately after the 'Set Registry' step. Option C is correct because the LOB application requires a reboot after the registry key is set to make the change effective. In MDT, a 'Restart Computer' step forces a system restart, ensuring the registry modification is recognized by the application installer. Without this reboot, the installer may read stale registry data and fail, even though the key is correctly written.

Answer

Add a 'Wait' step for 60 seconds

Answer

Add a 'Set Task Sequence Variable' step to set a reboot variable

Answer

Add a 'Run Command Line' step to run gpupdate /force

Question 17

You are a Microsoft 365 Endpoint Administrator for a global organization with 5,000 Windows 11 devices managed by Intune. The company has a strict security policy requiring that all devices have BitLocker enabled with TPM validation, PIN, and startup key. Currently, only 80% of devices are compliant with BitLocker. After investigating, you discover that many non-compliant devices are older models that lack TPM 2.0, but they do have TPM 1.2. Additionally, some devices are virtual machines (VMs) that do not have a TPM at all. The security team insists that all devices must be encrypted, but they are willing to accept alternative configurations for devices without TPM 2.0. You need to propose a solution that maximizes security while ensuring compliance. What should you do?

Accepted Answer

Create multiple compliance policies: one for devices with TPM 2.0 requiring full BitLocker, one for devices with TPM 1.2 requiring BitLocker with TPM validation, and one for VMs requiring BitLocker with startup password.. Option C is correct because it uses multiple compliance policies to enforce the strongest possible BitLocker configuration based on each device's TPM capabilities. Devices with TPM 2.0 can meet the full requirement (TPM validation, PIN, startup key), devices with TPM 1.2 can use TPM-only validation (since TPM 1.2 does not support PIN+startup key in the same way), and VMs without a TPM can use a startup password. This approach maximizes security while ensuring all devices remain compliant with the security policy's intent.

Answer

Create a single compliance policy that requires BitLocker with TPM validation, PIN, and startup key, and exclude devices without TPM 2.0 from the policy.

Answer

Modify the existing compliance policy to remove the PIN requirement so that all devices can comply.

Answer

Downgrade all non-compliant devices to Windows 10 and enable BitLocker with TPM 1.2.

Question 18

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that prevents users from disabling the camera on their corporate iOS devices. You create a device restrictions profile and set the 'Enable camera' setting to 'No'. You assign the profile to a group containing all iOS devices. After 24 hours, users report that the camera is still functional. What should you check first?

Accepted Answer

Verify that the devices are members of the assigned group.. Option A is correct because the profile must be assigned to the correct group; if the devices are not in the group, the policy won't apply. Option B is wrong because the setting is correct. Option C is wrong because iOS restrictions are applied at the device level, not user. Option D is wrong because device compliance is not relevant here.

Answer

Ensure the setting 'Enable camera' is set to 'Not configured' instead of 'No'.

Answer

Review the device compliance status.

Answer

Check if the profile is applied to users instead of devices.

Question 19

Your company uses Microsoft Intune to manage Windows 10 devices. You have a compliance policy that requires devices to have a minimum of 4GB RAM and 64GB disk space. Several devices are marked non-compliant due to disk space. You check the devices and find they have 60GB free. The compliance policy checks total disk capacity, not free space. You need to allow these devices to be compliant. What should you do?

Accepted Answer

Modify the compliance policy to require a minimum of 60GB disk capacity.. Option C is correct because the compliance policy in Microsoft Intune checks total disk capacity, not free space. By lowering the minimum required total disk capacity to 60GB, devices with 60GB total disk space will meet the policy requirement and become compliant, without needing hardware changes or scripts.

Answer

Upgrade the disk on these devices to 128GB.

Answer

Change the compliance policy to check free disk space instead of total capacity.

Answer

Create a script to free up disk space on the devices.

Question 20

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are planning to upgrade them to Windows 11. The devices must meet the Windows 11 hardware requirements. You need to identify which devices are eligible for upgrade and then deploy Windows 11 using a feature update policy in Intune. You have the following requirements: (1) Generate a report of devices that are not eligible due to TPM 2.0 or CPU incompatibility. (2) Deploy Windows 11 to eligible devices using a phased approach: first to IT department (200 devices), then to pilot users (500 devices), and finally to all remaining devices. (3) Ensure that devices in the IT department receive the update within 7 days of Microsoft's release, while pilot users receive it after 30 days, and remaining devices after 60 days. (4) Monitor deployment progress and roll back if critical issues are detected. What should you do?

Accepted Answer

Create feature update policies for Windows 10 and later, targeting each group with appropriate deferral settings. Use the Windows 11 readiness report to identify eligible devices.. Option C is correct because feature update policies allow you to specify deferral periods and target groups. The readiness report identifies incompatibilities. Option A is wrong because update rings are for quality updates, not feature updates. Option B is wrong because Autopilot is for initial provisioning, not upgrades. Option D is wrong because Windows Update for Business group policies are not managed via Intune.

Answer

Configure Windows Update for Business group policies in on-premises AD.

Answer

Use update rings with different deferral periods for each group.

Answer

Use Windows Autopilot to deploy Windows 11 images to devices.