MD-102 Practice Exam 64 — 20 Questions

Question 1

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

Accepted Answer

Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.. Option B is correct because deploying a staging server (or an Azure AD Connect staging server) allows the initial device synchronization to Azure AD to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Answer

Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

Answer

Use Windows Autopilot to reset the devices and enroll them in Intune.

Answer

Manually enroll each device by signing in to the Company Portal.

Question 2

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

Accepted Answer

Remote lock. Option A is correct because 'Remote lock' locks the device and allows a custom message to be displayed. Option B is wrong because 'Wipe' performs a factory reset, which would erase all data and prevent the message from being shown. Option C is wrong because 'Retire' removes company data only, does not lock the device. Option D is wrong because 'Reset passcode' changes the passcode but does not display a custom message.

Answer

Reset passcode

Answer

Wipe

Answer

Retire

Question 3

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

Accepted Answer

Use the 'Update Immediately' setting in the Windows Update for Business policy.. Option D is correct because the 'Update Immediately' setting forces the device to check for and install updates without delay. Option A is wrong because the deadline is already set to 1 day; increasing it would allow more delay. Option B is wrong because restarting the device does not force update installation. Option C is wrong because the issue is not with the update ring assignment; the policy is already applied.

Answer

Ask users to restart their devices.

Answer

Reassign the update ring to a broader device group.

Answer

Increase the 'Quality update deadline' to 3 days.

Question 4

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.. Option B is correct because Conditional Access policies use the device compliance status from Intune to grant or block access to cloud apps like Exchange Online. Option A is wrong because configuring a device configuration policy only enforces settings but does not block access. Option C is wrong because app protection policies protect data within apps but do not block access based on device compliance. Option D is wrong because blocking all devices from Azure AD would prevent access even for compliant devices.

Answer

Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

Answer

Create a device configuration policy that blocks access to corporate resources.

Answer

Create an app protection policy in Intune to block access to apps.

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs at every device startup to map network drives based on the user's security group membership. The script should run in the system context and should not require user interaction. How should you configure the script deployment in Intune?

Accepted Answer

Add the PowerShell script as a Windows PowerShell script in Intune, set the execution context to 'System', and configure the script to run at device startup.. Option A is correct because Intune supports PowerShell scripts that can run in the system context and be set to run at startup. Option B is incorrect because the script needs to run at startup, not on demand. Option C is incorrect because a device configuration profile cannot run scripts. Option D is incorrect because Proactive remediations are for detecting and fixing issues, not for running scripts at startup.

Answer

Add the script as a Windows PowerShell script in Intune and assign it to users, so it runs when users log in.

Answer

Use Proactive remediations in Intune to run the script on a schedule.

Answer

Create a device configuration profile that includes the script as a custom setting.

Question 6

You are an Intune administrator for a large enterprise that uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) for threat protection. You need to ensure that all Windows 10 devices are properly onboarded to Defender for Endpoint and that security settings are enforced via Intune. You have created a device configuration profile that includes the 'Microsoft Defender for Endpoint' settings, but some devices are not appearing in the Defender for Endpoint portal. You verify that the devices are Intune managed and enrolled. What should you do to ensure proper onboarding?

Accepted Answer

Deploy the Microsoft Defender for Endpoint onboarding package (WindowsDefenderATPOnboardingPackage.zip) via Intune using a PowerShell script or a device configuration profile.. Option B is correct because onboarding to Defender for Endpoint requires a specific deployment package (a .zip file containing the onboarding script) that must be deployed via Intune using a PowerShell script or a device configuration profile with the 'Microsoft Defender for Endpoint' template. However, the most common missing step is deploying the onboarding package. Option A is incorrect because compliance policy does not onboard devices. Option C is incorrect because the devices are already Intune managed. Option D is incorrect because Microsoft Entra ID registration is not the issue.

Answer

Ensure that the devices are co-managed with Configuration Manager.

Answer

Create a compliance policy that requires Defender for Endpoint to be active.

Answer

Register the devices in Microsoft Entra ID (Azure AD) as hybrid joined.

Question 7

Your organization uses Microsoft Intune to manage iOS and Android devices. You need to ensure that corporate data on these devices is protected. Specifically, you want to prevent users from copying corporate data from managed apps to personal apps. You also want to ensure that when a device is lost or stolen, the corporate data can be selectively wiped without affecting personal data. Which Intune feature should you use to achieve these requirements?

Accepted Answer

App Protection Policies (MAM).. Option A is correct because App Protection Policies (MAM) provide data protection settings such as preventing copy/paste between managed and unmanaged apps, and allow selective wipe of corporate data. Option B is incorrect because device compliance policies focus on device-level settings, not app-level data protection. Option C is incorrect because device configuration profiles configure device settings, not app data protection. Option D is incorrect because conditional access policies control access based on compliance, but do not directly prevent copy/paste or provide selective wipe at the app level.

Answer

Device Compliance Policies.

Answer

Conditional Access Policies.

Answer

Device Configuration Profiles.

Question 8

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

Accepted Answer

Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.. Option B is correct because Android Enterprise devices with work profile use file-based encryption by default, which is considered compliant with Intune's encryption requirement. However, if devices are still non-compliant, you may need to check the compliance policy settings for Android Enterprise. The most likely fix is to configure the compliance policy to 'Require encryption of data storage on device' which is already done. But if devices are still non-compliant, you might need to update the policy to include the specific encryption type. Option A is incorrect because you cannot change the encryption type via Intune. Option C is incorrect because device configuration profiles cannot change encryption type. Option D is incorrect because work profile is already enabled.

Answer

Enable the work profile on the devices via a device configuration profile.

Answer

Change the device encryption method to full-disk encryption using a device configuration profile.

Answer

Create a device configuration profile that enforces encryption on the work profile.

Question 9

You manage devices at Fabrikam Inc. using Microsoft Intune. You have a Windows 11 device that is not compliant because it is missing a required application. The device shows as 'Not evaluated' in Intune for the compliance policy. The user reports that the device syncs manually but still shows as non-compliant. You have verified that the device is enrolled and policy is assigned. What should you do first to resolve the issue?

Accepted Answer

From the Intune console, select the device and run the 'Sync' action with the option 'Re-evaluate compliance policies'.. Re-evaluating the compliance policy by running a sync with the Intune management extension can trigger a fresh assessment. Creating a new compliance policy is unnecessary. Removing and re-enrolling is disruptive. Checking the user's license is not relevant to compliance evaluation.

Answer

Verify that the user has a valid Microsoft 365 license.

Answer

Create a new compliance policy with the same requirements and assign it to the device.

Answer

Remove the device from Intune and re-enroll it.

Question 10

Your organization uses Microsoft Intune to manage Windows 10 and iOS devices. You need to deploy a certificate-based authentication solution for Wi-Fi and VPN access. You have set up a Certificate Connector for Microsoft Intune and issued a root CA certificate. You have created a trusted certificate profile for the root CA and a SCEP certificate profile for client certificates. However, iOS devices are failing to enroll for client certificates. You verify that the SCEP profile is correctly configured and assigned. What is the most likely cause?

Accepted Answer

The SCEP profile does not reference the trusted certificate profile for the root CA, or the trusted certificate profile is not assigned to iOS devices.. Option C is correct because iOS devices require a trusted certificate profile for the root CA to be deployed before the SCEP profile, and the SCEP profile must reference that trusted certificate. If the reference is missing or incorrect, the SCEP enrollment will fail. Option A is incorrect because the NDES server is not required for Intune certificate deployment. Option B is incorrect because device compliance is not a prerequisite for certificate enrollment. Option D is incorrect because iOS devices can use SCEP without a user affinity requirement.

Answer

The Certificate Connector is not configured to support iOS devices.

Answer

iOS devices require user affinity for SCEP enrollment, which is not configured.

Answer

The iOS devices are not compliant with the compliance policy.

Question 11

You are a Microsoft Intune administrator for Tailwind Traders. The company has enrolled Windows 11 devices. You need to configure BitLocker encryption on all devices using Intune. You have created an endpoint security policy for BitLocker and assigned it to the correct group. After 24 hours, some devices still show as not encrypted. You verify that the devices are compliant with the policy's prerequisites. What should you do to force the policy to apply?

Accepted Answer

Remotely sync the devices from the Intune console to refresh policy.. Triggering a sync on the devices will force the policy to be applied. Re-creating the policy is unnecessary. Using a local GPO is not managed centrally. Checking the hardware is not relevant.

Answer

Use Group Policy Editor to configure BitLocker locally on each device.

Answer

Check if the devices have TPM version 2.0.

Answer

Re-create the BitLocker policy with a different name.

Question 12

You are a Microsoft 365 administrator for a school district. You have 2,000 Windows 10 devices used by students. All devices are enrolled in Microsoft Intune. You need to deploy a set of educational apps from the Microsoft Store for Education (now part of Microsoft Store for Business). The apps should be automatically installed on all student devices, and students should not be able to remove them. You have already added the apps to your Microsoft Store for Business inventory and acquired offline licenses. You have also configured Intune to sync the Microsoft Store for Business. Which action should you take in Intune to deploy the apps with the least administrative effort?

Accepted Answer

Create a 'Microsoft Store for Business' app in Intune, select the offline-licensed apps, and assign as 'Required' to a device group containing all student devices.. Option A is correct: Using the 'Microsoft Store for Business' app type with offline licenses allows automatic sync and silent installation. Option B is for user-targeted. Option C is for online licenses. Option D is for Win32 apps.

Answer

Use the 'Microsoft Store app (Windows)' type and assign as 'Required' to the device group.

Answer

Create a 'Microsoft Store for Business' app in Intune, select the online-licensed apps, and assign as 'Available' to a user group.

Answer

Download the app packages and deploy as Win32 apps with silent switches.

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom vertical market app that is not available in the Apple App Store. The app is distributed as an .ipa file signed with an enterprise certificate. You have uploaded the .ipa file to Intune. However, when you assign the app to a user group, the installation fails on devices with the error 'Unable to download app'. The devices are enrolled as user-affinity devices with Device Enrollment Program (DEP). You have verified that the enterprise certificate is trusted on the devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in Supervised mode.. Option B is correct because enterprise-signed apps require the device to be in Supervised mode for silent installation without user prompts. Without supervision, the user must manually trust the certificate or the app may fail. Option A is wrong because VPN configuration is not required for app download. Option C is wrong because VPP is for store apps, not enterprise-signed. Option D is wrong because the icon file is not critical for installation.

Answer

The app package does not include an icon file.

Answer

The devices do not have a VPN configuration profile installed.

Answer

The app is not purchased through the Volume Purchase Program (VPP).

Question 14

You are a Microsoft 365 Endpoint Administrator for Contoso Ltd. The company has 2,000 Windows 11 devices enrolled in Microsoft Intune. You need to deploy a custom line-of-business (LOB) application (AppX package) to 500 devices used by the sales team. The app must be available in the Company Portal for users to install on demand, but it should also be automatically installed on devices that have not installed it within 7 days. Additionally, you want to ensure that the app is removed if a device is unenrolled from Intune. The sales team members are in a dynamic device group called 'Sales Devices' based on device category. You have the AppX package (.appxbundle) signed with a trusted certificate. You need to choose the correct deployment approach from the four options below.

Accepted Answer

Add as a Line-of-business app, assign to 'Sales Devices' group as 'Required', and also assign to the same group as 'Available' for Company Portal.. Option C is correct: A required assignment to the device group ensures installation on all devices; the 'Available' assignment makes it visible in Company Portal; the removal on unenroll is automatic with required assignment. Option A has no required assignment. Option B uses user group, not device group. Option D uses 'Available' assignment with deadline, but the deadline is not supported for LOB apps in that way.

Answer

Add as a Microsoft Store for Business (offline) app, assign to 'Sales Devices' group as 'Available', and configure deadline after 7 days.

Answer

Add as a Line-of-business app, assign to 'Sales Devices' group as 'Available', and configure 'Available for enrolled devices' with deadline after 7 days.

Answer

Add as a Windows app (Win32), assign to a user group containing sales users as 'Required', and set deadline to 7 days.

Question 15

Your company uses Microsoft Intune to manage Windows 10 and 11 devices. You have been asked to deploy a Microsoft 365 Apps for enterprise (formerly Office 365 ProPlus) configuration that includes Word, Excel, PowerPoint, and Outlook. The deployment must be assigned to a group of 200 devices that are not connected to the internet during initial setup; they will get updates from a local Distribution Point (DP) on the network. You have created a Win32 app using the Office Deployment Tool (ODT) with a configuration XML that specifies the products and updates source. Which additional step is necessary to ensure the installation succeeds without internet?

Accepted Answer

Include the SourcePath attribute in the configuration XML pointing to the local DP.. Option A is correct because the ODT configuration XML must include the SourcePath attribute pointing to the local DP for installation files. Option B is wrong because the local DP already hosts the files; no additional download required. Option C is wrong because network discovery is not needed if the path is specified. Option D is wrong because the channel is specified in the XML, not in Intune app properties.

Answer

Enable the 'Allow devices to discover network content' setting in Intune.

Answer

Download the Office installation files to each device before deployment.

Answer

Set the Office channel to 'Current' in the Intune app properties.

Question 16

Your organization uses Microsoft Intune to manage 1,500 Windows 10 and 500 macOS devices. You need to deploy Microsoft Edge (Stable channel) to all Windows devices. The deployment must ensure that Edge is set as the default browser, and that the 'SmartScreen' feature is enabled. You also want to ensure that users cannot change the default browser setting. You have created a configuration profile with the required settings. The Edge app is available in the Microsoft Store for Business. Which deployment method should you use to meet all requirements with the least administrative effort?

Accepted Answer

Use the 'Microsoft Edge for Windows 10 and later' built-in app type in Intune, assign it as 'Required' to a device group, and apply the configuration profile.. Option A is correct: Using the built-in 'Microsoft Edge for Windows 10 and later' app type in Intune allows you to set default browser and manage policies via configuration profiles. Option B is manual and less integrated. Option C requires scripting. Option D is not a built-in feature.

Answer

Use a PowerShell script to install Edge and apply settings via registry.

Answer

Deploy Edge as a Win32 app using the offline installer, and apply the configuration profile separately.

Answer

Deploy Edge as a Microsoft Store for Business app and use OMA-URI to set default browser.

Question 17

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

Accepted Answer

The managed Google Play Store app is disabled on the devices.. Option D is correct because in a work profile, the managed Google Play Store app must be present and active; if it is disabled, apps cannot be installed. Option A is wrong because the app is already approved. Option B is wrong because VPN is not required. Option C is wrong because there is no app protection policy requirement for installation.

Answer

The app is not approved in managed Google Play for the organization.

Answer

The devices do not have a VPN profile configured.

Answer

The users do not have an app protection policy assigned.

Question 18

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL.

You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16.

What is the most likely cause of the configuration not applying?

Accepted Answer

The devices are not supervised. Option D is correct. For VPP apps, app configuration policies must be assigned to the same group as the app assignment. Additionally, the configuration policy must be targeted to devices, not users, for iOS. However, the status 'Pending' suggests the policy is not yet applied; the likely cause is that the devices are not supervised. App configuration policies for iOS require supervised devices when using VPP. Option A is wrong because the app is required and installs successfully. Option B is wrong because the policy is assigned, but status is pending. Option C is wrong because iOS version is compatible.

Answer

The iOS version does not support app configuration

Answer

The app configuration policy is not assigned to the correct group

Answer

The app is not deployed via VPP correctly

Question 19

Your organization has 500 Windows 11 devices managed by Microsoft Intune. You need to deploy a third-party Win32 application (AppDeploy.exe) that requires the user to accept an end-user license agreement (EULA) during installation. The app must be installed silently without user interaction. You have created a custom script that accepts the EULA automatically. The app is packaged as an .intunewin file. You need to configure the deployment in Intune.

The installation command must run the script that accepts the EULA and then launches the installer. The detection rule must check for the presence of a specific file (C:\Program Files\AppDeploy\app.exe). You want to ensure that if the installation fails, Intune retries automatically.

Which of the following configurations should you choose?

Accepted Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1 && AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: 3 attempts every 60 minutes. Option B is correct. Using a PowerShell script as the install command allows you to chain commands: first accept EULA, then run setup. The detection rule uses file existence. Setting 'Retry count' to 3 and 'Retry interval' to 60 minutes provides automatic retry. Option A is wrong because it does not include the EULA acceptance. Option C is wrong because the detection rule checks registry instead of file, which may not be reliable. Option D is wrong because it does not include retry settings.

Answer

Install command: 'AppDeploy.exe /S', Detection rule: Registry 'HKLM\Software\AppDeploy\Installed' exists, Retry: 3 attempts every 60 minutes

Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Answer

Install command: 'AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Question 20

You are the endpoint administrator for Contoso, a company with 5,000 Windows 11 devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to implement a solution that ensures all devices have the latest Windows security updates installed within 7 days of release. Additionally, you must ensure that if a device misses two consecutive update cycles, it is automatically blocked from accessing corporate resources until it is updated. You have the following requirements: 1. Use Intune update rings to control update deployment. 2. Use MDE vulnerability management to identify missing updates. 3. Device compliance policies should check for missing updates and mark devices noncompliant. 4. Conditional Access should block noncompliant devices. Which combination of actions should you take?

Accepted Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.. Option D is correct: Update rings set the deferral period to 7 days; a device compliance policy checks for missing updates and marks noncompliant; Conditional Access blocks noncompliant devices. Option A (compliance policy on missing updates only) misses the Conditional Access block. Option B (app protection policy) is irrelevant. Option C (update ring with deferral 0) applies updates immediately, not within 7 days.

Answer

Configure an update ring with a 7-day deferral. Create an app protection policy that requires minimum OS version. Assign the app protection policy to all users.

Answer

Configure an update ring with no deferral (deferral 0). Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.

Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Assign the compliance policy to all devices. Do not configure Conditional Access.