MD-102 Practice Test 7 — 10 Questions

Question 1

You are configuring Microsoft Intune for Windows 10 devices. Which two settings can you enforce using a device restrictions profile? (Select TWO.)

Accepted Answer

Disable the camera. A is correct because the device restrictions profile in Microsoft Intune includes a 'Camera' setting under the 'General' category, which allows you to disable the camera on Windows 10 devices by setting it to 'Block'. This enforces a policy that prevents camera access across all apps and the OS, leveraging the CSP (Policy CSP) `Camera/AllowCamera`.

Answer

Set default web browser

Answer

Set battery saver threshold

Answer

Configure Windows Update for Business settings

Question 2

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Accepted Answer

Request the hardware hash from the device manufacturer (OEM). OEMs can provide the hardware hash for devices they manufacture, which can be uploaded to Microsoft Intune or the Autopilot deployment service. This method is commonly used for new devices ordered directly from the manufacturer, as the hash is generated during the manufacturing process and included in the device's packaging or accessible via the OEM's portal.

Answer

Extract the hardware hash from the device BIOS

Answer

Use Microsoft Intune to generate the hardware hash from the device serial number

Answer

Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

Question 3

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

Accepted Answer

The update ring is not assigned to the device's group.. The device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Answer

The update ring is configured with an incorrect deferral period.

Answer

The device is not compliant with the security baseline.

Answer

Windows Update is blocked by the corporate firewall.

Question 4

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Accepted Answer

Microsoft Entra ID Connect. In a hybrid deployment, Windows Hello for Business requires synchronization of user credentials from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID Connect (B) provides this synchronization, enabling the device to authenticate against both on-premises and cloud resources. Additionally, a Public Key Infrastructure (PKI) (C) is required to issue the certificate-based authentication keys used by Windows Hello for Business in hybrid deployments, as the on-premises domain controllers must trust the certificates.

Answer

Configuration Manager

Answer

Multifactor authentication (MFA)

Answer

Microsoft Intune

Question 5

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

Accepted Answer

Microsoft 365 Apps for Windows. The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Answer

Web link

Answer

Windows app (MSI)

Answer

Line-of-business app

Question 6

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

Accepted Answer

Trigger a sync from Intune to force the device to check in.. The PowerShell command shown likely runs a compliance evaluation or sync action, but the device remains noncompliant because the evaluation results haven't been reported back to Intune. Triggering a sync from Intune forces the device to check in, upload its latest compliance status, and update the portal, which is the first troubleshooting step before considering re-enrollment or policy changes.

Answer

Re-enroll the device.

Answer

Delete the device from Intune and re-register.

Answer

Assign a new compliance policy to the device.

Question 7

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

Accepted Answer

Check if the dependency app is assigned and installed successfully. When a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Answer

Ensure the devices have internet connectivity

Answer

Verify that the app is signed with a trusted certificate

Answer

Recreate the deployment policy

Question 8

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

Accepted Answer

The conditional access policy has the grant control set to 'Require device to be marked as compliant'.. The most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Answer

All users have the required Microsoft 365 license.

Answer

The conditional access policy includes all cloud apps.

Answer

The device platform condition is set to iOS and Android only.

Question 9

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

Accepted Answer

Apple Automated Device Enrollment (ADE). Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Answer

Apple Configurator enrollment

Answer

Device Enrollment Manager (DEM) account

Answer

User-initiated enrollment via Company Portal

Question 10

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Accepted Answer

Create a Windows 10 feature update deployment policy.. A Windows 10 feature update deployment policy is the specific Intune policy type designed to deliver feature updates (like version 22H2) to devices. This policy allows you to specify the target version and control the rollout, which is required for deploying feature updates via Intune.

Answer

Create a device compliance policy for the target version.

Answer

Create a Windows 10 update ring with expedited updates.