MD-102 Practice Test 8 — 10 Questions

Question 1

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Intune licenses assigned to users. Intune licenses must be assigned to users to grant them access to the service. Without a license, the user cannot authenticate with Intune, and automatic enrollment will fail during the device registration step. This is a prerequisite enforced by Microsoft Entra ID and Intune together.

Answer

Apple Push Notification service certificate (for iOS)

Answer

Configuration Manager (for co-management)

Question 2

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

Accepted Answer

Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker. Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Answer

Device configuration profile to enable BitLocker

Answer

Device compliance policy with a noncompliance action to mark device as non-compliant

Answer

PowerShell script deployment with assignment to all devices

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to create a compliance policy that requires devices to have a firewall enabled. Which setting should you configure?

Accepted Answer

Firewall. The Firewall setting in a Windows compliance policy specifically evaluates whether Windows Firewall is enabled. Setting it to 'Require' ensures devices without an active firewall are non-compliant, directly satisfying the scenario's requirement.

Answer

Antivirus

Answer

Require a password to unlock mobile devices

Answer

Require BitLocker

Question 4

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

Accepted Answer

The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.. Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Answer

The Configuration Manager client and a site code for automatic site assignment.

Answer

A provisioning package containing the MDM enrollment settings.

Answer

A Group Policy Object that configures automatic MDM enrollment.

Question 5

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

Accepted Answer

Device restrictions configuration policy. Device restrictions configuration policies in Microsoft Intune are designed to control built-in device settings and hardware features, including security-related options like blocking installation from unknown sources. For Android Enterprise, this policy type directly maps to the 'Unknown sources' setting under Device Restrictions, allowing you to prevent sideloading of apps. Compliance policies only evaluate conditions and mark devices as compliant or non-compliant; they do not enforce configuration changes. App configuration policies deliver app-specific settings (e.g., server URLs) to managed apps, and enrollment restrictions control which devices can enroll, not what users can do after enrollment.

Answer

Device compliance policy

Answer

App configuration policy

Answer

Enrollment restriction

Question 6

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

Accepted Answer

Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center. Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center is the standard method to register devices for Windows Autopilot. Option A is incorrect because the Microsoft Store for Business is deprecated and no longer supports Autopilot registration. Option B is incorrect because while OEMs can register devices, you already have the hardware hashes, making direct upload more efficient. Option C is incorrect because Windows Configuration Designer is used to create provisioning packages for manual setup, not for Autopilot device registration.

Answer

Use the Microsoft Store for Business to automatically register devices

Answer

Contact the OEM to register the devices using the device serial numbers

Answer

Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings

Question 7

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

Accepted Answer

Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.. Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Answer

Use a compliance policy with custom settings to enforce BitLocker.

Answer

Create a new security baseline from scratch and include the BitLocker settings.

Answer

Edit the built-in Windows security baseline and add the BitLocker settings.

Question 8

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

Accepted Answer

Use a Win32 app with install context set to 'system'.. Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Answer

Assign the app as 'available' for user-install.

Answer

Deploy as a line-of-business app with device context.

Answer

Package as a Microsoft Store for Business app.

Question 9

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

Accepted Answer

App protection policy (MAM). App protection policies (MAM) protect corporate data in apps like Outlook without requiring device enrollment in MDM. Option A (Device compliance policy) requires MDM enrollment. Option B (Device configuration profile) is for device settings, not data protection. Option C (Conditional Access policy) controls access but does not directly protect data within apps.

Answer

Device compliance policy

Answer

Device configuration profile

Answer

Conditional Access policy

Question 10

Which FOUR of the following are valid detection rules for a Win32 app in Intune?

Accepted Answer

PowerShell script (custom detection). Option A (PowerShell script / custom detection) is valid because Intune Win32 apps support a custom detection script whose exit code and stdout determine whether the app is considered installed. Option B (MSI product code) is valid because Intune can detect an installed app by matching its MSI product code in the Windows Installer database. Option C (Registry key or value exists) is valid because Intune's registry detection rule checks for a specified key/value (and can compare a value's string, integer, or version) to confirm installation. Option D (File system / file or folder exists) is valid because Intune's file/folder detection rule verifies existence (and optionally date, size, or version) of a specified path. Option E (Network share access) is not a supported Win32 app detection rule type in Intune, so it does not belong.

Answer

Network share access