MD-102 Practice Test 8 — 10 Questions

Question 1

You manage Windows 10 devices with Microsoft Intune. A user reports that their device is not receiving required compliance policies, and the device status in Intune shows 'Not evaluated' for compliance. You confirm the device is enrolled and able to sync. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the compliance policy is assigned to a group that includes the user or device.. A compliance policy must be assigned to a group containing the user or device for it to be evaluated. Even if the device is enrolled and syncing, without assignment the policy will not apply, resulting in a 'Not evaluated' status in Intune.

Answer

Verify that the user is assigned an Intune license.

Answer

Run the 'dsregcmd /status' command to check the device registration status.

Answer

Check that the device has a TPM chip enabled and Secure Boot turned on.

Question 2

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Accepted Answer

MDM enrollment enabled in Microsoft Entra ID. Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Answer

A device compliance policy assigned to the device

Answer

Azure AD Premium P1 license

Question 3

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

Accepted Answer

Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.. Setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Answer

Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

Answer

Set 'Update deferral period (days)' to 7.

Answer

Set 'Update deferral period (days)' to 30.

Question 4

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Accepted Answer

Enables the Windows Firewall for the public network profile. The setting shown in the exhibit configures the Windows Firewall to enable the firewall for the public network profile. In Intune, the 'Windows Firewall' configuration policy allows administrators to define per-profile firewall states. Enabling the firewall for the public profile is a common security baseline requirement to protect devices on untrusted networks.

Answer

Disables the Windows Firewall for all network profiles

Answer

Enables Microsoft Defender Antivirus real-time protection

Answer

Disables the Windows Firewall for the domain network profile

Question 5

A company uses Microsoft Intune to manage Windows 11 devices. Users report that the Company Portal app is not showing required applications. You verify that the devices show as 'Compliant' in Microsoft Intune. Which configuration should you check first?

Accepted Answer

Check the application assignments in Intune.. The most common reason required applications are not visible in Company Portal is that the applications have not been assigned to the user or device group. Even if a device is compliant, Intune will only display applications that are assigned with an 'Available' intent to the user or device. Checking application assignments first directly addresses the symptom without assuming other configurations are misconfigured.

Answer

Check the Microsoft Entra ID (Azure AD) configuration for the device.

Answer

Check the Windows Update for Business ring assignments.

Answer

Check the device compliance policy settings.

Question 6

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Accepted Answer

Device compliance policy. Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

Windows update ring

Question 7

Your organization needs to deploy a web app link to users' devices via Microsoft Intune. Which app type should you select?

Accepted Answer

Web link. C is correct because a Web link app type in Microsoft Intune allows you to deploy a shortcut to a web app on users' devices without installing any software. This is ideal for linking to a web app that runs in a browser, as it simply places an icon on the device's app list or home screen that opens the specified URL.

Answer

Windows app (Win32)

Answer

iOS store app

Answer

Managed Google Play app

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

Accepted Answer

Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.. Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Answer

Set up an automatic enrollment policy that retires devices after 30 days of inactivity.

Answer

Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.

Answer

Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.

Question 9

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Accepted Answer

Create a device compliance policy that checks for required settings.. A device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Answer

Configure an Exchange Active Sync policy in Intune.

Answer

Create a device configuration profile to enforce security settings.

Answer

Deploy an app protection policy for Outlook for iOS and Android.

Question 10

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile