MD-102 Practice Test 9 — 10 Questions

Question 1

Order the steps to configure a Windows 10 device for Microsoft 365 Apps deployment via Intune.

Accepted Answer

Sign in to Intune admin center, add a new app, select Microsoft 365 Apps, configure the suite settings, assign the app to groups.. Begin in Intune admin center, add a new app, choose Microsoft 365 Apps, configure suite, and assign.

Answer

Sign in to Intune admin center, add a new app, select Microsoft 365 Apps, assign the app to groups, configure the suite settings.

Answer

Sign in to Intune admin center, select Microsoft 365 Apps, add a new app, configure the suite settings, assign the app to groups.

Answer

Add a new app, sign in to Intune admin center, select Microsoft 365 Apps, configure the suite settings, assign the app to groups.

Question 2

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

Accepted Answer

Client apps. The 'Client apps' workload in Configuration Manager co-management is responsible for synchronizing client applications and enabling automatic enrollment of devices to Intune after the Configuration Manager client is installed. Option A (Endpoint Protection) is incorrect because it manages endpoint protection policies, not enrollment. Option B (Windows Update policies) is incorrect because it governs Windows Update for Business policies, not Intune enrollment. Option C (Resource access) is incorrect because it configures resource access policies like certificates and VPN, not automatic enrollment.

Answer

Endpoint Protection

Answer

Windows Update policies

Answer

Resource access

Question 3

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

Accepted Answer

Work profile. The Work profile enrollment type is correct because it creates a separate, managed container on Android Enterprise devices that isolates work apps and data from personal apps and data. This sandboxing is enforced by the Android Enterprise framework, ensuring that work apps cannot access personal data and vice versa, which meets the requirement for separation without requiring full device management.

Answer

Fully managed

Answer

Device administrator

Answer

Corporate-owned personally enabled (COPE)

Question 4

Your organization is preparing to deploy Windows 11 using Microsoft Intune. You need to ensure that all devices meet the minimum hardware requirements for Windows 11 before upgrade. Which THREE checks should you perform?

Accepted Answer

Check that Secure Boot is enabled.. Option A is correct because Windows 11 requires UEFI Secure Boot capability and the feature must be enabled on the device. Option C is correct because Windows 11 mandates TPM version 2.0, and it must be enabled and functioning in the firmware. Option D is correct because the minimum RAM requirement for Windows 11 is 4 GB. Option B is incorrect because while the processor must be 1 GHz or faster with 2 or more cores on a compatible 64-bit processor, the stated 1 core is insufficient. Option E is incorrect because the minimum storage requirement for Windows 11 is 64 GB, not 32 GB.

Answer

Check that the processor is at least 1GHz with 1 core.

Answer

Check that the device has at least 32GB of storage.

Question 5

Refer to the exhibit. You are deploying a custom OMA-URI policy to Windows 10 devices. What is the effect of this policy?

Accepted Answer

Device telemetry is set to enhanced.. The OMA-URI policy configured in the exhibit sets the 'System/AllowTelemetry' value to '2', which corresponds to the 'Enhanced' telemetry level in Windows 10. This policy enables Microsoft to collect additional diagnostic data, including how Windows and apps are used, to improve the user experience and device performance. It does not affect Windows Update deferral, Defender state, or Cortana.

Answer

Windows Update is configured to defer updates.

Answer

Windows Defender is disabled.

Answer

Cortana is enabled.

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive data from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on app and device context. By configuring a session policy with the condition 'Device tag equals Unmanaged' and the control 'Block download', you can automatically block downloads of sensitive data from SharePoint Online to unmanaged devices, leveraging reverse proxy architecture to inspect and intercept traffic.

Answer

Activity policy

Answer

App discovery policy

Answer

Access policy

Question 7

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

Accepted Answer

One of the required apps failed to install.. The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Answer

The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

Answer

The user attempted to retry the setup and it was blocked.

Answer

The device reset on failure is enabled, causing a reset loop.

Question 8

Your organization is planning to deploy Microsoft Entra hybrid joined devices. What is a prerequisite for this configuration?

Accepted Answer

Microsoft Entra Connect must be installed and configured.. Microsoft Entra hybrid joined devices require synchronization of on-premises Active Directory identities to Microsoft Entra ID. Microsoft Entra Connect (or Microsoft Entra Connect Sync) is the tool that performs this identity synchronization, making it a mandatory prerequisite. Without it, the on-premises AD objects cannot be linked to Entra ID for hybrid join.

Answer

Azure AD Premium P1 license is required.

Answer

Microsoft Intune must be enabled for auto-enrollment.

Answer

Microsoft Defender for Endpoint must be deployed.

Question 9

You are designing an app protection policy (APP) for Microsoft 365 mobile apps accessing corporate data on iOS devices. The security team requires that when a user opens a work document in the Microsoft Word app, the user must authenticate with Face ID or a passcode. Which setting should you configure?

Accepted Answer

Require PIN or Face ID for access (iOS). The 'Require PIN or Face ID for access (iOS)' setting enforces biometric or passcode authentication specifically when a user launches a managed app or resumes it from the background. This directly meets the requirement that opening a work document in Word triggers Face ID or passcode verification, as the app protection policy (APP) intercepts the app launch and prompts for authentication before granting access to corporate data.

Answer

Block managed apps from running on jailbroken devices

Answer

Encrypt app data

Answer

Require app PIN when device PIN is not set

Question 10

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

Accepted Answer

The devices are not connected to the internet.. Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Answer

The hardware hashes are invalid.

Answer

The devices are not running Windows 11 Pro or Enterprise.

Answer

The user does not have an Intune license.