MD-102 Practice Questions

Question 1

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

Accepted Answer

Automated investigation and response. The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Answer

Threat analytics

Answer

Device inventory

Answer

Alert queue

Question 2

Arrange the steps to troubleshoot a Windows 10 device failing to enroll in Microsoft Intune.

Accepted Answer

1) Verify user license and network connectivity. 2) Check enrollment logs (e.g., Event Viewer). 3) Verify DNS, certificate, and GPO prerequisites. 4) Retry enrollment.. Start with basic connectivity and licensing, then check logs for errors, verify prerequisites, and retry.

Answer

1) Check enrollment logs. 2) Retry enrollment. 3) Verify user license and connectivity. 4) Verify DNS, certificate, and GPO prerequisites.

Answer

1) Verify DNS, certificate, and GPO prerequisites. 2) Retry enrollment. 3) Check enrollment logs. 4) Verify user license and connectivity.

Answer

1) Retry enrollment immediately. 2) Verify user license if fails. 3) Check enrollment logs. 4) Verify DNS, certificate, and GPO prerequisites.

Question 3

Refer to the exhibit. You deploy this custom OMA-URI policy to Windows 10 devices. What is the expected outcome?

Accepted Answer

Telemetry is set to 0 - Security (Enterprise only). The OMA-URI policy sets the 'AllowTelemetry' value to 0, which in Windows 10 corresponds to the 'Security (Enterprise only)' telemetry level. This level sends only essential security data, such as the Malicious Software Removal Tool (MSRT) and Windows Defender information, and is only available in Enterprise editions. Therefore, the expected outcome is that telemetry is set to 0 - Security (Enterprise only).

Answer

Telemetry is set to 1 - Basic

Answer

The policy applies to users, not devices

Answer

The policy fails because value 0 is not allowed

Question 4

Your organization uses Microsoft Intune to manage iOS and Android devices. You have a compliance policy that requires a minimum OS version: iOS 16.0 and Android 12.0. You also have a Conditional Access policy that requires compliant devices. Several users report that they cannot access corporate email on their personal Android devices. The devices are Android 11.0. You need to allow these users to access email while ensuring that corporate data is protected. What should you do?

Accepted Answer

Create a Conditional Access policy that grants access but requires app protection policies and session controls.. It allows access from non-compliant devices while enforcing data protection through app protection policies (MAM) and session controls, such as limiting access to the web or approved apps. This balances security and usability. Option A is incorrect because removing the Conditional Access policy entirely would allow all devices, including those that are non-compliant, without any data protection. Option B is incorrect because lowering the minimum OS version in the compliance policy weakens the security baseline and may not align with organizational requirements. Option D is incorrect because upgrading devices may not be immediately possible for all users, and the organization needs a solution that works with existing devices.

Answer

Remove the Conditional Access policy for these users.

Answer

Update the compliance policy to accept Android 11.0.

Answer

Ask users to upgrade their devices to Android 12.0.

Question 5

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

Accepted Answer

Compliance policy. A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Answer

Device configuration policy

Answer

Windows Update for Business policy

Answer

Device health attestation policy

Question 6

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

Accepted Answer

Assign the app to users as 'Available' in the Company Portal. The 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Answer

Configure the app as 'Required' for all users

Answer

Add the app to the Windows Autopilot deployment profile

Answer

Grant users local administrator rights on their devices

Question 7

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Accepted Answer

Number of failed attempts before wipe.. The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Answer

Maximum passcode age (days).

Answer

Allow simple passcode.

Question 8

Refer to the exhibit. You are reviewing a Windows 10 compliance policy JSON. What is the purpose of the 'osMinimumVersion' setting?

Accepted Answer

It defines the minimum OS build version that the device must have to be compliant.. The 'osMinimumVersion' setting in a Windows 10 compliance policy specifies the minimum OS build version (e.g., 10.0.19041) that a device must have to be considered compliant. If the device's OS build version is lower than this value, Intune marks it as non-compliant, which can trigger conditional access blocks or remediation actions. This setting does not initiate an update; it only evaluates the current version against the defined threshold.

Answer

It sets the Windows Update for Business ring to that version.

Answer

It requires the device to be on a specific feature update.

Answer

It forces the device to update to that version.

Question 9

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

Accepted Answer

A device configuration profile using the 'Kiosk' settings for single-app mode. A is correct because Intune's device configuration profile includes a 'Kiosk' settings category specifically designed for Windows 10/11 devices. When you select 'Single-app mode' under kiosk settings, you can specify a single Store app (e.g., a UWP or Win32 app) that will run in full-screen, locked-down mode, preventing users from accessing any other system functions or apps.

Answer

A device restrictions profile blocking access to other apps

Answer

A compliance policy requiring the app to be installed

Answer

A configuration profile for Microsoft Edge in kiosk mode

Question 10

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Accepted Answer

Request the hardware hash from the device manufacturer (OEM). OEMs can provide the hardware hash for devices they manufacture, which can be uploaded to Microsoft Intune or the Autopilot deployment service. This method is commonly used for new devices ordered directly from the manufacturer, as the hash is generated during the manufacturing process and included in the device's packaging or accessible via the OEM's portal.

Answer

Extract the hardware hash from the device BIOS

Answer

Use Microsoft Intune to generate the hardware hash from the device serial number

Answer

Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

Question 11

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

Accepted Answer

Create an update ring for Windows 10 with a deadline of 7 days.. Update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Answer

Create a compliance policy for Windows 10 update compliance.

Answer

Create a device configuration profile for Windows 10 updates.

Answer

Configure a Windows Update for Business policy in Group Policy.

Question 12

You are managing devices with Microsoft Intune. You need to ensure that only compliant devices can access corporate email. Which TWO components should you configure?

Accepted Answer

Compliance policy for Microsoft Intune. To ensure only compliant devices can access corporate email, you need a compliance policy (Option B) that defines device health rules and a Conditional Access policy (Option D) that enforces access based on compliance status. Option C is essentially the same concept as Option B and should not be selected as an additional component. Option A (device configuration profile) sets device settings but does not define compliance. Option E (app protection policy) protects app data but does not evaluate device compliance.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

App protection policy

Question 13

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Accepted Answer

iOS/iPadOS app store app. Option B (iOS/iPadOS app store app) is correct because Intune supports deploying apps directly from the Apple App Store to managed iOS/iPadOS devices, either as required or available installs, using the built-in app type for store-published apps. Option E (iOS/iPadOS Line-of-business app) is correct because Intune allows uploading and assigning custom in-house .ipa packages for iOS/iPadOS, which is the standard method for distributing proprietary enterprise apps. Option A (Web link) is not an iOS/iPadOS-specific app type in this context; it is a generic web link app type used across platforms to pin a URL, not a native iOS app deployment type. Option C (Windows app (Win32)) is incorrect because Win32 apps target Windows devices, not iOS/iPadOS. Option D (Android Line-of-business app) is incorrect because Android LOB apps are for Android devices and use .apk or .aab packages, not iOS/iPadOS.

Answer

Web link

Answer

Windows app (Win32)

Answer

Android Line-of-business app

Question 14

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Answer

Require multi-factor authentication

Answer

Require hybrid Microsoft Entra ID joined device

Answer

Require approved client app

Question 15

You are designing a Windows Update for Business deployment for a hybrid environment with 5,000 devices. You need to ensure that critical security updates are deployed within 48 hours while allowing feature updates to be delayed up to 60 days. Which policy configuration should you use?

Accepted Answer

Configure a 'Quality update deadline' of 2 days and a 'Feature update deadline' of 60 days.. Windows Update for Business uses 'deadline' policies to enforce when updates must be installed, not deferral periods. A 'Quality update deadline' of 2 days ensures critical security updates are installed within 48 hours, while a 'Feature update deadline' of 60 days allows feature updates to be delayed up to 60 days. Deferral periods only postpone when an update is offered, not when it must be installed, making deadlines the appropriate mechanism for enforcing installation timelines.

Answer

Use a 'Quality update deferral period' of 48 hours and a 'Feature update deferral period' of 60 days in a Windows 10 update ring.

Answer

Set the 'Update notification level' to '2 - Disable all notifications' and configure active hours.

Answer

Configure a 'Quality update deferral period' of 2 days and a 'Feature update deferral period' of 60 days.

Microsoft 365 Endpoint Administrator MD-102 practice test

Three ways to study

Study MD-102 by domain

Study MD-102 by topic

Prepare infrastructure for devices practice questions

Protect devices practice questions

Manage and maintain devices practice questions

Manage applications practice questions

MD-102 fundamentals practice questions

MD-102 scenario practice questions

MD-102 troubleshooting practice questions

Top MD-102 questions

Microsoft 365 Endpoint Administrator MD-102 practice questions