Courseiva

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 1–75

942 questions total · 13pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 13

Page 2
1
MCQmedium

Refer to the exhibit. You run this PowerShell script using the Microsoft Graph PowerShell SDK. What is the purpose of this script?

A.To check compliance status of devices.
B.To enroll devices in Intune.
C.To remove unsupported devices from Intune.
D.To identify devices that are not supported for compliance policies.
AnswerD

The script flags Windows RT and Windows Mobile devices.

Why this answer

The script uses the `Get-MgDeviceManagementManagedDevice` cmdlet to retrieve all managed devices from Intune, then filters for devices where the `operatingSystem` property is not in the list of supported OS versions for compliance policies (e.g., Windows 10/11, iOS, Android, macOS). The output identifies devices that are unsupported for compliance policies, which aligns with option D. It does not check compliance status, enroll devices, or remove them.

Exam trap

The trap here is that candidates confuse 'checking compliance status' (which evaluates policy adherence) with 'identifying OS support for compliance policies' (which checks if the device can even be targeted by a policy), leading them to select option A instead of D.

How to eliminate wrong answers

Option A is wrong because the script does not evaluate compliance state (e.g., `complianceState` property) or check compliance policies; it only filters by OS version. Option B is wrong because enrollment requires `New-MgDeviceManagementManagedDevice` or Autopilot-related cmdlets, not a read-only `Get-` cmdlet. Option C is wrong because the script only retrieves and filters data; it does not call `Remove-MgDeviceManagementManagedDevice` or any deletion operation.

Full explanation →
2
MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a minimum OS version can access corporate email via Microsoft Outlook for iOS. Which policy type should you configure?

A.Device configuration policy
B.Conditional Access policy
C.Device compliance policy
D.App protection policy (MAM)
AnswerD

App protection policies can require a minimum OS version for managed apps.

Why this answer

App Protection Policies (MAM) allow you to target specific apps like Microsoft Outlook for iOS with conditional launch settings, including minimum OS version requirements. This policy applies at the app layer without requiring device enrollment, making it ideal for controlling access to corporate data in Outlook on iOS devices based on OS version.

Exam trap

The trap here is that candidates often confuse Device Compliance Policies (Option C) with app-level OS version controls, not realizing that MAM policies can enforce OS version requirements directly on the app without device enrollment.

How to eliminate wrong answers

Option A is wrong because Device Configuration Policies manage device settings (e.g., Wi-Fi, VPN, restrictions) but do not enforce OS version requirements for app-level access. Option B is wrong because Conditional Access policies control access at the authentication layer (e.g., requiring compliant devices) but cannot enforce a minimum OS version specifically for the Outlook app on iOS without device compliance integration. Option C is wrong because Device Compliance Policies evaluate device-level compliance (e.g., OS version, jailbreak status) but require device enrollment and are not app-specific; they would block all access from non-compliant devices, not just Outlook.

Full explanation →
3
MCQeasy

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

A.Device configuration profile (settings catalog)
B.Managed apps policy
C.Windows update ring policy
D.Microsoft 365 Apps (Windows) configuration policy
AnswerD

This policy type is designed to configure Microsoft 365 Apps.

Why this answer

The Microsoft 365 Apps (Windows) configuration policy is the correct choice because it is specifically designed to manage the deployment, update settings, and configuration of Microsoft 365 Apps for enterprise on Intune-managed Windows devices. This policy type provides granular control over installation parameters, update channels, and app settings, directly aligning with the requirement to deploy a Microsoft 365 Apps configuration.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Apps configuration policy with a device configuration profile or a managed apps policy, mistakenly thinking that general device policies can handle Office-specific deployment tasks, when in fact only the dedicated Microsoft 365 Apps policy provides the necessary ODT integration and update channel management.

How to eliminate wrong answers

Option A is wrong because a Device configuration profile (settings catalog) is used to configure device-level settings (e.g., security policies, registry keys) and cannot directly manage the installation or update configuration of Microsoft 365 Apps. Option B is wrong because a Managed apps policy applies to mobile application management (MAM) for protecting app data on devices not necessarily managed by Intune, and it does not handle deployment or configuration of Microsoft 365 Apps. Option C is wrong because a Windows update ring policy controls Windows OS update settings (e.g., deferral periods, feature updates) and has no capability to deploy or configure Microsoft 365 Apps for enterprise.

Full explanation →
4
MCQhard

You are troubleshooting a Microsoft 365 Apps for enterprise deployment on Windows 10 devices managed by Intune. Users report that the apps are not installing, but the deployment status in Intune shows 'Success' for some devices and 'Failed' for others. On a failing device, you discover that the Office Deployment Tool (ODT) logs indicate '0x80070005 - Access denied'. What is the most likely cause?

A.The device has insufficient disk space for the installation.
B.The configuration.xml file has an invalid Channel attribute.
C.The device does not have internet connectivity to download Office installation files.
D.The Office Deployment Tool is running in user context instead of system context.
AnswerD

Running as user leads to access denied when writing to Program Files.

Why this answer

The error code 0x80070005 (Access denied) in Office Deployment Tool (ODT) logs indicates a permissions issue. When Intune deploys Microsoft 365 Apps, it runs the ODT in the system context via the Intune Management Extension. If the ODT is inadvertently executed in the user context (e.g., due to a misconfigured detection script or deployment script that doesn't elevate), it lacks the necessary privileges to write to the Program Files directory or modify system registry keys, causing the access denied error.

Exam trap

The trap here is that candidates often associate 'Access denied' with file permissions or antivirus blocking, but in the context of Intune-managed ODT deployments, the root cause is almost always the execution context (user vs. system), not a missing file permission or security software.

How to eliminate wrong answers

Option A is wrong because insufficient disk space would produce a different error, such as 0x80070070 (ERROR_DISK_FULL) or a specific 'not enough space' message in the ODT logs, not an access denied error. Option B is wrong because an invalid Channel attribute in configuration.xml would cause a parsing error or a 'channel not found' error, not an access denied error; the ODT would fail before attempting to write files. Option C is wrong because lack of internet connectivity would result in a download failure error (e.g., 0x80072EFD or a timeout), not an access denied error; the ODT would report a network-related failure.

Full explanation →
5
MCQeasy

You need to deploy Windows 11 to a remote office with limited bandwidth. Which deployment method is most appropriate?

A.Cloud-based deployment using Windows Autopilot
B.PXE boot deployment from a local server
C.Deployment using BranchCache
D.Multicast deployment from a central location
AnswerC

BranchCache caches content locally, reducing WAN usage.

Why this answer

BranchCache is the most appropriate deployment method for a remote office with limited bandwidth because it allows clients to cache content locally from a peer after the first download, reducing WAN link usage. In Windows deployment, BranchCache can be used with Configuration Manager or standalone to distribute OS images efficiently by having clients retrieve data from local peers rather than repeatedly downloading from a central source over a slow link.

Exam trap

The trap here is that candidates often confuse BranchCache with peer caching in general or assume multicast is always the best for bandwidth savings, but multicast still requires a full WAN transfer of the image, whereas BranchCache avoids redundant WAN traffic entirely after the first download.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot is a cloud-based provisioning method that requires internet connectivity to download the OS image from Microsoft Intune or Windows Update, which would consume significant bandwidth over a limited link. Option B is wrong because PXE boot deployment from a local server requires a local Distribution Point or server at the remote site, which may not be available or feasible in a remote office with limited infrastructure. Option D is wrong because multicast deployment from a central location sends a single stream to multiple clients simultaneously, but it still requires the entire OS image to traverse the WAN link once, which can saturate limited bandwidth and does not leverage local caching.

Full explanation →
6
MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom VPN configuration that uses per-app VPN and certificate-based authentication. The certificate is already deployed via a PKCS certificate profile. However, the VPN connection fails. What is the most likely reason?

A.The certificate is not trusted by the device
B.The per-app VPN profile does not include the app bundle IDs or is not associated with the certificate
C.The VPN profile is not assigned to the correct device group
D.The VPN server type is not supported by iOS
AnswerB

The per-app VPN profile must specify the apps and associate the certificate.

Why this answer

Per-app VPN on iOS requires a VPN profile that includes the app identifier list and associates it with the certificate, and the certificate must be properly configured. Option A is wrong because the certificate is already deployed. Option C is wrong because per-app VPN does not require a separate MDM profile for each app.

Option D is wrong because the VPN server type is not necessarily the issue.

Full explanation →
7
MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs at every device startup to map network drives based on the user's security group membership. The script should run in the system context and should not require user interaction. How should you configure the script deployment in Intune?

A.Add the script as a Windows PowerShell script in Intune and assign it to users, so it runs when users log in.
B.Use Proactive remediations in Intune to run the script on a schedule.
C.Add the PowerShell script as a Windows PowerShell script in Intune, set the execution context to 'System', and configure the script to run at device startup.
D.Create a device configuration profile that includes the script as a custom setting.
AnswerC

Intune PowerShell scripts can run in system context and at startup.

Why this answer

Intune allows PowerShell scripts to run in the system context and be configured to run at device startup, fulfilling the requirement. Option A is incorrect because assigning the script to users and running at user logon does not run in the system context and requires user interaction. Option B is incorrect because Proactive remediations run on a schedule or on demand, not at startup.

Option D is incorrect because device configuration profiles cannot execute scripts directly.

Full explanation →
8
Multi-Selectmedium

Which TWO actions can you perform using Windows Autopilot in Microsoft Intune?

Select 2 answers
A.Enforce security baselines on devices
B.Convert existing devices to Autopilot by uploading hardware hash
C.Deploy third-party applications automatically
D.Customize the out-of-box experience (OOBE) for users
E.Configure BIOS settings remotely
AnswersB, D

Allows redeploying existing devices.

Why this answer

Windows Autopilot allows you to import a hardware hash (a unique device identifier) from existing devices into Intune, converting them into Autopilot devices. This enables you to apply Autopilot deployment profiles and customize the OOBE without requiring a full OS reinstall, leveraging the device's existing identity.

Exam trap

The trap here is that candidates confuse Windows Autopilot's OOBE customization capabilities with broader device management features like security baselines or third-party app deployment, which are handled by Intune policies after enrollment, not during the Autopilot provisioning phase.

Full explanation →
9
MCQeasy

You need to deploy a Microsoft 365 Apps for enterprise configuration that includes Teams and Visio Pro for Microsoft 365. Users should get the full suite with both apps. What is the recommended method?

A.Use the built-in Microsoft 365 Apps for enterprise app type in Intune and select the products.
B.Instruct users to install from the Office portal.
C.Deploy a PowerShell script that runs Setup.exe /configure.
D.Create a Win32 app with the Office Deployment Tool and a configuration.xml that includes both products.
AnswerD

ODT allows full customization of products.

Why this answer

The Office Deployment Tool (ODT) is the recommended method for deploying customized Microsoft 365 Apps configurations, including Teams and Visio Pro for Microsoft 365, in enterprise environments. By creating a Win32 app with a configuration.xml that specifies both products, you can control installation settings, language, and update channels, which is not possible with the built-in Intune app type for Microsoft 365 Apps.

Exam trap

The trap here is that candidates assume the built-in Intune app type for Microsoft 365 Apps can include additional products like Visio or Project, but it only supports the core suite, forcing you to use the Office Deployment Tool for custom product selections.

How to eliminate wrong answers

Option A is wrong because the built-in Microsoft 365 Apps for enterprise app type in Intune does not support selecting individual products like Visio Pro; it only installs the core Office suite (Word, Excel, etc.) and cannot include additional products. Option B is wrong because instructing users to install from the Office portal is not a managed deployment method; it relies on user self-service, lacks centralized control, and does not ensure consistent configuration across the organization. Option C is wrong because deploying a PowerShell script that runs Setup.exe /configure is not a standalone method; the /configure switch is part of the Office Deployment Tool and requires a properly configured configuration.xml file, making it essentially the same as Option D but without the Win32 app packaging for Intune distribution.

Full explanation →
10
MCQhard

Refer to the exhibit. You are configuring Windows enrollment restrictions in Intune. After applying this JSON, a user tries to enroll a Windows 10 device but receives an error that enrollment is blocked. What is the most likely cause?

A.The device does not meet authentication requirements
B.The enrollment is restricted to Windows Holographic only
C.The device type filter excludes Windows 10
D.The user already has 5 devices enrolled
AnswerA

requireDeviceAuthentication prevents enrollment without proper device auth.

Why this answer

The JSON configuration includes an 'authenticationRequirement' setting that mandates multifactor authentication (MFA) for enrollment. Since the user's device or account does not meet this MFA requirement, the enrollment is blocked. Authentication requirements are a common cause of enrollment failures, and the error message 'enrollment is blocked' typically aligns with such policy violations rather than version restrictions or device count limits.

Exam trap

The trap is that candidates may focus on version range but the actual block is due to authentication requirements specified in the JSON.

How to eliminate wrong answers

Option A is incorrect because the error is not related to authentication; the JSON does not contain any authentication-related settings (e.g., 'requireMultiAuth' or 'deviceEnrollmentLimit'). Option B is incorrect because the JSON does not specify 'deviceType' or 'platform' restrictions; it only filters by OS version, not by Holographic or any specific SKU. Option C is incorrect because the device type filter is not present in the JSON; the restriction is based on OS version range, not device type.

Option D is incorrect because the JSON does not include a 'deviceEnrollmentLimit' key; the user's device count is not restricted by this configuration.

Full explanation →
11
MCQhard

Refer to the exhibit. The JSON snippet shows a dynamic device group configuration in Microsoft Intune. What is the effect of the 'enrollmentTimeDeviceMembershipLimit' property set to 15?

A.The group will only contain devices that have been enrolled for at least 15 days
B.Only devices enrolled in the last 15 days are eligible
C.Limits the number of devices in the group to 15
D.Devices added to the group will be removed after 15 days from enrollment
AnswerD

This property sets a time limit for membership after enrollment.

Why this answer

The 'enrollmentTimeDeviceMembershipLimit' property in a dynamic device group rule sets a time window (in days) from enrollment during which a device remains a member of the group. When set to 15, devices are automatically removed from the group 15 days after their enrollment date, regardless of their compliance or management status. This is used for scenarios like temporary access or pilot groups where membership should expire after a fixed period.

Exam trap

The trap here is that candidates confuse 'enrollmentTimeDeviceMembershipLimit' with a device count limit or a recency filter, when it actually defines a fixed membership duration from the enrollment timestamp.

How to eliminate wrong answers

Option A is wrong because the property does not enforce a minimum enrollment duration; it sets a maximum membership window from enrollment, not a requirement that devices be enrolled for at least 15 days. Option B is wrong because it incorrectly suggests only devices enrolled in the last 15 days are eligible, but the property actually removes devices after 15 days from enrollment, not filters by enrollment recency. Option C is wrong because the property controls time-based membership duration, not a device count limit; device count limits are handled by a different property or group type.

Full explanation →
12
MCQeasy

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs in the user context to configure user settings. What type of script should you use?

A.A platform script for Windows.
B.A PowerShell script deployed via Intune Management Extension.
C.A discovery script.
D.A remediation script.
AnswerB

PowerShell scripts can run in user context.

Why this answer

The Intune Management Extension (IME) is the component that handles PowerShell script execution on Windows 10 devices managed by Intune. When you deploy a PowerShell script via Intune, it is automatically executed by the IME, and you can choose to run it in the user context (as the logged-on user) or the system context. This is the correct mechanism for deploying a user-context PowerShell script to configure user settings.

Exam trap

The trap here is that candidates often confuse 'discovery script' or 'remediation script' (which are part of proactive remediations) with the general-purpose PowerShell script deployment feature, leading them to pick a wrong answer when the question simply asks for a script to configure user settings.

How to eliminate wrong answers

Option A is wrong because 'platform script for Windows' is not a recognized Intune script type; Intune uses PowerShell scripts deployed via the IME, not a separate 'platform script' category. Option C is wrong because a discovery script is used in proactive remediations to detect a condition (e.g., a registry key or file state), not to configure user settings. Option D is wrong because a remediation script is also part of proactive remediations and is executed only after a discovery script detects an issue; it is not the primary method for deploying a standalone user-context configuration script.

Full explanation →
13
Multi-Selecteasy

Which TWO of the following are valid remote assistance tools for Windows devices managed by Microsoft Intune? (Choose two.)

Select 2 answers
A.Windows Remote Management (WinRM)
B.Remote Desktop
C.Quick Assist
D.Skype
E.TeamViewer
AnswersC, E

Quick Assist is a Windows built-in tool for remote assistance.

Why this answer

Quick Assist is a built-in Windows tool that allows remote assistance connections and is fully supported for managed devices in Microsoft Intune. It uses Remote Desktop Protocol (RDP) for screen sharing and control, and can be deployed and configured via Intune policies, making it a valid remote assistance option.

Exam trap

The trap here is that candidates often confuse Remote Desktop (full remote access) with remote assistance (attended, consent-based support), leading them to select Remote Desktop instead of Quick Assist or TeamViewer.

Full explanation →
14
Multi-Selectmedium

Which TWO settings can be configured in a Microsoft Intune device compliance policy for iOS/iPadOS?

Select 2 answers
A.Allow app installation from App Store only
B.Block USB devices
C.Require a password
D.Minimum OS version
E.Jailbroken devices
AnswersC, D

This is a compliance setting.

Why this answer

Intune device compliance policies for iOS/iPadOS include a setting to require a password on the device, which can enforce specific password complexity rules such as minimum length, number of complex characters, and lockout behavior. This setting is a core compliance requirement for securing devices that access corporate resources.

Exam trap

The trap here is that candidates often confuse settings available in device compliance policies with those in device configuration profiles, mistakenly thinking restrictions like app store installation or USB blocking are compliance settings, when they are actually managed under configuration profiles.

Full explanation →
15
Multi-Selecthard

You need to configure a Microsoft Intune policy to ensure that only devices with a minimum OS version can access corporate email. Which THREE policy types can enforce this requirement?

Select 3 answers
A.Device compliance policy
B.App protection policy
C.Enrollment restrictions
D.Device configuration profile
E.Conditional access policy
AnswersA, B, E

Compliance policy can require minimum OS version.

Why this answer

Device compliance policy (A) is correct because it allows you to define rules such as a minimum OS version requirement. When a device is marked as non-compliant due to an outdated OS, you can combine this with a Conditional Access policy to block access to corporate email. This is the primary mechanism for OS version enforcement on managed devices.

Exam trap

The trap here is that candidates often think Device configuration profiles can enforce security requirements like OS version, but they only configure settings and do not evaluate or block access based on compliance criteria.

Full explanation →
16
MCQeasy

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a VPP (Volume Purchase Program) app that is already purchased and assigned to your tenant. What is the minimum configuration required to make the app available to users?

A.Configure a device enrollment restriction to allow the app.
B.Sync the VPP token, then add the app from the store and assign it.
C.Distribute the app via the Company Portal without any additional configuration.
D.Upload the app IPA file to Intune, then create an app configuration policy.
AnswerB

Syncing the token brings in purchased licenses, then you can assign the app.

Why this answer

VPP apps require the VPP token to be synced with Intune first, then the app can be added from the store and assigned to users. Option A is wrong because device enrollment restrictions control device enrollment settings, not app deployment. Option C is wrong because the Company Portal is used for available apps, but the app must first be added and assigned in Intune; it is not automatically available without configuration.

Option D is wrong because VPP apps are distributed through the store, not by uploading IPA files.

Full explanation →
17
MCQmedium

Contoso has iOS/iPadOS devices managed by Intune. They need to prevent users from installing apps from outside the Apple App Store and ensure that devices with a jailbreak are blocked from accessing corporate email. Which two policies should they combine?

A.Device compliance policy and Conditional Access
B.Windows Autopilot and Intune enrollment
C.Device configuration profile and Microsoft Defender XDR
D.App protection policy and Conditional Access
AnswerA

Device compliance policy detects jailbreak; Conditional Access blocks noncompliant devices.

Why this answer

To prevent installation of apps from outside the Apple App Store, you need a Device Compliance Policy that includes the 'require non-removable app store' setting (which blocks sideloading). To block jailbroken devices from accessing corporate email, you combine that compliance policy with a Conditional Access policy that requires the device to be marked as compliant. Only the combination of Device Compliance Policy and Conditional Access enforces both restrictions at the device level before granting access to corporate resources.

Exam trap

The trap here is that candidates often confuse App Protection Policies (MAM) with Device Compliance Policies, thinking MAM can block jailbroken devices or sideloaded apps, but MAM only protects app data and does not evaluate device-level jailbreak or app installation sources.

How to eliminate wrong answers

Option B is wrong because Windows Autopilot and Intune enrollment are provisioning and registration workflows; they do not enforce runtime restrictions like blocking sideloaded apps or jailbreak detection. Option C is wrong because a Device Configuration Profile applies settings (e.g., restrictions, VPN) but does not evaluate compliance state or block access; Microsoft Defender XDR provides threat detection but does not enforce Conditional Access blocks on its own. Option D is wrong because App Protection Policies (MAM) manage data protection within apps (e.g., copy/paste, encryption) and do not detect jailbreak at the device level or block app installation from outside the App Store; they also do not integrate with Conditional Access to block email access based on device compliance.

Full explanation →
18
MCQeasy

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

A.Retire.
B.Wipe.
C.Delete.
D.Reset.
AnswerB

Wipe performs a factory reset, suitable for lost devices.

Why this answer

The Wipe action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost corporate-owned iOS device to ensure sensitive data is completely erased and the device cannot be accessed. Retire only removes managed apps and policies but leaves personal data intact, which is insufficient for a lost device scenario.

Exam trap

The trap here is that candidates confuse 'Retire' with 'Wipe', mistakenly thinking Retire is sufficient for a lost device, but Retire only removes management and corporate data without performing a full device reset, leaving personal data and the device usable.

How to eliminate wrong answers

Option A (Retire) is wrong because it only removes managed apps, corporate data, and Intune management, but does not perform a full factory reset, leaving personal data and the device operational. Option C (Delete) is wrong because deleting the device from the Intune console simply removes its enrollment record without initiating any wipe or data removal on the device itself. Option D (Reset) is wrong because Intune does not have a 'Reset' action; the correct term for a full factory reset is 'Wipe', and 'Reset' is not a valid action in the Intune console.

Full explanation →
19
MCQeasy

You are configuring an app protection policy in Microsoft Intune for iOS/iPadOS devices. Which setting can you enforce to prevent users from copying data from a managed app and pasting it into an unmanaged app?

A.Restrict cut, copy, and paste between other apps
B.Require a PIN for access
C.Prevent iTunes and iCloud backups
D.Block managed apps from running on jailbroken devices
AnswerA

This setting restricts clipboard operations between managed and unmanaged apps.

Why this answer

The 'Restrict cut, copy, and paste between other apps' setting in an Intune app protection policy (APP) for iOS/iPadOS directly controls data transfer between managed and unmanaged apps. When set to 'Blocked' or 'Policy Managed with Paste In', it prevents users from copying data from a managed app and pasting it into an unmanaged app, enforcing data leakage prevention at the OS clipboard level via the Intune MAM SDK.

Exam trap

The trap here is that candidates often confuse device-level restrictions (like jailbreak detection or backup blocking) with app-level data transfer controls, assuming any security setting prevents copy/paste, when only the specific 'Restrict cut, copy, and paste' setting governs clipboard behavior between managed and unmanaged apps.

How to eliminate wrong answers

Option B is wrong because 'Require a PIN for access' controls authentication to the managed app, not data transfer operations like copy/paste; it prevents unauthorized access but does not restrict clipboard sharing. Option C is wrong because 'Prevent iTunes and iCloud backups' protects data at rest by blocking backup to personal cloud or local storage, but it does not address real-time clipboard data movement between apps. Option D is wrong because 'Block managed apps from running on jailbroken devices' is a device-level compliance check that prevents app launch on compromised devices, but it does not restrict copy/paste behavior on compliant devices.

Full explanation →
20
Multi-Selectmedium

A company is planning to deploy Windows 11 using Microsoft Deployment Toolkit (MDT). The administrator needs to ensure that the deployment can be fully automated without user interaction. Which TWO settings should be configured in the CustomSettings.ini file?

Select 2 answers
A.SkipTaskSequence=YES
B.SkipComputerBackup=YES
C.SkipBitLocker=YES
D.SkipDomainMembership=YES
E.SkipFinalSummary=YES
AnswersA, E

Skips task sequence selection.

Why this answer

Setting SkipTaskSequence=YES in CustomSettings.ini allows MDT to bypass the Task Sequence Wizard, enabling a fully automated, zero-touch deployment. Option E is correct because SkipFinalSummary=YES suppresses the final summary dialog that would otherwise require user acknowledgment to complete the deployment. Together, these two settings eliminate all interactive prompts during the deployment process.

Exam trap

The trap here is that candidates often assume any single Skip* setting (like SkipDomainMembership or SkipBitLocker) is sufficient for full automation, but Microsoft explicitly requires both SkipTaskSequence and SkipFinalSummary to eliminate all user interaction in MDT.

Full explanation →
21
MCQmedium

Your organization is evaluating Microsoft Intune for device management. The security team requires that all devices be registered in Microsoft Entra ID before they can enroll in Intune. Which configuration should you implement?

A.Configure enrollment restrictions to require corporate ownership
B.Set device type restrictions to block unregistered devices
C.Configure automatic enrollment via Group Policy
D.Configure Microsoft Entra join or Microsoft Entra registration as a prerequisite for Intune enrollment
AnswerD

This ensures devices are registered in Entra ID before they can enroll in Intune.

Why this answer

Microsoft Entra ID (formerly Azure AD) registration or join is a prerequisite for Intune enrollment. Intune requires a device to have an identity in Entra ID to apply policies and manage compliance. Without this prerequisite, the device cannot authenticate or receive management commands from Intune.

Exam trap

The trap here is that candidates often confuse 'enrollment restrictions' (which control device platform or ownership) with the prerequisite of having an Entra ID identity, leading them to select Option A or B instead of understanding that Entra ID registration is a separate, mandatory step before Intune enrollment can proceed.

How to eliminate wrong answers

Option A is wrong because enrollment restrictions for corporate ownership control how devices are marked (e.g., personal vs. corporate), not whether they are registered in Entra ID. Option B is wrong because device type restrictions block specific platforms or OS versions, not unregistered devices; there is no built-in restriction to block devices that lack an Entra ID registration. Option C is wrong because automatic enrollment via Group Policy enables Intune enrollment for domain-joined devices but does not enforce that the device must be registered in Entra ID before enrollment; it uses a different enrollment method (GPO-triggered MDM enrollment) that may not require prior Entra ID registration.

Full explanation →
22
MCQhard

Refer to the exhibit. An administrator runs this Graph PowerShell script. What is the purpose?

A.To output the device names of all Windows devices.
B.To list the IDs of Windows devices.
C.To list devices that are registered in Autopilot.
D.To update the enrollment type of all Windows devices.
AnswerB

Correct. The script lists the unique IDs (`DeviceId`) of all Windows devices in Microsoft Entra ID. While the option says 'joined', the script does not filter by join type; it returns all Windows devices in the directory.

Why this answer

The script uses Get-MgDevice with a filter for operatingSystem eq 'Windows' to retrieve all Windows device objects from Microsoft Entra ID, regardless of their join type (joined, registered, or hybrid). By selecting the DeviceId property, it outputs the unique identifiers of these devices. The DeviceId is the Entra ID object identifier, not the device name or Autopilot registration status.

Exam trap

The trap here is confusing DeviceId (the Entra ID object ID) with the device name or Autopilot registration, leading candidates to select options about listing names or Autopilot devices instead of device IDs.

How to eliminate wrong answers

Option A is wrong because the script selects `DeviceId`, not `DisplayName` or `DeviceName`; it outputs IDs, not device names. Option C is wrong because `Get-MgDevice` retrieves all Entra ID registered/joined devices, not specifically Autopilot-registered devices; Autopilot devices are listed via `Get-MgDeviceManagementWindowsAutopilotDeviceIdentity`. Option D is wrong because the script only reads device data with a `Select` operation; it does not call any `Update-MgDevice` cmdlet or modify enrollment type.

Full explanation →
23
MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to configure a Windows 10 update ring that ensures feature updates are deferred by 120 days and quality updates are deferred by 30 days. Which settings should you configure in the update ring?

A.Set feature update deferral to 180 days and quality update deferral to 0 days.
B.Set feature update deferral to 30 days and quality update deferral to 120 days.
C.Set feature update deferral to 120 days and quality update deferral to 30 days.
D.Set both feature and quality update deferrals to 60 days.
AnswerC

This matches the required deferral periods.

Why this answer

The Windows 10 update ring settings in Microsoft Intune allow you to specify deferral periods for feature updates and quality updates independently. To meet the requirement of deferring feature updates by 120 days and quality updates by 30 days, you must set the feature update deferral to 120 days and the quality update deferral to 30 days. These values directly control how long the device waits before installing the respective update types after Microsoft releases them.

Exam trap

The trap here is that candidates often confuse the deferral periods for feature and quality updates, mistakenly swapping the values or assuming a single deferral applies to both, when the question explicitly requires independent settings for each update type.

How to eliminate wrong answers

Option A is wrong because setting feature update deferral to 180 days exceeds the required 120-day deferral, and setting quality update deferral to 0 days provides no deferral, failing the 30-day requirement. Option B is wrong because it reverses the deferral periods: feature updates would be deferred only 30 days (not 120) and quality updates would be deferred 120 days (not 30), which does not match the specified requirements. Option D is wrong because setting both deferrals to 60 days would defer feature updates by only 60 days instead of the required 120 days, and quality updates by 60 days instead of 30 days, failing both conditions.

Full explanation →
24
MCQmedium

A company uses Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) Win32 app to devices that are not assigned to any user. The app requires installation in the system context. Which installation behavior should be configured in the Intune Win32 app deployment?

A.User
B.Device
C.System
D.LoggedOnUser
AnswerC

System installs in the system context, suitable for device-wide and userless deployments.

Why this answer

(System) is correct because the Win32 app must run in the system context to install without a user session, which is required for devices not assigned to any user. In Intune, the 'System' installation behavior runs the installer as the local SYSTEM account, enabling silent, elevated installations regardless of user presence.

Exam trap

The trap here is that candidates confuse 'System' with 'Device' or 'LoggedOnUser', not realizing that 'Device' is not a valid installation behavior and that 'System' is the only option that guarantees installation without a user session.

How to eliminate wrong answers

Option A (User) is wrong because it runs the installer in the user context, which requires an interactive user session and cannot install on devices without assigned users. Option B (Device) is wrong because 'Device' is not a valid installation behavior in Intune Win32 app deployment; the correct options are User, System, and LoggedOnUser. Option D (LoggedOnUser) is wrong because it runs the installer in the context of the currently logged-on user, which also requires an active user session and fails on devices with no user assigned.

Full explanation →
25
MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?

A.Create a device configuration profile that requires iOS 16.0.
B.Modify the enrollment profile to require iOS 16.0.
C.Create a compliance policy that requires iOS 16.0 or later.
D.Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.
AnswerD

Platform restrictions block devices with older OS versions during enrollment.

Why this answer

Enrollment platform restrictions allow you to set a minimum OS version for enrollment, preventing devices with older iOS versions from enrolling. Option A is incorrect because a device configuration profile is applied after enrollment and manages device settings, not enrollment requirements. Option B is incorrect because the enrollment profile defines the enrollment method (e.g., user vs. device enrollment), not OS version restrictions.

Option C is incorrect because a compliance policy is applied after enrollment; it can mark devices as non-compliant but does not block enrollment itself.

Full explanation →
26
MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. What should you do to ensure the app installs successfully?

A.Create a device configuration profile to allow sideloading.
B.Add the app to the Microsoft Store for Business.
C.Disable automatic app updates for the device group.
D.Enable the Sideloading policy for the device group.
AnswerD

Sideloading allows installation of apps signed with untrusted certificates.

Why this answer

Enabling the Sideloading policy for the device group allows installation of line-of-business (LOB) apps signed with a certificate not trusted by the devices. In Microsoft Intune, sideloading bypasses the requirement for the app's signing certificate to be trusted by the device's trusted root store, enabling successful installation of internally developed or signed LOB apps on Windows 11 devices managed via Intune.

Exam trap

The trap here is that candidates often confuse 'sideloading' with 'allow sideloading' in a device configuration profile, but Intune requires a specific Sideloading policy (under Apps or Device configuration) rather than a generic configuration profile setting.

How to eliminate wrong answers

Option A is wrong because creating a device configuration profile to allow sideloading is not the correct approach; Intune uses a dedicated 'Sideloading policy' under 'Apps' > 'App configuration policies' or 'Device configuration' > 'Policies' > 'Sideloading', not a generic device configuration profile. Option B is wrong because adding the app to the Microsoft Store for Business would require the app to be signed with a certificate trusted by the Store, which does not solve the issue of an untrusted certificate; the Store for Business is for distributing apps through the Store infrastructure, not for sideloading untrusted-signed apps. Option C is wrong because disabling automatic app updates for the device group does not affect the installation of an LOB app with an untrusted certificate; it only prevents updates from being applied automatically, leaving the core signing trust issue unresolved.

Full explanation →
27
MCQmedium

You configured the above app protection policy for a Microsoft 365 app. Users report that they cannot paste text from the managed app into another app. What is the most likely reason?

A.The 'pinLength' requirement is not met.
B.The 'requireBiometric' setting is blocking actions.
C.The 'dataTransferPolicy' is set to 'allowNone', which prevents data from leaving the managed app.
D.The 'allowCutCopy' setting is set to false, which blocks copy, but paste is unaffected.
AnswerC

This setting blocks clipboard operations to unmanaged apps.

Why this answer

The 'dataTransferPolicy' setting controls how data can be transferred between managed and unmanaged apps. When set to 'allowNone', it prevents any data from leaving the managed app, including paste operations from the managed app into another app. This is the most direct cause of the reported issue.

Exam trap

The trap here is that candidates often confuse 'allowCutCopy' (which controls copy/cut within the app) with 'dataTransferPolicy' (which controls data leaving the app), leading them to incorrectly select Option D.

How to eliminate wrong answers

Option A is wrong because 'pinLength' only enforces a minimum PIN length for app access and does not affect data transfer or paste behavior. Option B is wrong because 'requireBiometric' controls biometric authentication for app access, not data transfer or clipboard operations. Option D is wrong because 'allowCutCopy' being set to false would block copy and cut operations within the managed app, but paste is indeed unaffected; the issue is about pasting from the managed app into another app, which is governed by 'dataTransferPolicy', not 'allowCutCopy'.

Full explanation →
28
MCQmedium

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage endpoint security. You need to ensure that all Windows 10 devices are onboarded to Defender for Endpoint via Microsoft Intune. Which policy type should you use?

A.Endpoint detection and response policy
B.Antivirus policy
C.Firewall policy
D.Windows Security experience policy
AnswerA

EDR policy is used to onboard devices to Defender for Endpoint.

Why this answer

To onboard Windows 10 devices to Microsoft Defender for Endpoint via Intune, you must use an Endpoint detection and response (EDR) policy. This policy type deploys the required onboarding configuration package (a .cmd script or .xml file) that registers the device with the Defender for Endpoint service, enabling sensor data collection and threat detection. Antivirus, Firewall, and Windows Security experience policies manage separate security features but do not handle the initial onboarding process.

Exam trap

The trap here is that candidates confuse 'onboarding' with 'configuring existing security features,' mistakenly selecting Antivirus policy because they think Defender Antivirus must be enabled first, when in fact onboarding is a distinct prerequisite handled only by the EDR policy.

How to eliminate wrong answers

Option B (Antivirus policy) is wrong because it configures Microsoft Defender Antivirus settings (e.g., real-time protection, cloud-delivered protection) but does not deploy the onboarding package required to connect the device to Defender for Endpoint. Option C (Firewall policy) is wrong because it manages Windows Defender Firewall rules and profiles, which are unrelated to the device registration and sensor activation needed for onboarding. Option D (Windows Security experience policy) is wrong because it customizes the Windows Security app interface (e.g., notifications, tamper protection) but does not include the onboarding configuration that establishes the device's connection to the Defender for Endpoint backend.

Full explanation →
29
MCQeasy

A company uses Microsoft Intune to manage iOS devices. They want to enforce a policy that requires a passcode of at least 6 characters and auto-lock after 5 minutes. Which configuration profile type should they use?

A.Device restrictions profile.
B.Wi-Fi profile.
C.VPN profile.
D.Email profile.
AnswerA

Device restrictions contain security settings like passcode and auto-lock.

Why this answer

A Device restrictions profile is the correct configuration profile type because it contains the security settings for iOS devices, including passcode requirements (minimum length, complexity) and device lock timeouts (auto-lock after minutes). This profile type enforces device-level security policies directly managed by Intune, making it the appropriate choice for requiring a 6-character passcode and 5-minute auto-lock.

Exam trap

The trap here is that candidates often confuse Device restrictions profiles with Compliance policies, but Compliance policies evaluate settings after they are applied, whereas Device restrictions profiles actually enforce the settings on the device.

How to eliminate wrong answers

Option B is wrong because a Wi-Fi profile is used to configure wireless network settings (SSID, authentication, certificates) and does not include passcode or auto-lock policies. Option C is wrong because a VPN profile configures virtual private network connections (server address, tunneling protocol, authentication) and has no settings for device passcode or lock timeout. Option D is wrong because an Email profile configures email account settings (server, username, SSL) and does not enforce device-level security policies like passcode length or auto-lock.

Full explanation →
30
Multi-Selectmedium

You are configuring an app protection policy for iOS devices to protect corporate data in Microsoft Outlook. Which TWO settings prevent users from copying corporate data to personal apps?

Select 2 answers
A.Allow app to transfer data to other apps
B.Save copies of work data
C.Block screen capture and screen recording
D.Restrict cut, copy, and paste between apps
E.Encrypt app data
AnswersA, D

Setting this to 'Policy managed apps' restricts data transfer.

Why this answer

Setting 'Allow app to transfer data to other apps' to 'Policy managed apps' or 'None' prevents corporate data from being transferred from Outlook to unmanaged personal apps. Option D is correct because 'Restrict cut, copy, and paste between apps' can be set to 'Policy managed apps' or 'None', which blocks users from copying corporate data from Outlook and pasting it into personal apps. These two settings directly control data movement at the app-to-app and clipboard levels.

Exam trap

The trap here is that candidates often confuse 'Block screen capture and screen recording' with data loss prevention, but it only prevents visual capture, not clipboard or app-to-app data transfer, which are the actual vectors for copying corporate data to personal apps.

Full explanation →
31
MCQmedium

You manage Windows 10 devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is an .msi file that requires admin privileges to install. Which deployment method should you use?

A.Upload the .msi file as a line-of-business app directly
B.Add the app as a Microsoft Store for Business app
C.Deploy the app using a PowerShell script in Intune
D.Use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy as a Win32 app
AnswerD

This is the standard method for deploying LOB .msi apps via Intune.

Why this answer

The correct deployment method is to use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy it as a Win32 app. This is required because Intune's native line-of-business (LOB) app deployment only supports .msi files that install in the user context without elevation, whereas this app requires admin privileges. The Win32 app model allows Intune to run the installer with system context, handle detection rules, and support complex installation logic.

Exam trap

The trap here is that candidates assume any .msi can be deployed as a line-of-business app directly, but Intune's LOB app deployment only supports user-context installations without elevation, so the Win32 app model is required when admin privileges are needed.

How to eliminate wrong answers

Option A is wrong because uploading the .msi as a line-of-business app directly only supports apps that install in the user context without requiring elevation; it cannot handle admin-privilege installations. Option B is wrong because the app is not available in the Microsoft Store, so adding it as a Microsoft Store for Business app is not possible. Option C is wrong because deploying the app using a PowerShell script in Intune is not a native deployment method; Intune does not have a direct 'PowerShell script' deployment type for apps, and scripts are used for device configuration or remediation, not for packaging and deploying installers with detection and requirement rules.

Full explanation →
32
Multi-Selecthard

Which THREE actions can be taken from the Intune admin center when a device is retired?

Select 3 answers
A.Retire
B.Remote lock
C.Reset passcode
D.Wipe
E.Delete
AnswersA, D, E

Retirement is the action itself.

Why this answer

When a device is retired in Intune, the device record is removed from management, and the device is no longer subject to compliance policies or conditional access. The Retire action (A) is the primary action that removes the device from Intune without wiping corporate data, while the Wipe action (D) resets the device to factory defaults and removes all data. The Delete action (E) permanently removes the device object from the Intune console, which is also available from the device blade after retirement or wipe.

Exam trap

The trap here is that candidates confuse the Retire action with the Wipe action, or assume that Remote lock and Reset passcode are part of the retire workflow, when in fact they are independent remote actions that do not remove the device from management.

Full explanation →
33
MCQhard

You are a Microsoft 365 Endpoint Administrator for a global organization with 5,000 Windows 11 devices managed by Intune. The company has a strict security policy requiring that all devices have BitLocker enabled with TPM validation, PIN, and startup key. Currently, only 80% of devices are compliant with BitLocker. After investigating, you discover that many non-compliant devices are older models that lack TPM 2.0, but they do have TPM 1.2. Additionally, some devices are virtual machines (VMs) that do not have a TPM at all. The security team insists that all devices must be encrypted, but they are willing to accept alternative configurations for devices without TPM 2.0. You need to propose a solution that maximizes security while ensuring compliance. What should you do?

A.Create a single compliance policy that requires BitLocker with TPM validation, PIN, and startup key, and exclude devices without TPM 2.0 from the policy.
B.Modify the existing compliance policy to remove the PIN requirement so that all devices can comply.
C.Create multiple compliance policies: one for devices with TPM 2.0 requiring full BitLocker, one for devices with TPM 1.2 requiring BitLocker with TPM validation, and one for VMs requiring BitLocker with startup password.
D.Downgrade all non-compliant devices to Windows 10 and enable BitLocker with TPM 1.2.
AnswerC

This addresses different hardware capabilities while maintaining encryption.

Why this answer

It uses multiple compliance policies to enforce the strongest possible BitLocker configuration based on each device's TPM capabilities. Devices with TPM 2.0 can meet the full requirement (TPM validation, PIN, startup key), devices with TPM 1.2 can use TPM-only validation (since TPM 1.2 does not support PIN+startup key in the same way), and VMs without a TPM can use a startup password. This approach maximizes security while ensuring all devices remain compliant with the security policy's intent.

Exam trap

The trap here is that candidates assume a single compliance policy with exclusions is sufficient, but they overlook the need to enforce encryption on all devices by tailoring the BitLocker requirements to each device's TPM capabilities.

How to eliminate wrong answers

Option A is wrong because excluding devices without TPM 2.0 from the policy would leave them unmonitored and non-compliant, violating the requirement that all devices must be encrypted. Option B is wrong because removing the PIN requirement weakens security for devices that do support TPM 2.0, and it does not address the specific limitations of TPM 1.2 or VMs. Option D is wrong because downgrading to Windows 10 does not solve the TPM 1.2 or missing TPM issue; BitLocker on Windows 10 still requires a TPM (1.2 or 2.0) for TPM-only protection, and VMs still lack a TPM, so this would not achieve compliance.

Full explanation →
34
MCQhard

You are troubleshooting a Windows 10 device that is not receiving policy updates from Intune. The device shows 'Pending' status in the Intune console. The device is connected to the internet. What is the most likely cause?

A.The device is not connected to the network.
B.The device has a pending reboot.
C.The Intune management extension service is not running.
D.The device enrollment is expired.
AnswerC

The service must be running to receive policies.

Why this answer

The Intune management extension service (IntuneManagementExtension.exe) is responsible for processing policy and app deployment actions on Windows 10 devices. If this service is not running, the device will show a 'Pending' status in the Intune console because it cannot acknowledge or apply incoming policies, even though the device is online and enrolled.

Exam trap

The trap here is that candidates may assume 'Pending' always means a network issue or a pending reboot, but the correct interpretation is that the Intune management extension service must be actively running to process policy updates, and a stopped service is the most common cause of a stuck 'Pending' status.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the device is connected to the internet, so network connectivity is not the issue. Option B is wrong because a pending reboot may delay some actions but does not prevent the Intune management extension from running or receiving policy updates; the 'Pending' status specifically indicates the service is not responding. Option D is wrong because device enrollment in Intune does not expire; enrollment remains valid until the device is manually retired or wiped, so an expired enrollment is not a valid concept in this context.

Full explanation →
35
MCQhard

You are using Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a preference for a third-party app. Which method should you use?

A.Upload an XML file with the preference settings.
B.Upload a DMG file containing the preferences.
C.Upload a property list (.plist) file.
D.Upload a JSON file with the preference settings.
AnswerC

Custom macOS profiles use plist files.

Why this answer

Intune for macOS uses property list (.plist) files to deploy custom configuration profiles for app preferences. The .plist format is the native macOS mechanism for storing application settings, and Intune's custom profile type directly accepts a valid .plist file to apply these settings via MDM. This method ensures the preferences are correctly parsed and enforced on managed macOS devices.

Exam trap

The trap here is that candidates confuse the macOS .plist format with generic XML or JSON, assuming any structured data file works, but Intune strictly requires a .plist file because macOS MDM enforces that format for preference domains.

How to eliminate wrong answers

Option A is wrong because XML files are not a supported format for macOS custom configuration profiles in Intune; while .plist files are XML-based, they must be in the specific .plist format with the correct plist DTD and structure. Option B is wrong because DMG files are disk images used for distributing applications, not for deploying configuration preferences; Intune cannot extract or apply settings from a DMG as a configuration profile. Option D is wrong because JSON files are not natively supported by macOS for system or app preference management; Intune's macOS custom profile only accepts .plist files, not JSON.

Full explanation →
36
MCQhard

You run the above PowerShell command. The app is installed on a device, but the detection rule checks for CompanyPortal.exe in C:\Program Files. The app installs to C:\Program Files (x86) due to a 32-bit installer. What is the most likely outcome?

A.The app is successfully detected and no action is taken
B.The app installation fails with error
C.The detection rule automatically adjusts to check both folders
D.Intune repeatedly tries to install the app because it is not detected
AnswerD

Failed detection triggers reinstallation.

Why this answer

Intune's detection rule is configured to check for CompanyPortal.exe in C:\Program Files. Since the 32-bit installer places the file in C:\Program Files (x86), the detection rule will not find it. Intune will then consider the app as not installed and will repeatedly attempt to reinstall it, leading to a loop of installation attempts.

Exam trap

The trap here is that candidates assume Intune's detection logic is intelligent enough to follow Windows file system redirection, when in fact it strictly checks the exact path provided, leading to a detection failure despite a successful installation.

How to eliminate wrong answers

Option A is wrong because the detection rule does not find CompanyPortal.exe in the specified path (C:\Program Files), so the app is not considered detected; no successful detection occurs. Option B is wrong because the installation itself succeeds (the app is installed), but the detection rule fails; the error is not an installation failure but a detection mismatch. Option C is wrong because Intune does not automatically adjust detection rules to check multiple folders; the rule is static and must be explicitly configured to include both paths.

Full explanation →
37
MCQeasy

Your company is deploying Windows 11 devices using Windows Autopilot. You need to ensure that during the first boot, the device automatically joins Microsoft Entra ID, enrolls in Intune, and installs required applications. What should you provide to the device?

A.The device's hardware hash, uploaded to Intune, and an Autopilot deployment profile assigned.
B.The Configuration Manager client and a site code for automatic site assignment.
C.A provisioning package containing the MDM enrollment settings.
D.A Group Policy Object that configures automatic MDM enrollment.
AnswerA

Autopilot requires the hardware hash to identify the device and the profile to define the deployment settings.

Why this answer

Windows Autopilot requires the device's hardware hash to be uploaded to Intune so that the device can be identified as an Autopilot device. An Autopilot deployment profile is then assigned to the device, which specifies the settings for joining Microsoft Entra ID, enrolling in Intune, and installing required applications during the first boot (Out-of-Box Experience). This combination ensures the entire provisioning flow occurs automatically without manual intervention.

Exam trap

The trap here is that candidates often confuse provisioning packages (PPKG) with Autopilot, but Autopilot is specifically designed to eliminate the need for any local media or manual steps, relying solely on cloud-based device identity and profile assignment.

How to eliminate wrong answers

Option B is wrong because the Configuration Manager client and site code are used for co-management or traditional client management, not for Windows Autopilot's zero-touch provisioning which relies on cloud-based enrollment via Intune. Option C is wrong because a provisioning package (PPKG) is used for manual or bulk provisioning via Windows Configuration Designer, not for the automatic, cloud-driven Autopilot process that requires no local media or USB drive. Option D is wrong because Group Policy Objects (GPOs) are applied after the device is already joined to the domain and enrolled, and they cannot trigger the initial Autopilot enrollment flow which happens before the device has network access to a domain controller.

Full explanation →
38
MCQhard

You are a Teams administrator. After running the PowerShell script shown in the exhibit, users report they cannot communicate with federated users from 'trusted.com'. What is the most likely cause?

A.The AllowedDomains list does not include a wildcard ' * ' to allow all domains, so only trusted.com is allowed.
B.The script sets AllowPublicUsers to $false, which blocks all external communication including federated users.
C.The script sets AllowFederatedUsers to $true, which disables federated user communication.
D.The script did not run in a Teams PowerShell session that supports the Set-CsTenantFederationConfiguration cmdlet.
AnswerD

The New-CsOnlineSession and Import-PSSession sequence is correct, but if the module is not properly loaded or the session is not created with the right endpoint, the cmdlets may not be available, causing the script to have no effect.

Why this answer

The `Set-CsTenantFederationConfiguration` cmdlet is only available in a remote Teams PowerShell session (connected via `Connect-MicrosoftTeams`), not in a local Skype for Business Online or legacy PowerShell module. If the script was run in an incompatible session (e.g., an older Skype for Business Online Connector or a local PowerShell window without proper module import), the cmdlet would not execute, leaving the federation configuration unchanged. This would cause the default settings to block federated communication with 'trusted.com'.

Exam trap

The trap here is that candidates focus on the federation settings (AllowedDomains, AllowFederatedUsers) and overlook the critical prerequisite of running the cmdlet in the correct PowerShell session, assuming any PowerShell window can execute Teams cmdlets.

How to eliminate wrong answers

Option A is wrong because the `AllowedDomains` list is used to restrict which federated domains are allowed when `AllowFederatedUsers` is `$true`; a missing wildcard does not block all communication—it only limits allowed domains, but the script's primary issue is that the cmdlet itself did not run. Option B is wrong because `AllowPublicUsers` controls Skype for Business public IM connectivity (e.g., with Skype consumer), not federated users from another organization's Teams/Skype for Business domain. Option C is wrong because setting `AllowFederatedUsers` to `$true` enables federated communication, not disables it; the problem is that the cmdlet never executed.

Full explanation →
39
Multi-Selecthard

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Select 2 answers
A.Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.
B.Reissue the user's Microsoft 365 license from the admin center.
C.Reset the device's enrollment state via the Company Portal.
D.Verify that the device has an active internet connection and can reach Intune services.
E.Run Invoke-Command to remotely execute gpupdate /force.
AnswersA, D

Correct. Group assignment is essential for policy delivery.

Why this answer

Intune security policies are assigned to Microsoft Entra ID groups. If the device is not a member of the targeted group, it will not receive the policy, resulting in a 'Not compliant' status. Verifying group membership ensures the policy scope is correctly applied.

Exam trap

The trap here is that candidates often confuse Intune MDM policy delivery with traditional on-premises Group Policy, leading them to select the gpupdate command (Option E) instead of recognizing that Intune relies on OMA-DM sync and network connectivity.

Full explanation →
40
MCQhard

An organization uses Microsoft Intune to manage Windows devices. They want to deploy a Win32 app that requires admin rights to install. The app must be installed in the system context and should not require user interaction. Which installation behavior should be configured?

A.Install behavior: User, Installation purpose: Required, Device restart behavior: No specific action
B.Install behavior: System, Installation purpose: Required, Device restart behavior: No specific action, Installation visibility: Hidden
C.Install behavior: User, Installation purpose: Available
D.Install behavior: System, Installation purpose: Required, Device restart behavior: Immediately
AnswerB

System context ensures admin rights, Hidden prevents user interaction, and Required ensures installation.

Why this answer

Deploying a Win32 app that requires admin rights and must run without user interaction in the system context requires setting the install behavior to 'System' and the installation purpose to 'Required'. The 'Hidden' installation visibility ensures the installation runs silently in the background, with no user prompts or interaction, which is essential for a non-interactive system-context deployment.

Exam trap

The trap here is that candidates often confuse 'Install behavior: User' with the ability to install apps requiring admin rights, not realizing that only the System context can elevate privileges silently without user prompts.

How to eliminate wrong answers

Option A is wrong because 'Install behavior: User' runs the installer in the user context, which lacks the necessary admin rights for an app that requires admin privileges, and 'Installation purpose: Required' with user behavior still prompts the user for elevation. Option C is wrong because 'Install behavior: User' again lacks system context, and 'Installation purpose: Available' allows the user to choose to install, which contradicts the requirement for no user interaction and admin rights. Option D is wrong because 'Device restart behavior: Immediately' forces an immediate reboot after installation, which is not required by the scenario (the requirement is 'no specific action' for restart), and this could disrupt user productivity.

Full explanation →
41
MCQhard

You have configured a Windows 10 update ring with a deadline of 3 days for quality updates. However, some devices are not installing updates within the deadline. What should you verify?

A.The devices are set to defer quality updates in Windows Update settings.
B.The devices have a feature update policy that conflicts.
C.The Intune Management Extension is installed.
D.The update ring is assigned to the correct Azure AD group.
AnswerA

Deferral settings can delay installation beyond the deadline.

Why this answer

If devices are configured to defer quality updates in their local Windows Update settings, they will ignore the deadline specified in the update ring policy. The update ring deadline enforces installation timing, but deferral settings can override that by delaying the download or installation beyond the deadline. You must verify that no local or Group Policy deferral is active, as Intune's update ring policy does not automatically clear existing deferral configurations.

Exam trap

The trap here is that candidates assume the update ring deadline is absolute, but they overlook that local deferral settings can override the deadline by delaying when the update is even offered to the device.

How to eliminate wrong answers

Option B is wrong because a feature update policy does not conflict with quality update deadlines; feature updates and quality updates are managed independently, and a feature update policy would not prevent quality updates from installing within their deadline. Option C is wrong because the Intune Management Extension is not required for Windows Update for Business policies; these policies are delivered via the Windows Update service and do not depend on the Intune Management Extension. Option D is wrong because if the update ring were not assigned to the correct Azure AD group, the devices would not receive the policy at all, rather than receiving it but failing to meet the deadline; the question states the devices are configured with the deadline, so assignment is already correct.

Full explanation →
42
MCQmedium

Refer to the exhibit. A KQL query in Microsoft Defender XDR returns no results for PC001 and PC002 even though you know there have been antivirus detections on those devices. What is the most likely reason?

A.The timestamp range is too narrow
B.The device names are case-sensitive and are entered incorrectly
C.You do not have permissions to view events on those devices
D.The ActionType filter is incorrect for antivirus detections
AnswerD

Antivirus detection action types may be 'AntivirusDetectedMalware' or others.

Why this answer

Antivirus detections in Microsoft Defender XDR are logged under specific ActionType values such as 'AntivirusDetection' or 'AntivirusDetectionCleaned', not generic detection names. If the KQL query uses an incorrect ActionType filter (e.g., filtering for 'MalwareDetection' or a misspelled value), it will return no results for PC001 and PC002 even though detections exist. The query must reference the exact ActionType string used by Microsoft Defender for Endpoint's antivirus events.

Exam trap

The trap here is that candidates assume any generic detection filter (like 'Detection' or 'Malware') will work, but Microsoft Defender XDR requires the precise ActionType value for antivirus events, and the question deliberately uses a filter that excludes those specific records.

How to eliminate wrong answers

Option A is wrong because a narrow timestamp range would affect all devices equally, not selectively exclude PC001 and PC002 while other devices return results; the issue is filter-specific, not time-based. Option B is wrong because device names in KQL queries against Microsoft Defender XDR are not case-sensitive; the query engine normalizes device names to lowercase for matching. Option C is wrong because if you lacked permissions to view events on those devices, the query would typically return an access-denied error or omit results entirely for all users, not silently return zero rows for only those two devices.

Full explanation →
43
MCQeasy

A company wants to prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. What should they configure?

A.Intune app protection policy
B.Device compliance policy
C.Microsoft Defender for Cloud Apps session policy
D.Conditional Access policy
AnswerA

App protection policies restrict copy/paste and data transfer between apps.

Why this answer

Intune app protection policies (APP) are designed to manage and protect corporate data within applications, regardless of the device management state. By configuring data protection settings such as 'Allow app to transfer data to other apps' set to 'Policy managed apps only' and 'Save copies of org data' set to 'Block', you can prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. This policy applies at the app layer, using the Intune App SDK or MAM (Mobile Application Management) channel, and does not require device enrollment.

Exam trap

The trap here is that candidates often confuse app protection policies (MAM) with device compliance or Conditional Access, mistakenly thinking that device-level controls can restrict app-to-app data transfer, when in fact only app-layer policies can enforce granular data protection like copy/paste restrictions.

How to eliminate wrong answers

Option B is wrong because device compliance policies evaluate device health and configuration (e.g., jailbreak detection, minimum OS version) but do not control data transfer between apps; they enforce compliance at the device level, not the app data layer. Option C is wrong because Microsoft Defender for Cloud Apps session policies control access and data exfiltration in real-time via reverse proxy for web apps (e.g., blocking downloads in a browser), but they do not apply to native mobile apps or control copy/paste between apps on iOS. Option D is wrong because Conditional Access policies enforce access controls (e.g., require compliant device, MFA) at sign-in, but they do not govern data movement or copy/paste behavior after authentication; they are an access gate, not a data protection mechanism.

Full explanation →
44
MCQhard

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the compliance status. Other devices in the same group are compliant. What is the most likely cause?

A.The device does not have a valid certificate profile.
B.The Intune Management Extension is not installed.
C.The device has a non-compliant component that prevents policy application.
D.The device's enrollment token has expired.
AnswerC

If a device is non-compliant, it may not receive further policies until remediated.

Why this answer

A non-compliant component (e.g., an outdated OS version, missing required app, or misconfigured setting) can cause the device to be marked as 'Not evaluated' if the compliance policy cannot be processed. The device is enrolled but the policy engine fails to evaluate compliance due to an underlying issue. Option A is incorrect: Certificate profiles are used for resource access, not for compliance evaluation.

Option B is incorrect: The Intune Management Extension is for deploying Win32 apps and PowerShell scripts, not for compliance policies. Option D is incorrect: Enrollment tokens are used for enrollment; if expired, the device would not be enrolled at all.

Full explanation →
45
MCQhard

Refer to the exhibit. A Windows 10 device shows a compliance state of 'noncompliant'. The last sync was 2 hours ago. The device is managed by Intune (mdm). You have verified that the assigned compliance policy requires a device threat level of 'high' from Microsoft Defender for Endpoint. Which of the following is the most likely cause of non-compliance?

A.Microsoft Defender for Endpoint reports a medium-severity threat on the device.
B.The device OS version is below the minimum required.
C.The device has not synced with Intune for over 24 hours.
D.The device is not enrolled in Microsoft Defender for Endpoint.
AnswerD

Correct. If the device is not enrolled in Microsoft Defender for Endpoint, it cannot provide a threat level, making it noncompliant. This is a common and likely cause given the scenario.

Why this answer

In Intune, when a compliance policy requires a device threat level of 'High', the policy actually requires the device to be at or under that threat level. Therefore, a device with a medium-severity threat would be considered compliant, not noncompliant. Given that the device synced recently and is managed, the most likely cause of noncompliance is that it is not enrolled in Microsoft Defender for Endpoint, so it cannot report any threat level.

Exam trap

Many candidates assume that any threat level below 'High' would cause noncompliance, tempting them to select option A (medium threat). However, 'High' is a maximum allowed level, so a medium threat would meet the requirement. The crucial issue is that without Defender for Endpoint enrollment, the device cannot report a threat level at all, leading to noncompliance.

How to eliminate wrong answers

Option B is wrong because the question states the compliance policy requires a threat level of 'high' from Microsoft Defender for Endpoint, not a minimum OS version; an OS version below the minimum would cause noncompliance only if such a rule were configured, but here the focus is on threat level. Option C is wrong because the device last synced 2 hours ago, which is well within the typical 24-hour grace period; noncompliance due to sync timeout would require the device to have not synced for over 24 hours. Option D is wrong because the device is managed by Intune and the compliance policy is evaluating threat level from Defender for Endpoint; if the device were not enrolled in Defender for Endpoint, the threat level would be 'not available' or 'not evaluated', not a medium-severity threat, and the device would likely show a different noncompliance reason.

Full explanation →
46
Matchingmedium

Match each PowerShell cmdlet to its function in Microsoft 365 management.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Connect to Microsoft Graph using delegated or app-only auth

Retrieve Intune-managed devices

Create a new device configuration policy

Update properties of a managed device

Retire a device from Intune

Why these pairings

PowerShell is used for programmatic management; these cmdlets are from Microsoft Graph PowerShell SDK.

Full explanation →
47
Multi-Selectmedium

Which TWO actions can you perform using Microsoft Intune to manage devices that are not compliant? (Choose two.)

Select 2 answers
A.Automatically send an email to the user's manager.
B.Remotely wipe the device.
C.Block access to corporate resources.
D.Send a push notification to the user.
E.Mark the device as noncompliant in the Intune admin center.
AnswersD, E

Intune can notify users when their device is noncompliant.

Why this answer

Microsoft Intune can send push notifications to noncompliant devices via the Company Portal app, alerting users about compliance issues and required actions. Option E is correct because marking a device as noncompliant in the Intune admin center is a manual action that updates the device's compliance state, which then triggers conditional access policies to block resources. Both actions are available for managing noncompliant devices without requiring user interaction or remote wipe.

Exam trap

The trap here is that candidates confuse the actions available directly in Intune (like sending notifications or marking noncompliant) with the downstream effects of conditional access policies (like blocking access), leading them to incorrectly select 'Block access to corporate resources' as an Intune action rather than a conditional access outcome.

Full explanation →
48
MCQhard

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

A.The deferral settings are too long.
B.The update ring is assigned to the correct device group.
C.The devices have the Windows Update for Business policy assigned.
D.The devices are compliant with the compliance policy.
AnswerC

WUfB policy controls update behavior.

Why this answer

Windows Update for Business (WUfB) policies must be explicitly assigned to devices to control update behavior via Intune. Even if update rings are configured and devices are enrolled, without the WUfB policy, devices may show 'Up to date' while missing critical security updates because they are not receiving the update instructions from Intune. The WUfB policy is what actually pushes the update configuration to the Windows Update client on the device.

Exam trap

The trap here is that candidates often assume that simply configuring an update ring and assigning it to a device group is sufficient, but they overlook the requirement to also assign the Windows Update for Business policy to the devices to actually enforce the update configuration.

How to eliminate wrong answers

Option A is wrong because deferral settings only delay the installation of updates after they are released; they do not prevent devices from receiving updates altogether, so the issue of devices showing 'Up to date' while missing critical updates is not caused by long deferrals. Option B is wrong because the update ring being assigned to the correct device group is necessary for targeting, but without the WUfB policy being assigned, the ring's configuration is not applied to the devices. Option D is wrong because compliance policy determines whether a device meets security requirements, but it does not control the delivery of Windows updates; a device can be compliant yet still not receive updates if the WUfB policy is missing.

Full explanation →
49
MCQmedium

You manage a fleet of Android Enterprise devices. You need to configure a policy that prevents users from installing apps from unknown sources. Which policy type should you use?

A.Device restrictions configuration policy
B.Device compliance policy
C.App configuration policy
D.Enrollment restriction
AnswerA

Device restrictions configuration policy includes the setting to block installation of apps from unknown sources on Android Enterprise devices.

Why this answer

Device restrictions configuration policy includes the setting to block installation of apps from unknown sources on Android Enterprise devices. Option B (Device compliance policy) is incorrect because compliance policies enforce security requirements but do not block app installations. Option C (App configuration policy) is incorrect because app configuration policies are used to pre-configure app settings, not to restrict installation.

Option D (Enrollment restriction) is incorrect because enrollment restrictions control whether devices can enroll, not app installation behavior.

Full explanation →
50
Drag & Dropmedium

Order the steps to deploy a Windows 10 virtual desktop in Azure using Windows 365.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Deploying Windows 10 virtual desktops via Windows 365 requires a specific sequence: first, ensure you have the appropriate licenses (Windows 365 Enterprise or Business). Then access the Microsoft Endpoint Manager admin center, create a provisioning policy, and configure its settings (e.g., network, management). After the policy is configured, you can provision Cloud PCs in bulk.

Finally, assign the Cloud PCs to users. Common mistakes include swapping the order of licensing and portal access, configuring after provisioning, or assigning before provisioning.

Full explanation →
51
Multi-Selecthard

You are planning a Microsoft Intune deployment for a large organization with Windows, iOS, and Android devices. You need to ensure that devices can enroll automatically when users sign in with their work accounts. Which THREE components are required?

Select 3 answers
A.Apple Push Notification service certificate (for iOS)
B.Intune licenses assigned to users
C.Microsoft Entra ID (for identity and device registration)
D.Microsoft Intune subscription (for MDM authority)
E.Configuration Manager (for co-management)
AnswersB, C, D

Users must have Intune licenses to enroll devices.

Why this answer

Intune licenses must be assigned to users to grant them access to the service. Without a license, the user cannot authenticate with Intune, and automatic enrollment will fail during the device registration step. This is a prerequisite enforced by Microsoft Entra ID and Intune together.

Exam trap

The trap here is that candidates often confuse prerequisites for device management (like APNs certificate) with prerequisites for automatic enrollment, leading them to select Apple Push Notification service certificate as a required component when it is only needed after enrollment for iOS device management.

Full explanation →
52
MCQeasy

You need to deploy a Microsoft 365 Apps for enterprise suite to Windows 10 devices using Intune. Users are unlicensed. How should you proceed?

A.Deploy the suite as 'available' from Company Portal.
B.Use the built-in Microsoft 365 Apps (Office) app type in Intune.
C.Assign the Office 365 E3 license to all users.
D.Create a Win32 app package for Microsoft 365 Apps and deploy it.
AnswerD

Win32 packaging allows you to include a volume license key or use shared activation for unlicensed users.

Why this answer

When users are unlicensed, the Microsoft 365 Apps for enterprise suite cannot be deployed via the built-in Intune app type (which relies on license activation). Creating a Win32 app package allows you to bundle the Office Deployment Tool (ODT) with a configuration XML that sets the product ID to 'O365ProPlusRetail' and disables automatic licensing checks, enabling deployment to unlicensed devices.

Exam trap

The trap here is that candidates assume the built-in Microsoft 365 Apps app type in Intune is always the correct choice, but they overlook the critical dependency on user licensing, which the question explicitly removes by stating users are unlicensed.

How to eliminate wrong answers

Option A is wrong because deploying the suite as 'available' from Company Portal still requires the user to have an Office 365 license to activate the apps; unlicensed users will see the app but cannot install or run it. Option B is wrong because the built-in 'Microsoft 365 Apps (Office)' app type in Intune is designed for licensed users and automatically triggers license-based activation; it will fail for unlicensed users. Option C is wrong because assigning Office 365 E3 licenses to all users is a licensing action, not a deployment method; while it would resolve the licensing issue, the question specifically states users are unlicensed and asks how to deploy the suite, not how to license users.

Full explanation →
53
MCQhard

Users report that after updating to Windows 11, their devices are no longer receiving policy updates from Intune. The devices appear as active and compliant in the Intune console. What is the most likely cause?

A.The devices lost compliance after the upgrade.
B.The Intune management extension is outdated and needs to be updated.
C.The MDM authority changed to Configuration Manager.
D.Windows 11 is not supported by Microsoft Intune.
AnswerB

The management extension must be updated to support Windows 11 policies.

Why this answer

The Intune management extension is responsible for deploying PowerShell scripts, Win32 apps, and custom compliance policies. After a Windows 11 upgrade, the extension may become outdated or fail to re-register, causing a break in the policy retrieval loop even though the device appears active and compliant. This is a known behavior where the extension’s version mismatch prevents it from processing new policy assignments.

Exam trap

The trap here is that candidates assume compliance status guarantees policy delivery, but Intune separates compliance evaluation from policy enforcement, and a stale management extension can block policy retrieval while compliance remains intact.

How to eliminate wrong answers

Option A is wrong because the devices are listed as compliant in the Intune console, which directly contradicts a loss of compliance. Option C is wrong because the MDM authority is a tenant-level setting that does not change automatically due to an OS upgrade; if it had changed, the devices would not appear in the Intune console at all. Option D is wrong because Windows 11 is fully supported by Microsoft Intune, with specific minimum build requirements (21H2 or later) that are met by the upgrade.

Full explanation →
54
MCQhard

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

A.Device configuration profile to enable BitLocker
B.Device compliance policy with a noncompliance action to mark device as non-compliant
C.PowerShell script deployment with assignment to all devices
D.Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker
AnswerD

Proactive remediations can detect and automatically run remediation scripts.

Why this answer

Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Exam trap

The trap here is that candidates often confuse Proactive remediations with simple script deployment, not realizing that Proactive remediations provide a detection-then-remediation loop that automatically re-applies the fix when drift is detected, whereas a one-time script deployment does not.

How to eliminate wrong answers

Option A is wrong because a device configuration profile can enable BitLocker on new or compliant devices, but it does not automatically remediate devices that later become non-compliant (e.g., after a user disables BitLocker). Option B is wrong because a device compliance policy with a noncompliance action only marks the device as non-compliant and can trigger conditional access blocks, but it does not run a PowerShell script to re-enable BitLocker. Option C is wrong because PowerShell script deployment runs the script once at assignment or during a scheduled sync, but it lacks the detection-and-remediation loop that Proactive remediations provide; it cannot automatically re-run when BitLocker is disabled again.

Full explanation →
55
MCQeasy

You need to ensure that Windows 10 devices automatically receive Microsoft Defender antivirus definition updates from Microsoft. Which update channel should you configure in the endpoint protection profile?

A.Microsoft Update
B.Microsoft Update for Business
C.Windows Update
D.WSUS
AnswerA

Correct. Microsoft Update delivers Defender definition updates directly from Microsoft.

Why this answer

The 'Microsoft Update' channel delivers Microsoft Defender antivirus definition updates directly from Microsoft. Option B is incorrect because Microsoft Update for Business is typically used for feature and quality updates, not specifically for Defender definition updates; the correct channel for automatic definition updates is Microsoft Update. Option C is incorrect because Windows Update is for OS updates, not definition updates.

Option D is incorrect because WSUS may delay definition updates.

Full explanation →
56
MCQhard

An administrator applies the app protection policy shown in the exhibit to a group of users. A user reports that they are unable to copy data from a managed app and paste it into an unmanaged app. Which setting in the policy causes this behavior?

A.requirePin is set to true.
B.dataTransferToUnmanagedApps is set to false.
C.appSharingFromLevel is set to 'policyManagedApps'.
D.disableAppEncryptionIfDeviceEncryptionIsEnabled is set to false.
AnswerB

This setting directly prevents data transfer to unmanaged apps.

Why this answer

The setting `dataTransferToUnmanagedApps` controls whether data can be transferred from a managed app to unmanaged apps via copy/paste, share, or other data-sharing mechanisms. When set to `false`, it blocks all such transfers, including pasting into unmanaged apps. This is the specific policy that prevents the user from copying data from a managed app and pasting it into an unmanaged app.

Exam trap

The trap here is that candidates often confuse `appSharingFromLevel` with `dataTransferToUnmanagedApps`, mistakenly thinking that restricting sharing to policy-managed apps also blocks copy/paste to unmanaged apps, when in fact `dataTransferToUnmanagedApps` is the explicit setting that controls clipboard-based data transfer to any unmanaged destination.

How to eliminate wrong answers

Option A is wrong because `requirePin` controls whether a PIN is required to access the managed app, not data transfer behavior. Option C is wrong because `appSharingFromLevel` set to `policyManagedApps` restricts sharing to only other apps that have the same app protection policy, but it does not block copy/paste to unmanaged apps; it allows sharing between managed apps. Option D is wrong because `disableAppEncryptionIfDeviceEncryptionIsEnabled` controls whether app-level encryption is disabled when device encryption is present, which is unrelated to data transfer restrictions.

Full explanation →
57
MCQmedium

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

A.The devices failed to enroll properly.
B.The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.
C.The devices are running a non-Windows operating system.
D.The devices have names that do not match the naming convention.
AnswerB

A common compliance rule requires devices to sync within a set number of days.

Why this answer

The compliance policy includes a rule for 'Maximum days since last check-in', which checks the `lastSyncDateTime` property. Devices that have not synced within the configured threshold (e.g., 30 days) are marked as noncompliant. This is a common Intune compliance setting for Windows devices to ensure they regularly communicate with the service.

Exam trap

The MD-102 exam often tests the distinction between enrollment failures and compliance violations; the trap here is that candidates may incorrectly attribute noncompliance to enrollment issues rather than recognizing that a valid `lastSyncDateTime` indicates successful enrollment, and the noncompliant state is due to a missed check-in threshold.

How to eliminate wrong answers

Option A is wrong because failed enrollment would prevent the device from appearing in the output at all, or it would show an enrollment failure state, not a compliance state of 'noncompliant' with a valid lastSyncDateTime. Option C is wrong because the PowerShell command specifically retrieves Windows devices (as stated in the question), and non-Windows OS devices would not be returned by this query. Option D is wrong because device naming conventions are not a compliance policy setting in Intune; naming is used for identification and management, not compliance evaluation.

Full explanation →
58
Multi-Selecteasy

You are preparing infrastructure for device management. Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Select 2 answers
A.Android Zero Touch.
B.Microsoft Entra ID join with automatic MDM enrollment.
C.Apple Business Manager.
D.Windows Autopilot.
E.Samsung Knox Mobile Enrollment.
AnswersB, D

Microsoft Entra ID join with automatic MDM enrollment automatically enrolls Windows devices in Intune when they join Entra ID.

Why this answer

The correct answers are B (Microsoft Entra ID join with automatic MDM enrollment) and D (Windows Autopilot). Both are valid methods to enroll Windows devices into Microsoft Intune. Option A (Android Zero Touch) is for Android devices, not Windows.

Option C (Apple Business Manager) is for Apple devices. Option E (Samsung Knox Mobile Enrollment) is for Samsung Android devices.

Full explanation →
59
Multi-Selecthard

Which THREE of the following are requirements for deploying a Win32 app via Microsoft Intune?

Select 3 answers
A.The device must have the Intune Management Extension installed separately.
B.The app installation files must be hosted on an external web server.
C.The app must be assigned to a group of users or devices.
D.Detection rules must be configured to verify installation.
E.The app must be packaged in the .intunewin format.
AnswersC, D, E

Assignment is required to target the app.

Why this answer

In Microsoft Intune, a Win32 app must be assigned to at least one group of users or devices to be deployed. Without an assignment, the Intune Management Extension will not receive the policy to download and install the application on the targeted devices.

Exam trap

The trap here is that candidates often confuse the automatic installation of the Intune Management Extension with a manual prerequisite, or assume that Win32 app files must be hosted externally rather than leveraging Intune's built-in cloud storage.

Full explanation →
60
MCQhard

Refer to the exhibit. You run the Get-AutopilotInfo script on a new Surface Pro 7. The output shows DeviceState as 'Unknown' and AssignmentStatus as 'NotAssigned'. The device is connected to the internet. What should you do to prepare this device for Autopilot deployment?

A.Upload the hardware hash to Microsoft Intune to register the device.
B.Assign an Autopilot deployment profile to the device group.
C.Run the script again with the -Online parameter.
D.Use a provisioning package to set up the device manually.
AnswerA

Registration is required for Autopilot to work.

Why this answer

The Get-AutopilotInfo script collects the hardware hash and device details but does not automatically register the device with Autopilot. A 'DeviceState' of 'Unknown' and 'AssignmentStatus' of 'NotAssigned' indicate the device is not yet registered in Intune. Uploading the hardware hash to Intune is the required first step to register the device, enabling Autopilot to recognize it and assign profiles.

Exam trap

The trap here is that candidates assume running the script with an online parameter (like -Online) would automatically register the device, but the script is offline-only and requires manual upload of the hardware hash to Intune.

How to eliminate wrong answers

Option B is wrong because assigning an Autopilot deployment profile to a device group is only possible after the device is registered in Intune; without registration, the device is not in any group and cannot receive profiles. Option C is wrong because the Get-AutopilotInfo script does not support an -Online parameter; the script is designed to run locally and output a CSV file for manual upload. Option D is wrong because using a provisioning package bypasses Autopilot entirely and is used for manual, non-Autopilot provisioning, which does not prepare the device for Autopilot deployment.

Full explanation →
61
MCQmedium

You are configuring Microsoft Defender for Endpoint in Microsoft Intune for Windows 10 devices. You need to ensure that when a threat is detected, the device automatically receives a remediation action. Which configuration should you use?

A.Configure a device compliance policy to mark the device as non-compliant.
B.Enable 'Manual investigation' in the endpoint security policy.
C.Create an alert rule in Microsoft Defender XDR to notify administrators.
D.Enable 'Automatic remediation' in the Microsoft Defender Antivirus policy.
AnswerD

Automatic remediation allows Defender to take action on detected threats.

Why this answer

Enabling 'Automatic remediation' in the Microsoft Defender Antivirus policy within Intune's endpoint security node ensures that when a threat is detected, the device automatically applies the configured remediation action (e.g., quarantine, remove, or block) without requiring manual intervention. This setting directly controls the behavior of Microsoft Defender Antivirus to act on detected threats, aligning with the requirement for automatic remediation.

Exam trap

The trap here is that candidates often confuse alerting or compliance policies with actual remediation actions, mistakenly thinking that marking a device non-compliant or creating an alert will automatically remediate the threat, when in fact only the antivirus policy's automatic remediation setting directly triggers the remediation action on the device.

How to eliminate wrong answers

Option A is wrong because configuring a device compliance policy to mark the device as non-compliant only triggers conditional access restrictions or user notifications; it does not perform any remediation action on the detected threat itself. Option B is wrong because 'Manual investigation' is not a valid setting in endpoint security policies; Microsoft Defender for Endpoint uses automated investigation and response (AIR) capabilities, and manual investigation is a separate process, not a configuration toggle. Option C is wrong because creating an alert rule in Microsoft Defender XDR only sends notifications to administrators about detected threats; it does not cause the device to automatically receive a remediation action.

Full explanation →
62
MCQeasy

You need to wipe a lost corporate-owned iOS device that is enrolled in Intune. Which action should you perform?

A.Delete the device from Intune.
B.Retire the device.
C.Wipe the device.
D.Disable the device.
AnswerC

Wipe resets the device completely.

Why this answer

The correct action is to wipe the device because a corporate-owned iOS device that is lost requires a full factory reset to remove all data and prevent unauthorized access. In Microsoft Intune, the 'Wipe' action performs a factory reset, returning the device to its out-of-box state and removing all corporate and personal data, which is appropriate for a lost corporate-owned device.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Wipe', assuming both achieve the same result, but 'Retire' is designed for BYOD scenarios where personal data must be preserved, while 'Wipe' is required for corporate-owned devices that need complete data sanitization.

How to eliminate wrong answers

Option A is wrong because deleting the device from Intune only removes it from the management console without initiating any remote wipe or data removal, leaving the device fully functional with all data intact. Option B is wrong because retiring the device removes only managed apps and corporate data but preserves personal data, which is insufficient for a lost corporate-owned device that must be completely sanitized. Option D is wrong because disabling the device is not a supported Intune action for iOS devices; Intune offers 'Retire' and 'Wipe' actions, and 'Disable' is a generic term that does not correspond to any specific remote management command.

Full explanation →
63
Multi-Selecteasy

Which TWO of the following are valid app types in Microsoft Intune for iOS/iPadOS devices?

Select 2 answers
A.Windows 10 Universal app
B.iOS line-of-business app
C.Android Enterprise system app
D.Managed Google Play iframe
E.iOS store app
AnswersB, E

For custom iOS apps.

Why this answer

Microsoft Intune supports deploying iOS line-of-business (LOB) apps, which are custom-built applications that are not available in the public App Store. Administrators upload the .ipa package directly to Intune, and the app is sideloaded onto managed iOS/iPadOS devices using the Intune Company Portal or Apple's Volume Purchase Program (VPP) for distribution.

Exam trap

The trap in this question is that candidates might select 'Managed Google Play iframe' thinking it is a generic web app type, but it is strictly an Android Enterprise feature and not valid for iOS/iPadOS devices in Microsoft Intune.

Full explanation →
64
MCQmedium

You are preparing to deploy Windows Autopilot for your organization. You have obtained the hardware hashes for 100 new devices. You need to register these devices in Microsoft Intune so that they can be associated with an Autopilot deployment profile. What should you do?

A.Use the Microsoft Store for Business to automatically register devices
B.Contact the OEM to register the devices using the device serial numbers
C.Use the Windows Configuration Designer to create a provisioning package that includes Autopilot settings
D.Upload the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center
AnswerD

This is the standard method to register devices.

Why this answer

Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center is the standard method to register devices for Windows Autopilot. Option A is incorrect because the Microsoft Store for Business is deprecated and no longer supports Autopilot registration. Option B is incorrect because while OEMs can register devices, you already have the hardware hashes, making direct upload more efficient.

Option C is incorrect because Windows Configuration Designer is used to create provisioning packages for manual setup, not for Autopilot device registration.

Full explanation →
65
Multi-Selecthard

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Select 3 answers
A.Run a detection script to identify issues.
B.Send email alerts when issues are detected.
C.Schedule scripts to run at regular intervals.
D.Run a remediation script to fix issues.
E.Mark devices as non-compliant if remediation fails.
AnswersA, C, D

Detection scripts identify problems.

Why this answer

Proactive remediations in Microsoft Intune are designed to detect and automatically fix common issues on Windows devices without requiring user intervention. Option A is correct because the workflow begins with a detection script that runs on the device to identify specific problems, such as registry misconfigurations or missing files. This script must return an exit code indicating whether an issue exists, which then triggers the remediation script if needed.

Exam trap

The trap here is that candidates often confuse proactive remediations with compliance policies or alerting features, assuming that failed remediation can automatically trigger non-compliance or email notifications, but Intune separates these functions into distinct policies and requires additional configuration for alerts.

Full explanation →
66
Multi-Selecthard

You are configuring Windows Autopilot for a customer who has a hybrid Azure AD join deployment. The devices are self-deploying using a self-deploying profile. Which THREE prerequisites must be met for the self-deploying mode to work?

Select 3 answers
A.The device must be registered in Windows Autopilot
B.The local administrator account must be enabled
C.The device must be connected to the internet and able to reach Azure AD
D.The user must be assigned a Windows Autopilot license
E.The device must have an Azure AD Premium license (P1 or P2)
AnswersA, C, E

Registration is required for Autopilot.

Why this answer

A device must be registered in Windows Autopilot to associate it with a self-deploying profile. Registration is done by uploading the device's hardware hash to the Autopilot service, which then links the device to the profile and enables automatic provisioning without user interaction.

Exam trap

The trap here is that candidates often confuse user-driven Autopilot requirements (like a user license) with device-driven self-deploying mode, leading them to incorrectly select option D instead of recognizing the device license prerequisite.

Full explanation →
67
MCQeasy

Your organization uses Windows Autopilot for device provisioning. Users report that after initial setup, devices are not automatically enrolled in Microsoft Intune. What should you verify?

A.That a device configuration profile is assigned to the devices.
B.That the devices are registered in Windows Autopilot with a valid hardware hash.
C.That a Conditional Access policy is in place requiring Intune enrollment.
D.That a device compliance policy is assigned to the Autopilot devices.
AnswerB

Autopilot devices must be registered to automatically enroll in Intune.

Why this answer

Windows Autopilot requires devices to be registered in the Autopilot service with a valid hardware hash (or other unique identifier like PKID or serial number) so that the service can match the device during OOBE and trigger the enrollment process into Intune. Without a valid hardware hash, the device will not be recognized by Autopilot and will proceed through standard OOBE without automatic Intune enrollment.

Exam trap

The trap here is that candidates often confuse post-enrollment policies (configuration profiles, compliance, Conditional Access) with the prerequisite registration step, assuming any assigned policy will force enrollment, when in fact the device must first be recognized by Autopilot via a valid hardware hash.

How to eliminate wrong answers

Option A is wrong because a device configuration profile is used to apply settings after enrollment, not to trigger enrollment itself; Autopilot enrollment happens before configuration profiles are applied. Option C is wrong because Conditional Access policies control access to resources after enrollment, they do not initiate or enforce the enrollment process during Autopilot. Option D is wrong because device compliance policies are evaluated after a device is enrolled in Intune, they have no role in the initial enrollment step.

Full explanation →
68
MCQeasy

You need to deploy a line-of-business (LOB) app to 100 iOS devices managed by Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

A.Upload the app package as an iOS LOB app in Intune
B.Add the app as a Volume Purchase Program (VPP) app
C.Use an Enterprise Code Signing certificate to deploy via MDM
D.Publish the app to the Apple App Store and deploy as public app
AnswerA

Direct method for custom enterprise apps.

Why this answer

Intune supports deploying internally developed LOB apps to iOS devices by uploading the signed .ipa package directly. Since the app is already signed with an enterprise certificate, it can be distributed via Intune's iOS LOB app workflow without requiring the Apple App Store or VPP.

Exam trap

The trap here is confusing the signing certificate (used to sign the app) with the deployment method, leading candidates to select Option C, which describes a prerequisite rather than a distribution mechanism.

How to eliminate wrong answers

Option B is wrong because Volume Purchase Program (VPP) apps are purchased from the Apple App Store and assigned to devices via managed distribution, not used for custom LOB apps. Option C is wrong because Enterprise Code Signing certificates are used to sign the app, not as a deployment method; MDM deploys the app via Intune's LOB app upload, not by using the certificate directly. Option D is wrong because publishing to the Apple App Store is unnecessary and contradicts the requirement to deploy a signed LOB app; public apps are for store-distributed apps, not enterprise-signed ones.

Full explanation →
69
MCQmedium

Contoso uses Microsoft Defender for Endpoint on Windows servers. They need to ensure that antivirus definitions are always up-to-date even if the server is disconnected from the internet for extended periods. What should they configure?

A.Enable Windows Update for Business group policy
B.Use Intune to deliver definition updates
C.Configure a network file share as an internal update source for Microsoft Defender Antivirus
D.Download definitions from Microsoft Update Catalog and install manually
AnswerC

Defender Antivirus supports internal file share for definition updates.

Why this answer

Microsoft Defender Antivirus supports using a network file share as an internal update source via Group Policy or Configuration Manager. This allows servers that are disconnected from the internet to receive definition updates from a local share, ensuring they remain up-to-date without external connectivity.

Exam trap

The trap here is that candidates often assume Intune or Windows Update for Business can handle offline updates, but both require internet connectivity, whereas a network file share is the only supported method for disconnected servers.

How to eliminate wrong answers

Option A is wrong because Windows Update for Business is designed for internet-connected devices to receive updates from Microsoft servers, not for offline or disconnected scenarios. Option B is wrong because Intune delivers definition updates via the cloud, requiring internet connectivity, and cannot serve as an offline update source. Option D is wrong because manually downloading definitions from the Microsoft Update Catalog is a one-time, non-automated process that does not ensure continuous updates for extended periods.

Full explanation →
70
MCQmedium

Your organization requires that all Windows 11 devices encrypt their drives with BitLocker. You have configured a BitLocker policy in Intune, but some devices show as 'Not evaluated' for the encryption status. What is the most likely reason?

A.The devices do not have a TPM chip.
B.The policy is not assigned to the correct group.
C.The devices have a conflicting Group Policy.
D.Secure Boot is disabled on the devices.
AnswerA

TPM is required for BitLocker, and without it the policy cannot be evaluated.

Why this answer

The 'Not evaluated' status in Intune indicates that the device has not yet checked in or the policy has not been applied, but the most common root cause for BitLocker policy evaluation failure is the absence of a TPM chip. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 for its default encryption method, and without it, the policy cannot be assessed, resulting in a 'Not evaluated' state rather than a compliance failure.

Exam trap

The trap here is that candidates often confuse 'Not evaluated' with a compliance failure or policy misassignment, but the key is that 'Not evaluated' specifically indicates the device could not even begin the assessment, often due to missing prerequisites like TPM.

How to eliminate wrong answers

Option B is wrong because if the policy is not assigned to the correct group, the device would typically show as 'Not applicable' or simply not appear in the policy report, not 'Not evaluated'. Option C is wrong because conflicting Group Policy would usually cause a 'Conflict' or 'Error' status, not 'Not evaluated', as Intune can still attempt evaluation and report the conflict. Option D is wrong because Secure Boot being disabled does not prevent BitLocker from evaluating the policy; it may cause a compliance failure or warning, but the policy would still be evaluated and show a status like 'Noncompliant' rather than 'Not evaluated'.

Full explanation →
71
MCQhard

A user reports that a required Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune console shows the app assignment is 'Required' for the user group. The device status shows 'Pending' for over a day. You verify the device is online and checks in regularly. What is the most likely cause?

A.The user does not have a Microsoft 365 license assigned.
B.The device has not checked in with Intune recently.
C.The device does not have enough disk space.
D.The app is assigned to the device group instead of the user group.
AnswerA

Microsoft 365 Apps require a license to activate; without it, installation may stall.

Why this answer

Microsoft 365 Apps for enterprise requires a valid license assigned to the user to install and activate. Intune's 'Pending' status indicates the installation is queued but cannot proceed, often due to license validation failure. Even though the device is online and checks in regularly, the app assignment will remain pending until the user has a license, as the Intune management extension waits for license confirmation before downloading and installing the suite.

Exam trap

The trap here is that candidates often assume 'Pending' means a technical issue like connectivity or disk space, rather than recognizing it as a licensing validation hold that prevents the installation from starting.

How to eliminate wrong answers

Option B is wrong because the scenario explicitly states the device is online and checks in regularly, so a lack of check-in is not the cause. Option C is wrong because insufficient disk space would typically result in a failed installation with an error status, not a persistent 'Pending' status; Intune would report a failure code. Option D is wrong because the app assignment is already set to 'Required' for the user group, and the device status shows 'Pending'; if the assignment were to a device group, the user would not see the app in the Company Portal, but the device would still attempt installation and show a different status.

Full explanation →
72
MCQhard

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

A.Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.
B.Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.
C.Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.
D.Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.
AnswerB

Feature updates in ConfigMgr perform in-place upgrades and can use Delivery Optimization to reduce bandwidth.

Why this answer

It leverages Configuration Manager's 'Windows 10/11 feature update' servicing plan, which is specifically designed for in-place upgrades while preserving user data and settings. Enabling Delivery Optimization for peer-to-peer download reduces bandwidth consumption in remote offices by allowing devices to share upgrade content locally, addressing the limited bandwidth constraint.

Exam trap

The trap here is that candidates may confuse provisioning packages (Option A) as a valid upgrade method, but they are designed for offline provisioning and cannot perform an in-place upgrade with user data preservation, while the feature update servicing plan is the correct, supported method for this scenario.

How to eliminate wrong answers

Option A is wrong because provisioning packages are intended for initial device configuration and offline deployment, not for in-place upgrades; they cannot orchestrate a Windows 11 upgrade while preserving existing user data and settings. Option C is wrong because Windows Autopilot reset wipes the device and reinstalls Windows, which does not preserve user data and settings; restoring from OneDrive is a separate process and not part of an in-place upgrade. Option D is wrong because configuring a task sequence to download content from the internet does not inherently reduce distribution point load; it shifts the download source to the internet, which may still consume significant bandwidth unless combined with peer caching or Delivery Optimization, and the task sequence method is more complex than the dedicated feature update servicing plan.

Full explanation →
73
MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate apps are installed automatically on new devices without user interaction. Which enrollment method should you use?

A.Android Enterprise fully managed
B.Android Enterprise dedicated device
C.Android Legacy device administrator
D.Android Enterprise work profile
AnswerA

Fully managed devices allow silent app installation.

Why this answer

Android Enterprise fully managed (A) is the correct enrollment method because it allows IT to enroll corporate-owned devices into Intune with full device control, enabling automatic, silent installation of required corporate apps without any user interaction. This mode uses the Android Enterprise API to push apps via managed Google Play as required or kiosk apps, ensuring they are installed before the device is handed to the user.

Exam trap

The trap here is that candidates often confuse 'fully managed' with 'dedicated device' because both are corporate-owned, but dedicated devices lack user association and cannot automatically install user-specific corporate apps without a user context.

How to eliminate wrong answers

Option B (Android Enterprise dedicated device) is wrong because it is designed for single-purpose or kiosk devices that are not assigned to a specific user, and while it can auto-install apps, it does not support user-based app targeting or user-specific corporate app deployment without a user context. Option C (Android Legacy device administrator) is wrong because it is a deprecated enrollment method that relies on Device Admin API, which does not support automatic app installation via managed Google Play and lacks the modern app management capabilities of Android Enterprise. Option D (Android Enterprise work profile) is wrong because it is intended for BYOD scenarios where a separate work profile is created on a personal device, and while apps can be pushed, they require user consent or interaction during profile setup and are not automatically installed on new devices without user involvement.

Full explanation →
74
MCQeasy

You need to ensure that only compliant devices can access Microsoft 365 resources. You create a Conditional Access policy in Microsoft Entra ID. Which condition should you use?

A.Locations condition set to trusted IPs.
B.Grant access with multi-factor authentication.
C.Require device to be marked as compliant.
D.Device platform condition set to all.
AnswerC

This is a grant control that enforces compliance.

Why this answer

The question specifically asks to ensure that only compliant devices can access Microsoft 365 resources. In a Conditional Access policy, the 'Require device to be marked as compliant' grant control enforces that the device must be enrolled in Microsoft Intune and meet all compliance policies (e.g., encryption, OS version, threat level) before access is granted. This directly ties device health to resource access, which is the core requirement.

Exam trap

The trap here is that candidates often confuse 'device compliance' with 'device platform' or 'MFA', thinking that restricting by platform or adding MFA is sufficient to ensure device health, but neither checks the actual security posture of the device.

How to eliminate wrong answers

Option A is wrong because the 'Locations condition set to trusted IPs' controls access based on network location (e.g., corporate office), not device compliance; a non-compliant device from a trusted IP would still be allowed. Option B is wrong because 'Grant access with multi-factor authentication' verifies user identity via a second factor, but does not evaluate the device's compliance status; a compromised but MFA-authenticated device could still access resources. Option D is wrong because 'Device platform condition set to all' simply includes all operating systems (Windows, iOS, Android, etc.) in the policy scope, but does not enforce any compliance check; it is a condition, not a grant control.

Full explanation →
75
MCQmedium

You are troubleshooting a Windows 10 device that is not receiving required security updates from Microsoft Intune. The device is enrolled and shows as compliant. The update ring policy is assigned to the device. You check the Windows Update for Business logs and see that the deferral period is set correctly. What is the most likely cause?

A.The update ring is configured with an incorrect deferral period.
B.The device is not compliant with the security baseline.
C.Windows Update is blocked by the corporate firewall.
D.The update ring is not assigned to the device's group.
AnswerD

Without proper assignment, the policy does not apply to the device.

Why this answer

The device is enrolled and compliant, and the deferral period is correctly set, which eliminates policy configuration issues. The most likely remaining cause is that the update ring policy is not assigned to the device's group, meaning the policy never reaches the device via Intune's policy delivery mechanism. Without proper group assignment, the Windows Update for Business settings are not applied, even if the device is compliant and the ring policy exists.

Exam trap

The trap here is that candidates assume a compliant device with a correctly configured policy will always receive updates, but they overlook the critical step of verifying that the device is actually a member of the assigned group, which is a separate prerequisite from compliance or policy configuration.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the deferral period is set correctly in the Windows Update for Business logs, so an incorrect deferral period is not the cause. Option B is wrong because the device is reported as compliant, and compliance with a security baseline is not a prerequisite for receiving update ring policies; update rings are applied via policy assignment, not compliance status. Option C is wrong because if Windows Update were blocked by a corporate firewall, the device would likely show errors connecting to Windows Update services, but the logs confirm the deferral period is correctly set, indicating the policy is being processed locally; a firewall block would prevent updates from downloading, not prevent the policy from being applied.

Full explanation →

Page 1 of 13

Page 2

All pages

12345678910111213

Practice MD-102 by domain

Target a specific domain to shore up weak areas.

Prepare infrastructure for devicesManage and maintain devicesManage applicationsProtect devices
See all domains with question counts →