Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 826–900 | Page 12/13

826

Multi-Selecthard

Which THREE conditions must be met for a Windows 10 device to be able to use Windows Autopilot self-deploying mode?

Select 3 answers

A.The device must be Azure AD joined.

B.The device must have a TPM 2.0 chip.

C.The device must be Hybrid Azure AD joined.

D.The device must be registered as an Autopilot device.

E.A user must be assigned to the device in Autopilot.

AnswersA, B, D

Self-deploying mode requires Azure AD join.

Why this answer

Azure AD join is required for self-deploying mode because this mode provisions a device for shared or kiosk scenarios without user interaction. The device must be joined to Azure AD to establish a device identity and allow policy application before any user signs in, which is a core requirement for the zero-touch provisioning flow.

Exam trap

The trap here is that candidates often confuse self-deploying mode with user-driven modes and incorrectly assume a user must be assigned, or they think Hybrid Azure AD join is supported in self-deploying mode, but Microsoft explicitly restricts self-deploying to Azure AD join only.

Full explanation →

827

MCQeasy

Your organization plans to deploy Microsoft 365 Apps to 500 Windows 10 devices using Microsoft Intune. You need to ensure that users do not need to enter their credentials to activate the apps. Which configuration should you use?

A.Enable device-based activation for Microsoft 365 Apps

B.Use a product key and activate via KMS server

C.Deploy Microsoft 365 Apps with user-based activation and ensure devices are Microsoft Entra ID joined

D.Configure Microsoft 365 Apps for enterprise with shared computer activation

AnswerC

User-based activation with Microsoft Entra ID provides single sign-on.

Why this answer

Deploying Microsoft 365 Apps with user-based activation on Microsoft Entra ID joined devices enables seamless single sign-on (SSO) using the user's cloud identity. When the device is Entra ID joined, the user's existing Microsoft Entra ID token is used to automatically activate Microsoft 365 Apps without requiring additional credential prompts, fulfilling the requirement for zero-touch activation.

Exam trap

The trap here is that candidates often confuse device-based activation (Option A) with user-based activation on Entra ID joined devices, mistakenly thinking device-based activation eliminates credential prompts, when in fact it requires a specific subscription and is not supported in Intune deployments.

How to eliminate wrong answers

Option A is wrong because device-based activation for Microsoft 365 Apps is not supported in Intune; it requires a subscription activation model that is only available with Windows 10/11 Enterprise E3/E5 or Microsoft 365 F3 subscriptions and is configured via Group Policy, not Intune. Option B is wrong because using a product key and KMS server is a volume activation method for on-premises environments, not for cloud-based Microsoft 365 Apps activation, and it still requires user credentials or a KMS client key, not eliminating credential entry. Option D is wrong because shared computer activation is designed for RDS or VDI environments where multiple users access the same device; it does not eliminate credential prompts for individual users on a dedicated Windows 10 device and requires user sign-in to activate.

Full explanation →

828

MCQmedium

An Android device running OS version 9.0 with app version 1.5.0 is targeted by the app protection policy in the exhibit. What is the expected behavior when the user tries to access work data?

A.Access is blocked because the OS version is below the warning level

B.Access is allowed with a warning to update the app and OS

C.Access is allowed without any warning because minimum requirements are met

D.Access is blocked because the app version is below the warning level

AnswerC

Correct. The device satisfies minimum requirements and is not at the warning level, so access is granted without warning.

Why this answer

The device meets the minimum OS and app version requirements, and the versions are not at the warning threshold configured in the policy. Therefore, access is allowed without any warning.

Exam trap

Candidates may confuse the warning level with the block level or assume that meeting minimums always results in no warning, but here the warning level is higher than the device's versions.

How to eliminate wrong answers

Option A is wrong because the OS version 9.0 is not below the warning level (8.0) — it is above it, so access is not blocked for OS version. Option C is wrong because while access is allowed, the statement 'without any warning because minimum requirements are met' is partially correct, but the question expects the behavior when the user tries to access work data — the policy allows access with a warning only if the app or OS is below the warning level but above the minimum; here both are above warning levels, so no warning is shown, making C technically correct but the exam answer is B because the exhibit likely shows the app version is below the warning level (1.5.0 vs 1.4.0 warning) — wait, re-evaluating: if app version 1.5.0 is above warning 1.4.0, no warning. The trap is that the exhibit might show the warning level for OS as 8.0 and app as 1.4.0, but the device OS 9.0 is above warning, app 1.5.0 is above warning, so no warning.

Option D is wrong because the app version 1.5.0 is not below the warning level (1.4.0) — it is above, so access is not blocked for app version.

Full explanation →

829

Multi-Selecthard

An administrator uses Intune to deploy a line-of-business (LOB) app for Android. The app is failing to install on some devices. The administrator reviews the Intune management extension logs and sees error 'Device not compliant with app configuration policy'. Which THREE conditions could cause this error?

Select 3 answers

A.The device is not enrolled in Android Enterprise work profile

B.The device is a personally owned device with work profile when the app requires fully managed device

C.The app was previously installed and then uninstalled

D.The Company Portal app is not installed on the device

E.The device's Android version is below the minimum required by the app

AnswersA, B, E

App configuration policies often require work profile enrollment.

Why this answer

The 'Device not compliant with app configuration policy' error occurs when an Android Enterprise work profile is required for the app's deployment but the device lacks this enrollment. Intune uses app configuration policies to enforce settings like work profile enrollment; if the device is not enrolled in a work profile, the policy cannot be applied, causing the installation to fail.

Exam trap

The trap here is that candidates may confuse app configuration policy compliance with device compliance policies or app installation prerequisites, leading them to select options like 'Company Portal not installed' or 'app uninstalled' instead of focusing on enrollment type mismatches.

Full explanation →

830

MCQmedium

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the result?

A.A list of all devices regardless of operating system.

B.A list of all Windows devices with their last activity.

C.A count of unique Windows devices per device name in the last 7 days.

D.A count of security alerts per device.

AnswerC

Correct. The query summarizes unique devices by name.

Why this answer

The KQL query uses `DeviceInfo` (a Microsoft Sentinel table for device inventory), filters with `where` to include only rows where `OperatingSystem` contains 'Windows', then uses `summarize` with `dcount(DeviceName)` to count distinct device names, and `bin(TimeGenerated, 7d)` to group by 7-day intervals. This produces a count of unique Windows devices per device name over the last 7 days, making option C correct.

Exam trap

The trap here is that candidates may misinterpret `dcount(DeviceName)` as a count of rows or a list of devices, rather than recognizing it as a distinct count aggregation, and may overlook that `DeviceInfo` is an inventory table, not an alert table.

How to eliminate wrong answers

Option A is wrong because the query explicitly filters for Windows devices (`where OperatingSystem contains 'Windows'`), so it does not return all devices regardless of OS. Option B is wrong because the query does not retrieve any 'last activity' data; it uses `dcount(DeviceName)` to count unique devices, not to list devices with their last activity timestamp. Option D is wrong because the query operates on `DeviceInfo`, which is a device inventory table, not a security alerts table; there is no alert data or alert count logic in the query.

Full explanation →

831

MCQeasy

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

A.Ensure the devices have internet connectivity

B.Verify that the app is signed with a trusted certificate

C.Recreate the deployment policy

D.Check if the dependency app is assigned and installed successfully

AnswerD

Dependencies must be installed first; if the dependency fails, the main app will not install.

Why this answer

When a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Exam trap

The trap here is that candidates may assume the issue is with the app itself (signing or connectivity) rather than recognizing that Intune's dependency enforcement means the parent app will not install until the dependency is successfully deployed.

How to eliminate wrong answers

Option A is wrong because while internet connectivity is needed for Intune communication, a dependency issue is a more specific and likely cause for a required app failing to install, and connectivity would typically affect all apps, not just one. Option B is wrong because LOB apps deployed via Intune are already signed with a trusted certificate during enrollment or sideloading; signing issues would cause installation failures on all devices, not just some, and the question indicates the app is already configured. Option C is wrong because recreating the deployment policy is a generic troubleshooting step that does not address the specific dependency configuration; it would not resolve a missing or failed dependency app.

Full explanation →

832

Multi-Selecthard

Which THREE components are required for a successful co-management setup between Configuration Manager and Microsoft Intune? (Choose three.)

Select 3 answers

A.Microsoft Intune tenant

B.Configuration Manager current branch

C.Service connection point (Cloud Attach)

D.Public key infrastructure (PKI) certificates

E.Microsoft Entra ID (Azure AD)

AnswersA, B, E

Intune is the cloud management side.

Why this answer

Options A, B, and E are correct. Co-management requires Microsoft Intune tenant (A) for cloud enrollment, Configuration Manager current branch (B) for on-premises management, and Microsoft Entra ID (E) for identity synchronization and hybrid join. Option C is not a requirement; the service connection point is used for cloud attach but is not mandatory for co-management.

Option D is not required; PKI certificates are optional for co-management, as Intune can handle certificate enrollment via SCEP or PKCS if needed.

Full explanation →

833

Drag & Dropmedium

Arrange the steps to troubleshoot a Windows 10 device failing to enroll in Microsoft Intune.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with basic connectivity and licensing, then check logs for errors, verify prerequisites, and retry.

Full explanation →

834

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that devices cannot connect to unsecured Wi-Fi networks. Which policy type should you configure?

A.Device configuration profile with network settings.

B.Compliance policy.

C.Certificate profile.

D.Wi-Fi profile.

AnswerD

Wi-Fi profiles define allowed networks and their security settings.

Why this answer

A Wi-Fi profile in Microsoft Intune is specifically designed to configure Wi-Fi settings on devices, including security protocols and authentication methods. By configuring a Wi-Fi profile to only allow connections to secured networks (e.g., WPA2-Enterprise or WPA3), you can prevent devices from connecting to unsecured Wi-Fi networks. This policy type directly controls the Wi-Fi connection behavior at the device level.

Exam trap

The trap here is that candidates often confuse a Wi-Fi profile with a device configuration profile or compliance policy, not realizing that only a Wi-Fi profile can enforce the specific security settings required to block unsecured network connections.

How to eliminate wrong answers

Option A is wrong because a device configuration profile with network settings can configure various network-related policies (e.g., proxy, VPN), but it does not include the specific Wi-Fi security settings needed to block unsecured networks. Option B is wrong because a compliance policy evaluates device compliance after a connection is made and can mark a device as non-compliant, but it cannot proactively prevent the device from connecting to an unsecured Wi-Fi network. Option C is wrong because a certificate profile is used to deploy certificates for authentication (e.g., for Wi-Fi or VPN), but it does not define the Wi-Fi connection rules or security requirements.

Full explanation →

835

Multi-Selectmedium

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Select 2 answers

A.Configure an Exchange Active Sync policy in Intune.

B.Create a device configuration profile to enforce security settings.

C.Deploy an app protection policy for Outlook for iOS and Android.

D.Create a device compliance policy that checks for required settings.

E.Create a conditional access policy in Microsoft Entra ID that requires devices to be marked as compliant.

AnswersD, E

Device compliance policies mark devices as compliant or non-compliant, used by conditional access.

Why this answer

A device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Exam trap

The trap here is that candidates confuse device compliance policies (which check device state) with app protection policies (which protect data at the app layer), leading them to incorrectly select Option C, even though app protection policies do not enforce device-level compliance for conditional access.

Full explanation →

836

Multi-Selecteasy

Which TWO of the following are methods to deploy apps to Windows 10/11 devices via Microsoft Intune?

Select 2 answers

A.iOS app

B.Web link

C.Microsoft Store app

D.Android app

E.Win32 app

AnswersC, E

Microsoft Store app is a supported deployment method.

Why this answer

The correct answers are C and E. Option C is correct because Microsoft Intune supports deploying Microsoft Store apps (including Store for Business and the new Microsoft Store experience) to Windows 10/11 devices. Intune can synchronize apps from the Microsoft Store and assign them to users or devices.

Option E is correct because Intune also supports deploying Win32 apps (traditional .exe and .msi applications) to Windows devices using the Win32 app management feature, which allows packaging and deploying line-of-business applications. Options A, B, and D are incorrect: iOS and Android apps are platform-specific and cannot be deployed to Windows devices via Intune; a web link is not an app deployment method but a shortcut.

Exam trap

A common trap is to overlook Win32 apps as a deployment method in Intune, assuming only modern apps (Store apps) are supported. Additionally, candidates might confuse web links with genuine app deployments.

Full explanation →

837

Multi-Selecthard

You are planning device management for a corporate environment with Windows 10, iOS, and Android devices. You need to implement a solution that allows users to access corporate email and documents securely on their personal devices without IT managing the entire device. Which THREE components should you include?

Select 3 answers

A.Azure AD application proxy for on-premises apps

B.Device enrollment into Intune

C.Microsoft Intune app protection policies (MAM)

D.Azure AD conditional access policies

E.Device compliance policies

AnswersA, C, D

Provides secure remote access without VPN.

Why this answer

Options A, C, and D are correct. Microsoft Intune app protection policies (MAM) protect corporate data at the application level without requiring full device management, allowing personal devices to remain unenrolled. Azure AD Conditional Access policies enforce access controls based on user, location, and app risk, ensuring only authorized users can access corporate resources.

Azure AD Application Proxy provides secure remote access to on-premises web applications, such as corporate email and intranet sites, without a VPN. Option B (Device enrollment into Intune) is not required because the goal is to avoid managing the entire device; MAM provides app-level protection instead. Option E (Device compliance policies) is also not needed as they apply to managed devices, which are not used in this scenario.

Full explanation →

838

Multi-Selectmedium

You are planning a Windows 10 deployment using Windows Autopilot. You need to ensure that devices are automatically enrolled in Intune during the out-of-box experience. Which two prerequisites must be met? (Choose two.)

Select 2 answers

A.Tenant must have Microsoft Entra ID P1 or P2

B.Devices must have a valid Windows 10/11 Pro or Enterprise license

C.Devices must be registered in Microsoft Entra ID as Autopilot devices

D.On-premises Active Directory synchronization must be configured

E.Users must have a Microsoft 365 E3 license

AnswersB, C

Windows Pro or Enterprise is required for Autopilot.

Why this answer

Windows Autopilot requires that devices have a valid Windows 10/11 Pro, Enterprise, or Education license to enable the automatic enrollment into Intune during the out-of-box experience (OOBE). Without a qualifying license, the device cannot be properly provisioned with Intune management policies. Option C is correct because devices must be registered in Microsoft Entra ID (formerly Azure AD) as Autopilot devices, which is typically done by uploading a hardware hash CSV file to the Autopilot deployment portal, allowing the device to be recognized and automatically enrolled during OOBE.

Exam trap

The trap here is that candidates often confuse the licensing requirements for Autopilot enrollment with those for Intune management features, incorrectly selecting Microsoft Entra ID P1/P2 or Microsoft 365 E3 as prerequisites when only a valid Windows Pro/Enterprise license and device registration in Microsoft Entra ID are needed.

Full explanation →

839

MCQhard

An organization uses Microsoft Defender for Endpoint (MDE) with Microsoft Intune for device management. The security team wants to automatically remediate risks detected by MDE on Windows devices. Which Intune feature should be used to trigger remediation actions based on MDE alerts?

A.Device configuration profile

B.Conditional Launch policy for MDE

C.Device compliance policy

D.Windows Update rings

AnswerB

Conditional Launch allows blocking access until device risk is remediated.

Why this answer

The Conditional Launch policy in Microsoft Defender for Endpoint (MDE) allows you to define automatic remediation actions (e.g., running a scan, isolating a device) triggered by specific MDE threat alerts. This policy is configured within the MDE security settings managed by Intune, enabling a direct, automated response to risks without manual intervention.

Exam trap

The trap here is that candidates often confuse Device compliance policies with automated remediation, but compliance policies only evaluate and report status—they do not execute remediation actions like scans or isolation, which is the specific function of the Conditional Launch policy.

How to eliminate wrong answers

Option A is wrong because Device configuration profiles are used to enforce settings and configurations on devices (e.g., security policies, app settings), not to trigger automated remediation actions based on real-time MDE alerts. Option C is wrong because Device compliance policies evaluate device health and compliance status (e.g., requiring a minimum OS version or antivirus state) and can mark devices as non-compliant, but they do not directly trigger remediation actions from MDE alerts; they rely on conditional access to block resources. Option D is wrong because Windows Update rings control the deployment and scheduling of Windows updates, not the automated response to security threats detected by MDE.

Full explanation →

840

MCQhard

Your organization plans to deploy Windows Autopilot for existing devices that are currently running Windows 10. You need to convert these devices from a traditional imaging deployment to an Autopilot deployment. You want to minimize user disruption. What should you do?

A.Assign an Autopilot deployment profile to the device group in Intune.

B.Export the hardware hash from each device and upload it manually to Intune.

C.Use a provisioning package (PPKG) to reset the device and register it for Autopilot.

D.Perform a full device wipe and reimage using traditional methods, then register with Autopilot.

AnswerC

PPKG allows reset and registration with minimal user disruption.

Why this answer

Using a provisioning package (PPKG) to reset the device and register it for Autopilot is the recommended method for converting existing Windows 10 devices to Autopilot with minimal user disruption. The PPKG approach allows you to capture the hardware hash, reset the device, and register it with the Autopilot service in a single process, avoiding the need for a full manual wipe or reimage. This method preserves the user's data and settings during the reset, aligning with the goal of minimizing disruption.

Exam trap

The trap here is that candidates often confuse the registration step (exporting the hardware hash) with the actual conversion process, failing to recognize that a reset or provisioning package is required to complete the Autopilot enrollment without disrupting users.

How to eliminate wrong answers

Option A is wrong because assigning an Autopilot deployment profile to a device group in Intune only applies after the device is already registered with Autopilot; it does not convert an existing device or register its hardware hash. Option B is wrong because manually exporting and uploading the hardware hash is a prerequisite for registration but does not perform the conversion or reset; it requires additional steps to actually deploy Autopilot, causing more disruption. Option D is wrong because performing a full device wipe and reimage using traditional methods contradicts the goal of minimizing user disruption, as it erases all data and settings, and then registering with Autopilot adds unnecessary overhead.

Full explanation →

841

MCQeasy

Refer to the exhibit. You deploy this custom OMA-URI policy to Windows 10 devices. What is the expected outcome?

A.Telemetry is set to 1 - Basic

B.The policy applies to users, not devices

C.The policy fails because value 0 is not allowed

D.Telemetry is set to 0 - Security (Enterprise only)

AnswerD

Value 0 disables telemetry.

Why this answer

The OMA-URI policy sets the 'AllowTelemetry' value to 0, which in Windows 10 corresponds to the 'Security (Enterprise only)' telemetry level. This level sends only essential security data, such as the Malicious Software Removal Tool (MSRT) and Windows Defender information, and is only available in Enterprise editions. Therefore, the expected outcome is that telemetry is set to 0 - Security (Enterprise only).

Exam trap

A common misconception is that setting telemetry to 0 causes policy failure on non-Enterprise editions. However, the policy applies successfully; the setting is simply ignored on editions that do not support it.

How to eliminate wrong answers

Option A is wrong because the policy explicitly sets the value to 0, not 1; value 1 corresponds to 'Basic' telemetry, which includes limited diagnostic data. Option B is wrong because OMA-URI policies for Windows 10 device configuration are applied at the device level via MDM, not per user; the policy targets the device CSP (Policy/Config/System/AllowTelemetry). Option C is wrong because value 0 is a valid and allowed integer for the AllowTelemetry policy in Windows 10 Enterprise editions; it is not a failure condition, though it may be ignored on non-Enterprise editions.

Full explanation →

842

MCQmedium

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to ensure that when a device is offboarding, all collected forensic data is deleted from Microsoft 365. What should you do?

A.Disable the device's onboarding policy in Intune.

B.Use the 'Remove device from organization' action in Microsoft Defender XDR console.

C.Run a PowerShell script to execute 'Remove-MpPreference -DisableRealtimeMonitoring $true'.

D.Uninstall the Microsoft Defender for Endpoint sensor from the device.

AnswerB

This action offboards the device and deletes its data from the service.

Why this answer

The 'Remove device from organization' action in the Microsoft Defender XDR console triggers a full offboarding workflow that deletes all collected forensic data (including machine-level telemetry, alerts, and investigation packages) from the Microsoft 365 backend. This action also revokes the device's access to the Defender for Endpoint service and removes its sensor registration, ensuring compliance with data retention policies.

Exam trap

The trap here is that candidates often confuse local sensor removal (Option D) with cloud-side data deletion, not realizing that uninstalling the sensor only stops future data collection while leaving historical forensic data intact in Microsoft 365.

How to eliminate wrong answers

Option A is wrong because disabling an onboarding policy in Intune only stops new configuration profiles from being applied; it does not remove the device from Defender for Endpoint or delete any previously collected forensic data. Option C is wrong because 'Remove-MpPreference -DisableRealtimeMonitoring $true' is a PowerShell cmdlet that disables real-time monitoring on the local device but has no effect on cloud-stored forensic data or the device's registration in Microsoft Defender XDR. Option D is wrong because uninstalling the sensor from the device only stops local data collection and communication with the cloud; it does not trigger deletion of historical forensic data already stored in Microsoft 365, and the device may still appear as 'inactive' in the console.

Full explanation →

843

MCQhard

You are troubleshooting a Windows 11 device that fails to install an Intune-managed update. The device has been offline for two weeks. After reconnecting, the update does not install. In the Intune console, the update shows 'Failed to install' with error code 0x800f0831. What is the most likely cause?

A.The device does not have internet connectivity.

B.The device's Windows component store is corrupted due to missing prerequisites.

C.The device does not have enough disk space.

D.The update is superseded and no longer applicable.

AnswerB

Being offline for a long time can cause prerequisite issues, leading to this error.

Why this answer

Error code 0x800f0831 indicates that the Windows component store (CBS) is corrupted because a required servicing stack or prerequisite update is missing. When a device has been offline for two weeks, it may lack the necessary baseline updates that the current update depends on, causing the installation to fail even after reconnecting to the network.

Exam trap

The trap here is that candidates often assume 'offline for two weeks' implies a connectivity issue (option A), but the specific error code 0x800f0831 points to a corrupted component store from missing prerequisites, not a network problem.

How to eliminate wrong answers

Option A is wrong because the device has reconnected to the network and the Intune console shows the update attempt with a specific error code, which implies internet connectivity is present; a lack of connectivity would typically result in a 'pending download' or 'not applicable' status, not a specific CBS error. Option C is wrong because insufficient disk space usually produces error codes like 0x80070070 or 0x80070008, not 0x800f0831, which is specific to component store corruption. Option D is wrong because a superseded update would show as 'not applicable' or 'superseded' in the Intune console, not 'Failed to install' with a CBS-related error code; superseded updates are simply no longer offered to the device.

Full explanation →

844

MCQhard

You manage iOS devices with Microsoft Intune. A user reports that a required app is missing from their device. You verify the app is assigned as 'Required' to a user group containing the user, and the device is compliant. What is the most likely reason the app is not installing?

A.The app is set to 'Available for enrolled devices' instead of 'Required'.

B.The device is not enrolled using Apple Device Enrollment Program (DEP).

C.The Apple Volume Purchase Program (VPP) token has expired.

D.The app is configured to require user enrollment, but the device uses device enrollment.

AnswerD

User enrollment is needed for apps that require a user context.

Why this answer

When an iOS app is configured with a 'Require user enrollment' assignment filter, it will only install on devices that use User Enrollment (which creates a per-user management identity). If the device uses Device Enrollment (e.g., via Apple Business Manager or manual device enrollment), the app will not install even if assigned as 'Required' to a user group. This is a common configuration mismatch that prevents app delivery.

Exam trap

The trap here is that candidates often assume 'Required' assignment guarantees installation, overlooking that assignment filters (like enrollment type) can silently block app delivery even when the user and device are compliant.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the app is assigned as 'Required', so the setting is not 'Available for enrolled devices'. Option B is wrong because enrollment via Apple Device Enrollment Program (DEP) is not a prerequisite for required app installation; Intune can push required apps to any enrolled iOS device, regardless of enrollment method. Option C is wrong because an expired VPP token would prevent app installation for all users, not just this one device, and the user's device is compliant, indicating the token is likely valid.

Full explanation →

845

MCQeasy

A user reports that after resetting their Windows 10 device, they cannot re-enroll it in Intune. The device appears as 'Pending' in the admin center. What is the most likely reason?

A.The device has a stale record in Intune that needs to be deleted.

B.The user is trying to enroll with a different Azure AD account.

C.The MDM authority is not set to Intune.

D.The user does not have an Intune license assigned.

AnswerA

A previous enrollment record can block re-enrollment; deleting it resolves the issue.

Why this answer

When a Windows 10 device is reset, its existing Intune enrollment record becomes stale. The device attempts to re-enroll but the old record causes a conflict, leaving the device in a 'Pending' state in the admin center. Deleting the stale device record from Intune allows the enrollment to complete successfully.

Exam trap

The trap here is that candidates may think a 'Pending' state is due to licensing or authority misconfiguration, but the real cause is the stale device record left behind after a reset, which is a specific enrollment conflict scenario tested in MD-102.

How to eliminate wrong answers

Option B is wrong because enrolling with a different Azure AD account would typically result in a different device identity or a registration failure, not a 'Pending' state; the issue is a stale record, not an account mismatch. Option C is wrong because if the MDM authority were not set to Intune, the device would fail to enroll entirely or show an error, not remain in 'Pending'; the authority is already configured for Intune. Option D is wrong because a missing Intune license would prevent enrollment initiation or show a licensing error, not cause a 'Pending' state after a reset; the user was previously enrolled, so licensing is already in place.

Full explanation →

846

Multi-Selecthard

Your organization uses Microsoft Intune to manage devices. You need to collect diagnostic logs from a remote Windows device without user interaction. Which THREE methods can you use?

Select 3 answers

A.MDM diagnostic log collection policy

B.Device configuration profile

C.Device diagnostics (Intune device action)

D.Microsoft Support and Recovery Assistant

E.Remote Windows PowerShell session

AnswersA, C, E

Policy can trigger log upload to Intune.

Why this answer

The MDM diagnostic log collection policy is a built-in Intune feature that allows administrators to configure and trigger the collection of device diagnostic logs from Windows devices remotely without any user interaction. This policy leverages the Windows MDM protocol to gather logs such as event viewer logs, registry keys, and network traces, and uploads them to an Azure storage container for analysis.

Exam trap

The trap here is that candidates often confuse Device configuration profiles (which manage settings) with diagnostic collection actions, or assume that SaRA can be triggered remotely via Intune, when in fact it requires local user initiation.

Full explanation →

847

MCQeasy

You need to ensure that all Windows 11 devices in your organization have BitLocker enabled and the recovery key escrowed to Microsoft Entra ID. Which Intune policy should you configure?

A.Compliance Policy

B.Device Restrictions profile

C.Endpoint Protection profile

D.Device Configuration profile

AnswerC

Correct. Endpoint Protection profile includes BitLocker settings.

Why this answer

The Endpoint Protection profile in Microsoft Intune contains the BitLocker settings, including the requirement to enable BitLocker and automatically escrow the recovery key to Microsoft Entra ID. This profile is specifically designed for security configurations like disk encryption, firewall, and antivirus, making it the correct choice for this task.

Exam trap

The trap here is that candidates often confuse Compliance Policy with configuration policies, thinking that compliance can enforce BitLocker, but compliance only reports and can trigger remediation actions—it does not configure the encryption or key escrow settings itself.

How to eliminate wrong answers

Option A is wrong because Compliance Policy evaluates whether devices meet security requirements (e.g., BitLocker enabled) but cannot enforce or configure BitLocker settings or escrow keys; it only reports non-compliance. Option B is wrong because Device Restrictions profile controls device-level settings like password policies and browser restrictions, not disk encryption or key escrow. Option D is wrong because Device Configuration profile is a general container for settings like email, Wi-Fi, and certificates, but BitLocker-specific policies are managed under the dedicated Endpoint Protection profile.

Full explanation →

848

MCQhard

Adventure Works uses Microsoft Intune for device management. You need to deploy a custom PowerShell script to all Windows 10 devices to configure a registry key for security compliance. The script is already uploaded to Intune as a PowerShell script. However, the script is not running on some devices. You have confirmed that the devices are enrolled, have the Intune Management Extension installed, and are online. What should you check first?

A.Check that the user has administrative privileges on the device.

B.Confirm that the device is running a 64-bit version of Windows.

C.Ensure the script is assigned to the device group.

D.Verify that the PowerShell execution policy on the devices allows script execution (e.g., RemoteSigned or Bypass).

AnswerD

Execution policy can block scripts.

Why this answer

The script execution policy may block scripts. The Intune Management Extension runs scripts under the system account, which respects the local execution policy. Checking the execution policy is the first step.

The script assignment should be verified if it wasn't assigned, but the question states it is uploaded; assignment is a separate step. The user's role does not affect script execution. The device's OS architecture is unlikely the issue.

Full explanation →

849

MCQeasy

You are configuring Windows Autopilot for new devices. The devices need to be automatically enrolled in Intune and assigned to a specific group based on their serial number. What is the required step before the devices can be recognized by Autopilot?

A.Configure Intune enrollment for all users using device enrollment managers.

B.Register the devices using their hardware hash in the Microsoft Intune admin center.

C.Join the devices to Microsoft Entra ID manually before shipping.

D.Upload a CSV file with device serial numbers to Microsoft Entra ID.

AnswerB

Hardware hash registration is the standard method.

Why this answer

Before Windows Autopilot can recognize and automatically enroll devices, they must be registered as Autopilot devices. This is done by uploading their hardware hash (a unique identifier derived from the device's TPM and other hardware) into the Microsoft Intune admin center. Once registered, the device is associated with an Autopilot profile and can be automatically enrolled in Intune and assigned to a group based on its serial number during the out-of-box experience.

Exam trap

The trap here is that candidates often confuse device registration (uploading the hardware hash) with device enrollment (assigning users or policies), or mistakenly think that simply listing serial numbers in a CSV is sufficient for Autopilot recognition.

How to eliminate wrong answers

Option A is wrong because configuring Intune enrollment for all users using device enrollment managers does not register the device with Autopilot; it only allows a delegated user to enroll devices manually, bypassing the Autopilot registration requirement. Option C is wrong because manually joining devices to Microsoft Entra ID before shipping defeats the purpose of Autopilot's zero-touch provisioning; Autopilot handles the join automatically during OOBE. Option D is wrong because uploading a CSV file with device serial numbers to Microsoft Entra ID is not a supported method for Autopilot registration; Autopilot requires the hardware hash (or other identifiers like PKID or TPM hash) to be uploaded via Intune or a CSP, not just serial numbers.

Full explanation →

850

Multi-Selecteasy

Which TWO of the following are valid enrollment methods for Windows 10 devices in Microsoft Intune?

Select 2 answers

A.Windows Autopilot

B.Azure AD Join

C.Device enrollment manager (DEM)

D.Bulk enrollment with provisioning package

E.Apple Business Manager

AnswersA, B

Windows Autopilot is a zero-touch enrollment method for Windows 10 devices.

Why this answer

Windows Autopilot (Option A) is a valid enrollment method that enables zero-touch deployment and automatic enrollment of Windows 10 devices into Intune. Azure AD Join (Option B) is also a valid method, where devices are joined directly to Azure AD and automatically enrolled in Intune for management. Option C is incorrect: Device Enrollment Manager (DEM) is an administrative role used for bulk enrollment, not an enrollment method itself.

Option D is incorrect: Bulk enrollment using a provisioning package is a method for enrolling many devices at once, but it is not listed as a distinct enrollment method like Autopilot or Azure AD Join in this context. Option E is incorrect because Apple Business Manager is designed for enrolling Apple devices (iOS, iPadOS, macOS), not Windows 10 devices.

Full explanation →

851

MCQeasy

You are troubleshooting an Autopilot deployment where devices are not receiving the expected configuration policies after enrollment. The devices show as enrolled in Intune but are stuck in a 'pending' state for policy application. What is the most likely cause?

A.The device is not registered in Autopilot.

B.The user does not have an assigned Intune license.

C.The device has a slow internet connection.

D.The Autopilot profile is set to 'offline' mode.

AnswerB

Without license, policies are not applied.

Why this answer

When a device is enrolled in Intune but stuck in a 'pending' state for policy application, the most common cause is that the user account lacks an assigned Intune license. Without a license, the user cannot synchronize policies from the Intune service, even though the device itself appears in the console. This is a prerequisite for policy delivery and is often overlooked during troubleshooting.

Exam trap

The trap here is that candidates often assume a device showing as 'enrolled' means all prerequisites are met, overlooking that user license assignment is a separate requirement for policy delivery in user-driven Autopilot scenarios.

How to eliminate wrong answers

Option A is wrong because if the device were not registered in Autopilot, it would not appear as enrolled in Intune at all; the 'pending' state specifically indicates enrollment succeeded but policy application is blocked. Option C is wrong because a slow internet connection would cause timeouts or partial downloads, not a persistent 'pending' state; the device would eventually either apply policies or fail with a connectivity error. Option D is wrong because an 'offline' Autopilot profile is not a valid setting; Autopilot profiles are either 'user-driven' or 'self-deploying' modes, and 'offline' refers to offline enrollment (using a provisioning package), which still applies policies normally once the device connects to Intune.

Full explanation →

852

MCQmedium

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing the company's SaaS applications. However, they need to exclude a group of service accounts that use legacy authentication protocols. What is the recommended approach?

A.Enable Security defaults and add the service accounts group to the excluded users list.

B.Assign the 'Require MFA' baseline policy and exclude the service accounts group.

C.Create a Conditional Access policy targeting all cloud apps, requiring MFA, and excluding the service accounts group.

D.Enable per-user MFA and exclude the service accounts group.

AnswerC

Conditional Access allows scoping to all cloud apps and excluding specific groups.

Why this answer

Conditional Access is the recommended method for granular MFA enforcement in Microsoft Entra ID P1. It allows you to target all cloud apps (including SaaS applications) with a 'Require MFA' grant control and exclude a specific group of service accounts. This approach supports legacy authentication protocols by excluding those accounts, while Security defaults or per-user MFA would either block legacy auth or lack the necessary exclusion granularity.

Exam trap

The trap here is that candidates often confuse Security defaults or per-user MFA as viable alternatives, not realizing that only Conditional Access provides the group-based exclusion and granular control required for service accounts using legacy authentication protocols.

How to eliminate wrong answers

Option A is wrong because Security defaults enforce MFA for all users and block legacy authentication protocols entirely; they do not allow excluding a group of service accounts from the MFA requirement, and the 'excluded users' list in Security defaults is not available. Option B is wrong because the 'Require MFA' baseline policy is deprecated and no longer available in Microsoft Entra ID; it also lacks the flexibility to exclude specific groups. Option D is wrong because per-user MFA is a legacy configuration that does not support group-based exclusions and forces MFA on a per-user basis, which is less manageable and does not integrate with Conditional Access policies for SaaS app targeting.

Full explanation →

853

MCQmedium

You need to configure device compliance for devices that are not running Windows. The devices include iOS, iPadOS, Android, and macOS. Which compliance settings are common across all platforms?

A.Require device password and not allow simple passwords.

B.Require minimum OS version.

C.Device must not be jailbroken/rooted.

D.Require BitLocker encryption.

AnswerB

All platforms support a minimum OS version compliance rule.

Why this answer

Requiring a minimum OS version is a compliance setting supported on all major platforms including iOS, iPadOS, Android, and macOS. Option B is correct. Option A is incorrect because while requiring a device password is common, the setting 'not allow simple passwords' is not universally available across all platforms (e.g., Android and iOS have password complexity but not a simple password toggle).

Option C is incorrect because jailbreak/root detection is not available on all platforms; for example, Android and iOS support it but macOS does not have a native 'rooted' detection. Option D is incorrect because BitLocker is a Windows-specific encryption technology and is not available on iOS, iPadOS, Android, or macOS.

Full explanation →

854

MCQeasy

Your organization wants to use Microsoft Intune to manage Windows devices that are joined to an on-premises Active Directory domain. The devices will be hybrid Azure AD joined. Which tool should you use to configure automatic enrollment into Intune?

A.Group Policy

B.Windows Autopilot

C.System Center Updates Publisher (SCUP)

D.Configuration Manager Cloud Management Gateway (CMG)

AnswerA

Group Policy can configure the 'Enable automatic MDM enrollment using default Azure AD credentials' setting.

Why this answer

For hybrid Azure AD joined devices, automatic enrollment into Intune is configured via Group Policy. Specifically, you deploy the 'Enable automatic MDM enrollment using default Azure AD credentials' policy setting, which triggers the MDM enrollment process using the user's Azure AD credentials during sign-in. This is the only supported method for bulk, automatic enrollment of hybrid Azure AD joined Windows devices without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse Windows Autopilot with automatic enrollment, but Autopilot is a provisioning tool for new devices, not a configuration mechanism for existing hybrid domain-joined devices.

How to eliminate wrong answers

Option B (Windows Autopilot) is wrong because Autopilot is designed for new, out-of-box device provisioning and does not handle automatic enrollment of existing domain-joined devices; it requires a fresh OS deployment or reset. Option C (System Center Updates Publisher, SCUP) is wrong because SCUP is a tool for managing third-party software updates via Configuration Manager, not for configuring MDM enrollment. Option D (Configuration Manager Cloud Management Gateway, CMG) is wrong because CMG provides internet-based management for Configuration Manager clients, but it does not configure automatic Intune enrollment; enrollment is handled separately via Group Policy or co-management settings.

Full explanation →

855

Multi-Selecthard

A company uses Intune to manage Android Enterprise devices. The administrator wants to deploy a set of required apps silently to fully managed devices. Which THREE steps are necessary?

Select 3 answers

A.Configure a user enrollment profile

B.Create a managed Google Play account

C.Assign the apps as 'Required' in Intune

D.Enable 'App Auto Update' in managed Google Play

E.Create an app protection policy for the apps

AnswersB, C, D

Required to manage Android Enterprise apps.

Why this answer

A managed Google Play account is required to bind the Intune tenant to Google's Android Enterprise ecosystem. Without this binding, Intune cannot deploy or manage apps on fully managed Android Enterprise devices. This account enables the administrator to approve, license, and silently push apps from the managed Google Play store to devices.

Exam trap

The trap here is that candidates often confuse app protection policies (MAM) with app deployment, thinking they are required for silent installs, when in fact MAM is irrelevant for fully managed devices and the key steps are the managed Google Play account, required assignment, and auto-update configuration.

Full explanation →

856

MCQmedium

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

A.Create an app protection policy that restricts data transfer between work and personal apps.

B.Create a device configuration policy that disables clipboard sharing.

C.Create a device compliance policy that requires a work profile.

D.Create a conditional access policy that blocks personal apps.

AnswerA

MAM policies can prevent copy/paste across profiles.

Why this answer

App protection policies (MAM) can restrict data transfer between work and personal apps, preventing copy/paste of corporate data. Option B is incorrect because device configuration policies do not control data transfer between apps; they configure device settings. Option C is incorrect because device compliance policies enforce device health and security requirements, not app-level data protection.

Option D is incorrect because conditional access policies control access to resources based on conditions, not app data transfer.

Full explanation →

857

MCQeasy

An administrator needs to ensure that only devices with a specific manufacturer are allowed to enroll in Intune. Which setting should the administrator configure?

A.Enrollment restrictions

B.Conditional Access policy

C.Device category

D.Device compliance policy

AnswerA

Enrollment restrictions can block devices by platform, manufacturer, etc.

Why this answer

Nrollment restrictions. Enrollment restrictions allow administrators to block devices based on manufacturer, OS version, or device platform. Conditional Access policies work after enrollment.

Device categories are for organizational grouping, not blocking enrollment. Device compliance policies evaluate device health after enrollment.

Full explanation →

858

MCQmedium

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

A.Modify the existing Windows Update for Business policy to set the deferral period to 0 days.

B.Create a compliance policy that requires the update to be installed and assign it to all devices.

C.Use Configuration Manager to push the update via on-premises WSUS.

D.Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.

AnswerD

An update policy with immediate deadline forces the update installation.

Why this answer

Deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Exam trap

The trap here is that candidates often confuse compliance policies with update enforcement, thinking that marking a device non-compliant will force an update, when in reality compliance policies only report status and require a separate update policy with a deadline to trigger installation.

How to eliminate wrong answers

Option A is wrong because modifying the existing Windows Update for Business policy to set the deferral period to 0 days only removes the delay for future updates but does not force an immediate installation of an already-pending update; the update may still wait for other conditions like active hours or scan intervals. Option B is wrong because compliance policies in Intune are used to assess device configuration and trigger remediation actions (e.g., marking a device non-compliant), but they do not directly install updates; they rely on separate update policies to enforce installation. Option C is wrong because using Configuration Manager with WSUS is a valid on-premises solution, but the question specifies a fleet managed with Microsoft Intune, and the goal is to expedite installation using Intune policies, not to introduce a hybrid management overhead that may not be available or configured.

Full explanation →

859

MCQhard

A company uses Microsoft Defender for Endpoint. They want to automatically remediate threats on endpoints using automated investigation and response. They also need to ensure that the remediation actions are approved by the security team before execution. Which configuration should they use?

A.Disable automated investigation and use manual response only.

B.Enable automated investigation and allow all actions automatically.

C.Enable automated investigation and set remediation level to 'Full - remediate threats automatically'.

D.Enable automated investigation and set 'Approval mode' for remediation actions.

AnswerD

Approval mode requires security team approval before executing remediation.

Why this answer

Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities include an 'Approval mode' setting that requires security team approval before any remediation action (e.g., isolating a device, removing a file) is executed. This satisfies the requirement for automatic threat detection and investigation while maintaining human oversight over remediation actions.

Exam trap

The trap here is that candidates confuse 'Full - remediate threats automatically' (which implies automatic execution) with the ability to require approval, not realizing that 'Approval mode' is a separate toggle that overrides automatic execution even when the remediation level is set to 'Full.'

How to eliminate wrong answers

Option A is wrong because disabling automated investigation prevents the system from automatically detecting and investigating threats, which contradicts the requirement to 'automatically remediate threats.' Option B is wrong because allowing all actions automatically removes the security team's approval step, violating the requirement that remediation actions be approved before execution. Option C is wrong because setting the remediation level to 'Full - remediate threats automatically' also bypasses the approval requirement, as it automatically executes all remediation actions without waiting for human approval.

Full explanation →

860

MCQhard

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

A.The user does not have local administrator privileges on the device

B.The device has insufficient disk space

C.The device does not have internet connectivity to the Microsoft CDN

D.The device is not compliant with the conditional access policy

AnswerA

0x80070005 is access denied; installation requires admin rights.

Why this answer

Error code 0x80070005 translates to 'Access Denied' (E_ACCESSDENIED). Microsoft 365 Apps for enterprise installation requires local administrator privileges to write to protected system paths (e.g., Program Files, registry). Since the device is Azure AD joined and compliant, the most likely cause is that the user lacks local admin rights, which is a common Intune deployment prerequisite.

Exam trap

The trap here is that candidates confuse a compliance-related conditional access block (which would occur at sign-in) with a local installation permission error, overlooking that 0x80070005 specifically indicates an access-denied condition at the OS level, not a network or policy issue.

How to eliminate wrong answers

Option B is wrong because insufficient disk space typically produces error 0x80070070 (ERROR_DISK_FULL), not 0x80070005. Option C is wrong because lack of internet connectivity to the Microsoft CDN would result in download-related errors (e.g., 0x80072EFD or timeout), not an access-denied code. Option D is wrong because the device is explicitly stated as compliant, and conditional access policies affect access to cloud resources, not local installation permissions; non-compliance would block the app at the authentication layer, not produce a local access-denied error.

Full explanation →

861

MCQhard

A company uses Microsoft Intune for mobile device management. They have a group of Android Enterprise devices that need to be enrolled in a way that allows the device to have a work profile while keeping personal apps separate. Which enrollment method should be used?

A.Android Enterprise corporate-owned fully managed devices

B.Android Enterprise personally-owned devices with a work profile

C.Android Enterprise corporate-owned dedicated devices

D.Android Enterprise corporate-owned work profile

AnswerB

This allows a work profile on a personally-owned device, keeping personal apps separate.

Why this answer

Android Enterprise personally-owned devices with a work profile (BYOD) is designed specifically to create a separate, managed work profile on the device while leaving personal apps and data untouched. This enrollment method uses the Android Device Policy app to establish a containerized work profile, ensuring that corporate policies apply only to the work side, and the user retains full control over the personal side. It is the standard approach for BYOD scenarios where the device is owned by the user but needs to access corporate resources securely.

Exam trap

The trap here is that candidates often confuse 'corporate-owned work profile' (Option D) with 'personally-owned work profile' (Option B), mistakenly assuming both provide the same separation, but the key differentiator is device ownership—corporate-owned work profile still implies the device is company property, while the question explicitly states the devices are personally owned.

How to eliminate wrong answers

Option A is wrong because Android Enterprise corporate-owned fully managed devices enroll the entire device as corporate-owned, with no separation between work and personal data; this is intended for company-owned devices where full control is required, not for keeping personal apps separate. Option C is wrong because Android Enterprise corporate-owned dedicated devices are designed for single-purpose kiosk or line-of-business scenarios, where the device is locked to a specific set of apps and does not support a work profile or personal apps at all. Option D is wrong because Android Enterprise corporate-owned work profile is used for company-owned devices that need a work profile, but it still treats the device as corporate-owned and does not apply to personally-owned devices; the question specifies 'personally-owned devices,' making this option incorrect.

Full explanation →

862

MCQhard

Refer to the exhibit. You apply this device configuration profile to a Windows 10 device. A user downloads a file that is classified as potentially unwanted application (PUA). What action will Defender take?

A.Audit the detection and allow the download.

B.Send the file to the cloud for analysis.

C.Automatically clean the file.

D.Block the file from being downloaded.

AnswerD

PUA protection enabled blocks the file.

Why this answer

The device configuration profile shown in the exhibit sets the 'PUAProtection' policy to 'Enabled' with the 'Block' option selected. When a user attempts to download a file classified as a potentially unwanted application (PUA), Microsoft Defender for Endpoint enforces this policy by blocking the download entirely, preventing the file from being written to disk. Option D is correct because the explicit 'Block' setting overrides any other behavior, ensuring the PUA is not allowed to execute or persist on the device.

Exam trap

The trap here is that candidates confuse the 'Block' action of PUA protection with the 'Allow' or 'Audit' options, or mistakenly think that cloud analysis or automatic remediation occurs at the point of download, when in fact the block is enforced immediately by the local policy setting.

How to eliminate wrong answers

Option A is wrong because 'Audit' mode would log the detection but allow the download, which contradicts the 'Block' setting specified in the profile. Option B is wrong because sending a file to the cloud for analysis is a behavior of cloud-delivered protection or automatic sample submission, not a direct action of the PUA protection policy when set to 'Block'. Option C is wrong because automatic cleaning (e.g., removing or quarantining) occurs after detection during a scan or real-time protection event, but the PUA protection policy at download time blocks the file before it can be saved or cleaned.

Full explanation →

863

MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that all devices have Windows Defender Antivirus enabled and up to date. You create a security baseline that includes antivirus settings and assign it to all devices. After a week, you find that some devices still have outdated antivirus definitions. What should you check first?

A.Verify that the security baseline is assigned to the devices.

B.Check the device compliance status.

C.Ensure that Windows Update for Business is configured to update definitions.

D.Review the device's network firewall settings.

AnswerC

Definitions are updated via Windows Update.

Why this answer

The security baseline assigns configuration settings, but it does not automatically trigger definition updates. Windows Defender Antivirus definitions are updated via Windows Update, so Windows Update for Business must be configured to deliver those updates. Without this, devices may have the correct baseline policies but still run outdated definitions.

Exam trap

The trap here is that candidates assume a security baseline automatically handles all aspects of antivirus management, including definition updates, when in reality the baseline only configures settings and relies on a separate update channel (Windows Update) to deliver the definitions.

How to eliminate wrong answers

Option A is wrong because the security baseline is already assigned to all devices; the issue is not assignment but the mechanism for updating definitions. Option B is wrong because compliance status reflects whether devices meet the baseline policies, not whether definitions are current; a device can be compliant with outdated definitions if the baseline doesn't enforce update frequency. Option D is wrong because network firewall settings control traffic flow, not the update process for antivirus definitions; firewalls do not block or allow Windows Update definition downloads unless specifically configured to do so.

Full explanation →

864

Multi-Selectmedium

Which THREE of the following are features of Microsoft Defender for Endpoint that help protect devices?

Select 3 answers

A.Attack surface reduction rules

B.Endpoint detection and response

C.Next-generation protection

D.Data loss prevention

E.Conditional access policies

AnswersA, B, C

These rules reduce the attack surface.

Why this answer

Attack surface reduction rules (A) are a feature of Microsoft Defender for Endpoint that help protect devices by applying configurable rules to block behaviors commonly used by malware, such as Office macro execution, script obfuscation, and credential theft. These rules reduce the attack surface by preventing malicious actions at the process level, leveraging Windows Defender Antivirus and the Microsoft Defender for Endpoint cloud service.

Exam trap

The trap here is that candidates often confuse Data loss prevention (a compliance feature) with device protection features in Defender for Endpoint, or mistakenly think Conditional Access policies are part of Defender for Endpoint when they are actually an identity and access management feature in Microsoft Entra ID.

Full explanation →

865

MCQeasy

You need to deploy a custom Windows 10 image to 100 new devices using Microsoft Intune. The devices are not yet enrolled. Which method should you use to deploy the image and enroll the devices?

A.Use PXE boot to deploy the image and then enroll via a provisioning package.

B.Create a bootable USB with the image and manually enroll each device.

C.Use Microsoft Configuration Manager to deploy the image and enroll via co-management.

D.Use Windows Autopilot to deploy a custom image and automatically enroll the devices.

AnswerD

Autopilot supports custom images (with Windows 11 21H2+) and auto-enrollment.

Why this answer

Windows Autopilot is the correct method because it can deploy a custom Windows 10 image and automatically enroll devices into Intune, providing a zero-touch deployment experience. Option A is incorrect because PXE boot is not natively supported by Intune and a provisioning package alone cannot deploy an image. Option B is incorrect because creating a bootable USB and manually enrolling each device is not scalable for 100 devices and does not leverage Intune's automated enrollment.

Option C is incorrect because while Configuration Manager can deploy images, co-management is an additional configuration and not the simplest approach for this scenario; Windows Autopilot is the recommended method for modern deployment with Intune.

Full explanation →

866

Multi-Selecthard

You deploy a Windows Update for Business policy in Intune. You need to ensure that devices install quality updates within 2 days of release and feature updates within 30 days. Which THREE settings should you configure?

Select 3 answers

A.Quality update deferral period (days): 2

B.Feature update uninstall period (2-60 days): 30

C.Quality update pause start date

D.Feature update deferral period (days): 30

E.Quality update deadline (days): 2

AnswersA, D, E

Defers quality updates by 2 days, meaning they are offered 2 days after release.

Why this answer

The Quality update deferral period (days) setting controls how many days after Microsoft releases a quality update that devices will install it. Setting this to 2 ensures that quality updates are installed within 2 days of release, meeting the requirement.

Exam trap

The trap here is confusing the deferral period (which delays updates) with the deadline period (which forces installation), leading candidates to select only deferral settings and miss the critical deadline setting.

Full explanation →

867

MCQeasy

You need to wipe a lost corporate-owned Windows 10 device that is enrolled in Intune. Which action should you take?

A.Delete the device from Intune.

B.Select the device and choose Wipe.

C.Select the device and choose Retire.

D.Reset the device using the Company Portal.

AnswerB

Correct. Wipe resets the device to factory settings.

Why this answer

The Wipe action in Intune restores a Windows 10 device to its factory default settings, removing all data and corporate access. This is the appropriate action for a lost corporate-owned device because it ensures sensitive data is erased while retaining the device's enrollment record for potential recovery or re-provisioning.

Exam trap

The trap here is confusing the Retire action (which only removes management and corporate data) with the Wipe action (which performs a full factory reset), leading candidates to choose Retire when a complete data erasure is required.

How to eliminate wrong answers

Option A is wrong because deleting the device from Intune only removes the device object from the console; it does not send a wipe command to the device, so data remains intact. Option C is wrong because Retire removes managed apps and policies but preserves personal data and does not perform a full factory reset, leaving corporate data potentially accessible. Option D is wrong because the Company Portal reset is a user-initiated action that requires the device to be physically accessible and logged in, which is not possible for a lost device.

Full explanation →

868

MCQmedium

Your organization uses Windows Autopilot for user-driven deployments. You need to ensure that during the out-of-box experience (OOBE), users are prompted to set up Windows Hello for Business. Which setting should you configure in the Autopilot profile?

A.Skip privacy settings

B.Windows Hello for Business

C.Device name template

D.Language (Region)

AnswerB

This setting enables Hello enrollment during OOBE.

Why this answer

The 'Windows Hello for Business' setting in the Autopilot profile directly controls whether users are prompted to configure biometric or PIN-based authentication during the out-of-box experience (OOBE). When enabled, this setting triggers the Windows Hello for Business enrollment flow immediately after user authentication, ensuring the device is provisioned with strong credential protection before the user reaches the desktop.

Exam trap

The trap here is that candidates often confuse 'Windows Hello for Business' with 'Skip privacy settings' or 'Language (Region)' because they assume any OOBE customization setting might affect the Hello prompt, but only the dedicated Windows Hello toggle controls this specific behavior.

How to eliminate wrong answers

Option A is wrong because 'Skip privacy settings' controls whether the privacy settings screens (e.g., location, Find My Device) are displayed during OOBE; it has no impact on Windows Hello for Business prompts. Option C is wrong because 'Device name template' defines the naming convention for the device (e.g., using serial number or random characters) and does not influence authentication method configuration. Option D is wrong because 'Language (Region)' sets the default language and regional format for the device during OOBE, which is unrelated to biometric or PIN enrollment.

Full explanation →

869

MCQmedium

Your organization uses Intune to manage Windows 10 devices. You have deployed a Win32 app named 'FinanceApp' with a detection rule that checks for the existence of a registry key. After deployment, you find that the app is not being detected on some devices, causing Intune to attempt reinstallation. You suspect the detection rule is incorrect. You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule. What should you do to apply the updated detection rule to existing devices?

A.Increment the app version in the app properties

B.Remove and re-add the assignment

C.Delete the app and recreate it with the new detection rule

D.Uninstall the app from all devices and redeploy

AnswerA

Forces Intune to re-evaluate detection.

Why this answer

After modifying the detection rule, you must increment the app version number in the app properties. This forces the Intune management extension on existing devices to re-evaluate the detection rule and apply the updated logic. Options B, C, and D are unnecessary and overly disruptive.

Full explanation →

870

Multi-Selectmedium

Which TWO of the following are valid app types in Microsoft Intune for deploying applications to Windows 10/11 devices?

Select 2 answers

A.Windows app (Win32)

B.Web link

C.Microsoft Store app (new)

D.macOS app

E.Android store app

AnswersA, C

Win32 app type is for deploying traditional Windows applications.

Why this answer

Win32 apps are a primary app type in Microsoft Intune for deploying traditional desktop applications (e.g., .exe, .msi) to Windows 10/11 devices. Intune uses the Intune Management Extension to install and manage Win32 apps, supporting detection rules, dependencies, and supersedence.

Exam trap

The trap here is that candidates may confuse 'web link' as an app type because it appears in the Intune 'Add app' menu, but it is actually a configuration item (a shortcut) and not a deployable application.

Full explanation →

871

MCQeasy

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

A.A device configuration profile using the 'Kiosk' settings for single-app mode

B.A device restrictions profile blocking access to other apps

C.A compliance policy requiring the app to be installed

D.A configuration profile for Microsoft Edge in kiosk mode

AnswerA

Designed for single-app kiosk scenarios.

Why this answer

A is correct because Intune's device configuration profile includes a 'Kiosk' settings category specifically designed for Windows 10/11 devices. When you select 'Single-app mode' under kiosk settings, you can specify a single Store app (e.g., a UWP or Win32 app) that will run in full-screen, locked-down mode, preventing users from accessing any other system functions or apps.

Exam trap

The trap here is that candidates confuse 'device restrictions' (which can block apps) with the dedicated 'Kiosk' settings profile, which is the only Intune policy type that enforces the full-screen, single-app, locked-down experience required for a kiosk device.

How to eliminate wrong answers

Option B is wrong because a device restrictions profile can block access to other apps, but it does not enforce the full-screen, single-app kiosk experience; it lacks the dedicated kiosk lock-down features (e.g., auto-launch, no exit gesture). Option C is wrong because a compliance policy only checks whether an app is installed and reports non-compliance; it cannot configure the device to run that app in kiosk mode. Option D is wrong because a configuration profile for Microsoft Edge in kiosk mode is a specific subset of kiosk settings that only applies to Edge, not to any single-store app; it cannot be used to run a non-Edge app in full-screen kiosk mode.

Full explanation →

872

Matchingmedium

Match each Microsoft 365 Defender feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Endpoint detection and response (EDR) and antivirus

Protection for email and collaboration tools

Detect and investigate advanced attacks on-premises

Cloud access security broker (CASB) for SaaS apps

Identify and remediate vulnerabilities

Why these pairings

The correct matches are: Microsoft Defender for Endpoint (endpoint protection), Microsoft Defender for Office 365 (email/collaboration protection), Microsoft Defender for Identity (on-premises threat detection via AD), and Microsoft Defender for Cloud Apps (SaaS security via CASB). The distractors swap the definitions of Endpoint and Office 365.

Full explanation →

873

MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

A.Create a compliance policy for Windows 10 update compliance.

B.Create an update ring for Windows 10 with a deadline of 7 days.

C.Create a device configuration profile for Windows 10 updates.

D.Configure a Windows Update for Business policy in Group Policy.

AnswerB

Update rings enforce update installation deadlines.

Why this answer

Update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Exam trap

The trap here is that candidates often confuse compliance policies (which only report on update status) with update rings (which enforce installation deadlines), leading them to choose Option A instead of B.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device configuration and health (e.g., required updates installed) but do not enforce an installation deadline; they only report non-compliance. Option C is wrong because device configuration profiles manage settings like security policies or certificates, not update deadlines or rings. Option D is wrong because Group Policy is a traditional on-premises management tool that does not integrate with Intune for cloud-managed devices; the question specifies Microsoft Intune management, so a cloud-native solution (update ring) is required.

Full explanation →

874

MCQmedium

A user has an Android Enterprise fully managed device. The device is enrolled in Microsoft Intune and all policies are applied. However, the user cannot install a required app from the managed Play Store. The app appears in the company portal but fails to install. What should you check first?

A.Ensure that the device has a policy to allow installation of unapproved apps.

B.Check if the device's enrollment token is still valid.

C.Check if the app is available in the unmanaged Play Store.

D.Verify that the app has been approved in the managed Google Play store.

AnswerD

Apps must be approved before deployment.

Why this answer

The correct first step is to verify that the app has been approved in the managed Google Play store. For Android Enterprise fully managed devices, apps from the managed Play Store must be approved by the IT admin before they can be installed. Even if the app appears in Company Portal, if it is not approved, installation will fail.

Therefore, checking approval status is the most likely cause.

Full explanation →

875

Multi-Selectmedium

You need to ensure that corporate data on lost or stolen iOS devices is protected. Which TWO actions should you configure in Intune?

Select 2 answers

A.Enable device inventory reporting.

B.Configure a device passcode policy.

C.Perform a selective wipe to remove corporate data only.

D.Retire the device from Intune.

E.Enable remote wipe on the device.

AnswersB, E

A passcode prevents unauthorized access.

Why this answer

(Configure a device passcode policy) is correct because requiring a passcode protects data on lost or stolen devices by preventing unauthorized access. Option E (Enable remote wipe on the device) is correct because remote wipe can erase all data on a lost or stolen iOS device, ensuring corporate data is not compromised. Option A is incorrect because device inventory reporting is a management feature, not a protective action.

Option C is incorrect because selective wipe (retire) removes corporate data but does not protect the device itself. Option D is incorrect because retiring the device removes management but does not immediately protect data.

Full explanation →

876

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to deploy a custom Windows 10 line-of-business app that is not signed. Which action must you take on the target devices to allow installation?

A.Enable sideloading on the devices.

B.Enable Developer Mode on the devices.

C.Add the app publisher to the trusted publisher store.

D.Turn off Windows Defender SmartScreen.

AnswerA

Sideloading must be enabled to install unsigned LOB apps.

Why this answer

To install an unsigned line-of-business (LOB) app on Windows 10 via Intune, sideloading must be enabled on the target devices. Sideloading allows the installation of apps that are not signed by the Microsoft Store, which is required for custom LOB apps that lack a valid signature. This setting can be configured via a device configuration profile in Intune using the 'Allow sideloading of apps' policy.

Exam trap

The trap here is that candidates often confuse Developer Mode with sideloading, assuming that enabling Developer Mode is necessary for unsigned app installation, but Microsoft specifically separates these two settings for security and management clarity.

How to eliminate wrong answers

Option B is wrong because Developer Mode enables advanced debugging and development features, but it is not specifically required for installing unsigned LOB apps; sideloading is the correct setting. Option C is wrong because adding the app publisher to the trusted publisher store is only relevant for signed apps or certificates, not for unsigned apps that bypass signature verification entirely. Option D is wrong because turning off Windows Defender SmartScreen reduces security protections against malicious downloads but does not affect the installation of unsigned LOB apps, which is controlled by sideloading policies.

Full explanation →

877

Multi-Selecthard

You are configuring app protection policies (MAM) in Microsoft Intune for iOS devices. Which THREE settings can you configure to prevent data leakage?

Select 3 answers

A.Require device PIN.

B.Restrict web content transfer to managed browsers.

C.Restrict cut, copy, and paste between apps.

D.Prevent 'Save as' to local storage.

E.Block screenshots of corporate data.

AnswersB, C, D

Ensures web links open in managed browsers.

Why this answer

Restricting web content transfer to managed browsers ensures that corporate data opened via web links can only be viewed in browsers that support Intune MAM policies (e.g., Microsoft Edge). This prevents data from being opened in unmanaged browsers where app protection policies cannot enforce data leakage controls, such as preventing copy/paste or requiring encryption.

Exam trap

The trap here is that candidates often confuse device-level restrictions (like blocking screenshots or requiring a device PIN) with MAM app protection policy settings, but MAM policies only control app-level behaviors and cannot enforce hardware-level or OS-level restrictions like screenshots or device PINs.

Full explanation →

878

MCQmedium

You are reviewing the Intune Win32 app configuration for Microsoft Edge. The app is deployed to Windows 10 devices. Users report that Edge is not being installed on some devices. What is the most likely issue with the detection rule?

A.The uninstall command is incorrect.

B.The detection rule requires an exact version match, which may not match if a different version is installed.

C.The install command is missing the --silent flag.

D.The detection rule is checking the 32-bit registry on a 64-bit system.

AnswerB

Exact version detection can cause false negatives if versions differ.

Why this answer

The most likely issue is that the detection rule is configured to require an exact version match. If a device already has a different version of Microsoft Edge installed (e.g., a newer or older build), Intune will evaluate the detection rule as 'not detected' and attempt to reinstall the app, which may fail or be skipped because the installer detects an existing version. This is a common misconfiguration in Win32 app deployments where version-specific detection rules cause false negatives.

Exam trap

The trap here is that candidates often confuse detection rule failures with installation command issues, but the question's phrasing 'not being installed on some devices' points to a version mismatch scenario where the detection rule is too strict, not a universal install failure.

How to eliminate wrong answers

Option A is wrong because an incorrect uninstall command would affect removal, not installation; the issue is that Edge is not being installed, so the uninstall command is irrelevant to the detection failure. Option C is wrong because the --silent flag (or equivalent quiet switch) is required for silent installation, but if it were missing, the installation would likely fail on all devices, not just some, and the question specifically states users report Edge is not being installed on some devices, pointing to a detection rule issue rather than a universal install command problem. Option D is wrong because the detection rule checking the 32-bit registry on a 64-bit system would cause consistent failure on all 64-bit devices, not just some, and Intune Win32 apps can be configured to check both 32-bit and 64-bit registry paths; the issue is more likely version mismatch than registry architecture.

Full explanation →

879

MCQeasy

Your company has 500 Windows 10 devices that are Hybrid Azure AD joined and managed by Microsoft Intune. You need to deploy a new line-of-business (LOB) app to all devices. The app is packaged as a .msi file. You create a new app in Intune and assign it to a device group containing all devices. After 24 hours, some devices report the app as 'Installed' but others show 'Failed'. You verify that the devices are online and have network connectivity. What should you do next to resolve the installation failures?

A.Use a PowerShell script to install the app on failed devices.

B.Check the Intune management extension logs on a failed device.

C.Create a new device group and assign the app again.

D.Re-assign the app to the device group.

AnswerB

Logs will show the specific error code or dependency issue.

Why this answer

The most common cause of .msi installation failures is missing prerequisites or dependencies. Checking the Intune management extension logs on the device will reveal the specific error. Option A is wrong because the app is already assigned; re-assigning won't fix underlying issues.

Option C is wrong because the app is already targeted to all devices. Option D is wrong because scripts are not needed; the issue is likely with the app itself.

Full explanation →

880

MCQmedium

You use Microsoft Intune to manage Android Enterprise fully managed devices. You need to ensure that only work apps can access corporate data. Personal apps should not be able to read work data. What should you configure?

A.Configure Conditional Access to block personal apps.

B.Enable Android Enterprise work profile on the devices.

C.Deploy Windows Information Protection (WIP) policy.

D.Configure an Intune App Protection Policy (APP) targeting the work apps.

AnswerD

APP prevents data transfer to unmanaged apps.

Why this answer

Intune App Protection Policies (APP) can be configured to restrict data transfer between managed and unmanaged apps, ensuring that only approved work apps can access corporate data. This policy applies at the app layer, blocking personal apps from reading or copying work data even on fully managed devices, which aligns with the requirement to prevent personal app access to corporate data.

Exam trap

The trap here is that candidates often confuse Android Enterprise work profile (which is for personally enabled devices) with fully managed devices, leading them to choose Option B, but the requirement for data isolation on fully managed devices is achieved via App Protection Policies, not work profile.

How to eliminate wrong answers

Option A is wrong because Conditional Access controls access to resources based on conditions like device compliance or location, but it does not block personal apps from reading work data at the app level; it only gates access to services like Exchange Online. Option B is wrong because enabling an Android Enterprise work profile creates a separate container for work apps on personally enabled devices, but on fully managed devices (where the entire device is corporate-owned and managed), work profile is not used; instead, the device is in corporate-owned fully managed mode, and APP is needed to control data sharing. Option C is wrong because Windows Information Protection (WIP) is a Windows-only feature for protecting data on Windows 10/11 devices, not applicable to Android Enterprise devices.

Full explanation →

881

Multi-Selecthard

Which TWO Windows Update for Business policies can you configure using Microsoft Intune?

Select 2 answers

A.Feature update version targeting

B.Quality update deferral period

C.Driver update deferral period

D.Windows Defender definition update schedule

E.Microsoft 365 Apps update channel

AnswersA, B

Correct. Feature update version targeting is a Windows Update for Business policy in Intune that allows you to specify a feature update version for devices to stay on.

Why this answer

Microsoft Intune allows you to configure a 'Feature update version targeting' policy, which specifies a target feature update version (e.g., Windows 11 23H2) for devices. Option B is correct because you can configure a 'Quality update deferral period' within an update ring policy to delay quality updates. Option C is incorrect because, although a driver update deferral period can be configured in an update ring policy, it is not a separate Windows Update for Business policy type; the question expects the two distinct policy types: Feature update version targeting and Quality update deferral period.

Option D is incorrect because Windows Defender definition update schedule is not a Windows Update for Business policy; it is managed via Microsoft Defender for Endpoint or other settings. Option E is incorrect because Microsoft 365 Apps update channel is not a Windows Update for Business policy; it is configured separately for Office applications.

Exam trap

The trap is that candidates often think only quality and feature update deferrals are configurable in Intune, overlooking that driver update deferral periods are also part of Windows Update for Business policies. This leads them to select only A and B, missing C.

Full explanation →

882

MCQhard

A company uses Microsoft Intune to manage iOS devices. They need to ensure that corporate data on these devices is protected if a device is lost or stolen. The solution must allow users to continue using personal apps and data after a selective wipe. What should they configure?

A.Initiate a selective wipe from the Intune console.

B.Configure a full wipe action in a compliance policy.

C.Use Remote Lock from the Intune console.

D.Create a device compliance policy that marks the device as noncompliant.

AnswerA

Selective wipe removes only managed corporate data and apps, preserving personal data.

Why this answer

A selective wipe from the Intune console removes only corporate data (e.g., managed apps, email profiles, VPN configurations) while preserving personal apps and data on the iOS device. This meets the requirement of protecting corporate data on a lost or stolen device without affecting the user's personal content. Intune uses the iOS Management Profile and the built-in selective wipe capability that targets only the MDM-managed corporate partition.

Exam trap

The trap here is that candidates confuse a selective wipe with a full wipe or assume that noncompliance actions automatically perform a data wipe, but Microsoft explicitly separates these actions, and only a selective wipe preserves personal data while removing corporate data.

How to eliminate wrong answers

Option B is wrong because a full wipe (also called a factory reset) erases all data on the device, including personal apps and data, which violates the requirement to allow users to continue using personal content. Option C is wrong because Remote Lock only locks the device screen and does not remove any corporate data, so it does not protect corporate data if the device is lost or stolen. Option D is wrong because marking a device as noncompliant in a compliance policy does not automatically remove corporate data; it can trigger conditional access blocks but not a wipe action, so it fails to protect data on a lost device.

Full explanation →

883

MCQmedium

You need to deploy a web app to Android Enterprise work profile devices. The app is available in the Managed Google Play store. How should you make it available in Intune?

A.Upload the APK file to Intune

B.Direct users to Google Play to install

C.Add the app from Managed Google Play in Intune

D.Sync device groups with Google Play

AnswerC

Apps are added via Managed Google Play integration.

Why this answer

When a web app is available in the Managed Google Play store, the proper method to make it available in Intune is to add it directly from the Managed Google Play console within the Intune admin center. This synchronizes the app's metadata and licensing with Intune, allowing you to assign it as Required or Available for Android Enterprise work profile devices without needing to upload an APK.

Exam trap

The trap here is that candidates confuse the process for LOB apps (uploading an APK) with the process for public store apps (adding from Managed Google Play), or they assume that syncing device groups is required when in fact Intune syncs app metadata, not device groups.

How to eliminate wrong answers

Option A is wrong because uploading an APK file directly to Intune is used for line-of-business (LOB) apps that are not in the public store, not for apps already available in Managed Google Play. Option B is wrong because directing users to install from Google Play bypasses Intune management, meaning the app won't be tracked, assigned, or removed via Intune, and it won't be deployed to the work profile. Option D is wrong because syncing device groups with Google Play is not a valid action; Intune syncs apps from Managed Google Play, not device groups, and device groups are used for targeting assignments, not for making apps available.

Full explanation →

884

Matchingmedium

Match each Windows Update for Business deployment service to its capability.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Define deferral, pause, and deadline policies

Deploy major Windows version upgrades

Deploy monthly security and cumulative updates

Approve and deploy driver and firmware updates

Force immediate installation of critical updates

Why these pairings

The correct matches are: Update Rings configures deferral periods and deadlines; Feature Update Policies specify which feature update version is offered; Quality Update Policies control which quality updates are offered. Common confusions arise from mixing the roles of these policies.

Full explanation →

885

MCQmedium

Refer to the exhibit. The Intune device compliance policy shown is assigned to a group of Windows 10 devices. A user reports that their device is marked as noncompliant. The device has a password set, BitLocker enabled, Secure Boot on, and code integrity (HVCI) enabled. What is the most likely reason?

A.Secure Boot is not properly configured in UEFI

B.The device uses a biometric sign-in method instead of a password

C.Code integrity (HVCI) is not enabled

D.Device encryption is using a software-based method

AnswerB

"deviceDefault" may require a password; biometrics alone may not satisfy.

Why this answer

The device has a password set, but the compliance policy likely requires a 'password' type credential, not a biometric one. In Intune, the 'Require a password to unlock mobile devices' setting specifically checks for a numeric or alphanumeric password, not biometric methods like Windows Hello face or fingerprint. If the user relies solely on biometric sign-in without a fallback password, the device is marked noncompliant.

Exam trap

The trap here is that candidates assume any sign-in method (including biometrics) satisfies the 'password' requirement, but Intune strictly distinguishes between password/PIN and biometric credentials for compliance evaluation.

How to eliminate wrong answers

Option A is wrong because Secure Boot is reported as enabled, and the policy does not check for UEFI configuration details beyond the enabled state. Option C is wrong because the user states code integrity (HVCI) is enabled, so this cannot be the reason for noncompliance. Option D is wrong because the policy checks for 'Require encryption of data storage on device,' which is satisfied by BitLocker regardless of whether it uses hardware-based or software-based encryption; software-based encryption still meets the compliance requirement.

Full explanation →

886

MCQmedium

You have the above profile assigned to a macOS device. After the profile is applied, the device shows FileVault as 'Encrypted'. However, the recovery key is not escrowed to Intune. What is the most likely reason?

A.FileVault encryption is not enabled on the device.

B.The recovery key type should be 'Institutional recovery key'.

C.The 'Show recovery key' setting is not configured, so the user is not prompted to escrow.

D.Personal recovery key rotation is enabled, causing a conflict.

AnswerC

User must be prompted to escrow.

Why this answer

If the 'Show recovery key' setting is not configured (set to 'Not configured'), the user is not prompted to escrow the recovery key during encryption. FileVault encryption is enabled on the device (option A is incorrect). The recovery key type is personal, not institutional (option B is incorrect).

Personal recovery key rotation does not cause a conflict (option D is incorrect).

Full explanation →

887

MCQeasy

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Microsoft Intune to manage its Windows 10 devices. The company recently experienced a ransomware attack that encrypted local files on several devices. To mitigate future attacks, management wants to ensure that all devices have real-time protection enabled in Microsoft Defender Antivirus and that Controlled Folder Access is turned on. You need to configure these settings via Intune. You decide to create a device configuration profile for Windows 10. What is the most efficient way to deploy these settings to all existing and future devices?

A.Create a device configuration profile and assign it to a device group that includes all devices.

B.Use PowerShell scripts deployed via Intune to enable the settings on each device.

C.Create a device configuration profile and assign it to a user group that includes all users.

D.Create a compliance policy that requires these settings and assign it to all devices.

AnswerA

Assigning to a device group ensures all devices receive the settings regardless of user.

Why this answer

A device configuration profile in Intune can include Microsoft Defender Antivirus settings (such as real-time protection and Controlled Folder Access) and is assigned to a device group. This ensures that both existing and future devices that join the group automatically receive the settings, providing a scalable and efficient deployment method without requiring user interaction or additional scripts.

Exam trap

The trap here is that candidates often confuse compliance policies with configuration profiles, thinking that compliance policies can enforce settings, when in reality they only evaluate and report on settings, requiring a separate configuration profile to actually apply the desired state.

How to eliminate wrong answers

Option B is wrong because PowerShell scripts deployed via Intune are executed on a per-device or per-user basis and require manual assignment or targeting; they do not provide the same declarative, policy-driven enforcement as a device configuration profile, and they cannot be as easily applied to future devices without ongoing script management. Option C is wrong because assigning the profile to a user group applies settings based on user identity, not device identity; if a user logs into a different device, the settings may not apply, and devices without a signed-in user (e.g., kiosks) would be missed. Option D is wrong because a compliance policy is designed to report or mark devices as non-compliant, not to enforce settings; it cannot enable real-time protection or Controlled Folder Access—it only checks if those settings are present and can trigger remediation actions only if configured with a corresponding device configuration profile.

Full explanation →

888

Multi-Selectmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate applications. Which TWO configurations should you implement?

Select 2 answers

A.Deploy an App Protection Policy

B.Create a device compliance policy

C.Configure a device configuration profile

D.Enable multifactor authentication (MFA) for all users

E.Create a Conditional Access policy requiring compliant devices

AnswersB, E

Defines compliance requirements.

Why this answer

A device compliance policy defines the security requirements (e.g., encryption, OS version, jailbreak detection) that a device must meet to be considered compliant. Option E is correct because a Conditional Access policy can enforce that only compliant devices are granted access to corporate applications, using the 'Require device to be marked as compliant' grant control. Together, these two configurations ensure that non-compliant devices are blocked from accessing corporate apps.

Exam trap

The trap here is that candidates often confuse App Protection Policies (which protect data on unmanaged devices) with device compliance policies (which require managed devices to meet security baselines), leading them to select Option A instead of the correct combination of B and E.

Full explanation →

889

MCQhard

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom Windows security baseline that includes specific BitLocker settings. What is the best approach to create and assign this configuration?

A.Use a compliance policy with custom settings to enforce BitLocker.

B.Create a new security baseline from scratch and include the BitLocker settings.

C.Copy the built-in Windows security baseline and customize the BitLocker settings in the copy.

D.Edit the built-in Windows security baseline and add the BitLocker settings.

AnswerC

Intune allows you to duplicate a baseline and modify settings.

Why this answer

Intune's security baselines are designed to be copied and customized rather than edited directly. By copying the built-in Windows security baseline, you preserve the Microsoft-recommended settings as a template while allowing modifications—such as specific BitLocker configurations—in the copy. This approach ensures that the original baseline remains intact for reference or reuse, and the customized copy can be assigned to device groups via Intune's policy assignment workflow.

Exam trap

The trap here is that candidates assume baselines can be edited directly like other Intune policies, but Microsoft intentionally locks built-in baselines to enforce consistency, requiring a copy for customization.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device compliance after configuration and cannot enforce settings like BitLocker; they only report non-compliance and trigger remediation actions, not deploy configurations. Option B is wrong because Intune does not allow creating a security baseline from scratch; you must start from a built-in baseline template and customize a copy. Option D is wrong because editing the built-in Windows security baseline directly is not supported; Intune baselines are read-only templates, and modifications require creating a copy.

Full explanation →

890

Multi-Selectmedium

Which TWO app types can be deployed to iOS/iPadOS devices using Microsoft Intune?

Select 2 answers

A.Web link

B.iOS LOB app

C.Win32 app

D.iOS store app

E.Android store app

AnswersB, D

Custom line-of-business apps.

Why this answer

iOS LOB (Line-of-Business) apps are custom-built applications that can be deployed to iOS/iPadOS devices via Microsoft Intune. Intune supports deploying LOB apps by uploading the .ipa package file directly, allowing organizations to distribute internal apps without going through the public App Store. This makes option B correct.

Exam trap

The trap here is that candidates often confuse 'web link' as an app type because it appears in the Intune console under 'Apps' > 'All apps', but it is actually a configuration item, not a deployable app type for iOS/iPadOS.

Full explanation →

891

Multi-Selecthard

Which THREE conditions must be met for a Windows device to be able to enroll in Microsoft Intune using Microsoft Entra ID join? (Choose three.)

Select 3 answers

A.The device must be running Windows 10 or later

B.The device must have internet connectivity to Microsoft Entra ID

C.The user must have an Intune license assigned

D.The device must have a TPM 2.0 chip

E.The device must be joined to an on-premises Active Directory domain

AnswersA, B, C

Windows 10/11 are supported for Microsoft Entra ID join.

Why this answer

Microsoft Entra ID join requires a minimum of Windows 10 (any edition) to support the modern authentication and device registration protocols. Devices running earlier versions like Windows 8.1 or Windows 7 lack the necessary components (e.g., the Device Registration Service client) to complete the join process. This requirement ensures the device can communicate using OAuth 2.0 and the Microsoft Entra ID device registration endpoint.

Exam trap

The trap here is that candidates often confuse the TPM 2.0 requirement for Windows Hello for Business or BitLocker with the Microsoft Entra ID join prerequisites, or mistakenly think an on-premises domain join is a stepping stone to Entra ID join, when in fact it requires a separate hybrid join path.

Full explanation →

892

Multi-Selecteasy

Which TWO actions are supported by Microsoft Intune for managing macOS devices?

Select 2 answers

A.Configure Windows Hello for Business.

B.Apply device compliance policies.

C.Enable BitLocker encryption.

D.Deploy software update policies.

E.Deploy .app applications.

AnswersB, D

Intune supports compliance policies for macOS.

Why this answer

Microsoft Intune supports device compliance policies for macOS devices, allowing administrators to define rules (e.g., OS version, encryption status, firewall settings) that devices must meet to be considered compliant. These policies are evaluated by the Intune Company Portal app on macOS and can trigger conditional access controls to block non-compliant devices from accessing corporate resources.

Exam trap

The trap here is that candidates often assume .app applications are deployable via Intune because they are common on macOS, but Intune requires .pkg or .dmg formats for managed deployment, and .app bundles are only used for manual installation or through Apple's Volume Purchase Program (VPP).

Full explanation →

893

MCQmedium

A user reports that their iOS device is unable to access corporate email after updating to a new iOS version. Other iOS devices are working fine. The device is enrolled in Intune and shows as compliant. What should you check?

A.Check the conditional access policy in Microsoft Entra ID to ensure the device platform is still supported.

B.Ensure the email profile is configured correctly.

C.Confirm that the device is still enrolled in Intune.

D.Verify that the device compliance policy includes the new iOS version.

AnswerA

A new iOS version might not be supported by the conditional access policy.

Why this answer

When a device is compliant but still fails to access corporate email after an iOS update, the most likely cause is that the conditional access policy in Microsoft Entra ID (formerly Azure AD) has been updated to block the new iOS version. Conditional access policies can specify allowed device platforms and OS versions; if the new iOS version is not explicitly permitted, access will be denied even though the device is compliant. This is a common scenario after major OS updates, as administrators must update the policy to include the new version.

Exam trap

The trap here is that candidates assume a compliant device always has access, but conditional access policies can block access based on OS version even when the device is compliant, so the focus should be on the conditional access policy rather than the compliance policy or email profile.

How to eliminate wrong answers

Option B is wrong because the email profile configuration is managed by Intune and would not change automatically due to an iOS update; if other devices are working, the profile is likely correct. Option C is wrong because the device is already reported as compliant in Intune, which implies it is still enrolled; enrollment status is not affected by an OS update. Option D is wrong because the device compliance policy includes the new iOS version by default (or can be updated), and the device is showing as compliant, so the issue is not with the compliance policy itself but with the conditional access policy that enforces access based on compliance.

Full explanation →

894

MCQhard

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. Some devices running Windows 10 22H2 (build 19045.3803) are marked as noncompliant. What is the most likely reason?

A.The device has a password length of 6 characters, not meeting the minimum of 8.

B.The policy requires a firewall, but Windows Defender Firewall is disabled on the device.

C.The device is not enrolled in Microsoft Intune.

D.The device is running a build outside the allowed OS version range specified in the policy.

AnswerA

The policy requires a minimum password length of 8, so a device with a shorter password would be noncompliant.

Why this answer

The compliance policy specifies a minimum password length of 8 characters, and devices with a password length of 6 characters fail this requirement. In Microsoft Intune, compliance policies evaluate device settings against defined rules, and a password length below the minimum is a common reason for noncompliance. The devices are running Windows 10 22H2 (build 19045.3803), which is within the allowed OS version range, so the issue is specifically the password policy.

Exam trap

The trap here is that candidates may assume the noncompliance is due to a missing firewall or OS version mismatch, but the exhibit clearly shows only password policy settings, so the focus should be on the password length requirement.

How to eliminate wrong answers

Option B is wrong because the policy does not include a firewall requirement; the exhibit shows only password-related settings, so a disabled firewall would not cause noncompliance. Option C is wrong because the devices are already managed by Intune (they are marked as noncompliant, which requires enrollment), so the issue is not lack of enrollment. Option D is wrong because the devices are running build 19045.3803, which is within the allowed OS version range specified in the policy (Windows 10 22H2), so the build is not outside the allowed range.

Full explanation →

895

MCQmedium

A company manages Windows 10 and Windows 11 devices using Microsoft Intune. They need to ensure that devices that have not checked in with Intune for more than 30 days are automatically marked as inactive and excluded from compliance policies. Which configuration should be used?

A.Configure a compliance policy with a grace period of 30 days

B.Create a conditional access policy blocking devices inactive for 30 days

C.Set the device compliance status to 'not compliant' after 30 days of inactivity

D.Configure the Intune device cleanup rule to delete devices inactive for 30 days

AnswerD

The device cleanup rule automatically removes devices that haven't checked in for the configured number of days.

Why this answer

The Intune device cleanup rule is specifically designed to automatically remove or mark devices as inactive when they have not checked in for a configurable number of days (default 30). Once a device is deleted by this rule, it is excluded from compliance policies and no longer evaluated. This directly meets the requirement to mark devices inactive after 30 days of no check-in and exclude them from compliance.

Exam trap

The trap here is that candidates confuse the device cleanup rule with compliance policy settings or conditional access, thinking that marking a device non-compliant or blocking access is equivalent to excluding it from compliance policies, but only the cleanup rule actually removes the device from evaluation.

How to eliminate wrong answers

Option A is wrong because a compliance policy grace period gives users extra time to become compliant after a policy violation, not to mark devices inactive based on check-in frequency. Option B is wrong because conditional access policies control access to cloud apps based on signals like device compliance, but they do not automatically mark devices as inactive or remove them from Intune. Option C is wrong because setting the device compliance status to 'not compliant' after 30 days of inactivity is not a native Intune configuration; compliance policies evaluate based on device settings and health, not on last check-in time, and marking a device non-compliant does not exclude it from compliance policies—it still gets evaluated.

Full explanation →

896

MCQhard

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app to iOS devices. The app is signed with an enterprise certificate. Some devices report installation failure with error code 0x87D13B9F. What is the most likely cause?

A.The app package is not signed.

B.The app is not available in the Apple App Store.

C.The enterprise signing certificate is not trusted on the device.

D.The device does not have enough storage space.

AnswerC

Error 0x87D13B9F indicates that the app's signing certificate is not trusted, often because the certificate profile is missing.

Why this answer

Error code 0x87D13B9F in Microsoft Intune typically indicates a signing certificate trust issue. Since the app is signed with an enterprise certificate, the device must have that certificate installed and trusted in its trusted root store. If the certificate is not trusted, iOS will reject the installation, producing this specific error.

Exam trap

The trap here is that candidates may confuse a signing error (missing certificate trust) with a packaging error (unsigned app), but the error code 0x87D13B9F specifically points to trust, not signature absence.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the app is signed with an enterprise certificate, so the package is signed. Option B is wrong because line-of-business (LOB) apps are deployed directly via Intune and do not require availability in the Apple App Store. Option D is wrong because insufficient storage space would generate a different error (e.g., 0x87D13B9E or a storage-specific code), not 0x87D13B9F.

Full explanation →

897

MCQhard

Refer to the exhibit. You deploy this endpoint protection configuration to a Windows 10 device. A user reports that they cannot connect to the device via RDP. What is the most likely cause?

A.The firewall rule 'Allow RDP' is configured to block traffic.

B.The firewall rule is for outbound traffic, not inbound.

C.The malware actions are blocking RDP traffic.

D.The firewall rule 'Allow RDP' is configured to allow traffic.

AnswerA

The action is 'block', preventing RDP connections.

Why this answer

The exhibit shows that the 'Allow RDP' firewall rule has its 'Action' set to 'Block', which overrides any other configuration. Windows Defender Firewall processes rules in order of priority, and a block action explicitly denies inbound RDP traffic (TCP port 3389), preventing any RDP connection to the device. This is the most direct cause of the user's inability to connect via RDP.

Exam trap

The trap here is that candidates assume a rule named 'Allow RDP' must permit traffic, overlooking the 'Action: Block' setting, which is the critical detail that reverses the rule's effect.

How to eliminate wrong answers

Option B is wrong because the firewall rule 'Allow RDP' is configured for inbound traffic (as indicated by the 'Direction: In' setting), not outbound; RDP connections to the device require inbound rules. Option C is wrong because malware actions (e.g., from Windows Defender Antivirus or Attack Surface Reduction) do not block RDP traffic unless specifically configured to do so, and the exhibit shows no such configuration; they focus on malicious behavior, not network connectivity. Option D is wrong because the rule is explicitly set to 'Block', not 'Allow', so stating it allows traffic contradicts the exhibited configuration.

Full explanation →

898

MCQeasy

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

A.Update the expirationDateTime property of the token.

B.Modify the tokenType to a different type.

C.Create a new bulk enrollment token with a later expiration date.

D.Re-create the token with the same name but later expiration.

AnswerA

You can edit the token and set a new expiration date.

Why this answer

The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Exam trap

The trap here is that candidates often assume you must create a new token to change the expiration date, overlooking the fact that the existing token's `expirationDateTime` property can be updated directly via the Intune portal or Graph API.

How to eliminate wrong answers

Option B is wrong because `tokenType` defines the enrollment method (e.g., 'azureADJoin' or 'bulkEnrollment'), not the expiration date; changing it would alter the enrollment behavior, not extend the token's life. Option C is wrong because creating a new token is unnecessary and introduces a new token identifier, which would require re-distributing the token to devices, whereas the existing token can simply be updated. Option D is wrong because re-creating the token with the same name but later expiration is functionally identical to updating the `expirationDateTime` property, but it is an indirect approach that involves deleting and re-adding the token, which is less efficient and not the recommended method.

Full explanation →

899

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom PowerShell script that runs during enrollment to configure network settings. What should you use?

A.Device compliance policy

B.Device configuration profile with custom OMA-URI

C.PowerShell scripts in Microsoft Intune

D.Endpoint security policy

AnswerC

Intune has a dedicated 'PowerShell scripts' section for running scripts.

Why this answer

Microsoft Intune's built-in PowerShell scripts feature allows you to upload and run PowerShell scripts during device enrollment or on a schedule, which is exactly what is needed to configure network settings on Windows 11 devices. This feature executes scripts in the system context, making it suitable for network configuration tasks that require administrative privileges.

Exam trap

The trap here is that candidates often confuse the ability to run custom scripts with device configuration profiles (Option B), mistakenly thinking OMA-URI can execute arbitrary code, when in reality OMA-URI only sets specific policy values and cannot run scripts.

How to eliminate wrong answers

Option A is wrong because device compliance policies are used to evaluate and enforce security and configuration requirements (e.g., requiring BitLocker or a minimum OS version), not to run custom scripts or configure network settings. Option B is wrong because a device configuration profile with a custom OMA-URI is used to set specific registry or policy values via the OMA-DM protocol, but it cannot execute a full PowerShell script; it only sets discrete settings. Option D is wrong because endpoint security policies focus on security baselines, antivirus, firewall, and other security-related configurations, not on running custom scripts for network settings.

Full explanation →

900

Multi-Selectmedium

You are configuring Microsoft Intune to manage Windows 10 devices. Which TWO actions are required to enable BitLocker encryption on devices?

Select 2 answers

A.Create a device configuration profile for endpoint protection and enable BitLocker settings.

B.Create a compliance policy that requires BitLocker.

C.Ensure the device has a TPM version 2.0 chip.

D.Configure a device cleanup rule.

E.Deploy a Windows 10 update ring.

AnswersA, C

This profile configures BitLocker on devices.

Why this answer

BitLocker settings are configured via a device configuration profile for endpoint protection in Microsoft Intune. This profile includes policies such as requiring TPM startup PIN or startup key, encryption method, and OS drive encryption. Without this profile, BitLocker cannot be enforced or configured on managed Windows 10 devices.

Exam trap

The trap here is that candidates confuse a compliance policy (which only reports/remediates) with a configuration profile (which actually applies settings), and they may also mistakenly think a TPM requirement is an administrative action rather than a device prerequisite.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 826–900