Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 901–942 | Page 13/13

901

Multi-Selectmedium

You are managing devices with Microsoft Intune. You need to ensure that only compliant devices can access corporate email. Which TWO components should you configure?

Select 2 answers

A.Device configuration profile

B.Compliance policy for Microsoft Intune

C.Device compliance policy

D.Conditional Access policy in Microsoft Entra ID

E.App protection policy

AnswersB, D

Correct - defines compliance rules that devices must meet to be considered compliant.

Why this answer

To ensure only compliant devices can access corporate email, you need a compliance policy (Option B) that defines device health rules and a Conditional Access policy (Option D) that enforces access based on compliance status. Option C is essentially the same concept as Option B and should not be selected as an additional component. Option A (device configuration profile) sets device settings but does not define compliance.

Option E (app protection policy) protects app data but does not evaluate device compliance.

Exam trap

The trap is that candidates may mistakenly include additional components such as configuration profiles or app protection policies, not realizing that only two components are necessary: Compliance Policy and Conditional Access.

Full explanation →

902

MCQhard

Refer to the exhibit. You have configured a Windows update ring using the JSON above. Today is March 10, 2025. Devices assigned to this ring are not receiving any quality updates. What is the most likely reason?

A.The quality update deferral of 7 days has not yet elapsed since the last update.

B.The quality update pause has expired, but quality updates are still blocked.

C.Quality updates are paused until March 15, 2025.

D.Feature updates are deferred for 30 days, preventing all updates.

AnswerC

The pause is active, blocking quality updates.

Why this answer

The JSON configuration includes 'qualityUpdatesPauseStartDate': '2025-03-01' and 'qualityUpdatesPauseExpiryDate': '2025-03-15'. Since today is March 10, 2025, the pause is still active and will block all quality updates until March 15. The pause overrides any deferral settings, so devices will not receive quality updates regardless of the 7-day deferral period.

Exam trap

The trap here is that candidates often confuse 'deferral' with 'pause' and assume a short deferral period is the cause, overlooking that an active pause overrides all deferral settings for that update type.

How to eliminate wrong answers

Option A is wrong because the 7-day quality update deferral is irrelevant while a pause is active; the pause explicitly blocks updates until its expiry date. Option B is wrong because the pause has not expired (it expires on March 15, 2025), so updates are still blocked by the pause, not by an expired pause. Option D is wrong because feature update deferral settings do not affect quality updates; quality and feature update policies are independent in Windows Update for Business.

Full explanation →

903

MCQmedium

You are troubleshooting an Android Enterprise device that fails to install a required app from the Managed Google Play store. The device is compliant and has a valid work profile. What should you check first?

A.Check that the device is enrolled in Android Enterprise and has a work profile.

B.Ensure the Managed Google Play app is enabled and active on the device.

C.Confirm the user has approved the app installation in the Managed Google Play store.

D.Verify the device compliance policy allows app installation from unknown sources.

AnswerB

The Managed Google Play app must be active to install apps.

Why this answer

The Managed Google Play app is the client-side component that processes app installation requests on Android Enterprise devices. Even if the device is compliant and has a valid work profile, if the Managed Google Play app is disabled, frozen, or not active, it cannot receive or execute the installation command from the EMM console. This is the first thing to verify because it is a prerequisite for any app deployment via Managed Google Play.

Exam trap

The trap here is that candidates assume user approval (Option C) is always required for app installations, but in Android Enterprise managed devices, silent push installations bypass user interaction, making the Managed Google Play app's active status the critical first check.

How to eliminate wrong answers

Option A is wrong because the question already states the device has a valid work profile, so checking enrollment is redundant and not the first troubleshooting step. Option C is wrong because in a fully managed or work profile Android Enterprise deployment, app installations are pushed silently from the EMM console; user approval is not required unless the app is marked as 'user-approved' in the EMM policy, which is not the default. Option D is wrong because Android Enterprise devices install apps exclusively through the Managed Google Play store, not from unknown sources; compliance policies for unknown sources are irrelevant to Managed Google Play installations.

Full explanation →

904

MCQhard

You are the Intune administrator for Contoso Ltd., a company with 5,000 Windows 11 devices and 1,000 iOS devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint for threat detection. You need to implement a solution that ensures devices are compliant before they can access corporate resources. You have the following requirements: 1. Windows devices must have Defender for Endpoint running and report a threat level of 'low' or better. 2. iOS devices must have a PIN of at least 6 characters and be jailbreak-detected as 'not jailbroken'. 3. If a device becomes noncompliant, it should be blocked immediately with no grace period. 4. Noncompliant devices should receive a notification to the user. You create compliance policies for Windows and iOS. You also create a conditional access policy in Microsoft Entra ID to require compliant devices. After deploying, you find that some Windows devices that are missing Defender for Endpoint are still able to access email. What should you do to resolve this issue?

A.Configure a notification to users when their device is noncompliant.

B.Modify the conditional access policy to require a compliant device and a specific client app.

C.Enable the 'Require Defender for Endpoint' setting in the Windows compliance policy.

D.Set the required threat level to 'medium' in the Windows compliance policy.

AnswerC

This setting ensures devices without the agent are marked noncompliant.

Why this answer

The Windows compliance policy must explicitly have the 'Require Defender for Endpoint' setting enabled to enforce that the Defender for Endpoint sensor is present and active on the device. Without this setting, the compliance policy only checks the threat level reported by Defender for Endpoint but does not require the sensor to be installed or running. Enabling this setting ensures that devices missing the Defender for Endpoint sensor are marked as noncompliant, which then triggers the conditional access policy to block access to corporate resources like email.

Exam trap

The trap here is that candidates often assume that setting the required threat level to 'low' automatically enforces the presence of Defender for Endpoint, but in reality, the threat level check only evaluates the last reported threat score, not the sensor's installation or running state.

How to eliminate wrong answers

Option A is wrong because configuring a notification to users when their device is noncompliant does not enforce compliance or block access; it only informs the user after the device is already noncompliant. Option B is wrong because modifying the conditional access policy to require a specific client app does not address the missing Defender for Endpoint sensor; the conditional access policy already requires a compliant device, and the issue is that the compliance policy is not correctly evaluating the Defender for Endpoint requirement. Option D is wrong because setting the required threat level to 'medium' would allow devices with a threat level of 'medium' to be compliant, which is less restrictive than 'low' and does not solve the problem of devices missing Defender for Endpoint entirely.

Full explanation →

905

MCQmedium

You are setting up Microsoft Intune for the first time. You need to ensure that users can enroll their iOS devices using the Company Portal app. You have configured the enrollment restrictions to allow iOS enrollment. However, users report that they see an error 'This device is not allowed to enroll' when trying to enroll. What is the most likely cause?

A.A conditional access policy requires compliant devices.

B.The Apple MDM push certificate is not configured.

C.The enrollment restrictions are set to block personally owned devices.

D.The users have not accepted the terms of use.

AnswerC

Correct. The enrollment restrictions are likely set to block personally owned devices, causing the error when users attempt to enroll their personal iOS devices.

Why this answer

The error 'This device is not allowed to enroll' typically occurs when enrollment restrictions block the device type or ownership. In this scenario, although iOS enrollment is allowed, the restriction likely blocks personally owned devices. If users are trying to enroll personal iOS devices, the restriction preventing personally owned devices would cause this error.

Option A is incorrect because a conditional access policy requiring compliant devices blocks access to resources after enrollment, not the enrollment itself. Option B is incorrect because the Apple MDM push certificate is required for Intune to communicate with iOS devices, but a missing certificate would cause a different error related to certificate setup. Option D is incorrect because terms of use appear after the enrollment attempt and would not prevent the initial enrollment.

Full explanation →

906

MCQhard

Your company uses Microsoft Intune for device management. You need to configure a Windows 10 device restriction policy that blocks the use of the camera and microphone on all devices. Which settings should you configure?

A.Camera and Microphone

B.Bluetooth and Nearby Share

C.Copy and paste and Clipboard

D.Location and Messaging

AnswerA

These settings block the camera and microphone hardware.

Why this answer

To block the camera and microphone on Windows 10 devices managed by Microsoft Intune, you configure the 'Camera' and 'Microphone' settings within a device restrictions policy (under the 'General' category). These settings directly disable the corresponding hardware devices at the OS level by modifying the relevant registry keys (e.g., HKLM\SOFTWARE\Policies\Microsoft\Camera\AllowCamera and HKLM\SOFTWARE\Policies\Microsoft\Sound\AllowMicrophone). This ensures that no application can access the camera or microphone, meeting the compliance requirement.

Exam trap

The trap here is that candidates may confuse 'Camera and Microphone' with broader categories like 'Bluetooth' or 'Location', assuming those peripherals are grouped under connectivity or privacy settings, when in fact they are explicitly listed under device restrictions in Intune.

How to eliminate wrong answers

Option B is wrong because 'Bluetooth and Nearby Share' controls wireless connectivity and file sharing, not audio/video capture devices. Option C is wrong because 'Copy and paste and Clipboard' manages data transfer restrictions, not hardware peripherals like cameras or microphones. Option D is wrong because 'Location and Messaging' governs geolocation services and text/chat functionality, not camera or microphone access.

Full explanation →

907

MCQmedium

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

A.Configure the app as 'Required' for all users

B.Add the app to the Windows Autopilot deployment profile

C.Grant users local administrator rights on their devices

D.Assign the app to users as 'Available' in the Company Portal

AnswerD

Available assignment allows users to install from Company Portal.

Why this answer

The 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Exam trap

The trap here is that candidates may confuse 'Available' assignments with 'Required' assignments, thinking that self-service implies mandatory installation, or incorrectly assume that local admin rights are needed for app installation in Intune.

How to eliminate wrong answers

Option A is wrong because configuring the app as 'Required' forces installation on all targeted devices, which does not allow users to choose when or if to install the app, contradicting the self-install requirement. Option B is wrong because Windows Autopilot deployment profiles are used for device provisioning and initial setup, not for ongoing self-service app installation via Company Portal. Option C is wrong because granting users local administrator rights is a security risk and unnecessary; Intune's 'Available' assignment enables self-installation without elevated privileges, as the Company Portal uses the Intune Management Extension to install apps in the system context.

Full explanation →

908

Multi-Selectmedium

Which THREE actions can you perform using Microsoft Intune's remote assistance feature for Windows devices?

Select 3 answers

A.View the user's screen.

B.Reset the device's password.

C.Transfer files to and from the device.

D.Take full control of the user's desktop.

E.Restart a Windows service.

AnswersA, C, D

Screen viewing is supported.

Why this answer

Microsoft Intune's remote assistance feature, built on Windows Remote Assistance (WRA) using the Remote Desktop Protocol (RDP) over HTTPS, allows a help desk operator to view the user's screen with the user's explicit consent. This is a core capability for troubleshooting without taking control, enabling the administrator to see what the user sees in real time.

Exam trap

The trap here is that candidates confuse Intune's remote assistance with full remote control tools like TeamViewer or RDP, assuming all remote management actions (password reset, service restart) are bundled, but Microsoft deliberately limits remote assistance to view and full control only, with no administrative actions like password or service management.

Full explanation →

909

MCQhard

You are troubleshooting a Windows 10 device that shows as 'Noncompliant' in Intune despite having all required compliance policies applied. The device is domain-joined and configured with hybrid Azure AD join. What is the most likely cause?

A.The Intune Management Extension is not installed.

B.The device is not registered in Microsoft Entra ID.

C.The device's health attestation certificate has expired.

D.The device is not enrolled in Intune.

AnswerC

Expired health attestation can cause noncompliance.

Why this answer

A device that is hybrid Azure AD joined and domain-joined but shows as 'Noncompliant' in Intune, despite having all required compliance policies applied, is most likely failing compliance due to an expired health attestation certificate. Intune uses Windows Health Attestation Service (HAS) to verify device integrity; if the attestation certificate has expired, the device cannot prove its health status, causing it to be marked noncompliant even when policies are correctly assigned.

Exam trap

The trap here is that candidates often assume noncompliance is due to missing enrollment or registration, but the question explicitly states the device is hybrid joined and enrolled, so the real issue is a stale or expired health attestation certificate that prevents the compliance check from completing.

How to eliminate wrong answers

Option A is wrong because the Intune Management Extension is used for deploying PowerShell scripts and Win32 apps, not for compliance evaluation; compliance is handled by the Intune agent and the enrollment state. Option B is wrong because the device is described as hybrid Azure AD joined, which inherently means it is registered in Microsoft Entra ID (Azure AD); lack of registration would prevent hybrid join from succeeding. Option D is wrong because the device is already enrolled in Intune (it shows as 'Noncompliant' in Intune), so the issue is not a lack of enrollment but a failure in the compliance check process.

Full explanation →

910

MCQhard

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

A.Automated investigation and response

B.Threat analytics

C.Device inventory

D.Alert queue

AnswerA

Correct. This page contains settings for automation.

Why this answer

The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Exam trap

The trap here is that candidates often confuse the 'Automated investigation and response' configuration with the 'Alert queue' or 'Threat analytics' because they all appear under the same XDR portal section, but only the AIR setting directly manages the automation behavior for device-level response actions.

How to eliminate wrong answers

Option B is wrong because Threat Analytics is a feature that provides threat intelligence, vulnerability reports, and mitigation recommendations, but it does not configure the automatic investigation and response behavior for devices. Option C is wrong because Device Inventory is a list of all managed devices with their security status and configuration details, not a setting to enable or adjust automated response actions. Option D is wrong because Alert Queue is a view of security alerts generated by Defender for Endpoint, and while it allows manual triage of alerts, it does not control the automation level or response configuration for investigations.

Full explanation →

911

MCQeasy

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

A.Configure Windows Hello for Business in Intune

B.Deploy an attack surface reduction rule in Microsoft Defender XDR

C.Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

D.Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot

AnswerD

Conditional Access with compliance policy enforces health requirements before access.

Why this answer

Conditional Access policies in Microsoft Entra ID can require devices to be marked as compliant before granting access to corporate resources. A device compliance policy in Intune can be configured to check for TPM 2.0 and Secure Boot status on Windows 11 devices. Only when both conditions are met will the device be considered compliant, and the Conditional Access policy will enforce that compliance requirement, effectively blocking non-compliant devices from accessing corporate resources.

Exam trap

The trap here is that candidates often confuse provisioning-time enforcement (Autopilot) with runtime compliance enforcement (Conditional Access + compliance policy), mistakenly thinking Autopilot can block access after the device is in use.

How to eliminate wrong answers

Option A is wrong because Windows Hello for Business is an authentication method that uses biometrics or PINs, not a mechanism to enforce TPM 2.0 or Secure Boot as a compliance check for resource access. Option B is wrong because attack surface reduction rules in Microsoft Defender XDR are designed to block malicious behaviors (e.g., script execution, Office macro abuse), not to enforce hardware security features like TPM or Secure Boot for device compliance. Option C is wrong because Windows Autopilot is a provisioning tool that can apply settings during initial setup, but it does not enforce ongoing compliance checks or block access to corporate resources after provisioning; it cannot replace a Conditional Access policy that dynamically evaluates device compliance.

Full explanation →

912

Multi-Selecteasy

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Select 2 answers

A.Apple Device Enrollment Program (DEP).

B.Android device administrator.

C.Android Enterprise corporate-owned work profile.

D.Android Enterprise fully managed.

E.Windows Autopilot.

AnswersC, D

Correct. Corporate-owned work profile is a supported Android Enterprise enrollment method.

Why this answer

Android device administrator (DA) is a legacy enrollment method that is deprecated and not recommended for new enrollments. Option B is incorrect because it is a legacy method and not one of the intended two modern methods. Option C is correct because Android Enterprise corporate-owned work profile is a valid enrollment method that enables management of organization-owned devices with a work profile.

Option D is correct because Android Enterprise fully managed is a separate, fully managed enrollment method for corporate-owned devices. Both C and D are distinct Android Enterprise enrollment methods in Intune.

Exam trap

Candidates may mistakenly think that device administrator (B) is a correct answer because it is a valid enrollment method, but it is legacy and deprecated. The two modern Android enrollment methods are Android Enterprise corporate-owned work profile and Android Enterprise fully managed. Fully managed is a separate enrollment method, not just a configuration under Android Enterprise.

Full explanation →

913

MCQhard

Your organization uses Microsoft Intune to manage Windows 11 devices. You notice that some devices are not receiving security updates even though update rings are assigned. What is the most likely cause?

A.Devices are noncompliant and blocked from receiving updates

B.Devices are not enrolled in Intune

C.Update ring policy has a deferral period configured that delays updates

D.Devices are not connected to the internet

AnswerC

Deferral periods can significantly delay update installation.

Why this answer

Update ring policies in Microsoft Intune include a deferral period setting that delays the installation of updates for a specified number of days after Microsoft releases them. If a deferral period is configured (e.g., 30 days for feature updates or 7 days for quality updates), devices will not receive security updates until that period expires, even though the update ring is assigned. This is a common configuration to allow testing before broad deployment, but it can mistakenly be overlooked when troubleshooting missing updates.

Exam trap

The trap here is that candidates often assume missing updates are due to compliance or connectivity issues, but the MD-102 exam specifically tests the understanding that deferral periods in update rings can delay security updates even when the policy is correctly assigned.

How to eliminate wrong answers

Option A is wrong because noncompliant devices are not blocked from receiving security updates; Intune can still deliver updates to noncompliant devices, though compliance policies may restrict access to corporate resources. Option B is wrong because the question states that devices are managed by Intune and have update rings assigned, which implies they are enrolled; if they were not enrolled, they would not appear in Intune at all. Option D is wrong because if devices were not connected to the internet, they would not be able to communicate with Intune or Windows Update, but the question specifies that update rings are assigned and the issue is specifically about security updates not being received, not a complete lack of connectivity.

Full explanation →

914

MCQmedium

Your company uses Microsoft Intune to manage iOS devices. You have an app protection policy that requires a PIN to access corporate data. Users report that they can access corporate data without entering a PIN after the first time. You want to ensure that the PIN is required every time the app is opened. What should you configure?

A.Set 'Require PIN to access' to 'Yes'.

B.Require device PIN instead of app PIN.

C.Set 'PIN reset after number of hours' to 0.

D.Set 'Timeout' to 1 minute.

AnswerC

0 forces PIN entry every time.

Why this answer

Setting 'PIN reset after number of hours' to 0 forces the user to enter a PIN every time the app is opened, regardless of whether they previously entered it. Option A is incorrect because 'Require PIN to access' is already set to 'Yes' but does not control PIN frequency; the PIN can be cached for a session. Option B is incorrect because requiring a device PIN instead of an app PIN changes the authentication method, but the issue is about requiring the app PIN on every open, not changing to device PIN.

Option D is incorrect because 'Timeout' controls how long the app can be inactive before requiring a PIN, not upon initial app launch.

Full explanation →

915

MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that all devices have a passcode of at least 6 characters and that devices are updated to the latest iOS version. You create a compliance policy. After assigning the policy, some devices are marked as non-compliant even though they have a passcode. What is the most likely cause?

A.The devices have multiple compliance policies applied.

B.iOS devices do not support compliance policies.

C.The devices have not checked in with Intune since the policy was assigned.

D.The policy was assigned to a user group instead of a device group.

AnswerC

Devices need to check in to receive and report compliance status.

Why this answer

Intune compliance policies are evaluated only when devices check in with the service. If a device has not performed a check-in since the policy was assigned, it will not have received or evaluated the new policy, and its compliance status will remain based on the previous state. The check-in interval for iOS/iPadOS devices is typically every 8 hours, but can be forced manually by the user.

Until the device checks in, it cannot be marked compliant even if it meets the passcode and OS version requirements.

Exam trap

The trap here is that candidates assume compliance policies are evaluated immediately upon assignment, but Intune requires a device check-in to apply and evaluate the policy, and devices that haven't checked in will show as non-compliant even if they meet the requirements.

How to eliminate wrong answers

Option A is wrong because having multiple compliance policies does not inherently cause a device to be marked non-compliant; Intune evaluates all assigned policies and the device is compliant only if it meets all of them. Option B is wrong because iOS/iPadOS devices fully support compliance policies in Intune, including passcode and OS version requirements. Option D is wrong because assigning a compliance policy to a user group is the standard and supported method; Intune applies the policy to all devices owned by users in that group, and this does not cause false non-compliance.

Full explanation →

916

MCQmedium

Your organization uses Microsoft Intune to manage 1,000 Windows 10 devices and 500 iOS devices. You need to enforce device compliance policies. For Windows devices, you require BitLocker encryption and Windows Defender Antivirus enabled. For iOS devices, you require a passcode of at least 6 characters and device encryption. Devices that become noncompliant should be marked as such and users should receive a notification email. After 7 days of noncompliance, the device should be blocked from accessing corporate email. You also need to create a report that shows the compliance status of all devices. Which combination of actions should you take?

A.Create Windows and iOS compliance policies with the required settings. Configure actions for noncompliance: send email immediately and block access after 7 days. Use the built-in compliance report.

B.Create app protection policies to require encryption and passcode. Use conditional access to block noncompliant devices.

C.Create device configuration profiles for BitLocker and encryption. Use conditional access to block noncompliant devices. Manually generate reports using PowerShell.

D.Use Autopilot to enforce encryption and passcode. Use Intune reporting for compliance status.

AnswerA

Compliance policies with actions and conditional access meet all requirements.

Why this answer

Intune compliance policies directly enforce device-level settings like BitLocker and passcode length, and they include built-in actions for noncompliance (e.g., send email, block access after a specified number of days). The built-in compliance report in the Intune portal provides an immediate view of all devices' compliance status without requiring manual scripting or additional tools.

Exam trap

Microsoft often tests the distinction between compliance policies (device-level enforcement with built-in actions) and app protection policies (data-level controls), leading candidates to confuse which policies can enforce BitLocker or trigger time-based blocking.

How to eliminate wrong answers

Option B is wrong because app protection policies (MAM) manage data-level security within apps, not device-level settings like BitLocker or device encryption; they cannot enforce BitLocker or Windows Defender Antivirus. Option C is wrong because device configuration profiles apply settings but do not include built-in actions for noncompliance (like sending email or blocking access after a delay); conditional access alone cannot trigger time-based actions, and manually generating reports with PowerShell is unnecessary when Intune provides a built-in compliance report. Option D is wrong because Autopilot is a deployment tool, not a compliance enforcement mechanism; it cannot enforce passcode length or device encryption on iOS, and Intune reporting is not limited to Autopilot.

Full explanation →

917

MCQhard

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

A.Configure a selective wipe policy.

B.Configure a compliance policy to mark the device as noncompliant.

C.Configure a remote lock action.

D.Configure a full wipe action.

AnswerA

Selective wipe removes corporate data while leaving personal data intact.

Why this answer

A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Exam trap

The trap here is that candidates often confuse selective wipe with full wipe, assuming that any data removal requires a complete device reset, but the exam tests the specific Intune behavior where selective wipe is the correct method for removing only corporate data upon unenrollment.

How to eliminate wrong answers

Option B is wrong because configuring a compliance policy to mark the device as noncompliant does not automatically remove corporate data; it triggers conditional access blocks or notifications but requires a separate wipe action. Option C is wrong because a remote lock action only locks the device screen and does not remove any data. Option D is wrong because a full wipe action resets the entire device to factory settings, removing both corporate and personal data, which is not the requirement for selective removal of corporate data only.

Full explanation →

918

MCQmedium

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

A.Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.

B.Create a device configuration profile with a custom OMA-URI setting to execute the script.

C.Use a device compliance policy to trigger the script when noncompliant.

D.Use Intune proactive remediations and configure the script to run as a detection script.

AnswerA

This runs the script in the user context.

Why this answer

Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Exam trap

The trap here is that candidates often confuse the execution context of Intune PowerShell scripts (user vs. system) and assume proactive remediations or compliance policies can run scripts in the user context, but only the PowerShell script deployment feature with the logged-on credentials option supports this.

How to eliminate wrong answers

Option B is wrong because a device configuration profile with a custom OMA-URI setting can only execute scripts in the system context via the DeviceManagement/Remediation CSP, not in the user context. Option C is wrong because a device compliance policy cannot directly trigger script execution; it only evaluates compliance and can mark devices noncompliant, but does not run remediation scripts. Option D is wrong because Intune proactive remediations run detection and remediation scripts in the system context by default, not the user context, and cannot be configured to run as a detection script in the user context.

Full explanation →

919

Multi-Selecthard

An organization uses Configuration Manager to deploy Windows 11. The administrator needs to ensure that after deployment, the devices are automatically enrolled in Microsoft Intune for co-management. Which THREE actions are required?

Select 3 answers

A.Enable WinRM on the target devices.

B.Configure Azure AD hybrid join in the environment.

C.Configure the Intune Connector in Configuration Manager.

D.Enable co-management in Configuration Manager.

E.Configure a Group Policy for automatic Intune enrollment.

AnswersB, C, D

Devices must be Azure AD hybrid joined.

Why this answer

Azure AD hybrid join is required for co-management because it allows devices to be registered in both on-premises Active Directory and Azure AD, enabling them to be managed by both Configuration Manager and Intune simultaneously. Without hybrid join, devices cannot authenticate to Intune for enrollment, as co-management relies on Azure AD identity for device registration and policy assignment.

Exam trap

The trap here is that candidates often confuse automatic Intune enrollment via Group Policy (Option E) as a required step for co-management, but in the co-management workflow, enrollment is handled by the Configuration Manager client after the Intune Connector and hybrid join are configured, making the Group Policy redundant.

Full explanation →

920

MCQmedium

A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?

A.Device configuration policy (settings catalog).

B.Conditional Access policy.

C.Device compliance policy.

D.App protection policy.

AnswerC

Compliance policies evaluate passcode settings and mark devices as non-compliant if not met.

Why this answer

Device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level.

Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.

Full explanation →

921

Multi-Selectmedium

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Select 3 answers

A.Number of failed attempts before wipe.

B.Maximum passcode age (days).

C.Minimum passcode length.

D.Allow simple passcode.

E.Allow Touch ID.

AnswersA, C, E

This triggers a wipe after 10 failed attempts.

Why this answer

The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Exam trap

The trap here is that candidates often confuse 'Maximum passcode age' with the wipe-on-failed-attempts setting, or mistakenly think 'Allow simple passcode' is required to enable Touch ID, when in fact Touch ID is a separate toggle that does not depend on simple passcode being allowed.

Full explanation →

922

MCQhard

You are troubleshooting a Windows 11 device that fails to receive a PowerShell script deployed via Intune. The script is assigned to a group containing the device. Other policies on the device apply successfully. What should you check first?

A.Ensure the device has internet connectivity.

B.Check the Windows PowerShell execution policy on the device.

C.Check that the script is digitally signed.

D.Verify that the device is in the correct security group.

AnswerB

PowerShell scripts require the execution policy to be set to allow scripts.

Why this answer

The Windows PowerShell execution policy controls whether scripts can run on the device. Even if the script is successfully delivered by Intune, a restrictive execution policy (e.g., Restricted) will block its execution. Since other policies apply successfully, connectivity and group membership are not the issue, making the execution policy the most likely cause.

Exam trap

The trap here is that candidates often assume script signing (Option C) is required for Intune deployments, but Intune does not enforce digital signatures by default; the local execution policy is the primary gatekeeper.

How to eliminate wrong answers

Option A is wrong because internet connectivity is required for Intune communication, but since other policies apply successfully, the device already has connectivity. Option C is wrong because Intune does not require PowerShell scripts to be digitally signed by default; the execution policy can be configured to allow unsigned scripts (e.g., RemoteSigned). Option D is wrong because the device is already in the correct group (as stated in the question), and other policies from that group apply successfully.

Full explanation →

923

MCQeasy

Your company uses Microsoft Intune to manage devices. You need to ensure that all corporate-owned iOS devices automatically enroll in Intune when users sign in with their work account. Which enrollment method should you configure?

A.Apple Configurator enrollment

B.Device Enrollment Manager (DEM) account

C.Apple Automated Device Enrollment (ADE)

D.User-initiated enrollment via Company Portal

AnswerC

ADE enables zero-touch deployment where devices enroll automatically when the user signs in with a work account.

Why this answer

Apple Automated Device Enrollment (ADE) is the correct method because it enables zero-touch, automated enrollment for corporate-owned iOS devices. When ADE is configured with Intune, devices are automatically enrolled during the initial setup assistant when the user signs in with their work account, without requiring manual intervention or the Company Portal app.

Exam trap

The trap here is that candidates often confuse Apple Configurator enrollment (a manual, wired method) with ADE (an automated, over-the-air method), or they think user-initiated enrollment via Company Portal can be automated, but it requires manual steps by the user.

How to eliminate wrong answers

Option A is wrong because Apple Configurator enrollment is a manual, wired method intended for small-scale or shared device scenarios, not for automatic enrollment at scale when users sign in. Option B is wrong because the Device Enrollment Manager (DEM) account is used to enroll multiple devices using a single shared account, not to trigger automatic enrollment per user sign-in. Option D is wrong because user-initiated enrollment via Company Portal requires the user to manually download the app and enroll, which does not meet the requirement for automatic enrollment when signing in with a work account.

Full explanation →

924

MCQmedium

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

A.Configure device compliance policy to require jailbreak detection.

B.Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.

C.Configure device configuration profile to require device PIN.

D.Configure App Protection Policy to require app PIN.

AnswerB

This restricts data transfer to managed apps only.

Why this answer

App Protection Policies (APP) in Microsoft Intune provide data protection at the application layer, independent of device management. By setting 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' to 'Policy managed apps', corporate data in Microsoft 365 apps is prevented from leaking to unmanaged or compromised apps, even if the device itself is jailbroken or otherwise compromised. This ensures data remains protected regardless of the device's security state.

Exam trap

The trap here is that candidates often confuse device-level controls (like compliance policies or device PINs) with app-level data protection, mistakenly believing that blocking access or requiring authentication is sufficient to protect corporate data on a compromised device, when in fact only App Protection Policies that restrict data movement can prevent data exfiltration.

How to eliminate wrong answers

Option A is wrong because device compliance policies with jailbreak detection are device-level controls that can block access or trigger conditional access, but they do not protect corporate data within apps if the device is already compromised; they only prevent access from non-compliant devices. Option C is wrong because a device configuration profile requiring a device PIN enforces device-level authentication but does not restrict data movement between apps or protect data within Microsoft 365 apps on a compromised device. Option D is wrong because requiring an app PIN via App Protection Policy adds an authentication layer to the app but does not control data transfer or copy/paste behavior, leaving corporate data vulnerable to exfiltration from a compromised device.

Full explanation →

925

MCQeasy

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

A.Change the update ring policy deadline to 7 days to ensure devices have enough time.

B.Create a new feature update policy for KB5001234 and assign it to all devices.

C.Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.

D.Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.

AnswerC

Removes deferral and sets a short deadline.

Why this answer

The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates.

Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Full explanation →

926

MCQmedium

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

A..msi

B..appx

C..intunewin

D..exe

AnswerC

.intunewin is the required format for Win32 app deployment via Intune.

Why this answer

The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Exam trap

The trap here is that candidates mistakenly think a raw .exe or .msi can be deployed as a Win32 app in Intune, but Intune requires the .intunewin wrapper to handle detection, dependencies, and installation behavior for non-Store apps.

How to eliminate wrong answers

Option A is wrong because .msi files can be deployed directly as line-of-business apps in Intune, but they do not support the Win32 app deployment method's advanced features like custom detection rules, dependencies, or requirement rules; for a Win32 app, you must wrap the .msi in an .intunewin file. Option B is wrong because .appx files are used for Universal Windows Platform (UWP) apps, not Win32 apps, and they require a different deployment pipeline (e.g., Store or LOB app type). Option D is wrong because .exe files cannot be deployed directly as Win32 apps in Intune without being wrapped in an .intunewin file; the .intunewin packaging tool is required to encapsulate the .exe and its installation parameters.

Full explanation →

927

Multi-Selecteasy

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Select 2 answers

A.Android Enterprise corporate-owned devices with work profile

B.Android Enterprise personally-owned devices with work profile

C.Android Device Administrator

D.Apple Business Manager

E.Windows Autopilot

AnswersA, B

This is a valid enrollment method.

Why this answer

Android Enterprise corporate-owned devices with work profile is a valid enrollment method in Microsoft Intune that allows IT to manage a work profile on company-owned devices while keeping the personal space separate. This method uses the Android Enterprise platform to enforce corporate policies without requiring full device management, leveraging the work profile container for security and compliance.

Exam trap

The trap here is that candidates often confuse Android Device Administrator (a deprecated legacy method) as a valid enrollment option, but Microsoft Intune now requires Android Enterprise enrollment for new devices, making options like C incorrect.

Full explanation →

928

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

A.Device configuration policy

B.Compliance policy

C.Windows Update for Business policy

D.Device health attestation policy

AnswerB

Compliance policies can include a grace period and action for non-compliance, including retiring devices after a specified period of inactivity.

Why this answer

A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Exam trap

The trap here is that candidates often confuse a device configuration policy (which controls settings) with a compliance policy (which enforces conditions and triggers actions like retirement), leading them to select Option A instead of B.

How to eliminate wrong answers

Option A is wrong because a device configuration policy manages settings like passwords, encryption, and restrictions, but it does not include a check-in timeout or retirement trigger. Option C is wrong because a Windows Update for Business policy controls update deferrals and delivery optimization, not device check-in monitoring or retirement. Option D is wrong because a device health attestation policy verifies boot integrity and security features (e.g., Secure Boot, BitLocker) via the TPM, but it does not enforce a check-in interval or automatic retirement.

Full explanation →

929

MCQhard

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

A.%windir%\temp\MdmEnrollment.log

B.%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log

C.%windir%\Panther\setupact.log

D.Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

AnswerB

This log contains provisioning package enrollment details.

Why this answer

When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Exam trap

The trap here is that candidates confuse the general MDM enrollment log (MdmEnrollment.log) with the provisioning package-specific log, not realizing that provisioning package enrollment uses a completely separate logging path and engine.

How to eliminate wrong answers

Option A is wrong because MdmEnrollment.log is used for MDM enrollment initiated via Settings or manual enrollment, not for provisioning package-based enrollment. Option C is wrong because setupact.log is a Windows Setup log used for OS installation and upgrade troubleshooting, not for provisioning package or MDM enrollment issues. Option D is wrong because the DeviceManagement-Enterprise-Diagnostics-Provider logs in Event Viewer capture general MDM client events but are not the primary log for provisioning package execution; the provisioning engine writes its own dedicated log file.

Full explanation →

930

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

A.Device compliance policies.

B.No additional configuration is needed.

C.Device configuration policies.

D.App protection policies.

AnswerA

Compliance policies must be configured and assigned to devices.

Why this answer

A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.

Exam trap

The trap here is that candidates assume Conditional Access policies are self-sufficient for compliance enforcement, overlooking that Intune compliance policies are the required mechanism to generate the compliance state that Conditional Access evaluates.

How to eliminate wrong answers

Option B is wrong because Conditional Access alone cannot enforce compliance; it only checks the compliance status reported by Intune, so additional configuration in Intune is mandatory. Option C is wrong because device configuration policies manage settings like Wi-Fi or VPN profiles, not compliance evaluation; they do not mark a device as compliant or non-compliant for Conditional Access. Option D is wrong because app protection policies (MAM) manage data protection at the app level without requiring device enrollment, but they do not make a device compliant for device-based Conditional Access policies targeting Exchange Online.

Full explanation →

931

MCQhard

A company uses Configuration Manager to deploy Windows 10 to 2000 devices. After deployment, several devices report that the Start menu layout is not applied. The administrator used a provisioning package to configure Start layout. What is the most likely cause of the issue?

A.Group Policy settings are overriding the Start layout configuration.

B.The devices are not Azure AD joined.

C.The provisioning package was not signed properly.

D.The provisioning package was applied after user first logon.

AnswerA

GP can override provisioning package settings.

Why this answer

The most likely cause is that Group Policy settings are overriding the Start layout configuration. Provisioning packages apply settings during OOBE, but Group Policy is applied later and can overwrite those settings. The other options are less likely: Azure AD join is not required for Start layout; signing issues would prevent application, not override; and the timing of first logon is after OOBE, but Group Policy still overrides.

Full explanation →

932

Multi-Selecthard

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Select 3 answers

A.Azure AD Application Proxy

B.Multi-factor authentication (MFA)

C.Azure AD Connect sync

D.Device compliance policies

E.Conditional Access policies

AnswersB, D, E

Verifies identity.

Why this answer

Multi-factor authentication (MFA) is essential for a zero-trust architecture because it enforces strong identity verification beyond just a password, ensuring that each authentication request is validated with an additional factor (e.g., a phone call, text message, or authenticator app). This aligns with the zero-trust principle of 'never trust, always verify' by requiring explicit proof of identity at every access attempt, even if the user is inside the corporate network.

Exam trap

The trap here is that candidates often confuse infrastructure components (like Azure AD Connect sync or Application Proxy) with security controls, mistakenly thinking they are required for zero trust when they are merely supporting services for hybrid identity or remote access.

Full explanation →

933

MCQeasy

Your organization needs to deploy a web app link to users' devices via Microsoft Intune. Which app type should you select?

A.Windows app (Win32)

B.iOS store app

C.Web link

D.Managed Google Play app

AnswerC

Creates a shortcut to the URL.

Why this answer

C is correct because a Web link app type in Microsoft Intune allows you to deploy a shortcut to a web app on users' devices without installing any software. This is ideal for linking to a web app that runs in a browser, as it simply places an icon on the device's app list or home screen that opens the specified URL.

Exam trap

The trap here is that candidates may confuse a Web link app with a full application deployment, thinking they need to select a platform-specific app type (like Win32 or iOS store app) even when the requirement is simply to provide a URL shortcut.

How to eliminate wrong answers

Option A is wrong because a Windows app (Win32) is used for deploying traditional desktop applications via .intunewin files, not for linking to a web app. Option B is wrong because an iOS store app is for deploying native iOS applications from the Apple App Store, not for creating a shortcut to a web URL. Option D is wrong because a Managed Google Play app is for deploying Android apps from the Google Play Store, not for web links.

Full explanation →

934

MCQeasy

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

A.Disables the Windows Firewall for all network profiles

B.Enables the Windows Firewall for the public network profile

C.Enables Microsoft Defender Antivirus real-time protection

D.Disables the Windows Firewall for the domain network profile

AnswerB

The setting enables firewall on public profile.

Why this answer

The setting shown in the exhibit configures the Windows Firewall to enable the firewall for the public network profile. In Intune, the 'Windows Firewall' configuration policy allows administrators to define per-profile firewall states. Enabling the firewall for the public profile is a common security baseline requirement to protect devices on untrusted networks.

Exam trap

The trap here is that candidates confuse the 'Windows Firewall' setting with Microsoft Defender Antivirus real-time protection, or assume the setting disables all profiles when it actually enables a specific profile; the exhibit's focus on a single profile (public) is the key detail to avoid misinterpreting the scope.

How to eliminate wrong answers

Option A is wrong because the setting specifically enables the firewall for the public profile, not disables it for all profiles; disabling all profiles would be a separate configuration. Option C is wrong because this setting controls Windows Firewall, not Microsoft Defender Antivirus real-time protection, which is managed under a different policy category (Endpoint Protection). Option D is wrong because the setting targets the public profile, not the domain profile; disabling the domain profile firewall would be a distinct policy choice and is not what is shown.

Full explanation →

935

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with a Trusted Platform Module (TPM) version 2.0 and Secure Boot enabled can access corporate email. What should you configure?

A.Create a compliance policy with device health rules.

B.Configure Windows Hello for Business with TPM requirement.

C.Create a conditional access policy that requires compliant device.

D.Create a device configuration policy to enable Secure Boot.

AnswerA

Correct. A compliance policy with device health rules can require TPM 2.0 and Secure Boot, ensuring devices meet hardware security requirements.

Why this answer

To ensure devices meet TPM 2.0 and Secure Boot requirements, create an Intune compliance policy with device health rules. This policy evaluates device health and marks devices compliant only when they meet the configured hardware requirements. Windows Hello for Business (Option B) is a passwordless sign-in method and does not restrict corporate email access based on Secure Boot or TPM.

Option C is incorrect because a conditional access policy only enforces an existing compliance state and does not define the TPM/Secure Boot health rules. Option D is incorrect because a device configuration policy applies settings but does not enforce compliance for accessing corporate email.

Exam trap

Do not choose a conditional access policy as the direct configuration for TPM and Secure Boot requirements. Conditional access can require a compliant device, but the hardware health rules must be defined in a compliance policy.

Full explanation →

936

MCQmedium

You are implementing Windows Autopilot for your organization. You need to ensure that during the first boot, the device automatically enrolls in Microsoft Intune and joins Microsoft Entra ID. What is the minimum requirement for the device?

A.The device must have a local administrator account.

B.The device must be joined to an on-premises Active Directory domain.

C.The device must have a TPM 2.0 chip.

D.The device must be registered in Autopilot with a valid profile.

AnswerD

Autopilot requires registration and profile assignment.

Why this answer

Windows Autopilot requires the device to be registered in the Autopilot service with a valid profile assigned. This profile contains the settings that dictate the out-of-box experience (OOBE), including automatic enrollment into Microsoft Intune and joining Microsoft Entra ID (formerly Azure AD). Without a registered Autopilot profile, the device will not trigger the automated enrollment and join process during first boot.

Exam trap

The trap here is that candidates often confuse hardware prerequisites (like TPM 2.0) with the mandatory requirement of a registered Autopilot profile, leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because a local administrator account is not a prerequisite for Autopilot; the device can be a standard user device and still enroll via Autopilot. Option B is wrong because Autopilot devices are designed to join Microsoft Entra ID directly, not an on-premises Active Directory domain; hybrid join is an optional configuration, not a minimum requirement. Option C is wrong because while TPM 2.0 is recommended for self-deploying mode and Windows Hello for Business, it is not a minimum requirement for user-driven Autopilot enrollment and Entra ID join; devices without TPM 2.0 can still use user-driven mode with password-based authentication.

Full explanation →

937

MCQhard

A company applies the above BitLocker policy to Windows 10 devices via Intune. An administrator discovers that some devices are not encrypting. The administrator checks a device and finds that it has no TPM chip. Which setting in the policy will cause encryption to fail?

A.requireTpm

B.recoveryKeyRotation

C.encryptionMethod

D.requireStartupPin

AnswerA

If requireTpm is true, devices without TPM will not encrypt.

Why this answer

The 'requireTpm' setting enforces that BitLocker will only start encryption if a Trusted Platform Module (TPM) chip is present on the device. If a device lacks a TPM, this policy setting causes the encryption process to fail outright, as BitLocker cannot meet the mandatory hardware requirement.

Exam trap

The trap here is that candidates may think 'requireStartupPin' is the direct cause of failure on a TPM-less device, but the policy's 'requireTpm' setting is evaluated first and will block encryption entirely before any PIN requirement is even considered.

How to eliminate wrong answers

Option B (recoveryKeyRotation) is wrong because it controls how often the recovery key is rotated in Azure AD, not whether encryption starts; it has no effect on TPM absence. Option C (encryptionMethod) is wrong because it specifies the algorithm (e.g., AES 128/256) used after encryption begins, not a prerequisite for starting encryption. Option D (requireStartupPin) is wrong because it requires a PIN at startup but still relies on a TPM to validate that PIN; without a TPM, this setting also fails, but the question asks which setting in the policy causes failure, and 'requireTpm' is the direct cause—if 'requireTpm' is set to 'true', encryption fails regardless of other settings.

Full explanation →

938

MCQhard

You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?

A.OS version is above the maximum allowed

B.Password minimum length is not met

C.Device threat protection level is below medium

D.TPM is not present

AnswerA

The device build 22621.1500 exceeds the maximum 22621.1000.

Why this answer

The compliance policy in the exhibit specifies a maximum OS version of 10.0.22621.1000, but the Windows 11 device is running build 10.0.22621.1500, which is above that maximum. Intune compares the device's OS version against the configured maximum OS version setting; if the device's version exceeds the maximum, it is marked as noncompliant. This setting is used to prevent devices with newer, potentially untested builds from accessing corporate resources.

Exam trap

The trap here is that candidates often assume noncompliance is due to missing security features like TPM or password policies, but the exhibit clearly shows a maximum OS version setting that the device's build exceeds, making it the direct cause.

How to eliminate wrong answers

Option B is wrong because the compliance policy does not include a password minimum length requirement, so the device cannot be noncompliant due to that setting. Option C is wrong because the policy does not configure a device threat protection level; the device threat protection setting is not present in the exhibit, so it cannot cause noncompliance. Option D is wrong because the policy does not require TPM presence; the TPM setting is not configured in the exhibit, so a missing TPM would not trigger noncompliance.

Full explanation →

939

MCQeasy

Your organization uses Microsoft Intune to manage Android devices. You need to deploy an app that is available in the Managed Google Play store as a required app. What must you do first?

A.Connect Intune to the Managed Google Play store.

B.Enroll the device in Intune.

C.Install the Managed Google Play app on the device.

D.Upload the app package to Intune.

AnswerA

You must establish the connection before you can browse and assign apps.

Why this answer

To deploy a required app from the Managed Google Play store, you must first establish the connection between Intune and the Managed Google Play store. This connection is a prerequisite because Intune uses it to synchronize apps, manage licenses, and push required apps to Android devices. Without this connection, Intune cannot access or deploy any apps from the Managed Google Play store.

Exam trap

The trap here is that candidates often think device enrollment (Option B) is the first step, but the connection to Managed Google Play must be established first because Intune cannot deploy any apps from the store without it.

How to eliminate wrong answers

Option B is wrong because enrolling the device in Intune is necessary for app deployment, but it is not the first step; the Intune-to-Managed Google Play connection must be established before any app deployment can occur. Option C is wrong because the Managed Google Play app is automatically installed on Android devices during the enrollment process when the connection is configured, so manually installing it is not a prerequisite. Option D is wrong because you do not upload app packages to Intune for Managed Google Play apps; instead, you approve and sync apps from the Managed Google Play store after the connection is established.

Full explanation →

940

MCQhard

An administrator deploys a Win32 app via Intune with detection rule 'File exists: C:\Program Files\MyApp\app.exe'. The app is reported as installed, but users cannot launch it. The file exists but is corrupted. How should the administrator modify the detection rule to ensure the app is correctly detected and re-installed if corrupted?

A.Remove the detection rule so Intune always re-installs the app

B.Add a registry detection rule for the app's uninstall key

C.Use a custom detection script that validates the file hash or signature

D.Change detection rule to 'File version comparison' and set minimum version

AnswerC

A script can verify integrity and return 0 only if valid.

Why this answer

A custom detection script can verify the file's integrity by checking its hash or digital signature, ensuring that even if the file exists, it is not corrupted. Intune's built-in detection rules only check for file existence or version, not file integrity. By using a script that validates the hash, the administrator can force a reinstall when the file is corrupted, as the detection will fail.

Exam trap

The trap here is that candidates assume 'File exists' or 'File version comparison' are sufficient for detection, overlooking that these rules do not validate file integrity, which is a common misconception in Intune app deployment scenarios.

How to eliminate wrong answers

Option A is wrong because removing the detection rule would cause Intune to always reinstall the app on every sync, leading to unnecessary bandwidth and user disruption, and it does not solve the corruption detection issue. Option B is wrong because adding a registry detection rule for the uninstall key only confirms the app was installed via the registry, not that the executable is uncorrupted; the uninstall key remains even if the file is corrupted. Option D is wrong because 'File version comparison' only checks the version number of the file, not its integrity; a corrupted file can still have the correct version metadata, so this would not trigger a reinstall.

Full explanation →

941

MCQmedium

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

A.Sync-IntuneDevice -DeviceId ...

B.Start-DeviceSync -DeviceName PC-001

C.Invoke-IntuneDeviceAction -DeviceId ... -Action Sync

D.Update-IntuneDevice -DeviceId ...

AnswerA

This cmdlet initiates a sync with Intune.

Why this answer

The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Exam trap

The trap here is that candidates often confuse Invoke-IntuneDeviceAction with a sync action because it supports many device actions, but they fail to recognize that the correct parameter value for a sync is 'SyncDevice' (not 'Sync'), and that Sync-IntuneDevice is the dedicated cmdlet for this purpose.

How to eliminate wrong answers

Option B is wrong because Start-DeviceSync is not a valid Microsoft Intune cmdlet; it does not exist in the Microsoft Graph or Intune PowerShell module. Option C is wrong because Invoke-IntuneDeviceAction is a valid cmdlet but it requires an -Action parameter with a value like 'SyncDevice', not just 'Sync', and it is used for remote device actions such as wipe or retire, not for triggering a policy sync. Option D is wrong because Update-IntuneDevice is not a standard Intune cmdlet; it may be confused with Update-AutopilotDevice or similar, but it does not perform a sync action.

Full explanation →

942

Multi-Selecteasy

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Select 2 answers

A.Web link

B.iOS/iPadOS app store app

C.Windows app (Win32)

D.Android Line-of-business app

E.iOS/iPadOS Line-of-business app

AnswersB, E

For apps available in the Apple App Store.

Why this answer

Microsoft Intune supports deploying iOS/iPadOS app store apps (option B) by integrating with the Apple Volume Purchase Program (VPP) or directly assigning public store apps via the Intune console. iOS/iPadOS line-of-business apps (option E) are custom-built apps that are uploaded as .ipa files and deployed to devices without going through the public App Store. Both are native app types for iOS/iPadOS management in Intune.

Exam trap

The trap here is that candidates often confuse web links (shortcuts) with actual app deployments, or mistakenly think platform-specific app types like Win32 or Android LOB can be cross-deployed, but Intune strictly enforces app type per OS platform.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 901–942