Courseiva

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 76–150

942 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 13

Page 3
76
Multi-Selecthard

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy an app that requires a VPN configuration when the app is launched. Which TWO options can you use to achieve this? (Choose two.)

Select 2 answers
A.Use a managed app configuration to include VPN settings.
B.Use a device compliance policy to require VPN.
C.Assign an app protection policy that enables VPN.
D.Create a device-wide VPN configuration profile.
E.Create a per-app VPN configuration profile and assign it to the app.
AnswersA, E

Managed app configuration can include VPN settings to apply when the app launches.

Why this answer

Options A and E are correct. A per-app VPN configuration profile (E) can be assigned to the app to trigger VPN on launch. Alternatively, a managed app configuration (A) can include VPN settings to enable per-app VPN.

Option B is incorrect because a device compliance policy cannot configure VPN settings. Option C is incorrect because app protection policies do not manage VPN connectivity. Option D is incorrect because a device-wide VPN profile applies to all traffic and does not restrict to specific apps.

Full explanation →
77
MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are stuck in a reboot loop. The administrator needs to identify devices affected by the issue. Which report in the Microsoft Intune admin center should the administrator use?

A.Windows Update report
B.Update compliance report
C.Device compliance report
D.Device inventory report
AnswerA

Windows Update report provides details on update deployment, including restart status.

Why this answer

The Windows Update report in the Microsoft Intune admin center provides detailed information about Windows 10 update deployments, including devices that are stuck in a reboot loop after an update. This report shows update status, errors, and pending reboots, allowing the administrator to identify affected devices and take remediation actions.

Exam trap

The trap here is that candidates often confuse the 'Update compliance report' (which is an Azure Monitor solution for broad update compliance) with the Intune-native 'Windows Update report' that specifically tracks update deployment status and reboot issues, leading them to select the wrong option.

How to eliminate wrong answers

Option B is wrong because the Update compliance report is a feature of Azure Monitor and Windows Analytics, not a native Intune report; it focuses on overall update compliance across devices but does not specifically highlight reboot loop issues. Option C is wrong because the Device compliance report shows compliance status against policies (e.g., encryption, antivirus) and does not track update-related reboot failures. Option D is wrong because the Device inventory report lists hardware and software details (e.g., OS version, installed apps) but does not include update status or reboot loop information.

Full explanation →
78
MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically install critical updates from Windows Update for Business within 3 days of release. Which configuration should you use?

A.Windows Autopatch deployment policy
B.Windows feature update policy
C.Device configuration policy for Windows 10/11
D.Update rings for Windows 10 and later
AnswerD

Update rings allow configuring deferral periods for quality updates.

Why this answer

Update rings for Windows 10 and later allow you to configure Windows Update for Business settings, including the ability to set a deadline for quality updates. By configuring the 'Quality update deferral period (days)' to 0 and the 'Deadline for quality updates (days)' to 3, devices are forced to install critical updates within 3 days of release. This is the correct policy to enforce automatic installation of critical updates within a specific timeframe.

Exam trap

The trap here is that candidates often confuse 'Update rings' with 'Device configuration policies' or 'Feature update policies,' mistakenly thinking that general device configuration or feature update policies can enforce quality update deadlines, when only Update rings provide the specific deadline and deferral settings for quality updates.

How to eliminate wrong answers

Option A is wrong because Windows Autopatch deployment policy is a service that automates the entire update process, but it does not allow granular control over the installation deadline for critical updates within 3 days; it uses its own schedules. Option B is wrong because a Windows feature update policy is used to manage feature updates (e.g., version upgrades), not critical/quality updates. Option C is wrong because a Device configuration policy for Windows 10/11 manages device settings and compliance, but it does not include the specific update deadline settings needed to enforce installation within 3 days; those settings are only available in Update rings.

Full explanation →
79
MCQhard

Refer to the exhibit. You run this Microsoft Graph PowerShell command to retrieve managed devices. The output shows a device with a lastSyncDateTime of 5 days ago. What does this indicate?

A.The device was enrolled 5 days ago.
B.The device is non-compliant.
C.The device is unenrolled.
D.The device has not communicated with Intune for 5 days.
AnswerD

lastSyncDateTime indicates the last check-in time.

Why this answer

The `lastSyncDateTime` property in Microsoft Graph for Intune-managed devices indicates the most recent time the device successfully checked in with the Intune service. A value of 5 days ago means the device has not communicated with Intune for 5 days, which could be due to network issues, device inactivity, or configuration problems. This does not inherently mean the device is non-compliant or unenrolled—it simply reflects the last successful sync.

Exam trap

The trap here is that candidates often confuse `lastSyncDateTime` with enrollment date or compliance status, leading them to incorrectly assume the device is non-compliant or unenrolled, when in fact it simply indicates the last successful communication with Intune.

How to eliminate wrong answers

Option A is wrong because `lastSyncDateTime` records the last successful sync with Intune, not the enrollment date; enrollment date is tracked by the `enrolledDateTime` property. Option B is wrong because a device can be non-compliant for many reasons (e.g., missing required updates, jailbreak detection) and a stale sync date alone does not determine compliance—compliance is evaluated based on policy conditions, not sync recency. Option C is wrong because an unenrolled device would not appear in the managed devices list at all; the `lastSyncDateTime` field would be absent or the device would be removed from the inventory.

Full explanation →
80
MCQhard

Refer to the exhibit. A Windows 11 device assigned to this update ring is running a released version. What is the immediate behavior after the policy applies?

A.The device will uninstall the current Insider build and revert to the released version.
B.The device will be offered the latest Windows Insider Dev Channel build.
C.The device will defer all updates by 10 days.
D.The device will install the latest released quality update immediately.
AnswerB

Correct. The servicing channel directs the device to Dev Channel builds.

Why this answer

The exhibit shows an update ring policy configured with the 'Windows Insider Program' enabled and the 'Insider Channel' set to 'Dev Channel'. Since the device is currently on a released version, applying this policy will enroll it in the Windows Insider Program and offer the latest Dev Channel build. This is the immediate behavior because the policy triggers a check for the specified Insider build, not a deferral or quality update.

Exam trap

The trap here is that candidates may confuse the 'Deferral' settings with Insider build behavior, assuming deferral periods apply to Insider builds, when in fact enabling the Insider Program overrides deferrals for feature updates and directly offers the specified channel's build.

How to eliminate wrong answers

Option A is wrong because the policy does not uninstall the current build; it enrolls the device in the Insider Program, which offers a new build without reverting the existing OS. Option C is wrong because the policy explicitly enables Insider builds, overriding any deferral settings; deferrals apply to quality updates, not feature updates from Insider channels. Option D is wrong because the policy targets Insider Dev Channel builds, not released quality updates; quality updates are managed separately via deferral periods or other policies.

Full explanation →
81
Multi-Selectmedium

Which TWO prerequisites are required for Windows Autopilot self-deploying mode? (Choose two.)

Select 2 answers
A.A user account with Intune license
B.A Windows product key
C.MDM user affinity
D.TPM 2.0 chip
E.Network connectivity to Microsoft Intune
AnswersD, E

TPM 2.0 is required for hardware attestation.

Why this answer

Options D and E are correct. Self-deploying mode requires a physical TPM 2.0 chip for attestation and network connectivity to Microsoft Intune. Option A is wrong because a user account is not required.

Option B is wrong because a product key is not needed. Option C is wrong because MDM user affinity is not required.

Full explanation →
82
MCQhard

Refer to the exhibit. An Intune administrator finds this configuration on a Windows 10 device. What is the purpose of this setting?

A.Define the Intune MDM discovery URL
B.Set the compliance policy evaluation URL
C.Configure Windows Update service endpoint
D.Specify the Microsoft Defender ATP tenant
AnswerA

This CSP sets the MDM enrollment server URL for Intune.

Why this answer

It defines the Intune MDM discovery URL, which is used by the device to locate the Intune service for enrollment and management. Option B is incorrect because the compliance policy evaluation URL is different. Option C is incorrect because the Windows Update service endpoint is separate.

Option D is incorrect because the URL is for MDM, not Defender ATP.

Full explanation →
83
Multi-Selectmedium

You are troubleshooting a Windows 11 device that fails to install a required Win32 app deployed via Intune. Which THREE logs or locations should you review?

Select 3 answers
A.Windows Update log (C:\Windows\WindowsUpdate.log)
B.Intune Management Extension logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs
C.The IntuneManagementExtension.log file in the agent directory.
D.Windows Registry under HKLM\Software\Microsoft\Intune
E.Windows Event Logs under Applications and Services Logs > Microsoft > Windows > AppLocker
AnswersB, C, E

These logs detail app installation attempts.

Why this answer

The Intune Management Extension (IME) is the agent responsible for processing Win32 app deployments on Windows 11 devices. Its logs, located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs, provide detailed information about the download, detection, and installation phases of Win32 apps, making them the primary source for troubleshooting installation failures.

Exam trap

The trap here is that candidates confuse the Intune Management Extension logs with the Windows Update log, assuming all app installations use the same logging mechanism, but Win32 apps rely solely on the IME agent, not Windows Update.

Full explanation →
84
Multi-Selectmedium

Which TWO actions can you perform using Microsoft Intune to manage Windows 10 devices?

Select 2 answers
A.Create local user accounts on the device
B.Remotely wipe a device
C.Configure DHCP settings
D.Apply BitLocker encryption policies
E.Add the device to an Active Directory group
AnswersB, D

Intune supports remote wipe.

Why this answer

Microsoft Intune supports a remote wipe action that can be triggered from the Intune console to reset a Windows 10 device to factory settings or selectively remove corporate data. This is a core device management capability used for data protection when a device is lost or stolen, leveraging the Windows 10 reset functionality via the Intune management channel.

Exam trap

The trap here is that candidates often confuse Intune's device management capabilities with on-premises Group Policy or Active Directory tasks, leading them to incorrectly select options like creating local users or managing DHCP, which are outside Intune's scope.

Full explanation →
85
MCQmedium

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

A.Set up a device compliance policy in Microsoft Purview to block non-compliant devices.
B.Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.
C.Configure a device filter in Exchange Online to block devices that are not managed by Intune.
D.Deploy an email security policy via Intune to block access from non-compliant devices.
AnswerB

This correctly combines Intune compliance with Entra ID Conditional Access to block non-compliant devices.

Why this answer

Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.

Exam trap

The trap here is that candidates confuse device compliance enforcement with email security profiles or legacy device filters, not realizing that Conditional Access in Entra ID is the only modern, cloud-native method to gate access based on Intune compliance for Exchange Online.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview is a compliance and data governance solution, not a device access control tool; it does not enforce device compliance for email access. Option C is wrong because Exchange Online device filters are legacy and only block devices based on properties like device type or OS, not compliance status managed by Intune. Option D is wrong because Intune email security policies configure email profile settings (e.g., server, encryption) on managed devices but do not block access from non-compliant devices at the authentication layer.

Full explanation →
86
MCQeasy

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

A.Assign a driver update policy.
B.Assign a quality update policy.
C.Assign an update ring for Windows 10.
D.Assign a Windows 10/11 feature update policy.
AnswerD

Feature update policies are used to upgrade Windows 10 to Windows 11.

Why this answer

A Windows 10/11 feature update policy in Microsoft Intune is specifically designed to manage the upgrade of Windows 10 devices to Windows 11. This policy uses Windows Update for Business to deliver the feature update (e.g., Windows 11 23H2) and automatically applies it to devices that meet the hardware requirements, ensuring a controlled upgrade process.

Exam trap

The trap here is that candidates confuse 'update rings' (which control update behavior like deferrals and deadlines) with 'feature update policies' (which actually push the OS version upgrade), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because a driver update policy only manages driver updates, not OS version upgrades; it cannot trigger a Windows 11 feature update. Option B is wrong because a quality update policy handles cumulative security and non-security patches (e.g., monthly updates), not feature updates that change the OS version. Option C is wrong because an update ring for Windows 10 configures deferral and update behavior for Windows 10 updates but does not initiate a feature upgrade to Windows 11; it only controls how existing Windows 10 updates are applied.

Full explanation →
87
Multi-Selecthard

Which FOUR of the following are valid detection rules for a Win32 app in Intune?

Select 4 answers
A.PowerShell script (custom detection)
B.MSI product code
C.Registry (key or value exists)
D.File system (file or folder exists)
E.Network share access
AnswersA, B, C, D

PowerShell script (custom detection) is a valid detection rule for Win32 apps.

Why this answer

For Win32 apps in Intune, the valid detection rules are: PowerShell script (custom detection), MSI product code, Registry (key or value exists), and File system (file or folder exists). Network share access is not a detection rule. Therefore, options A, B, C, and D are correct.

Exam trap

Candidates may mistakenly think network share access is a valid detection rule, but it is not.

Full explanation →
88
Multi-Selecthard

Which TWO are required to enable Windows Hello for Business in a hybrid deployment? (Select TWO.)

Select 2 answers
A.Configuration Manager
B.Microsoft Entra ID Connect
C.Public Key Infrastructure (PKI)
D.Multifactor authentication (MFA)
E.Microsoft Intune
AnswersB, C

Synchronizes on-premises AD with Microsoft Entra ID.

Why this answer

In a hybrid deployment, Windows Hello for Business requires synchronization of user credentials from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID Connect (B) provides this synchronization, enabling the device to authenticate against both on-premises and cloud resources. Additionally, a Public Key Infrastructure (PKI) (C) is required to issue the certificate-based authentication keys used by Windows Hello for Business in hybrid deployments, as the on-premises domain controllers must trust the certificates.

Exam trap

The trap here is that candidates often confuse prerequisites (like MFA) with required infrastructure components, leading them to select MFA instead of recognizing that PKI and directory synchronization are the two mandatory elements for hybrid deployments.

Full explanation →
89
MCQmedium

Your organization has 500 Windows 11 devices managed by Microsoft Intune. You need to deploy a third-party Win32 application (AppDeploy.exe) that requires the user to accept an end-user license agreement (EULA) during installation. The app must be installed silently without user interaction. You have created a custom script that accepts the EULA automatically. The app is packaged as an .intunewin file. You need to configure the deployment in Intune. The installation command must run the script that accepts the EULA and then launches the installer. The detection rule must check for the presence of a specific file (C:\Program Files\AppDeploy\app.exe). You want to ensure that if the installation fails, Intune retries automatically. Which of the following configurations should you choose?

A.Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1 && AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: 3 attempts every 60 minutes
B.Install command: 'AppDeploy.exe /S', Detection rule: Registry 'HKLM\Software\AppDeploy\Installed' exists, Retry: 3 attempts every 60 minutes
C.Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None
D.Install command: 'AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None
AnswerA

Chains EULA acceptance and silent install; retry configured.

Why this answer

The install command uses a PowerShell script to first accept the EULA (AcceptEULA.ps1), then runs the installer silently with AppDeploy.exe /S. The detection rule checks for the file at C:\Program Files\AppDeploy\app.exe, which verifies installation. The retry settings (3 attempts every 60 minutes) ensure automatic retry on failure.

Option B is wrong because it does not include the EULA acceptance. Option C is wrong because it only runs the script without launching the installer, so the app never installs. Option D is wrong because it has no retry settings.

Full explanation →
90
MCQeasy

An IT administrator needs to ensure that iOS devices enrolled in Intune require a PIN of at least 6 digits. Where should the administrator configure this setting?

A.App protection policy
B.Device compliance policy for iOS
C.Conditional Access policy
D.Enrollment restrictions
AnswerB

Compliance policies include device health and security settings like PIN length.

Why this answer

Evice compliance policy for iOS. Device compliance policies can enforce device-level settings such as requiring a PIN of at least 6 digits on iOS devices. Option A (App protection policy) applies to apps, not device-level PIN.

Option C (Conditional Access policy) controls access based on conditions, not device settings. Option D (Enrollment restrictions) governs device enrollment, not post-enrollment settings.

Full explanation →
91
MCQeasy

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

A.Proactive remediations
B.PowerShell scripts (Devices > Scripts)
C.Compliance policy
D.Device configuration profile
AnswerB

PowerShell scripts in Intune can run in the system context.

Why this answer

PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Exam trap

A common misconception is that Proactive remediations can replace custom PowerShell scripts. However, Proactive remediations require both a detection script and a remediation script, and are designed for automatic remediation of specific issues, not for general script deployment. Custom PowerShell scripts (Devices > Scripts) are the correct choice for deploying a standalone script under the SYSTEM account.

How to eliminate wrong answers

Option A is wrong because Proactive remediations are used for detecting and fixing common support issues with built-in detection and remediation scripts, not for deploying custom PowerShell scripts under the SYSTEM account. Option C is wrong because Compliance policies evaluate device settings against defined rules and do not execute scripts. Option D is wrong because Device configuration profiles manage settings via CSPs (Configuration Service Providers) and cannot run arbitrary PowerShell scripts.

Full explanation →
92
MCQeasy

You need to remotely wipe a lost corporate-owned iOS device enrolled in Microsoft Intune. The device is currently offline. What will happen when the device comes online?

A.The device must be unenrolled first and then wiped.
B.The device will be wiped immediately after a grace period of 24 hours.
C.The device will receive the wipe command the next time it checks in with Intune.
D.The wipe command will be queued only if the device is supervised.
AnswerC

Intune stores the command and delivers it on next device check-in.

Why this answer

When a remote wipe command is issued for an offline iOS device enrolled in Microsoft Intune, the command is stored in the Microsoft Intune service. The device will receive and execute the wipe command the next time it checks in with the Intune service, regardless of whether it is supervised or not. This check-in occurs periodically (typically every 8 hours) or when the device is powered on and connected to the internet.

Exam trap

The trap here is that candidates often confuse the offline wipe behavior with a mandatory grace period or think that supervision is required for remote wipe, when in fact Intune queues the command and executes it on the next check-in for any enrolled iOS device.

How to eliminate wrong answers

Option A is wrong because there is no requirement to unenroll the device before a remote wipe; the wipe command itself triggers the removal of management and corporate data. Option B is wrong because there is no built-in 24-hour grace period for offline wipe commands in Intune; the wipe executes immediately upon the next check-in, not after a fixed delay. Option D is wrong because the wipe command is not queued only for supervised devices; both supervised and unsupervised iOS devices can receive and execute a remote wipe command when they come online.

Full explanation →
93
MCQhard

Your organization uses Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive data from SharePoint Online to unmanaged devices. Which policy type should you use?

A.Activity policy
B.App discovery policy
C.Access policy
D.Session policy
AnswerD

Session policies can block downloads in real-time.

Why this answer

Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on app and device context. By configuring a session policy with the condition 'Device tag equals Unmanaged' and the control 'Block download', you can automatically block downloads of sensitive data from SharePoint Online to unmanaged devices, leveraging reverse proxy architecture to inspect and intercept traffic.

Exam trap

The trap here is confusing Access policies (which control sign-in and token issuance) with Session policies (which control in-session actions like downloads), leading candidates to incorrectly choose Access policy when the question explicitly requires blocking a specific file operation on unmanaged devices.

How to eliminate wrong answers

Option A is wrong because Activity policies are used for post-event detection and alerting on specific user activities (e.g., multiple failed logins), not for real-time blocking of downloads based on device compliance. Option B is wrong because App discovery policies analyze cloud app usage and shadow IT, not control data exfiltration from managed apps like SharePoint Online. Option C is wrong because Access policies control authentication and access (e.g., requiring MFA or blocking sign-in) but do not provide granular, session-level controls like blocking file downloads within an already authenticated session.

Full explanation →
94
Multi-Selectmedium

A company uses Microsoft Intune to manage Windows 10 devices. Users report that some required line-of-business (LOB) apps are not being installed on their devices. The apps are assigned as 'Required' to a device group that includes the affected devices. Which two actions should the administrator take to troubleshoot the issue? (Choose two.)

Select 2 answers
A.Review the Intune Management Extension logs on a device for installation errors.
B.Uninstall the app from the affected devices and reassign it as Required.
C.Check the device’s last check-in time and perform a manual sync from the Intune console.
D.Reassign the app to the device group with a different assignment type.
E.Run gpresult /r on a device to confirm the app assignment policy is applied.
AnswersA, C

Logs provide detailed error messages.

Why this answer

The Intune Management Extension (IME) is the component responsible for deploying Win32 and line-of-business (LOB) apps on Windows 10 devices. Reviewing its logs (located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs) provides detailed error messages, such as download failures, dependency issues, or script execution errors, which directly indicate why a required app failed to install.

Exam trap

The trap here is that candidates confuse Intune MDM app deployment with traditional Group Policy Software Installation (GPSI) and incorrectly choose gpresult /r, not realizing Intune uses the IME and MDM channel, not Active Directory Group Policy.

Full explanation →
95
MCQhard

Refer to the exhibit. A Windows 10 device with OS build 10.0.19041.1 is evaluated against this compliance policy. The device meets all settings except one: the OS version is 10.0.19041.1, which is below the minimum 10.0.19041.0? Actually it is above. But wait, the device has BitLocker enabled, Secure Boot enabled, and firewall enabled. Which setting will cause the device to be non-compliant?

A.BitLocker is not enabled on the device.
B.Antivirus signatures are out of date.
C.Secure Boot is not enabled on the device.
D.The firewall is not enabled on the device.
AnswerB

The policy requires signatureOutOfDate: false, meaning signatures must be up to date.

Why this answer

The compliance policy requires antivirus signatures to be up to date. Since the device meets all other settings (BitLocker enabled, Secure Boot enabled, firewall enabled, and OS version 10.0.19041.1 is above the minimum 10.0.19041.0), the only remaining setting that can cause non-compliance is outdated antivirus signatures. In Microsoft Intune, the 'Antivirus' compliance rule checks for the presence and recency of signature updates via Windows Defender or a third-party AV, and if signatures are older than the configured threshold, the device is marked non-compliant.

Exam trap

The trap here is that candidates assume the OS version check is the cause of non-compliance because the version number appears close to the minimum, but the device's OS build 10.0.19041.1 is actually above the minimum 10.0.19041.0, so the only remaining non-compliant setting is the antivirus signature age.

How to eliminate wrong answers

Option A is wrong because the exhibit states BitLocker is enabled, so this setting is compliant. Option C is wrong because Secure Boot is enabled on the device, meeting the policy requirement. Option D is wrong because the firewall is enabled, satisfying the policy's firewall rule.

Full explanation →
96
MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a PKG app that requires reboot. Which app type should you select?

A.macOS LOB app
B.macOS web app
C.Microsoft 365 for macOS
D.macOS DMG app
AnswerA

Supports PKG and scripts for reboot.

Why this answer

A macOS LOB (line-of-business) app type is required because Intune uses this type to deploy PKG files that can include installation scripts and handle reboots. The LOB app type supports the .pkg format natively and allows Intune to manage the installation lifecycle, including required reboots, through the Intune management agent on macOS.

Exam trap

The trap here is that candidates often confuse PKG with DMG, assuming both are handled by the same app type, but Intune requires the LOB app type specifically for PKG files that need installation scripts and reboot handling.

How to eliminate wrong answers

Option B is wrong because a macOS web app type is used to deploy web links or shortcuts, not native PKG installations that require a reboot. Option C is wrong because Microsoft 365 for macOS is a specific app type for deploying the Office suite, not for arbitrary PKG apps. Option D is wrong because a macOS DMG app type is used for .dmg disk images, which are mounted and then the app is copied; it does not support PKG-based installations or handle reboots.

Full explanation →
97
MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy a custom configuration profile to configure Wi-Fi settings for corporate devices. Which method should you use?

A.Use a Microsoft Entra ID (Azure AD) device configuration policy.
B.Use a PowerShell script to apply the settings.
C.Use a custom configuration profile in Intune.
D.Use a Microsoft Defender for Endpoint security policy.
AnswerC

Custom profiles allow deploying settings not available in built-in templates.

Why this answer

Intune's custom configuration profile allows you to deploy Apple Configurator–generated .mobileconfig files or custom XML/PLIST settings that are not available in the built-in Wi-Fi policy. This is the only method in Intune that supports arbitrary key-value pairs for iOS Wi-Fi configurations, such as EAP-TLS with specific certificate requirements or advanced proxy settings.

Exam trap

The trap here is that candidates confuse custom configuration profiles with built-in Wi-Fi policies, not realizing that advanced Wi-Fi settings (e.g., custom EAP types, proxy PAC URLs, or per-connection VPN) require a .mobileconfig file rather than the simple UI-based Wi-Fi policy.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID device configuration policies are used for identity and access management, not for deploying device-level Wi-Fi settings. Option B is wrong because PowerShell scripts cannot run on iOS devices; they are only supported on Windows, macOS, and Linux managed by Intune. Option D is wrong because Microsoft Defender for Endpoint security policies focus on threat protection and vulnerability management, not on configuring network connectivity settings like Wi-Fi profiles.

Full explanation →
98
MCQeasy

A user reports that their Windows 10 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which of the following is the most likely cause?

A.The device has not checked in with Intune recently.
B.The MDM authority is set to Configuration Manager.
C.The compliance policy is set to 'Not applicable' due to OS version.
D.BitLocker encryption is enabled on the device.
AnswerA

The device must sync to receive and evaluate policies.

Why this answer

A device must check in with Intune to receive and report compliance policies. The 'Not evaluated' status indicates that Intune has not received a recent health check from the device. The default check-in interval is approximately 8 hours, but it can be forced manually via Settings > Accounts > Access work or school > Info > Sync or by running the command 'dsregcmd /sync'.

Exam trap

The trap here is that candidates often confuse 'Not evaluated' with 'Not applicable' or think that a device configuration issue (like BitLocker) would prevent evaluation, when in fact the root cause is simply a missing check-in.

How to eliminate wrong answers

Option B is wrong because setting the MDM authority to Configuration Manager would mean the device is managed by ConfigMgr, not Intune, and compliance policies would be evaluated by ConfigMgr, not Intune—this would not cause a 'Not evaluated' status in Intune; the device would simply not appear as an Intune-managed device. Option C is wrong because if a compliance policy is set to 'Not applicable' due to OS version, the device would show a status of 'Not applicable' or 'Compliant' (if no other policies apply), not 'Not evaluated'. Option D is wrong because BitLocker encryption being enabled does not prevent compliance evaluation; in fact, BitLocker is a common compliance setting that Intune can check, and its status would be reported during a check-in.

Full explanation →
99
MCQhard

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the system context during automatic enrollment. The script must run before the user logs on. Which approach should you use?

A.Add the script as a device management extension (PowerShell script) in Intune, assigned to 'All Devices'.
B.Assign the script as a compliance policy remediation.
C.Deploy the script as a proactive remediation in Microsoft Intune.
D.Embed the script in a device configuration profile using a custom OMA-URI.
AnswerA

Device management extension scripts run in system context during enrollment.

Why this answer

Device management extension (PowerShell scripts) in Microsoft Intune run in the system context and execute during automatic enrollment before the user logs on. This is the only Intune method that supports system-context script execution at enrollment time without requiring a user session.

Exam trap

The trap here is that candidates confuse proactive remediations (which also run PowerShell scripts) with device management extension scripts, not realizing that proactive remediations require a user session and are intended for post-enrollment health checks, not pre-logon provisioning.

How to eliminate wrong answers

Option B is wrong because compliance policy remediations run only after the device has been evaluated for compliance, which occurs after enrollment and user logon, not before. Option C is wrong because proactive remediations are designed for ongoing detection and remediation of common support issues, not for first-run deployment during automatic enrollment. Option D is wrong because custom OMA-URI profiles are used to configure device settings via CSPs, not to execute PowerShell scripts in the system context.

Full explanation →
100
Multi-Selectmedium

An Intune administrator needs to ensure that Windows 10 devices are compliant with security requirements. Which TWO options are valid compliance settings for Windows 10?

Select 2 answers
A.Device category must be 'Corporate'
B.Device enrollment type must be 'Corporate'
C.Require BitLocker
D.Minimum OS version
E.Require app protection policy
AnswersC, D

BitLocker is a built-in compliance setting for Windows 10.

Why this answer

Require BitLocker is a valid compliance setting in Microsoft Intune for Windows 10 devices. It ensures that BitLocker drive encryption is enabled on the system drive, which is a critical security requirement for data protection. This setting can be enforced via a compliance policy to mark devices as noncompliant if encryption is not active.

Exam trap

The trap here is that candidates confuse device-level compliance settings (like OS version and BitLocker) with enrollment properties (device category, enrollment type) or app-level policies (app protection policy), which are managed in different policy types within Intune.

Full explanation →
101
MCQhard

Refer to the exhibit. You have an Intune configuration that includes a compliance policy and a device configuration policy for Windows 10 devices. You deploy both policies to a group of devices. After deployment, some devices are marked as non-compliant even though they have BitLocker enabled and Windows Defender Antivirus running. Which setting is most likely causing the conflict?

A.The compliance policy requires password, but the device configuration policy does not configure any password settings, leading to non-compliance.
B.The compliance policy requires encryption, but the device configuration policy does not enforce BitLocker startup PIN, causing compliance failure.
C.The device configuration policy sets scanParameter to 'fullscan', which may interfere with compliance checks.
D.The compliance policy requires Defender, but the device configuration policy sets cloudBlockLevel to 'high', which may conflict with some devices.
AnswerA

The compliance policy requires a password, but the device configuration policy does not set a password policy, so devices may not have a compliant password.

Why this answer

The compliance policy requires a password, but the device configuration policy does not configure any password settings. In Intune, compliance policies evaluate device settings independently of configuration policies; if a compliance policy mandates a password and the device lacks one (because the configuration policy doesn't enforce it), the device will be marked non-compliant. BitLocker and Defender being enabled do not satisfy a password requirement, so the conflict is the missing password configuration.

Exam trap

The trap here is that candidates assume enabling BitLocker and Defender automatically satisfies all compliance requirements, but Intune compliance policies evaluate each setting independently, so a missing password configuration will cause non-compliance even if other security features are present.

How to eliminate wrong answers

Option B is wrong because the compliance policy requires encryption, not a BitLocker startup PIN; the device configuration policy not enforcing a startup PIN does not cause compliance failure if BitLocker is enabled and encryption is satisfied. Option C is wrong because the scanParameter setting in a device configuration policy does not interfere with compliance checks; compliance policies evaluate security state, not scan parameters. Option D is wrong because cloudBlockLevel set to 'high' in a device configuration policy does not conflict with a compliance policy requiring Defender; both can coexist without causing non-compliance.

Full explanation →
102
Multi-Selectmedium

Which TWO Intune policies can be used to enforce encryption on macOS devices?

Select 2 answers
A.Device Compliance policy that requires BitLocker.
B.Device Compliance policy that requires Disk Encryption.
C.Device Configuration policy (Device Restrictions) for Disk Encryption.
D.Device Configuration policy (Endpoint Protection) for FileVault.
E.Device Compliance policy that requires FileVault.
AnswersD, E

This policy configures FileVault settings.

Why this answer

FileVault is the native full-disk encryption solution for macOS, and Intune's Device Configuration policy (Endpoint Protection) provides a dedicated profile to enable and enforce FileVault encryption. Option E is correct because a Device Compliance policy can also require FileVault encryption as a compliance setting, allowing conditional access to block non-compliant devices.

Exam trap

The trap here is that candidates confuse the generic 'Disk Encryption' term with the macOS-specific FileVault, or assume that BitLocker (a Windows-only feature) can be applied to macOS, leading them to select options A or B instead of the correct FileVault-based answers.

Full explanation →
103
Multi-Selecteasy

You need to deploy Windows updates to a group of devices using Microsoft Intune. Which TWO policies should you configure to ensure updates are applied within a maintenance window?

Select 2 answers
A.Assignment filter
B.Device compliance policy
C.Windows 10 and later update ring
D.Windows 10 and later quality update
E.Windows 10 and later feature update
AnswersC, E

Update rings manage update deferral, deadline, and maintenance windows.

Why this answer

(Windows 10 and later update ring) is correct because update rings in Microsoft Intune allow you to configure a maintenance window by setting the 'Active hours start' and 'Active hours end' values, which define a period during which updates are deferred and applied outside of those hours. This ensures updates are installed only during the specified maintenance window, aligning with the requirement to control update timing.

Exam trap

The trap here is that candidates may confuse 'Windows 10 and later quality update' (a non-existent policy) with the actual quality update settings within an update ring, or assume that a device compliance policy can enforce update timing, when in fact only update rings provide the maintenance window configuration.

Full explanation →
104
Multi-Selectmedium

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a PowerShell script that runs in the user context during device enrollment. Which two conditions must be met? (Select TWO.)

Select 2 answers
A.The script must be assigned to the user scope.
B.The script must be saved as a .psm1 file.
C.The script must be assigned to device groups.
D.The script must be signed with a trusted certificate.
E.The script must be added via a custom OMA-URI policy.
AnswersA, D

User context scripts must be assigned to user groups.

Why this answer

PowerShell scripts deployed via Microsoft Intune that run in the user context must be assigned to user groups (user scope). When a script is assigned to users, it executes under the user's security context during enrollment, allowing access to user-specific resources and settings. Assigning to device groups would run the script in the system context, which does not satisfy the requirement for user-context execution.

Exam trap

The trap here is that candidates often confuse user-context script assignment with device-context assignment, mistakenly thinking device groups can also run scripts in the user context, or they overlook the signing requirement because Intune does not enforce it unless the device's local execution policy demands it.

Full explanation →
105
Multi-Selectmedium

Which TWO conditions must be met for a Windows 10 device to be considered compliant with an Intune compliance policy that requires BitLocker and Secure Boot?

Select 2 answers
A.TPM is present and enabled.
B.Secure Boot is enabled.
C.All fixed drives are encrypted with BitLocker.
D.Windows Defender Antivirus is active.
E.BitLocker is enabled on the system drive.
AnswersB, E

Secure Boot is a required setting.

Why this answer

Secure Boot is a required condition in an Intune compliance policy that mandates Secure Boot. Intune checks that Secure Boot is enabled on the device to ensure that only trusted firmware and OS components are loaded during startup, which is a core security requirement for compliance.

Exam trap

The trap here is that candidates often assume 'BitLocker enabled' means all drives must be encrypted, but Intune's compliance policy specifically only requires encryption on the system drive, not all fixed drives.

Full explanation →
106
MCQhard

You are the endpoint administrator for Contoso, Ltd., a company with 10,000 employees. The environment includes Windows 10/11 devices, iOS/iPadOS, and Android Enterprise devices. The company recently acquired a subsidiary that uses non-compliant Android devices. The security team mandates that all devices must have encryption enabled and a PIN of at least 6 digits. Additionally, the company wants to use Microsoft Defender for Endpoint on all Windows devices. Currently, only 60% of devices are enrolled in Intune. The CIO wants to increase enrollment to 95% within 6 months. You need to design a device preparation strategy. Which approach should you recommend?

A.Deploy Windows Autopilot for all new devices and ignore existing devices.
B.Purchase a third-party MDM tool to manage non-compliant devices.
C.Ask all users to manually enroll their devices using the Company Portal app.
D.Configure automatic enrollment via Microsoft Entra ID for Windows devices, deploy conditional access policies that require compliance for iOS/Android, and run a communications campaign to drive enrollment.
AnswerD

This leverages automation and policy enforcement to increase enrollment.

Why this answer

It leverages Microsoft Entra ID automatic enrollment for Windows devices (via Group Policy or MDM discovery), which scales enrollment without user intervention, and uses Conditional Access policies to enforce compliance for iOS/Android devices, requiring encryption and a 6-digit PIN. This approach addresses the 95% enrollment target within 6 months by combining automated enrollment, compliance enforcement, and user awareness, while also integrating Microsoft Defender for Endpoint for Windows devices.

Exam trap

The trap here is that candidates may assume manual enrollment (Option C) is sufficient, overlooking the scalability and enforcement capabilities of automatic enrollment and Conditional Access, which are essential for achieving high enrollment rates in a large enterprise with mixed device platforms.

How to eliminate wrong answers

Option A is wrong because ignoring existing devices leaves 40% of the current fleet unmanaged, failing to meet the 95% enrollment target; Windows Autopilot is only for new devices and does not address existing non-compliant Android devices. Option B is wrong because purchasing a third-party MDM tool introduces unnecessary cost and complexity, and does not integrate with Intune or Microsoft Defender for Endpoint, which is required for Windows devices; the goal is to increase Intune enrollment, not replace it. Option C is wrong because relying solely on manual enrollment via Company Portal is inefficient and unlikely to achieve 95% enrollment within 6 months, as it depends on user initiative and does not enforce compliance for non-compliant Android devices.

Full explanation →
107
MCQhard

You manage iOS devices with Microsoft Intune. You need to deploy an app that is not available in the Apple App Store. The app is developed internally and signed with an enterprise certificate. Which app type should you use?

A.iOS/iPadOS app store app
B.Web link
C.Built-in app
D.iOS/iPadOS Line-of-business app
AnswerD

LOB apps are for custom or in-house iOS apps.

Why this answer

For internally developed iOS apps not in the App Store, use the iOS/iPadOS Line-of-business app type. Option D is correct. Option A is wrong because the iOS app store app type is for apps from the App Store.

Option B is wrong because the Web link type is for web shortcuts. Option C is wrong because the Built-in app type is for pre-installed system apps.

Full explanation →
108
MCQhard

Refer to the exhibit. You create a custom configuration profile in Intune for Windows 10 devices. The profile is assigned to a test device, but the telemetry setting is not applied. The device is managed and compliant. What is the most likely reason?

A.The device is not compliant with the baseline policy.
B.The OMA-URI path for AllowTelemetry is incorrect.
C.The AllowTelemetry policy value must be an integer, not a string, or the device needs a Windows 10 version that supports this setting.
D.The custom profile conflicts with a built-in policy that sets telemetry to full.
AnswerC

AllowTelemetry expects an integer (0-3); OMA-URI string type may cause failure. Also, some settings require specific builds.

Why this answer

The AllowTelemetry setting in a custom OMA-URI profile requires the value to be an integer (0–3) and the device must be running Windows 10 version 1703 or later. If the value is entered as a string (e.g., "2" instead of 2), Intune will not apply the policy, and the device will silently ignore the configuration. Additionally, older Windows 10 builds do not support this OMA-URI path and will fail to process it.

Exam trap

The trap here is that candidates assume any OMA-URI value will be accepted regardless of data type, or they overlook the version requirement, leading them to incorrectly blame the OMA-URI path or compliance status instead of the value format or OS version.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as compliant, and compliance status does not prevent a custom profile from applying—non-compliance would block access to resources but not stop policy application. Option B is wrong because the OMA-URI path for AllowTelemetry is correctly specified as ./Device/Vendor/MSFT/Policy/Config/System/AllowTelemetry; an incorrect path would generate a sync error in Intune, not a silent failure. Option D is wrong because built-in policies do not conflict with custom profiles in a way that silently blocks application; conflicts are reported in the device's policy status, and a conflicting built-in policy would still attempt to apply the custom setting, not prevent it from being applied.

Full explanation →
109
MCQeasy

A user reports that their Windows device is not appearing in the Intune console after enrollment. The device is joined to Microsoft Entra ID and the user has an Intune license. What should you check first?

A.Ensure that the MDM user scope in Microsoft Entra ID is set to 'All' or 'Some'.
B.Assign an Intune license to the device.
C.Verify that enrollment restrictions are not blocking the device.
D.Check if the device is compliant.
AnswerA

The MDM user scope controls automatic enrollment.

Why this answer

The most common reason a device fails to appear in the Intune console after enrollment is that the MDM user scope in Microsoft Entra ID is not configured to include the user. The MDM user scope determines which users can automatically enroll their devices into Intune; if it is set to 'None', enrollment is blocked entirely. Since the device is already joined to Microsoft Entra ID and the user has an Intune license, the first step is to verify this scope setting.

Exam trap

The trap here is that candidates often jump to troubleshooting enrollment restrictions or compliance policies, overlooking the foundational MDM user scope which must be explicitly configured to allow enrollment to proceed.

How to eliminate wrong answers

Option B is wrong because Intune licenses are assigned to users, not devices; the user already has a license, so assigning one to the device is not a valid action. Option C is wrong because enrollment restrictions (e.g., platform or version blocks) would typically cause an enrollment failure with an error message, not a silent absence from the console after a successful join. Option D is wrong because device compliance is evaluated after enrollment and does not affect whether the device appears in the Intune console; a non-compliant device still shows up.

Full explanation →
110
MCQeasy

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

A.Remote lock
B.Reset passcode
C.Wipe
D.Retire
AnswerA

Correct. Remote lock locks the device and displays a custom message.

Why this answer

'Remote lock' locks the device and allows a custom message to be displayed. Option B is wrong because 'Reset passcode' changes the passcode but does not display a custom message. Option C is wrong because 'Wipe' performs a factory reset, which erases all data and prevents the message from being shown.

Option D is wrong because 'Retire' removes company data only, does not lock the device.

Full explanation →
111
Multi-Selecthard

Which THREE of the following are valid methods to deploy Microsoft 365 Apps for enterprise using Microsoft Intune?

Select 3 answers
A.Use the built-in Microsoft 365 Apps app type in Intune.
B.Use the Office Deployment Tool (ODT) within a script deployed via Intune.
C.Assign the apps via Azure AD application registration.
D.Package the Office installer as a Win32 app.
E.Deploy the MSI version of Office via Intune.
AnswersA, B, D

Simplest method with built-in settings.

Why this answer

Intune includes a built-in app type specifically for Microsoft 365 Apps for enterprise. This native integration allows you to configure installation settings (e.g., update channel, excluded apps, and language) directly in the Intune console without needing to create a custom package or script.

Exam trap

The trap here is that candidates confuse Azure AD application registration (an identity/authentication feature) with a deployment mechanism, or mistakenly think MSI-based Office deployment is still supported for Microsoft 365 Apps in Intune.

Full explanation →
112
Multi-Selecteasy

Which TWO settings can be configured in a Windows 10 device restriction profile in Intune to enhance security?

Select 2 answers
A.Require BitLocker encryption
B.Disable copy and paste between apps
C.Disable the camera
D.Require a password for unlocking the device
E.Configure Windows Update for Business settings
AnswersC, D

Disabling camera is a security restriction.

Why this answer

Options C and D are correct. Disabling the camera (C) reduces the attack surface by preventing unauthorized camera usage, and requiring a password (D) enforces authentication to unlock the device. Option A (BitLocker) is an encryption setting, not a device restriction profile setting.

Option B (disable copy/paste) is an app restriction, not a device restriction. Option E (Windows Update for Business) is configured in an update policy, not a device restriction profile.

Full explanation →
113
Matchingmedium

Match each Intune configuration profile type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Control settings like password, camera, and Bluetooth

Define rules for device health and security

Deploy custom OMA-URI or Apple Configurator settings

Configure Windows Defender Firewall and BitLocker

Group Policy-like settings for Windows devices

Why these pairings

Device restrictions manage device features, Endpoint protection handles security settings, Administrative templates use ADMX, and Custom uses OMA-URI. Common confusions involve swapping the first two.

Full explanation →
114
MCQhard

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. The app requires installation in the system context. Which deployment method should you use?

A.Microsoft Store for Business app
B.Win32 app
C.Microsoft Intune LOB app (msi/appx)
D.Web link
AnswerB

Win32 apps can be unsigned and run in system context.

Why this answer

Win32 apps in Microsoft Intune support installation in the system context via the 'Install behavior' setting, and they can be deployed using a custom installation script that handles certificate trust issues (e.g., by installing the signing certificate first or using a silent install switch). This method also allows the app to run with elevated privileges, which is required for system-context installation, and does not depend on the device trusting the app's signing certificate at deployment time.

Exam trap

The trap here is that candidates often assume 'LOB app' must use the Intune LOB app type (MSI/APPX), but the requirement for system context and untrusted certificate forces the use of the Win32 app type, which provides the flexibility to handle certificate trust via scripting.

How to eliminate wrong answers

Option A is wrong because Microsoft Store for Business apps require the device to trust the Microsoft Store certificate chain and cannot be deployed in the system context; they are per-user installs. Option C is wrong because Intune LOB apps (MSI/APPX) require the app to be signed with a certificate that is already trusted by the device (e.g., via a PKI or pre-installed root), and they do not support custom installation logic to bypass certificate trust issues. Option D is wrong because a web link simply opens a URL in the browser and does not install any software, let alone in the system context.

Full explanation →
115
MCQmedium

Your organization uses Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices for accessing an internal web app. Which profile type should you use?

A.PKCS certificate profile
B.SCEP certificate profile
C.Trusted certificate profile
D.Custom configuration profile (preferences)
AnswerC

Deploys a root CA certificate to devices.

Why this answer

A Trusted certificate profile is used to deploy a root or intermediate CA certificate that the device must trust for certificate-based authentication, such as accessing an internal web app over HTTPS. This profile type simply installs the certificate into the device's trusted root store without generating a private key, which is exactly what is needed when you only need to establish trust for the server certificate presented by the web app.

Exam trap

The trap here is that candidates often confuse deploying a trusted root certificate (needed for server trust) with issuing a client certificate (needed for device authentication), leading them to incorrectly choose PKCS or SCEP profiles when the question only requires establishing trust for the server's SSL certificate.

How to eliminate wrong answers

Option A is wrong because a PKCS certificate profile is used to issue a client certificate with a private key to the device for client authentication, not to deploy a trusted root certificate. Option B is wrong because a SCEP certificate profile is used to request and renew client certificates dynamically via the Simple Certificate Enrollment Protocol, again for client authentication, not for deploying a trusted root. Option D is wrong because a Custom configuration profile (preferences) is used to deploy app-specific settings or plist files, not to install certificates into the device's trust store.

Full explanation →
116
MCQmedium

Your organization recently deployed Windows 11 devices managed by Microsoft Intune. You need to ensure that only approved third-party drivers are installed on these devices. What is the best approach?

A.Deploy a Windows Driver Frameworks (WDF) Coinstaller to enforce driver signing.
B.Use Device Installation Restrictions to allow only approved hardware IDs.
C.Configure Windows Update for Business group policy settings to block driver updates from Windows Update.
D.Configure a Windows Defender Application Control policy to block unsigned drivers.
AnswerD

Correct. Windows Defender Application Control (WDAC) enforces a code integrity policy that allows only drivers signed by trusted publishers or with specific hashes to install. This ensures that only approved third-party drivers can be installed, regardless of the source.

Why this answer

Windows Defender Application Control (WDAC) allows you to configure code integrity policies that restrict driver installation to only those that are signed by approved publishers or have known-good hashes. This ensures that only approved third-party drivers, as defined by your organization's policy, can be installed, regardless of the installation source (Windows Update, manual, or otherwise). Option C is insufficient because blocking driver updates from Windows Update does not prevent manual installation of unapproved drivers.

Options A and B do not provide a comprehensive enforcement mechanism for driver approval.

Exam trap

Candidates often assume that blocking driver updates from Windows Update is sufficient, but this does not prevent manual installation or side-loading of drivers. WDAC provides a stronger control by enforcing code integrity at installation time.

How to eliminate wrong answers

Option A is wrong because Windows Driver Frameworks (WDF) Coinstaller is used to install and register driver packages, not to enforce driver signing; it does not restrict which drivers can be installed. Option B is wrong because Device Installation Restrictions based on hardware IDs can block specific devices but do not control driver updates from Windows Update; they are designed to prevent installation of devices, not drivers. Option D is wrong because Windows Defender Application Control (WDAC) blocks unsigned binaries from executing, but it does not specifically target driver updates from Windows Update; it is a broader security control that can block legitimate signed drivers if not properly configured, and it is not the best approach for simply restricting driver updates.

Full explanation →
117
MCQhard

Refer to the exhibit. An Intune compliance policy JSON for Windows 10 devices. A device with OS version 10.0.19041.1 and no encryption reports as noncompliant. What is the most likely reason?

A.The OS version exceeds the maximum allowed version.
B.The password type is set to 'deviceDefault' which does not support numeric PIN.
C.The OS version is below the minimum requirement.
D.The device does not have BitLocker encryption enabled.
AnswerD

The policy requires encryption (storageRequireEncryption: true), and since the device lacks encryption, it is noncompliant.

Why this answer

The compliance policy specifies storageRequireEncryption: true, but the device does not have BitLocker encryption enabled, causing noncompliance. Option A is incorrect because the OS version 10.0.19041.1 is below the maximum allowed (10.0.19044.1). Option B is incorrect because 'deviceDefault' allows any valid Windows password type, including numeric PIN.

Option C is incorrect because the OS version is above the minimum required (10.0.19041.0).

Full explanation →
118
MCQhard

Refer to the exhibit. You are creating a device filter in Microsoft Intune to target a policy to Windows 10 Pro devices. The filter should only apply to devices running OS build 1904x (20H1 or later). However, some devices with build 1904x and SKU Professional are not receiving the policy. What is the most likely reason?

A.The -startsWith operator does not work for osVersion property.
B.The device must be enrolled via Autopilot for filters to apply.
C.The filter rule syntax is incorrect because of the parentheses.
D.The device.skuFamily property value is case-sensitive and may not match 'Professional'.
AnswerD

Case sensitivity can cause mismatches.

Why this answer

The `device.skuFamily` property in Microsoft Intune is case-sensitive. When creating a device filter rule, the value 'Professional' must exactly match the case of the SKU family string returned by the device. If the actual SKU family is reported as 'Professional' with a different casing (e.g., 'professional' or 'PROFESSIONAL'), the filter will not match, causing the policy not to apply to those devices.

Exam trap

The trap here is that candidates often assume property values in Intune filters are case-insensitive, leading them to overlook the exact casing requirement for `device.skuFamily`, and instead focus on unrelated syntax or enrollment requirements.

How to eliminate wrong answers

Option A is wrong because the `-startsWith` operator is fully supported for the `osVersion` property in Intune device filters, and it is commonly used to match OS build versions like '1904x'. Option B is wrong because device filters in Intune do not require Autopilot enrollment; they work with any enrolled Windows device, regardless of enrollment method. Option C is wrong because parentheses are valid in filter rule syntax for grouping conditions, and the provided syntax does not contain an error related to parentheses.

Full explanation →
119
MCQeasy

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

A.Change the compliance policy to require immediate updates.
B.Run Windows Update manually on the device.
C.Re-enroll the device in Intune.
D.Assign the device to a different update ring with a 0-day deferral.
AnswerD

This ensures the device receives updates without delay.

Why this answer

The device is assigned to an update ring that defers updates by 30 days, which is why it is not receiving the latest security updates despite being compliant. To immediately receive the latest updates, you must assign the device to a different update ring with a 0-day deferral, as update rings in Microsoft Intune control the deferral period for Windows Update for Business. Changing the ring triggers the device to check for updates based on the new policy, ensuring immediate availability of security updates.

Exam trap

The trap here is that candidates may think manually running Windows Update or changing compliance policies can override the update ring deferral, but only reassigning to a different ring with a shorter deferral period will actually change the update behavior.

How to eliminate wrong answers

Option A is wrong because compliance policies in Intune do not control update deferral settings; they enforce device health and configuration requirements, not update ring deferral periods. Option B is wrong because manually running Windows Update on the device will still respect the deferral period set by the assigned update ring policy, so it will not bypass the 30-day delay. Option C is wrong because re-enrolling the device in Intune does not change the update ring assignment; the device would still be subject to the same deferral policy unless the ring assignment is explicitly changed.

Full explanation →
120
MCQmedium

A company plans to deploy Windows 11 to 500 devices using Microsoft Deployment Toolkit (MDT). The deployment must be fully automated with minimal user interaction. Which configuration should be used in the CustomSettings.ini file?

A.SkipApps=YES
B.UserDataLocation=AUTO
C.SkipWizard=YES
D.DoNotCreateExtraPartition=YES
AnswerC

Suppresses all wizard pages, enabling zero-touch deployment.

Why this answer

`SkipWizard=YES` in the CustomSettings.ini file tells MDT to bypass all deployment wizard pages, enabling a fully unattended, zero-touch deployment. This is the specific setting required to achieve minimal user interaction during the MDT deployment process.

Exam trap

The trap here is that candidates often confuse `SkipWizard=YES` with individual `Skip*` settings, thinking they need to list each one, or they mistakenly believe `UserDataLocation=AUTO` or `DoNotCreateExtraPartition=YES` control automation level when they only affect specific deployment phases.

How to eliminate wrong answers

Option A is wrong because `SkipApps=YES` only skips the application selection page in the wizard, but the deployment still requires user interaction for other wizard pages (e.g., computer name, credentials). Option B is wrong because `UserDataLocation=AUTO` controls where user state data is stored during migration, not the level of automation or wizard skipping. Option D is wrong because `DoNotCreateExtraPartition=YES` prevents MDT from creating additional partitions (like a recovery partition) during disk configuration, but does not affect the wizard interaction or automation level.

Full explanation →
121
Multi-Selectmedium

Which TWO settings can you configure in a Microsoft Intune device compliance policy for Android Enterprise devices?

Select 2 answers
A.Encryption
B.Require a password to unlock the device
C.Minimum OS version
D.Disable camera
E.Maximum OS version
AnswersB, C

This is a compliance setting.

Why this answer

Microsoft Intune device compliance policies for Android Enterprise require a password to unlock the device as a configurable setting. This setting enforces a lock screen password, which is a fundamental security requirement for compliance evaluation. It directly controls device access and is a standard compliance check for Android Enterprise work profiles and fully managed devices.

Exam trap

The trap here is that candidates confuse device compliance policies with device configuration profiles, assuming settings like disabling the camera or controlling encryption are part of compliance, when they are actually managed under separate configuration policies.

Full explanation →
122
MCQmedium

Refer to the exhibit. You run the PowerShell cmdlet in Microsoft Graph to list managed Windows devices. The output shows that several devices have a complianceState of 'noncompliant' but lastSyncDateTime is recent. What is the most likely reason for noncompliance?

A.The devices are running a non-Windows OS.
B.The devices have not synced recently.
C.The devices do not meet the assigned compliance policies.
D.The admin lacks permissions to view compliance details.
AnswerC

Noncompliance occurs when devices fail compliance policy rules.

Why this answer

A device's complianceState is determined by evaluating its configuration against assigned compliance policies. Even if lastSyncDateTime is recent, the device will be marked 'noncompliant' if it fails any of the policy checks (e.g., missing required updates, encryption not enabled, or a required antivirus solution not running). The sync timestamp only indicates when the device last communicated with Intune, not whether it meets policy requirements.

Exam trap

The trap here is that candidates assume a recent sync timestamp implies the device is healthy or compliant, when in fact sync and compliance are separate attributes—a device can be fully synced yet persistently noncompliant due to policy violations.

How to eliminate wrong answers

Option A is wrong because the cmdlet specifically queries 'managed Windows devices', so the output only includes Windows devices; a non-Windows OS would not appear in these results. Option B is wrong because the exhibit explicitly shows that lastSyncDateTime is recent, meaning the devices have synced recently; noncompliance is not caused by a lack of sync. Option D is wrong because if the admin lacked permissions to view compliance details, the cmdlet would either fail or return an access-denied error, not show a complianceState of 'noncompliant' for specific devices.

Full explanation →
123
MCQmedium

Refer to the exhibit. You are reviewing a JSON representation of a Microsoft Intune compliance policy for Windows 10. The policy is assigned to a group of devices running Windows 10 version 22H2 (build 22621). The devices are non-compliant due to the OS version. What is the most likely reason?

A.The validOperatingSystemBuildRanges property is empty, causing all builds to be non-compliant.
B.The OS build is greater than the maximum version specified.
C.The OS build is less than the minimum version.
D.The policy requires a password but the devices have no password.
AnswerB

Correct. The maximum version is exclusive, so build 22621 equals the maximum and is not less than it, making devices non-compliant.

Why this answer

The policy defines the maximum OS version as 10.0.22621.0 (Windows 10 22H2), but the device is running a build that exceeds this maximum. Although the device build is 22621, the policy may interpret the build range as exclusive, or the device has a newer build (e.g., 22631) that is greater than the maximum. In either case, the OS build is greater than the allowed maximum, causing non-compliance.

Option A is incorrect because the validOperatingSystemBuildRanges property is not the issue. Option C is incorrect because the build is not less than the minimum version. Option D is incorrect because the policy does not require a password.

Exam trap

Intune's osMaximumVersion is exclusive; a build equal to the maximum is non-compliant.

Full explanation →
124
MCQhard

Refer to the exhibit. The JSON shows a device queried from Microsoft Graph. The device shows as compliant, but the user reports that they are unable to access corporate resources. The conditional access policy requires device compliance. What is a likely reason for the access issue?

A.The device has not synced recently, so the compliance state may be outdated.
B.The device compliance state is actually non-compliant.
C.The device is managed by MAM instead of MDM.
D.The device enrollment date is too recent.
AnswerA

Last sync is at 10:30, which might be too old for conditional access.

Why this answer

The device's compliance state is determined at the time of the last check-in with Microsoft Intune. If the device has not synced recently, the compliance state shown in Microsoft Graph may be stale, and the Conditional Access policy will evaluate the last known state. Even though the device was compliant at last check-in, changes in device health, configuration, or user context since then could cause access to be denied until a fresh compliance evaluation occurs.

Exam trap

The trap here is that candidates assume the compliance state in Graph is always current, but Microsoft intentionally tests the concept that compliance is evaluated at sync time and can become stale, leading to a mismatch between the reported state and actual device posture.

How to eliminate wrong answers

Option B is wrong because the exhibit explicitly shows the device as compliant, so the compliance state is not actually non-compliant; the issue is that the state may be outdated. Option C is wrong because MAM (Mobile Application Management) is used for app-level management without device enrollment, but the device is enrolled (as shown by enrollmentType and managementType in the JSON), so it is managed by MDM, not MAM. Option D is wrong because the enrollment date being recent does not inherently cause access issues; Conditional Access policies evaluate compliance state, not enrollment age, and a newly enrolled device can be compliant immediately after its first sync.

Full explanation →
125
MCQhard

You manage devices with Microsoft Intune. You need to ensure that only devices with a specific BIOS serial number can enroll. What should you configure?

A.Enrollment restrictions that block devices by hardware identifier.
B.A device category with a dynamic group based on BIOS serial.
C.A device compliance policy that checks BIOS serial number.
D.A Conditional Access policy that requires a compliant device.
AnswerA

Enrollment restrictions can block devices based on hardware IDs like BIOS serial numbers.

Why this answer

Intune's enrollment restrictions allow you to block or allow devices based on hardware identifiers such as the BIOS serial number. By adding the specific BIOS serial numbers to the blocked hardware identifiers list, you can effectively prevent any device that does not match the allowed serials from enrolling. This is the only built-in mechanism in Intune that directly controls enrollment eligibility based on hardware characteristics.

Exam trap

The trap here is that candidates often confuse post-enrollment controls (compliance policies, Conditional Access) with pre-enrollment controls (enrollment restrictions), leading them to select options that only take effect after the device has already enrolled.

How to eliminate wrong answers

Option B is wrong because device categories and dynamic groups are used for organizational and targeting purposes after enrollment, not to block or allow enrollment itself. Option C is wrong because a device compliance policy checks conditions after enrollment and can mark a device as noncompliant, but it does not prevent the device from enrolling in the first place. Option D is wrong because a Conditional Access policy that requires a compliant device only applies after the device is enrolled and registered in Azure AD; it cannot block the initial enrollment process.

Full explanation →
126
MCQmedium

You need to configure a Windows 10 device to automatically install updates from a specific branch readiness level. Which setting in the Update ring policy should you configure?

A.Automatic update behavior
B.Quality update deferral period
C.Feature update deferral period
D.Branch readiness level
AnswerD

This setting determines the branch for updates.

Why this answer

The Branch readiness level setting in an Update ring policy directly controls which Windows Insider or semi-annual channel (e.g., Preview, Broad) a device receives updates from, determining the specific branch readiness level for automatic updates. This is the correct setting to configure when you need to specify a branch readiness level for automatic installation.

Exam trap

The trap here is that candidates often confuse deferral periods (which only delay updates within a chosen branch) with the Branch readiness level setting, which actually selects the branch itself, leading them to pick Quality or Feature update deferral period instead.

How to eliminate wrong answers

Option A is wrong because Automatic update behavior controls when and how updates are installed (e.g., auto install at maintenance time, notify download), not which branch readiness level is used. Option B is wrong because Quality update deferral period only delays the installation of quality (security) updates by a set number of days, it does not select the branch readiness level. Option C is wrong because Feature update deferral period only delays the installation of feature updates by a set number of days, it does not determine the branch readiness level.

Full explanation →
127
MCQhard

A company uses Microsoft Intune to manage macOS devices. A security audit requires that all macOS devices must have FileVault encryption enabled. Compliance policy reports show that 90% of devices are compliant, but 10% are non-compliant. You review the non-compliant devices and find that FileVault is enabled on them. What is the most likely cause of the non-compliance?

A.FileVault is not actually enabled on those devices.
B.The recovery key is not escrowed to Intune.
C.The devices are not supervised.
D.The compliance policy is not assigned to those devices.
AnswerB

Key escrow is required for compliance.

Why this answer

The most likely cause is that the recovery key is not escrowed to Intune. Even though FileVault is enabled on the device, Intune's compliance policy checks for the presence of the FileVault recovery key in its escrow database. If the key is missing, the device is marked non-compliant because Intune cannot verify full management and recovery capability, which is a key security requirement.

Exam trap

The trap here is that candidates assume enabling FileVault alone satisfies compliance, but Intune requires the recovery key to be escrowed to confirm full manageability and recovery capability.

How to eliminate wrong answers

Option A is wrong because the scenario explicitly states that FileVault is enabled on the non-compliant devices, so the issue is not that encryption is absent. Option C is wrong because macOS devices do not require supervision for FileVault compliance; supervision is an iOS/iPadOS concept and does not apply to macOS in this context. Option D is wrong because if the compliance policy were not assigned, the devices would not appear in compliance reports at all, or would show as 'not evaluated' rather than 'non-compliant'.

Full explanation →
128
Multi-Selecthard

Which THREE permissions are required for a service account to register devices in Windows Autopilot? (Select THREE.)

Select 3 answers
A.Intune Administrator role
B.Security Reader role
C.Global Administrator role
D.Windows Autopilot device enrollment manager (DEM) permissions
E.Microsoft Entra ID join permission
AnswersA, D, E

This role allows managing Autopilot devices.

Why this answer

The Intune Administrator role is required because it grants the necessary permissions to manage Windows Autopilot deployment profiles, upload device hashes, and assign profiles to devices within the Microsoft Intune admin center. Without this role, a service account cannot configure or monitor the Autopilot registration process, as it is a core Intune workload.

Exam trap

The trap here is that candidates often select Global Administrator thinking it is required for all administrative tasks, but Microsoft explicitly recommends using the Intune Administrator role combined with DEM permissions to follow least-privilege principles for Autopilot registration.

Full explanation →
129
MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You deploy a Windows 10 feature update policy to keep devices on a specific version. After deployment, some devices report that the update is not being offered. The devices are not in a maintenance window. What is the most likely cause?

A.The devices are running a build that is newer than the target version
B.Windows Update for Business deferral or pause settings are blocking the update
C.The policy is not assigned to the correct group
D.The devices are in a maintenance window that blocks updates
AnswerB

Deferral or pause can prevent the update from being offered.

Why this answer

The most likely cause is that Windows Update for Business deferral or pause settings are blocking the update. Feature update policies in Intune rely on Windows Update for Business to deliver updates. If a device has deferral periods set (e.g., for quality or feature updates) or has updates paused, the policy will not apply until those settings are cleared.

Options A and D are incorrect: a newer build does not prevent the policy from targeting, and devices not in a maintenance window would still receive updates. Option C is possible but less likely, as the policy assignment would typically be verified before deployment.

Full explanation →
130
MCQmedium

Refer to the exhibit. An Intune admin configures the above Windows Update for Business policy. Users report that quality updates are not being installed until 7 days later than expected. What is the likely reason?

A.Quality updates are paused
B.Feature updates are deferred by 30 days
C.Update notifications are set to default
D.Quality updates are deferred by 7 days
AnswerD

The deferral period causes the delay.

Why this answer

QualityUpdateDeferralPeriodInDays is set to 7, which defers updates by 7 days. This is the intended behavior; no issue. However, the question implies users think updates are late.

The policy is correct; perhaps users misunderstand. But the question asks for likely reason. The deferral period is 7 days, so updates are intentionally deferred.

The update notification level is default. Feature updates deferred 30 days. No pause.

So the quality update deferral is the cause.

Full explanation →
131
MCQhard

You are implementing Windows Autopilot for a new fleet of devices. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and is enrolled in Intune. Which configuration is required?

A.Upload corporate identifiers for each device.
B.Configure the Enrollment Status Page in Intune.
C.Create an Autopilot deployment profile assigned to the devices.
D.Create a dynamic device group in Microsoft Entra ID.
AnswerC

The profile defines the OOBE experience, including Entra ID join and Intune enrollment.

Why this answer

An Autopilot deployment profile specifies the out-of-box experience (OOBE) settings, including the option to automatically join the device to Microsoft Entra ID and enroll it in Intune. Without a deployment profile assigned to the device, Autopilot will not enforce these behaviors during OOBE.

Exam trap

The trap here is that candidates often confuse the prerequisite step of registering the device (uploading corporate identifiers) with the configuration step that actually defines the OOBE behavior (the deployment profile), leading them to select Option A instead of C.

How to eliminate wrong answers

Option A is wrong because uploading corporate identifiers (e.g., hardware hashes) registers the device with Autopilot but does not configure the OOBE behavior; it only enables the device to be recognized by the Autopilot service. Option B is wrong because the Enrollment Status Page (ESP) controls the post-enrollment device setup experience (e.g., app and policy installation progress), not the initial join or enrollment actions during OOBE. Option D is wrong because a dynamic device group in Microsoft Entra ID is used for targeting policies or applications after enrollment, not for triggering or configuring the Autopilot OOBE flow.

Full explanation →
132
MCQeasy

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

A.Enable 'Private store only' in Microsoft Store for Business settings.
B.Disable 'Automatic app updates' in the device restriction policy.
C.Set 'Allow application store' to 'Block' for non-admin users.
D.Configure 'Require a password for app purchases' to 'Yes'.
AnswerC

Blocking the store prevents non-admins from installing apps manually.

Why this answer

The 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Exam trap

The trap here is that candidates often confuse the 'Allow application store' setting with store visibility or purchase controls, thinking that blocking the entire store or requiring a password for purchases achieves the same result, but only the explicit block for non-admin users prevents manual installations.

How to eliminate wrong answers

Option A is wrong because 'Private store only' in Microsoft Store for Business settings restricts the visible catalog to private apps but does not prevent non-admin users from manually installing apps; it only limits which apps they see. Option B is wrong because disabling 'Automatic app updates' controls whether apps update automatically, not whether users can manually install apps from the Store. Option D is wrong because 'Require a password for app purchases' applies to purchase transactions, not to manual installations of free apps or to blocking installation by non-admin users.

Full explanation →
133
MCQhard

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

A.The SharePoint site is configured to allow access only from specific IP ranges
B.The device compliance policy has a grace period for non-compliance, and the device is still within that period
C.An app protection policy is blocking access to SharePoint from the browser
D.A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome
AnswerD

Conditional Access can require approved client apps; using an unapproved app can block access.

Why this answer

When a Conditional Access policy requires the use of Microsoft Edge or the Microsoft Authenticator app for accessing SharePoint, users attempting to use Chrome on Android will be blocked. The devices show as compliant in Intune, so the issue is not device compliance but the requirement for a specific approved client app. This policy enforces app-based conditional access, which overrides browser access unless the approved app is used.

Exam trap

The trap here is that candidates assume device compliance is the only factor for access, overlooking that Conditional Access policies can enforce app-level requirements even on compliant devices, causing a false sense of security when devices show as compliant.

How to eliminate wrong answers

Option A is wrong because IP range restrictions would block all traffic from outside those ranges, not just from Chrome on compliant devices, and the issue is specific to the browser used. Option B is wrong because a grace period for non-compliance would allow access temporarily, but the devices are already compliant, so no grace period is active. Option C is wrong because an app protection policy (MAM) blocks data transfer or access from unmanaged apps, but it does not specifically block SharePoint access from a browser; it would apply to apps, not the browser itself, and the issue is browser-specific.

Full explanation →
134
Drag & Dropmedium

Order the steps to migrate user profiles from Windows 10 to a new device using User State Migration Tool (USMT).

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

ScanState collects data, specify store, install new OS, LoadState restores, then verify.

Full explanation →
135
MCQmedium

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. The user has confirmed that the device is enrolled and connected to the internet. Which is the most likely cause?

A.The device is not enrolled in Microsoft Intune.
B.The device has a Device Lock policy applied that blocks evaluation.
C.The Intune Management Extension is not installed or not running.
D.The user does not have a Microsoft 365 E3 license assigned.
AnswerC

The Intune Management Extension is needed for compliance evaluation on Windows devices.

Why this answer

The Intune Management Extension (IME) is the component responsible for processing and applying compliance policies on Windows devices. If the IME is not installed or not running, the device cannot evaluate compliance policies, resulting in a 'Not evaluated' status in the Intune admin center, even though the device is enrolled and connected to the internet.

Exam trap

The trap here is that candidates confuse enrollment status with policy evaluation readiness, assuming that if a device is enrolled and online, compliance policies should automatically apply, overlooking the critical role of the Intune Management Extension service.

How to eliminate wrong answers

Option A is wrong because the user confirmed the device is enrolled, and the 'Not evaluated' status specifically indicates enrollment is recognized but policy evaluation has failed. Option B is wrong because a Device Lock policy would prevent access or configuration changes but does not block the compliance evaluation engine from running; the device would still show an evaluation status. Option D is wrong because while a Microsoft 365 E3 license is required for Intune enrollment, the device is already enrolled, so licensing is not the immediate cause of the 'Not evaluated' status.

Full explanation →
136
MCQhard

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

A.Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.
B.Add the device to a hybrid Azure AD join profile.
C.Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.
D.Modify the enrollment restrictions to block personally owned devices.
AnswerA

This setting controls whether the device is joined or registered.

Why this answer

The Autopilot deployment profile includes a setting called 'Join to Azure AD as' that determines whether the device performs an Azure AD join or an Azure AD registration. By default, this setting may be configured as 'Azure AD registered', which results in a device that is only registered (workplace-joined) rather than fully joined. Changing this setting to 'Azure AD joined' ensures the device completes a full Azure AD join during the user-driven deployment, making it a managed device in Microsoft Entra ID.

Exam trap

The trap here is that candidates often confuse 'Azure AD registered' with 'Azure AD joined' because both involve Azure AD, but they fail to recognize that the Autopilot profile's join type setting directly controls this distinction, and that enrollment restrictions or hybrid join profiles are unrelated to changing the join type for a cloud-native Autopilot deployment.

How to eliminate wrong answers

Option B is wrong because a hybrid Azure AD join profile is used for devices that need to be joined to both on-premises Active Directory and Azure AD, typically requiring connectivity to a domain controller and synchronization via Azure AD Connect; this does not apply to a pure cloud-native Autopilot scenario where the device should be directly Azure AD joined. Option C is wrong because setting 'Join to Azure AD as' to 'Azure AD registered' would explicitly configure the device to be registered (workplace-joined) rather than joined, which is the opposite of what is needed to fix the issue. Option D is wrong because enrollment restrictions control which devices are allowed to enroll based on platform or ownership type (e.g., blocking personally owned devices), but they do not change the join type from registered to joined; the device would still be registered if the profile specifies registration.

Full explanation →
137
Multi-Selectmedium

Which TWO options are valid methods to deploy Windows 10 to new hardware in a Configuration Manager environment?

Select 2 answers
A.Microsoft Deployment Toolkit (MDT) Lite Touch
B.Windows Autopilot self-deploying mode
C.Azure Migrate
D.Bootable media deployment
E.PXE-initiated task sequence deployment
AnswersD, E

Standard ConfigMgr deployment method.

Why this answer

Bootable media deployment (Option D) is a valid method in Configuration Manager because it allows you to create bootable USB or CD/DVD media that contains the boot image, task sequence, and required content. When the media is booted on new hardware, it initiates a task sequence that contacts the Configuration Manager site server to download the OS image and apply it, making it ideal for bare-metal deployments without network connectivity.

Exam trap

The trap here is that candidates often confuse MDT Lite Touch as a Configuration Manager deployment method, but MDT is a separate tool and Lite Touch does not use the Configuration Manager client or infrastructure, making it invalid for this context.

Full explanation →
138
MCQhard

Refer to the exhibit. A PowerShell script is used to check the encryption compliance state of Windows devices managed by Intune. Some devices return a State of 'notApplicable' for the Encryption setting. What does this indicate?

A.The device has pending actions to enable encryption
B.The compliance policy is not assigned to the device
C.The device's operating system edition does not support the encryption setting
D.The device does not require encryption per policy
AnswerC

Some editions like Home don't support BitLocker, so setting is not applicable.

Why this answer

In Intune, the 'notApplicable' state for an encryption compliance setting indicates that the device's operating system edition lacks the required encryption capabilities, such as BitLocker support. BitLocker is only available on Windows Pro, Enterprise, and Education editions; Windows Home edition does not support it, so the compliance check returns 'notApplicable' rather than 'compliant' or 'noncompliant'.

Exam trap

The trap here is that candidates confuse 'notApplicable' with 'not assigned' or 'not required', but Microsoft specifically uses 'notApplicable' to indicate the device's OS edition does not support the setting, not a policy assignment issue.

How to eliminate wrong answers

Option A is wrong because 'pending actions' would typically result in a 'not evaluated' or 'error' state, not 'notApplicable', as the compliance engine can still assess the encryption status. Option B is wrong because if the compliance policy were not assigned, the device would not report any compliance state for that setting, or it would show 'not evaluated', not 'notApplicable'. Option D is wrong because 'notApplicable' is not a policy-driven exemption; it is a technical determination by the device's operating system that the encryption setting cannot be evaluated due to lack of support.

Full explanation →
139
MCQeasy

You need to configure Intune to automatically retire devices that have not checked in for 90 days. Where should you set this?

A.Compliance policies
B.Enrollment restrictions
C.Windows Autopilot devices blade
D.Device cleanup rules in Intune admin center
AnswerD

This allows automatic retirement of inactive devices.

Why this answer

Device cleanup rules in the Intune admin center allow administrators to automatically retire or delete devices that have not checked in for a specified number of days. This is the correct location because the rule is specifically designed for lifecycle management of stale devices, not for compliance or enrollment policies. Setting the threshold to 90 days ensures that devices exceeding that inactivity period are removed from management.

Exam trap

The trap here is that candidates often confuse compliance policies (which can mark devices as non-compliant for inactivity) with the actual retirement action, but compliance policies do not automatically retire devices—they only trigger conditional access or user notifications, whereas device cleanup rules perform the actual removal.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device configuration and health against rules (e.g., requiring encryption or a minimum OS version) and can mark devices as non-compliant, but they do not automatically retire devices based solely on check-in inactivity. Option B is wrong because enrollment restrictions control which devices can enroll (e.g., by platform, OS version, or device manufacturer) and do not manage post-enrollment lifecycle actions like retirement. Option C is wrong because the Windows Autopilot devices blade is used to manage Autopilot deployment profiles and device registration for zero-touch provisioning, not to configure automatic retirement rules for stale devices.

Full explanation →
140
Multi-Selecteasy

You need to deploy a Windows 10 feature update to a pilot group. Which TWO steps are required in Microsoft Intune?

Select 2 answers
A.Create a feature update policy for Windows 10.
B.Create a driver update policy for Windows 10.
C.Assign the feature update policy to a device group containing pilot devices.
D.Create an update ring for Windows 10.
E.Create a compliance policy for Windows 10.
AnswersA, C

Feature update policy specifies the target version.

Why this answer

A is correct because a feature update policy in Microsoft Intune is the specific policy type designed to control which Windows 10 feature update version (e.g., 22H2) is offered to devices. This policy allows you to defer or approve updates for pilot groups, ensuring controlled rollout before broad deployment.

Exam trap

The trap here is confusing update rings (which control deferral periods and deadlines) with feature update policies (which explicitly set the target version), leading candidates to select 'Create an update ring' instead of the correct feature update policy.

Full explanation →
141
MCQhard

You are evaluating Windows Autopilot for a hybrid Azure AD join scenario. Devices are domain-joined on-premises and will be hybrid Azure AD joined. Which prerequisite is required for Autopilot to perform hybrid Azure AD join?

A.Devices must have line-of-sight to an on-premises domain controller.
B.Devices must have VPN connectivity to Azure.
C.An Intune connector for Active Directory must be installed.
D.Azure AD Connect must be configured with password hash sync.
AnswerA

Required to join the domain during Autopilot.

Why this answer

For hybrid Azure AD join via Windows Autopilot, the device must complete domain join during the out-of-box experience. This requires line-of-sight to an on-premises domain controller so that the domain join operation can succeed, as the device cannot join the domain without contacting a DC directly over the network.

Exam trap

The trap here is that candidates often confuse the Intune connector for Active Directory (which is needed for device writeback in hybrid scenarios) with the actual domain join requirement, but the connector does not replace the need for direct line-of-sight to a domain controller.

How to eliminate wrong answers

Option B is wrong because VPN connectivity to Azure is not required; the device needs connectivity to on-premises domain controllers, not Azure. Option C is wrong because the Intune connector for Active Directory is used for device writeback and synchronization, not for the domain join step itself. Option D is wrong because password hash sync is a feature of Azure AD Connect for authentication, not a prerequisite for hybrid Azure AD join; the device must be able to authenticate to the on-premises domain controller directly.

Full explanation →
142
MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with TPM 2.0 and Secure Boot enabled can access Microsoft 365 resources. What is the best approach?

A.Create an app protection policy targeting Microsoft 365 apps.
B.Create a device configuration policy to enable TPM and Secure Boot.
C.Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.
D.Create a Conditional Access policy requiring TPM and Secure Boot.
AnswerC

This combination enforces the requirements and blocks access.

Why this answer

Device compliance policies in Microsoft Intune can evaluate hardware attributes like TPM version and Secure Boot status. When combined with a Conditional Access policy that blocks non-compliant devices, this enforces the security requirements before granting access to Microsoft 365 resources. This two-step approach ensures only devices meeting the hardware security baseline can authenticate.

Exam trap

The trap here is that candidates often think a Conditional Access policy alone can directly check hardware features, but it actually requires a compliance policy to report those attributes first.

How to eliminate wrong answers

Option A is wrong because app protection policies (MAM) manage data protection within apps (e.g., copy/paste restrictions) and do not evaluate device-level hardware features like TPM or Secure Boot. Option B is wrong because device configuration policies are used to configure settings (e.g., enable BitLocker) but cannot enforce access control; they lack the ability to block devices from accessing cloud resources. Option D is wrong because a Conditional Access policy alone cannot evaluate TPM or Secure Boot; it relies on device compliance status, which must be reported by Intune via a compliance policy.

Full explanation →
143
Multi-Selecteasy

You are configuring Microsoft Defender for Endpoint for your organization. You need to ensure that devices are onboarded to the service. Which two methods can you use to onboard Windows 10 devices? (Choose two.)

Select 2 answers
A.PowerShell script
B.Group Policy
C.Microsoft Intune
D.Microsoft Endpoint Manager
E.Microsoft Configuration Manager
AnswersB, C

Group Policy can deploy the onboarding configuration.

Why this answer

Group Policy is correct because it allows you to deploy a Group Policy Object (GPO) that configures the Windows 10 device to automatically download and apply the Defender for Endpoint onboarding package, including the required registry keys and service configuration. This method is ideal for on-premises, Active Directory-joined devices that are not managed by a modern management solution like Intune.

Exam trap

The trap here is that candidates often select 'Microsoft Endpoint Manager' thinking it is a distinct method, but it is an umbrella term that includes Intune and Configuration Manager, so it is not a specific onboarding method; the exam expects you to know the precise tools: Group Policy, Intune, and Configuration Manager.

Full explanation →
144
Multi-Selecthard

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Select 3 answers
A.Create a Windows 10 feature update deployment policy.
B.Ensure the test devices are in a group that targets the feature update.
C.Create a device compliance policy for the target version.
D.Create a Windows 10 update ring with expedited updates.
E.Assign the policy to the test device group.
AnswersA, B, E

A feature update deployment policy is needed.

Why this answer

A Windows 10 feature update deployment policy is the specific Intune policy type designed to deliver feature updates (like version 22H2) to devices. This policy allows you to specify the target version and control the rollout, which is required for deploying feature updates via Intune.

Exam trap

The trap here is confusing update rings (which manage quality updates and deferral settings) with feature update policies (which target specific feature versions), leading candidates to incorrectly select expedited update rings for feature updates.

Full explanation →
145
MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode longer than six characters can access corporate email. Which type of policy should you configure?

A.Device configuration profile
B.Device compliance policy
C.Enrollment restriction
D.App protection policy
AnswerB

Compliance policies check passcode length and are used with Conditional Access for access control.

Why this answer

Device compliance policies in Microsoft Intune evaluate device settings against defined rules, such as requiring a passcode longer than six characters. When a device is marked noncompliant, Conditional Access can block access to corporate email. This is the correct mechanism because compliance policies are specifically designed to enforce security requirements like passcode length before granting resource access.

Exam trap

The trap here is confusing device configuration profiles (which can set a passcode policy) with compliance policies (which enforce and block access), leading candidates to choose Option A because they think 'configure a policy' means setting the passcode requirement, not enforcing it.

How to eliminate wrong answers

Option A is wrong because device configuration profiles are used to configure device settings (e.g., Wi-Fi, VPN, or passcode policy) but do not enforce compliance or block access to resources; they simply push settings. Option C is wrong because enrollment restrictions control which devices can enroll in Intune (e.g., by platform or OS version), not post-enrollment security requirements like passcode length. Option D is wrong because app protection policies (MAM) manage data within apps (e.g., copy/paste, encryption) and do not enforce device-level passcode requirements; they apply even on unmanaged devices.

Full explanation →
146
Multi-Selecthard

Which THREE prerequisites are required to enable Windows Autopilot for existing devices?

Select 3 answers
A.The device must be domain-joined to an on-premises Active Directory
B.The device must be running Windows 10 or Windows 11 Pro, Enterprise, or Education edition
C.The device must have a TPM 2.0 chip
D.The device must have internet connectivity during the out-of-box experience
E.The device must be registered in Intune using its hardware hash
AnswersB, D, E

Autopilot requires these editions.

Why this answer

Windows Autopilot requires a supported edition of Windows 10 or Windows 11 (Pro, Enterprise, or Education) to access the necessary cloud-based provisioning and enrollment features. Home editions lack the required MDM enrollment capabilities and policy support, making them incompatible with Autopilot deployment.

Exam trap

The trap here is that candidates often assume TPM 2.0 is universally required for all Autopilot scenarios, but it is only mandatory for self-deploying mode and pre-provisioning, not for user-driven Autopilot on existing devices.

Full explanation →
147
MCQhard

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

A.Use a Win32 app with install context set to 'system'.
B.Assign the app as 'available' for user-install.
C.Deploy as a line-of-business app with device context.
D.Package as a Microsoft Store for Business app.
AnswerA

Win32 apps support system context installation, enabling admin-level installs on shared devices.

Why this answer

Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Exam trap

The trap here is that candidates often confuse 'device context' with 'system context', not realizing that LOB apps cannot handle .exe files and that 'available' assignments run in user context, which fails for admin-required installs on shared devices.

How to eliminate wrong answers

Option B is wrong because assigning the app as 'available' for user-install runs the installer in the user context, which lacks admin privileges and installs per-user, not per-device, making it unsuitable for shared kiosk devices. Option C is wrong because line-of-business (LOB) apps in Intune only support .msi, .appx, or .msix formats, not .exe files, and the 'device context' option for LOB apps is limited to .msi installers with system context, not custom .exe apps. Option D is wrong because packaging as a Microsoft Store for Business app requires the app to be available in the Store or repackaged as a Store-managed app, which does not support custom .exe files and cannot enforce admin privileges during installation.

Full explanation →
148
MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. They want to prevent users from installing unapproved applications. Which approach provides the most granular control?

A.Use the Microsoft Store for Business to deploy only approved apps.
B.Deploy AppLocker rules via Intune to allow only approved publishers.
C.Enable Windows Defender SmartScreen to block unknown apps.
D.Configure User Account Control (UAC) to always notify.
AnswerB

AppLocker provides granular control over app execution.

Why this answer

AppLocker allows creating rules based on publisher, path, or hash, enabling granular control to allow only approved applications. Intune policies can deploy AppLocker rules to Windows 10 devices. Option A is wrong because the Microsoft Store for Business only controls store apps, not all applications.

Option C is wrong because SmartScreen only warns about unknown apps but does not block installation. Option D is wrong because UAC only prompts for elevation and does not prevent installation.

Exam trap

Candidates often confuse AppLocker with SmartScreen or UAC, but AppLocker is the only option that allows rule-based control over all applications.

Full explanation →
149
MCQhard

Your organization has 500 Windows 10 devices that are currently managed by Microsoft Configuration Manager (ConfigMgr). You plan to enable co-management with Microsoft Intune to leverage cloud-based policies and conditional access. The devices are on-premises Active Directory joined and are already enrolled in ConfigMgr. You need to configure the co-management workload slider in ConfigMgr to move the 'Device configuration' workload to Intune while keeping 'Compliance policies' and 'Windows Update policies' in ConfigMgr initially. The devices should automatically enroll in Intune upon receiving the co-management policy. You have already configured Azure AD Connect for hybrid Azure AD join. What should you do next?

A.Install the Intune connector for ConfigMgr and configure the workloads.
B.Create a Group Policy that enables automatic MDM enrollment to Intune.
C.In ConfigMgr, enable co-management, select the devices for pilot, and set the 'Device configuration' workload slider to 'Pilot Intune' or 'Intune'.
D.Configure hybrid Azure AD join for all devices via Group Policy and wait for auto-enrollment.
AnswerC

This configures the workload movement and triggers Intune enrollment for pilot devices.

Why this answer

To enable co-management and move the Device configuration workload to Intune, you need to configure co-management in ConfigMgr. This involves enabling co-management, selecting a pilot collection (or all devices), and setting the workload slider for Device configuration to either 'Pilot Intune' or 'Intune' (full migration). This triggers automatic enrollment in Intune via the co-management policy.

Option A is incorrect because the Intune connector is not needed for co-management; enrollment happens via ConfigMgr policy. Option B is incorrect because Group Policy for automatic MDM enrollment is not required when using co-management; the enrollment is triggered by ConfigMgr. Option D is incorrect because hybrid Azure AD join alone does not automatically enroll devices into co-management; the ConfigMgr co-management configuration is necessary.

Full explanation →
150
MCQeasy

Your organization is deploying Windows 10 devices using Windows Autopilot. The devices are purchased from a vendor and will be shipped directly to users. You need to ensure that the devices are automatically enrolled in Intune and configured with your organization's standard settings as soon as the user turns on the device and connects to the internet. The devices should be Azure AD joined. What is the minimal configuration required?

A.Ask the vendor to configure the devices with your organization's settings before shipping.
B.Upload the device's hardware hash to Azure AD.
C.Instruct the user to manually enroll the device after receiving it.
D.Upload the device's hardware hash to Microsoft Intune.
AnswerD

The hash is needed for Autopilot device recognition.

Why this answer

The hardware hash must be uploaded to Microsoft Intune for Autopilot to automatically recognize the device, enroll it in Intune, and join it to Azure AD upon first boot. Option A is incorrect because vendors cannot pre-configure Autopilot settings; they should provide the hardware hash. Option B is incorrect because the hardware hash is uploaded to Intune, not Azure AD directly.

Option C is incorrect because the user should not manually enroll; Autopilot automates the process.

Full explanation →
Page 1

Page 2 of 13

Page 3

All pages

12345678910111213

Practice MD-102 by domain

Target a specific domain to shore up weak areas.

Prepare infrastructure for devicesManage and maintain devicesManage applicationsProtect devices
See all domains with question counts →