Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 301–375 | Page 5/13

301

MCQhard

An organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. The security team wants to automatically apply an Intune app protection policy (APP) when a user accesses a risky app from an unmanaged device. What should the administrator use?

A.Conditional Access App Control with session control

B.Device configuration policy

C.App protection policy assignment to users

D.Device compliance policy

AnswerA

Session control can enforce APP when a risky app is accessed.

Why this answer

Conditional Access App Control with session control is the correct solution because it allows the administrator to monitor and control app sessions in real time, applying Intune app protection policies (APP) when a user accesses a risky app from an unmanaged device. This integration uses reverse proxy architecture to intercept traffic and enforce data protection policies, such as blocking downloads or requiring managed apps, directly within the cloud app session.

Exam trap

The trap here is that candidates often confuse 'app protection policy assignment to users' (Option C) as the direct method, but the question requires dynamic, risk-based triggering via Conditional Access and Defender for Cloud Apps, not static user assignment.

How to eliminate wrong answers

Option B (Device configuration policy) is wrong because it manages device settings (e.g., Wi-Fi, VPN) and does not enforce app-level protection based on risk or device management status. Option C (App protection policy assignment to users) is wrong because it assigns APP directly to users without session-level conditional access; it cannot dynamically trigger based on real-time risk detection from Defender for Cloud Apps. Option D (Device compliance policy) is wrong because it evaluates device compliance (e.g., jailbreak detection, OS version) and blocks access at the device level, but it does not apply app protection policies within a cloud app session from an unmanaged device.

Full explanation →

302

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

A.Ask users to restart their devices.

B.Reassign the update ring to a broader device group.

C.Use the 'Update Immediately' setting in the Windows Update for Business policy.

D.Increase the 'Quality update deadline' to 3 days.

AnswerC

This setting forces the device to check for and install available updates immediately.

Why this answer

The 'Update Immediately' setting in the Windows Update for Business policy forces devices to check for and install updates immediately, overriding the configured deadline. Option A is incorrect because restarting alone does not trigger installation of pending updates. Option B is incorrect because reassigning the update ring does not affect the urgency of already applied policies.

Option D is incorrect because increasing the deadline would allow more delay, not cause immediate installation.

Full explanation →

303

MCQeasy

A company uses Microsoft 365 E3 licenses. They need to enforce that all users must use the Microsoft Authenticator app for MFA instead of SMS or phone call. What should the administrator configure?

A.MFA service settings in the legacy portal

B.Authentication methods policy

C.Security defaults

D.Conditional Access policy

AnswerB

This policy controls which methods are allowed.

Why this answer

The Authentication methods policy (B) is the correct configuration because it allows administrators to control exactly which authentication methods users can register and use for MFA. By targeting the policy to all users and disabling SMS and voice call while enabling Microsoft Authenticator (push notifications or OTP), the requirement is met. This policy supersedes legacy MFA settings and provides granular control over modern authentication methods.

Exam trap

The trap here is that candidates often confuse the Authentication methods policy with Conditional Access policies, assuming that a Conditional Access policy can restrict MFA methods, but in reality, Conditional Access only controls when MFA is required, not which methods are allowed.

How to eliminate wrong answers

Option A is wrong because the MFA service settings in the legacy portal only control per-user MFA enforcement and basic method availability (call, SMS, app), but they do not allow disabling specific methods like SMS or phone call for all users—they only enable or disable the app as a whole. Option C is wrong because Security defaults enforce a baseline set of security policies (including requiring MFA for all users) but do not allow granular control to restrict MFA methods to only the Authenticator app; they permit any available method. Option D is wrong because a Conditional Access policy can require MFA but cannot restrict which specific MFA methods (e.g., Authenticator app vs.

SMS) are allowed; method restriction is handled exclusively by the Authentication methods policy.

Full explanation →

304

Matchingmedium

Match each Microsoft 365 compliance feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Prevent sensitive data from being shared inappropriately

Classify and protect documents and emails with labels

Manage retention and disposal of records

Search and export content for legal investigations

Log and investigate user and admin activities

Why these pairings

Compliance features are part of the Microsoft 365 security and compliance center, relevant for endpoint administrators.

Full explanation →

305

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a compliance policy requiring devices to have BitLocker enabled. Some devices report as non-compliant even though BitLocker appears to be on. You discover these devices are using software-based encryption instead of hardware-based encryption. What should you do to resolve the compliance failure?

A.Modify the compliance policy to include 'BitLocker hardware encryption' as 'not configured' or set to 'allow software encryption'.

B.Configure the compliance policy to require TPM attestation.

C.Upgrade the devices to Windows 10 Enterprise edition.

D.Change the compliance policy setting from 'require' to 'allow' for BitLocker.

AnswerA

This accommodates both encryption types.

Why this answer

The compliance policy can be configured to accept both hardware and software encryption. By setting 'BitLocker hardware encryption' to 'not configured' or 'allow software encryption', the policy will consider software-based encryption as compliant. Option B is incorrect because TPM attestation is not required for this issue; the problem is the encryption type, not TPM presence.

Option C is incorrect because BitLocker is available on Windows 10 Pro and Enterprise, so upgrading to Enterprise does not resolve the compliance failure. Option D is incorrect because changing 'require' to 'allow' for BitLocker would still require some form of encryption, but the policy currently requires it; the issue is that software encryption is not being recognized, so allowing it directly addresses the problem.

Full explanation →

306

Multi-Selecthard

Which THREE factors should you consider when planning the deployment of Windows 10 feature updates using Intune?

Select 3 answers

A.Devices must have sufficient disk space to download the update.

B.A deployment ring strategy should be used to test updates on a pilot group first.

C.The version of Windows 10 determines which update rings are available.

D.The feature update compatibility report is only available for Windows 11.

E.Deferral periods can be set to delay the update installation.

AnswersA, B, E

Sufficient disk space is required for feature updates.

Why this answer

Windows 10 feature updates require sufficient free disk space (typically 20–32 GB depending on the version) to download and stage the update files. If a device lacks adequate space, the update will fail or be blocked by Intune's update readiness checks, which evaluate disk space before initiating the deployment.

Exam trap

The trap here is that candidates often confuse update ring availability with OS version, assuming older Windows 10 versions lack ring support, when in fact all Windows 10 versions (1507 and later) support update rings, and the compatibility report is not limited to Windows 11.

Full explanation →

307

MCQhard

You manage devices with Microsoft Intune. Some Windows devices are not receiving required security updates despite being assigned to an update ring for Windows 10. You verify that the devices are active and connected to the internet. What is the most likely cause?

A.The devices have a compliance policy requiring a specific version that is not yet met.

B.The update ring has a deferral period configured that delays updates for 30 days.

C.The devices are not connected to a corporate VPN.

D.Delivery Optimization is disabled on the devices.

AnswerB

Deferral periods can significantly delay update delivery.

Why this answer

The most likely cause is that the update ring has a deferral period configured that delays updates for 30 days. In Microsoft Intune, update rings for Windows 10 allow administrators to set deferral periods for quality and feature updates. A deferral period of 30 days means that even if the device is active and connected, it will not install the update until the specified number of days after Microsoft releases it.

This explains why the devices are not receiving the updates despite being compliant and online.

Exam trap

The trap here is that candidates often assume connectivity or compliance issues are the root cause, overlooking the fact that update rings can intentionally delay updates via deferral periods, which is a core configuration in Intune for staged rollouts.

How to eliminate wrong answers

Option A is wrong because a compliance policy requiring a specific version would not prevent updates from being offered; it would instead mark the device as non-compliant if the version is not met, but updates would still be available and installable. Option C is wrong because Windows Update for Business does not require a corporate VPN to receive updates; devices can download updates directly from Microsoft's update servers over the internet. Option D is wrong because Delivery Optimization is a peer-to-peer caching mechanism that speeds up update downloads but is not required for updates to be received; disabling it would not block updates entirely.

Full explanation →

308

MCQhard

Your organization deploys Microsoft Defender for Endpoint (now Microsoft Defender XDR) on Windows 10 devices using Intune. After deployment, some devices show 'Defender service is not running' in the security console. The devices are online and compliant. What is the most likely cause?

A.Tamper protection is enabled and blocking the service.

B.The devices are not compliant with the Defender policy.

C.Windows Firewall is blocking Defender updates.

D.A third-party antivirus is installed and active.

AnswerD

Defender disables when another AV is active.

Why this answer

When a third-party antivirus is installed and active on a Windows 10 device, Windows Defender (now Microsoft Defender Antivirus) automatically disables itself to avoid conflicts. This is by design: the Windows Security Center detects the active third-party AV and sets Defender's service state to stopped or disabled. In the Microsoft Defender for Endpoint console, this appears as 'Defender service is not running' even though the device is online and compliant with Intune policies.

Exam trap

The trap here is that candidates often assume tamper protection (Option A) is the culprit because it is a common security feature, but they overlook the automatic disabling behavior triggered by a third-party antivirus registration in the Windows Security Center.

How to eliminate wrong answers

Option A is wrong because tamper protection prevents unauthorized changes to Defender settings but does not stop the Defender service itself; it blocks modifications to real-time protection, cloud-delivered protection, and security intelligence updates, not the service state. Option B is wrong because the devices are explicitly stated as compliant with the Defender policy, so non-compliance is not the cause. Option C is wrong because Windows Firewall does not block Defender updates; Defender updates use Windows Update or dedicated update channels (e.g., HTTP/HTTPS to Microsoft servers) which are not filtered by the built-in firewall unless custom rules are misconfigured, and even then, a blocked update would not stop the service from running.

Full explanation →

309

MCQmedium

Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?

A.The compliance policy has a grace period of 7 days for BitLocker.

B.The compliance policy is not assigned to the device.

C.The device is configured as a kiosk device, which exempts it from compliance.

D.There is no Conditional Access policy that requires compliant device for access to corporate email.

AnswerD

Without a Conditional Access policy, compliance status does not block access.

Why this answer

D is correct because compliance policies alone do not enforce access restrictions; they only report device compliance status. To block access to corporate email, a Conditional Access policy must be configured to require a compliant device. Without such a policy, the device can still access email even if it is non-compliant.

Exam trap

The trap here is that candidates assume a compliance policy automatically blocks access to resources when a device is non-compliant, but in reality, a separate Conditional Access policy is required to enforce that block.

How to eliminate wrong answers

Option A is wrong because a grace period delays enforcement but does not allow access if the device is non-compliant and a Conditional Access policy is in place; the question states the device is non-compliant and still accessing email, so the absence of Conditional Access is the key. Option B is wrong because the exhibit states the compliance policy is assigned to all devices, so the device is indeed assigned the policy. Option C is wrong because kiosk devices are not exempt from compliance policies; they can be targeted by compliance policies and Conditional Access, and there is no built-in exemption for kiosk mode in this context.

Full explanation →

310

MCQmedium

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

A.The compliance policy has been removed from these devices.

B.The devices are still within the grace period and can access resources.

C.The devices were recently remediated and are now compliant.

D.The devices have exceeded the grace period and should be blocked from accessing resources.

AnswerD

Past expiration means grace period has been exceeded.

Why this answer

The complianceGracePeriodExpirationDateTime represents the deadline by which a device must become compliant after initially being marked noncompliant. When this timestamp is in the past, it means the grace period has expired, and the device should be blocked from accessing corporate resources as per the conditional access policy. This is a standard behavior in Microsoft Intune for managing noncompliant devices.

Exam trap

The trap here is that candidates confuse the complianceGracePeriodExpirationDateTime with the last check-in time or assume a past timestamp means the device is still compliant, when in fact it signals the end of the grace period and triggers blocking actions.

How to eliminate wrong answers

Option A is wrong because removing the compliance policy from a device does not affect the grace period timestamp; the timestamp is set when the device is marked noncompliant and persists regardless of policy removal. Option B is wrong because a past grace period expiration indicates the grace period has ended, not that the device is still within it; devices within the grace period would have a future timestamp. Option C is wrong because remediated devices would have a new compliance status and a reset complianceGracePeriodExpirationDateTime, not a past one; a past timestamp indicates the grace period was not resolved in time.

Full explanation →

311

MCQmedium

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

A.Real-time scanning is set to monitorAllFiles, but the file was an archive.

B.The scan type is set to quick, which does not scan downloaded files.

C.The cloud block level is set to high, which may block unknown files, but known files might be missed.

D.The policy has not been applied to the device yet.

AnswerD

If the policy hasn't applied, settings are not active.

Why this answer

If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Exam trap

The trap here is that candidates assume a protection policy is automatically active once created, but Microsoft Intune policies require device check-in and successful application before they take effect, and the cloud block level setting is often misunderstood as affecting known malware detection.

How to eliminate wrong answers

Option A is wrong because real-time scanning set to monitorAllFiles includes archives; Microsoft Defender scans archive files (e.g., .zip, .rar) by default when monitorAllFiles is enabled, so an archive would still be scanned. Option B is wrong because the scan type (quick, full, or custom) applies to scheduled or on-demand scans, not to real-time protection; real-time scanning always inspects files as they are downloaded or accessed, regardless of the scan type setting. Option C is wrong because the cloud block level setting (high, moderate, etc.) affects how aggressively unknown files are sent to the cloud for analysis, but known malicious files are blocked locally by signature-based detection and do not rely on cloud block level; a known file would be blocked even with a high cloud block level.

Full explanation →

312

MCQeasy

You need to retire a device in Microsoft Intune. What is the effect of retiring a device?

A.The device is unenrolled, and corporate data and apps are removed. Personal data is preserved.

B.The device is factory reset to its original settings.

C.The device remains enrolled but can no longer access corporate resources.

D.The device is deleted from Azure AD and Intune.

AnswerA

Retirement removes company data and unenrolls the device.

Why this answer

Retiring a device in Microsoft Intune performs a selective wipe that removes only corporate-managed data and apps while preserving the user's personal data. The device is also unenrolled from Intune management, meaning it no longer receives policy or compliance enforcement. This is distinct from a full wipe, which resets the entire device to factory settings.

Exam trap

The trap here is that candidates often confuse 'retire' with 'wipe' (factory reset), assuming both remove all data, but Intune's selective wipe is designed specifically to preserve personal data while removing corporate resources.

How to eliminate wrong answers

Option B is wrong because it describes a factory reset (full wipe), which removes all data including personal content, whereas retirement only removes corporate data. Option C is wrong because a retired device is unenrolled and loses all access to corporate resources, not remaining enrolled with restricted access. Option D is wrong because while the device record is removed from Intune, it is not automatically deleted from Azure AD; the device object in Azure AD remains until explicitly removed or until the user's sync cycle cleans it up.

Full explanation →

313

MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that only approved corporate apps can be installed on work profiles. What should you configure?

A.Device compliance policy to block noncompliant devices

B.Device restrictions configuration profile

C.App configuration policy for managed Google Play

D.Conditional access policy to require approved apps

AnswerC

App configuration policies can define an approved list of apps for work profiles.

Why this answer

To restrict app installation on Android Enterprise work profiles to only approved corporate apps, you must configure an app configuration policy for managed Google Play. This policy enforces a list of required and allowed apps, preventing users from installing unapproved apps from the Play Store on the work profile. Device compliance and conditional access policies control access to resources, not app installation, while device restrictions lack the granularity to enforce app whitelisting on managed Google Play.

Exam trap

The trap here is that candidates often confuse app configuration policies (which control app installation and settings) with app protection policies (which control data behavior within apps), leading them to incorrectly select conditional access or compliance policies instead.

How to eliminate wrong answers

Option A is wrong because device compliance policies evaluate device health (e.g., encryption, root status) and can block access to resources, but they do not control which apps can be installed on the work profile. Option B is wrong because device restrictions configuration profiles manage device settings (e.g., camera, Bluetooth) but cannot enforce a whitelist of approved apps for installation on managed Google Play. Option D is wrong because conditional access policies require approved apps for resource access (e.g., Exchange Online) but do not prevent installation of unapproved apps on the work profile; they only gate access after the app is already installed.

Full explanation →

314

MCQhard

The above PowerShell cmdlet returns the following output: DeviceName: LAPTOP001 LastSyncDateTime: 2025-03-15T08:30:00Z ComplianceState: noncompliant ManagementState: managed OSVersion: 10.0.19044.1288 The device last synced 3 days ago. What is the most likely reason for the noncompliant status?

A.The device is running an outdated OS version.

B.The device has been retired or wiped.

C.The device has not synced in over 24 hours.

D.The device has no compliance policy assigned.

AnswerC

Many compliance policies require a recent sync to remain compliant.

Why this answer

The device last synced 3 days ago, and the output shows ComplianceState: noncompliant. In Microsoft Intune, a device that has not checked in for more than 24 hours is automatically marked as noncompliant because the compliance policies cannot be evaluated without a recent sync. The LastSyncDateTime of 2025-03-15T08:30:00Z confirms the device has not synced within the required 24-hour window, making C the correct answer.

Exam trap

The trap here is that candidates assume 'noncompliant' always means a policy rule violation (like outdated OS or missing encryption) rather than recognizing that Intune can mark a device noncompliant simply for failing to sync within the required timeframe, even if all other policies are satisfied.

How to eliminate wrong answers

Option A is wrong because the OSVersion (10.0.19044.1288) corresponds to a supported build of Windows 10 21H2, which is not inherently outdated for compliance unless a specific policy requires a newer version, and the output does not indicate an OS version mismatch. Option B is wrong because the ManagementState is 'managed', not 'retired' or 'wiped', so the device is still under management and has not been removed. Option D is wrong because if no compliance policy were assigned, the device would typically show a ComplianceState of 'unknown' or 'not evaluated', not 'noncompliant'.

Full explanation →

315

MCQeasy

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

A.The current OS version on the device.

B.The user's license status.

C.The compliance policy is assigned to the device.

D.The device is connected to the internet.

AnswerA

The device might not have the required OS version.

Why this answer

The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Exam trap

The trap here is that candidates may jump to verifying policy assignment or connectivity, overlooking that the most direct and immediate verification is the actual OS version on the device, which is the specific attribute being evaluated by the compliance policy.

How to eliminate wrong answers

Option B is wrong because license status affects enrollment and access to Intune features, but it does not directly cause a device to be marked noncompliant due to a missing OS version; a licensed user can still have a noncompliant device. Option C is wrong because if the compliance policy were not assigned to the device, the device would not be evaluated against that policy and would not be marked noncompliant for that reason; the fact that it is marked noncompliant indicates the policy is assigned. Option D is wrong because while internet connectivity is required for the device to check in with Intune and report compliance, the device is already reporting its noncompliant status, meaning it has communicated with the service; connectivity is not the root cause of the OS version mismatch.

Full explanation →

316

Multi-Selecthard

Which THREE of the following are valid detection rule types for a Win32 app in Microsoft Intune? (Select THREE.)

Select 3 answers

A.Windows feature

B.MSI product code

C.File system

D.Registry

E.DNS query

AnswersB, C, D

Detects based on MSI product GUID.

Why this answer

MSI product code detection rules allow Intune to verify the presence of a Win32 app by checking the Windows Installer (MSI) product code in the registry (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall). This is a native detection method that directly confirms the application's installation state without requiring custom scripts.

Exam trap

The trap here is that candidates may confuse 'Windows feature' (a deployment type for optional Windows features) with a valid detection rule, or assume 'DNS query' is a plausible detection method due to its use in other Intune features like compliance policies, but it is not applicable to Win32 app detection.

Full explanation →

317

Multi-Selecthard

Which THREE components are essential for a Microsoft Defender for Endpoint deployment on Windows 10 devices? (Choose three.)

Select 3 answers

A.Cloud-delivered protection enabled

B.Microsoft Defender for Endpoint sensor

C.Microsoft Defender Antivirus

D.Microsoft Intune management agent

E.Microsoft 365 Apps for enterprise

AnswersA, B, C

Cloud protection provides real-time defense.

Why this answer

A is correct because cloud-delivered protection is a core component of Microsoft Defender for Endpoint (MDE) that enables near-instant threat intelligence updates and behavioral analysis. Without it, the endpoint relies solely on local signatures, missing cloud-based machine learning and automated response capabilities. This setting is enforced via Group Policy or Intune to ensure real-time protection against emerging threats.

Exam trap

The trap here is that candidates often assume a management agent like Intune is required for MDE deployment, but Microsoft explicitly lists only the sensor, antivirus, and cloud protection as essential components, with management being a separate configuration layer.

Full explanation →

318

MCQmedium

Your organization manages Windows devices with Intune and uses Azure Information Protection (AIP) to classify documents. You are deploying the AIP client as a Win32 app. After deployment, some users report that the AIP add-in is not visible in Office applications. What should you check first?

A.Confirm that Office is updated to the latest version.

B.Ensure that the required .NET Framework and Visual Studio Tools for Office runtime are installed.

C.Verify that the user has local administrator rights.

D.Check if the device has internet access to activate the client.

AnswerB

These are prerequisites for the add-in to load.

Why this answer

The AIP client add-in for Office requires the .NET Framework and Visual Studio Tools for Office runtime to be installed. If these prerequisites are missing, the add-in will not load. Option A is incorrect because while Office updates may be necessary, the most common issue is missing prerequisites.

Option C is incorrect because local administrator rights are not required for the add-in to be visible after installation. Option D is incorrect because internet access is needed for activation but does not affect add-in visibility.

Full explanation →

319

Multi-Selecthard

Which THREE of the following are prerequisites for using Microsoft Intune to manage Linux devices?

Select 3 answers

A.The Microsoft Intune agent installed on the Linux device.

B.A supported Linux distribution such as Ubuntu 20.04 or later.

C.The device must be joined to an on-premises Active Directory domain.

D.Network connectivity to Microsoft Intune service endpoints.

E.An Azure Active Directory Premium P2 license for each user.

AnswersA, B, D

The agent enables management and compliance reporting.

Why this answer

The Microsoft Intune agent is the core component that enables communication between the Linux device and the Intune service. Without this agent installed, the device cannot enroll, receive compliance policies, or be managed. The agent handles device registration, policy retrieval, and reporting back to Intune.

Exam trap

The trap here is that candidates often assume Linux devices must be domain-joined or require premium Azure AD licensing, but Intune manages Linux as a standalone mobile device class with only basic licensing and network connectivity prerequisites.

Full explanation →

320

Multi-Selecteasy

You need to deploy Microsoft Defender for Endpoint to Windows 10 devices using Microsoft Intune. Which TWO methods can you use to deploy the Microsoft Defender for Endpoint client?

Select 2 answers

A.Using Group Policy connected to Intune.

B.As a line-of-business (LOB) app in Intune.

C.From the Microsoft Store for Business.

D.Via a device configuration profile using the 'Microsoft Defender for Endpoint' CSP.

E.Via Microsoft Configuration Manager.

AnswersB, D

You can upload the MDATP installer as an LOB app.

Why this answer

You can deploy the Microsoft Defender for Endpoint client as a line-of-business (LOB) app in Intune by uploading the Windows Defender ATP client installation file (e.g., WindowsDefenderATPOnboardingPackage.zip) and targeting it to Windows 10 devices. Option D is correct because you can use a device configuration profile with the 'Microsoft Defender for Endpoint' Configuration Service Provider (CSP) to configure and deploy the client settings, such as onboarding and policy enforcement, directly via Intune.

Exam trap

The trap here is that candidates often confuse Group Policy with MDM policies or think the Microsoft Store for Business can distribute security agents, but Intune relies on CSPs and LOB app deployment for Defender for Endpoint, not traditional Group Policy or store distribution.

Full explanation →

321

MCQeasy

Refer to the exhibit. You see this JSON in an Intune policy for a Windows 10 device. What type of app is being deployed?

A.Win32 app

B.Web app

C.Line-of-business app

D.Microsoft Store app

AnswerD

The type is windowsStoreApp.

Why this answer

The JSON includes the key 'productId' with a value like '9WZDNCRFJ3PS', which is a Microsoft Store product identifier. Intune uses this identifier to deploy apps directly from the Microsoft Store for Windows 10 devices, making this a Microsoft Store app deployment. The absence of an installation command line, file path, or URL confirms it is not a Win32, LOB, or web app.

Exam trap

The trap here is that candidates confuse the productId with a package family name or assume any JSON with an ID must be a Win32 app, but the specific 'productId' key is unique to Microsoft Store app deployments in Intune.

How to eliminate wrong answers

Option A is wrong because Win32 apps require an installation command line and file path (e.g., .exe or .msi), not a productId. Option B is wrong because web apps are defined by a URL and do not use a productId; they simply open a browser link. Option C is wrong because line-of-business apps are uploaded directly as a package file (e.g., .appx or .msi) and do not reference a Microsoft Store productId.

Full explanation →

322

Multi-Selectmedium

Your organization is planning to enroll Windows devices into Microsoft Intune using Group Policy. Which TWO prerequisites must be in place? (Choose two.)

Select 2 answers

A.An on-premises Active Directory environment.

B.A Group Policy object to enable automatic MDM enrollment.

C.A Microsoft Intune subscription must be active.

D.Azure AD Connect must be configured.

E.Devices must be Azure AD hybrid joined.

AnswersA, B

Group Policy is used to configure automatic enrollment.

Why this answer

Options A and B are correct. Group Policy enrollment into Intune requires an on-premises Active Directory environment (A) to target devices via Group Policy, and a Group Policy object (B) configured with the MDM enrollment settings to enable automatic enrollment. Option C is incorrect because an Intune subscription is necessary but not a prerequisite specific to Group Policy enrollment—it is a general requirement.

Option D is incorrect because Azure AD Connect is needed for hybrid identity, but Group Policy enrollment works with on-premises AD only. Option E is incorrect because hybrid Azure AD join is not required for Group Policy enrollment; devices can be on-premises joined and still enroll.

Full explanation →

323

MCQhard

A multinational organization uses Microsoft 365 E5 licenses. The compliance officer wants to ensure that all documents containing credit card numbers are automatically classified and protected with a label that applies encryption. You configure auto-labeling policies in Microsoft Purview. After 24 hours, the compliance officer reports that no documents have been labeled. The policy scope is set to 'All locations' and the policy is enabled. What is the most likely cause of the issue?

A.The policy is deployed in simulation mode only.

B.No sensitivity labels have been published to the users.

C.Auto-labeling requires Azure Information Protection (AIP) add-on license.

D.The priority of the policy is too low compared to other policies.

AnswerA

Auto-labeling policies start in simulation mode; you must turn on the policy to apply labels.

Why this answer

Auto-labeling policies in Microsoft Purview can be configured in simulation mode, which evaluates documents against the policy rules and reports what would be labeled without actually applying any labels. Since the compliance officer reports that no documents have been labeled after 24 hours, the most likely cause is that the policy is still in simulation mode, which is a common deployment step to validate the policy before turning it on for real labeling.

Exam trap

The trap here is that candidates may assume auto-labeling policies apply labels immediately upon creation, overlooking the deliberate simulation mode that Microsoft requires for validation before production deployment.

How to eliminate wrong answers

Option B is wrong because publishing sensitivity labels to users is required for manual labeling, but auto-labeling policies apply labels automatically based on conditions, regardless of whether labels are published to users. Option C is wrong because auto-labeling for sensitive information types like credit card numbers is included with Microsoft 365 E5 licenses and does not require an additional Azure Information Protection (AIP) add-on license. Option D is wrong because policy priority affects which label is applied when multiple policies match, but it does not prevent labeling entirely; if the policy is enabled and in production mode, it would still apply labels even if its priority is lower.

Full explanation →

324

MCQeasy

You need to configure BitLocker encryption for Windows 10 devices managed by Intune. You create a device configuration profile for endpoint protection. After assigning, devices show 'BitLocker not enabled' in the Intune console. What is the most likely cause?

A.The profile is assigned to a user group instead of a device group.

B.The devices do not have a TPM chip.

C.Secure Boot is not enabled on the devices.

D.The devices are running Windows 10 Home edition.

AnswerB

BitLocker requires TPM for seamless encryption; without TPM, a USB startup key is needed.

Why this answer

BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 to store encryption keys securely. Without a TPM chip, BitLocker cannot be enabled by default, and the Intune console will report 'BitLocker not enabled' even if the endpoint protection profile is correctly assigned. This is the most common hardware prerequisite failure in managed environments.

Exam trap

The trap here is that candidates assume Secure Boot is a strict prerequisite for BitLocker, but Microsoft's documentation lists TPM as the primary hardware requirement, while Secure Boot is optional for enhanced security.

How to eliminate wrong answers

Option A is wrong because Intune endpoint protection profiles for BitLocker can be assigned to user groups; the profile will apply to devices when the user enrolls, and the 'BitLocker not enabled' status is not caused by user vs. device group targeting. Option C is wrong because Secure Boot is not a mandatory prerequisite for BitLocker; while it enhances security, BitLocker can function without Secure Boot enabled. Option D is wrong because Windows 10 Home edition does not support BitLocker device encryption at all, but the question states the devices are managed by Intune and show 'not enabled'—if they were Home edition, the profile would likely not apply or would show an error, but the most likely cause among the options is the missing TPM, as TPM is a core requirement for standard BitLocker.

Full explanation →

325

MCQhard

A Windows device shows enrollment state 'Enrolled' and compliance state 'compliant', but the policy setting 'MaxInactivityTimeDeviceLock' is not applied. The exhibit shows the device JSON from Intune. What is the most likely reason?

A.The OMA-URI setting is invalid.

B.The device is not enrolled.

C.The device's group membership is still being processed, so policies are not yet applied.

D.The device is not compliant.

AnswerC

Pending status indicates group membership processing.

Why this answer

When a device shows 'Enrolled' and 'Compliant' in Intune, the issue is not enrollment or compliance but policy delivery. The 'MaxInactivityTimeDeviceLock' OMA-URI setting (./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock) is a CSP-based policy that applies via group membership targeting. If the device was recently added to the group or the group membership is still being evaluated, Intune's policy processing cycle (which runs every 15–30 minutes by default) may not have delivered the policy yet.

The JSON exhibit likely shows the device is in a pending state for policy application despite being enrolled and compliant.

Exam trap

The trap here is that candidates see 'Enrolled' and 'Compliant' and assume the device is fully healthy, but they overlook that policy application is asynchronous and depends on group membership processing, which can lag behind enrollment and compliance evaluation.

How to eliminate wrong answers

Option A is wrong because if the OMA-URI setting were invalid, the policy would show an error or 'Not applicable' status in Intune, not a missing application while the device remains compliant. Option B is wrong because the device explicitly shows enrollment state 'Enrolled', so the device is enrolled and this contradicts the premise. Option D is wrong because the device shows compliance state 'Compliant', so non-compliance is not the reason the policy is not applied.

Full explanation →

326

MCQeasy

An organization uses Microsoft Intune to manage Windows 11 devices. They want to deploy a custom script that runs during device provisioning (ESP – Enrollment Status Page). Which app type should they use?

A.Line-of-business app

B.Win32 app

C.PowerShell script (Device configuration)

D.Proactive remediations

AnswerC

Can run during ESP.

Why this answer

PowerShell scripts (Device configuration) are the correct choice because they can be assigned to run during the Enrollment Status Page (ESP) phase of Windows 11 provisioning. Unlike Win32 or LOB apps, PowerShell scripts are executed by the Intune Management Extension before the ESP completes, allowing custom actions like registry modifications or file creation to occur during the critical 'Device setup' stage. This ensures the script runs synchronously with ESP, blocking the provisioning process until completion.

Exam trap

The trap here is that candidates often confuse 'PowerShell scripts (Device configuration)' with 'Proactive remediations' or 'Win32 apps,' assuming any script can run during ESP, but only the specific PowerShell script deployment type is designed to execute synchronously within the provisioning flow.

How to eliminate wrong answers

Option A is wrong because Line-of-business (LOB) apps are intended for sideloading .appx or .msix packages and cannot run custom scripts during ESP; they are installed after ESP completes. Option B is wrong because Win32 apps are deployed via the Intune Management Extension and are not designed to execute during the ESP phase—they run after the user signs in and are not integrated with the provisioning sequence. Option D is wrong because Proactive remediations are used for detecting and fixing common support issues on already-enrolled devices, not for running scripts during initial provisioning or ESP.

Full explanation →

327

Multi-Selectmedium

Which TWO prerequisites are required for Windows Autopilot self-deploying mode?

Select 2 answers

A.Device is registered in Windows Autopilot

B.A user account with Intune license

C.Windows 11/10 Pro, Enterprise, or Education edition

D.Microsoft Entra ID P1 or P2 license

E.TPM 2.0 chip on the device

AnswersA, E

Correct. Device registration in Windows Autopilot is essential for identifying the device.

Why this answer

For Windows Autopilot self-deploying mode, the two key prerequisites are that the device must be registered in Windows Autopilot (A) and have a TPM 2.0 chip (E) for hardware-based attestation. A supported Windows edition (C) is also needed, but it is a general requirement for any Autopilot mode and not specific to self-deploying. Options B and D are not required because this mode is device-driven and does not need a user account or premium licensing.

Exam trap

Candidates often assume that a supported Windows edition is the additional prerequisite for self-deploying mode, but the specific requirement that distinguishes it from user-driven mode is TPM 2.0. Also, licensing and user accounts are common distractors.

Full explanation →

328

Multi-Selectmedium

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Select 3 answers

A.Assign the policy to a user group, which applies to devices enrolled by those users.

B.Assign the policy to an Azure AD group that contains devices.

C.Assign the policy directly to individual devices from the Intune console.

D.Assign the policy to a dynamic device group created using device rules.

E.Assign the policy to a device category.

AnswersA, B, D

User-based assignment applies policies to devices enrolled by those users.

Why this answer

Microsoft Intune compliance policies can be assigned to user groups, and when a user in the group enrolls a device, the policy applies to that device. This is the most common deployment method, leveraging user-based targeting to ensure compliance settings are enforced on devices associated with those users.

Exam trap

The trap here is that candidates may confuse device categories as a direct assignment target, but they are only used to define membership rules for dynamic device groups, not as a policy assignment scope.

Full explanation →

329

MCQeasy

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

A.appVersion: 96.0.1054.62

B.channel: Stable

C.uninstallPrevious: true

D.intent: required

AnswerC

This removes previous versions before installing.

Why this answer

The `uninstallPrevious` setting in the Microsoft Edge Intune deployment profile forces the removal of any existing version of Edge (e.g., Beta, Dev, or older Stable) before the new version is installed. This ensures a clean installation and prevents conflicts, which is critical when deploying Edge as a required app via Intune for Windows devices.

Exam trap

The trap here is that candidates often confuse `uninstallPrevious` with `channel` or `appVersion`, assuming that specifying a version or channel alone will automatically replace older installations, but Microsoft Edge requires an explicit flag to trigger removal of prior versions.

How to eliminate wrong answers

Option A is wrong because `appVersion: 96.0.1054.62` specifies the version of Edge to install, not the removal of previous versions; it does not trigger uninstallation. Option B is wrong because `channel: Stable` defines the update channel (Stable, Beta, Dev) but has no effect on whether prior versions are removed; it only determines which build is deployed. Option D is wrong because `intent: required` makes the app mandatory for users but does not control the removal of older Edge installations; it only enforces installation.

Full explanation →

330

Drag & Dropmedium

Arrange the steps to configure Conditional Access for Microsoft 365 in Azure AD.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Full explanation →

331

Multi-Selectmedium

Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?

Select 3 answers

A.The app must be assigned to a security group.

B.The app must be signed with an Apple Developer Enterprise Distribution certificate.

C.The device UDID must be registered with Apple Business Manager.

D.The app must be uploaded as a .ipa file.

E.The user must have an active Apple ID.

AnswersA, B, D

Assignment is required for deployment, but the question asks for conditions for installation, not deployment. However, without assignment it won't install. But the three correct answers are the technical prerequisites.

Why this answer

For an iOS line-of-business (LOB) app to be successfully installed via Intune, three conditions must be met. First, the app must be assigned to a security group (A) because Intune targets app deployments to groups; without assignment the app will not be installed. Second, the app must be signed with an Apple Developer Enterprise Distribution certificate (B) to be trusted by devices without individual Apple approval.

Third, the app must be uploaded as a .ipa file (D), which is the required package format for iOS LOB apps. Option C is incorrect because registering the device UDID with Apple Business Manager is not a requirement for LOB app installation; it is used for device enrollment and supervision. Option E is incorrect because an active Apple ID is not needed for enterprise-distributed LOB apps.

Exam trap

The trap here is that candidates often confuse the prerequisites for App Store apps (which require an Apple ID) with those for enterprise LOB apps, leading them to incorrectly select 'active Apple ID' as a requirement.

Full explanation →

332

MCQmedium

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Intune to manage Windows 10 and iOS devices. The company recently experienced a malware outbreak on several Windows 10 devices. The security team wants to implement a solution that can automatically remediate threats on Windows 10 devices by isolating them from the network and running a full antivirus scan. They also want to be alerted when a threat is detected. You have already configured Microsoft Defender for Endpoint (MDE) and devices are onboarded. What should you configure in Intune to meet these requirements?

A.Configure a device compliance policy to require Device Health Attestation (DHA) and set the action for non-compliance to 'Quarantine device'.

B.Create a device compliance policy that marks devices with active threats as non-compliant, and configure the non-compliance action to 'Retire device' and 'Send notification'.

C.Enable Windows Defender Firewall with advanced security and create an inbound rule to block all traffic.

D.Configure AppLocker to block all apps and set the action to 'Run antivirus scan'.

AnswerB

Retire action can be used to isolate and remediate, but a more accurate answer would be to use the 'Quarantine' action; however, Intune's compliance policy can trigger MDE's automatic investigation and remediation. In practice, you would use MDE's automated investigation and remediation capabilities, which can be triggered by compliance policy. Option D is the closest correct answer.

Why this answer

It uses Intune's device compliance policy integrated with Microsoft Defender for Endpoint. When MDE detects an active threat on a Windows 10 device, Intune marks it as non-compliant. The configured non-compliance action 'Retire device' will remove the device from management and corporate access, effectively isolating it, while 'Send notification' alerts the security team.

This automatically remediates the threat by isolating the device and running a full scan (as part of MDE's response). Option A only blocks resource access without remediation; Option C uses firewall rules which do not provide automated threat response; Option D is incorrect because AppLocker cannot run antivirus scans.

Exam trap

The trap here is that candidates confuse 'Quarantine device' (a compliance action that only blocks resource access) with the actual network isolation and remediation workflow, or they mistakenly think AppLocker or Firewall rules can replace MDE's automated threat response.

How to eliminate wrong answers

Option A is wrong because Device Health Attestation (DHA) verifies boot integrity (e.g., Secure Boot, BitLocker) but does not detect or remediate active malware threats; its non-compliance action 'Quarantine device' only blocks access to resources, not isolate from network or run a scan. Option C is wrong because enabling Windows Defender Firewall with an inbound rule to block all traffic is a static network control that does not automatically detect threats, isolate the device, or trigger a full antivirus scan; it also lacks alerting capabilities. Option D is wrong because AppLocker is an application control feature that blocks apps based on rules, not a threat remediation tool; it cannot run a full antivirus scan or isolate the device from the network, and it does not integrate with MDE threat detection for automatic actions.

Full explanation →

333

MCQmedium

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

A.Ask users to restart their devices.

B.Ask users to run Windows Update.

C.Adjust the MDM sync interval in Intune.

D.In the Intune portal, select the devices and click 'Sync'.

AnswerD

The Sync action forces the devices to check in and apply latest policies.

Why this answer

The Intune 'Sync' action sends a direct MDM policy refresh command to the device via the Microsoft Intune service. This triggers the device's enrollment client to immediately check in with the MDM server, download the latest policies, and apply them without waiting for the next scheduled sync interval. Since the devices are online and have connectivity, this remote sync forces an immediate policy refresh.

Exam trap

The trap here is that candidates often confuse a device restart or Windows Update with triggering an MDM policy refresh, but Intune's MDM sync is a distinct, remote action that must be initiated from the Intune portal or via a manual sync on the device itself.

How to eliminate wrong answers

Option A is wrong because restarting the device does not force an MDM policy sync; it only reboots the OS, and the device will still wait for its next scheduled sync interval (typically every 8 hours) unless a sync is triggered via Intune. Option B is wrong because running Windows Update checks for OS and driver updates, not MDM policy changes; policy updates are handled by the MDM client, not Windows Update. Option C is wrong because adjusting the MDM sync interval in Intune only changes the default check-in frequency for future syncs; it does not force an immediate refresh for devices that have already missed a policy update.

Full explanation →

334

MCQmedium

You have the following JSON compliance policy for Windows 10 devices in Intune. A device with OS version 10.0.19042.0, build 19042, with BitLocker enabled, Secure Boot enabled, but Code Integrity disabled reports as non-compliant. Which setting is causing the non-compliance?

A.requireCodeIntegrity

B.minimumOsVersion

C.requireSecureBoot

D.requireDeviceEncryption

AnswerA

Code Integrity is disabled, causing non-compliance.

Why this answer

The device reports as non-compliant because the compliance policy requires `requireCodeIntegrity` to be enabled, but the device has Code Integrity disabled. Even though BitLocker and Secure Boot are enabled, and the OS version meets the minimum requirement, the absence of Code Integrity enforcement triggers non-compliance. In Intune, Windows 10 compliance policies evaluate each setting independently, and a failure on any required setting results in overall non-compliance.

Exam trap

The trap here is that candidates often assume Secure Boot or BitLocker alone satisfy all security requirements, but Intune's `requireCodeIntegrity` is a separate, independent check that specifically enforces runtime code validation, and failing to enable it causes non-compliance even when other security features are active.

How to eliminate wrong answers

Option B is wrong because `minimumOsVersion` is satisfied by OS version 10.0.19042.0 (build 19042), which is above the typical minimum (e.g., 10.0.17763 for 1809), so it is not causing non-compliance. Option C is wrong because `requireSecureBoot` is enabled on the device, as stated in the scenario, so Secure Boot is compliant. Option D is wrong because `requireDeviceEncryption` is satisfied by BitLocker being enabled, which provides full device encryption, so this setting is compliant.

Full explanation →

335

MCQhard

You manage a hybrid Microsoft Entra ID environment with 5,000 Windows 10 devices enrolled in Microsoft Intune. You need to deploy a critical security update that requires a reboot to all devices within the next 4 hours. Users must be able to postpone the reboot for up to 8 hours. You configure a device restart policy in Intune. Which deadline and grace period settings should you use?

A.Deadline: 8 hours, Grace period: 4 hours

B.Deadline: 2 hours, Grace period: 12 hours

C.Deadline: 4 hours, Grace period: 8 hours

D.Deadline: 4 hours, Grace period: 30 minutes

AnswerC

Correct. The deadline ensures reboot within 4 hours, and the grace period allows postponement up to 8 hours.

Why this answer

The deadline (4 hours) matches the required deployment window for the critical update, and the grace period (8 hours) allows users to postpone the reboot for up to 8 hours after the deadline. In Intune device restart policies, the deadline specifies when the update must be installed and the reboot initiated, while the grace period defines how long users can delay the restart after the deadline. With a 4-hour deadline and 8-hour grace period, the update is enforced within 4 hours, and users can postpone the reboot for up to 8 hours from that point, meeting both requirements.

Exam trap

The trap here is confusing the deadline with the grace period, leading candidates to think the deadline should be the total time allowed for postponement (8 hours) and the grace period the deployment window (4 hours), which reverses the correct logic.

How to eliminate wrong answers

Option A is wrong because a deadline of 8 hours exceeds the required 4-hour deployment window, meaning the update would not be enforced within the necessary timeframe. Option B is wrong because a deadline of 2 hours is too short, forcing the update and reboot before the 4-hour window is fully utilized, and a 12-hour grace period is excessive, allowing postponement beyond the 8-hour user flexibility requirement. Option D is wrong because a grace period of 30 minutes is far too short, preventing users from postponing the reboot for up to 8 hours as required.

Full explanation →

336

Multi-Selectmedium

You are planning the deployment of Microsoft Defender for Endpoint to macOS devices managed by Microsoft Intune. Which TWO prerequisites are required?

Select 2 answers

A.Microsoft Defender for Endpoint license assigned to the user or device

B.macOS device enrollment in Microsoft Intune

C.Microsoft Intune management extension installed on the device

D.Onboarding to Microsoft Defender for Cloud

E.A VPN connection to the corporate network

AnswersA, B

A license is required.

Why this answer

The correct prerequisites are: A and B. For A: Microsoft Defender for Endpoint requires a valid license assigned to the user or device. For B: The macOS device must be enrolled in Microsoft Intune to receive the configuration profile and policies for Defender.

Option C is incorrect because the Microsoft Intune management extension is for Windows only, not macOS. Option D is incorrect because onboarding to Microsoft Defender for Cloud is not a prerequisite; Defender for Endpoint can be deployed independently. Option E is incorrect because a VPN connection is not required for Defender for Endpoint to function on macOS.

Full explanation →

337

MCQeasy

You have deployed the above Endpoint Protection configuration profile to Windows 10 devices. Some users report that their devices are not encrypted. You verify that the devices have TPM 2.0 and meet hardware requirements. What is the most likely cause?

A.The policy does not configure recovery key escrow to Azure AD.

B.The policy disables encryption for the OS drive.

C.The devices do not have a TPM chip.

D.The encryption method is not supported by the devices.

AnswerA

BitLocker requires a recovery password to be escrowed; without it, encryption may not start.

Why this answer

When BitLocker encryption is enabled via an Endpoint Protection configuration profile in Microsoft Intune, the policy must include recovery key escrow to Azure AD for encryption to proceed. Without this setting, BitLocker will not encrypt the drive, even if the device meets TPM and hardware requirements. The policy in question likely has the 'Require BitLocker recovery key to be stored in Azure AD' option set to 'Not configured' or 'No', which prevents encryption from starting.

Exam trap

The trap here is that candidates assume meeting hardware requirements (TPM 2.0) is sufficient for BitLocker encryption, overlooking the mandatory recovery key escrow configuration in the Intune policy that is required to initiate encryption.

How to eliminate wrong answers

Option B is wrong because the policy does not disable encryption for the OS drive; the issue is that encryption fails to initiate due to missing recovery key escrow, not because the OS drive encryption is explicitly disabled. Option C is wrong because the question explicitly states that the devices have TPM 2.0 and meet hardware requirements, so the absence of a TPM chip is not the cause. Option D is wrong because the encryption method (e.g., XTS-AES 128-bit or 256-bit) is supported by Windows 10 devices with TPM 2.0, and the problem is not related to encryption method incompatibility.

Full explanation →

338

Multi-Selectmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices to authenticate to a corporate Wi-Fi network. Which TWO methods can you use to deploy the certificate?

Select 2 answers

A.Create a SCEP certificate profile in Intune.

B.Create a device compliance policy that includes the certificate.

C.Create a Wi-Fi profile and embed the certificate in the profile.

D.Create a VPN profile that includes the certificate.

E.Create a PKCS certificate profile in Intune.

AnswersA, E

SCEP profiles request and install certificates from a CA.

Why this answer

A SCEP certificate profile in Intune allows iOS/iPadOS devices to request a certificate from a Simple Certificate Enrollment Protocol (SCEP) server, which can then be used for Wi-Fi authentication. This method supports automated enrollment and renewal of certificates without manual intervention, making it suitable for large-scale deployments.

Exam trap

The trap here is that candidates often confuse a Wi-Fi profile's ability to reference a certificate with the ability to embed the certificate directly, leading them to select option C, but Intune requires the certificate to be deployed separately via a certificate profile.

Full explanation →

339

Multi-Selectmedium

Your organization uses Intune to manage iOS devices. You need to deploy a custom configuration for a line-of-business app. Which TWO methods can you use?

Select 2 answers

A.App Configuration Policy for managed devices

B.App Protection Policy

C.iOS app configuration file in the app package

D.App Configuration Policy for managed apps

E.Device Configuration Profile

AnswersA, C

Delivers settings to LOB apps.

Why this answer

App Configuration Policies for managed devices allow you to supply custom configuration settings (e.g., JSON or XML key-value pairs) to an iOS line-of-business app when the device is enrolled in Intune MDM. Option C is correct because you can embed a configuration file (e.g., a .plist) directly within the iOS app package, which the app reads at launch without requiring a separate policy push.

Exam trap

The trap here is confusing 'App Configuration Policy for managed devices' (device-enrolled) with 'App Configuration Policy for managed apps' (MAM-only), leading candidates to incorrectly select Option D instead of A.

Full explanation →

340

MCQeasy

You need to deploy Microsoft 365 Apps to 200 Windows devices using Intune. Which app type should you select in Intune?

A.Microsoft 365 Apps for Windows

B.Web link

C.Windows app (MSI)

D.Line-of-business app

AnswerA

Dedicated type for Office deployment.

Why this answer

The Microsoft 365 Apps for Windows app type in Intune is specifically designed to deploy the Microsoft 365 Apps suite (e.g., Word, Excel, Outlook) to Windows devices. It provides built-in configuration options for update channels, removal of previous Office versions, and license assignment, making it the correct choice for deploying Microsoft 365 Apps to 200 devices. Other app types lack the integrated logic to handle the suite's installation, activation, and update management.

Exam trap

The trap here is that candidates often confuse the 'Microsoft 365 Apps for Windows' app type with the 'Windows app (MSI)' or 'Line-of-business app' types, mistakenly thinking they can upload an Office installer manually, but Intune requires the dedicated app type to properly handle the Click-to-Run installation and licensing integration.

How to eliminate wrong answers

Option B is wrong because a web link app type only creates a shortcut to a URL on the device's Start menu or desktop, not an actual software installation. Option C is wrong because Windows app (MSI) is used for deploying traditional MSI-based applications, but Microsoft 365 Apps is not distributed as a single MSI file; it uses the Office Deployment Tool (ODT) and Click-to-Run technology. Option D is wrong because the line-of-business (LOB) app type is intended for sideloading app packages (e.g., .intunewin, .msi, .appx) that are not available in the public store, but it does not provide the specialized configuration options for Microsoft 365 Apps, such as channel selection or exclusion of specific apps.

Full explanation →

341

Multi-Selecteasy

You are configuring Microsoft Entra Conditional Access for a company that requires all employees to use multi-factor authentication (MFA) when accessing the Azure portal. The company also wants to block access from devices that are not compliant. You create a Conditional Access policy. Which two assignments must you configure to meet these requirements? (Choose two.)

Select 2 answers

A.Grant access, require Microsoft Entra hybrid joined device

B.Grant access, block access for non-compliant devices

C.Grant access, require multi-factor authentication

D.Grant access, require device to be marked as compliant

AnswersC, D

This enforces MFA for access.

Why this answer

The requirement to enforce multi-factor authentication (MFA) for Azure portal access is met by configuring the 'Grant' control to 'Require multi-factor authentication'. Option D is correct because blocking access from non-compliant devices is achieved by selecting 'Require device to be marked as compliant' under Grant controls, which ensures only devices that meet compliance policies (e.g., Intune-managed) are allowed. Both assignments are necessary to satisfy the two distinct requirements.

Exam trap

The trap here is that candidates often confuse 'Block access for non-compliant devices' (which does not exist as a Grant control) with the correct 'Require device to be marked as compliant', or they mistakenly think a hybrid join requirement is needed for MFA enforcement.

Full explanation →

342

MCQmedium

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

A.The device is not enrolled in Intune correctly.

B.The password policy is conflicting with Secure Boot.

C.The virtual machine does not have Secure Boot enabled in its firmware settings.

D.The device does not have BitLocker enabled, which is required for Secure Boot.

AnswerC

VMs often have Secure Boot disabled; enabling it in the VM settings resolves the issue.

Why this answer

Secure Boot is a hardware-based feature that ensures the system boots using only software trusted by the PC manufacturer. In virtual machines, Secure Boot is often not enabled by default or may not be supported by the hypervisor. For Intune compliance, if the VM does not have Secure Boot enabled, it will report as non-compliant.

Option C is correct because the VM's firmware settings likely have Secure Boot disabled. Option A is incorrect because the device may still be enrolled correctly. Option B is incorrect because password policy is unrelated to Secure Boot.

Option D is incorrect because BitLocker is a separate encryption feature not required for Secure Boot.

Full explanation →

343

MCQhard

Refer to the exhibit. You are deploying a custom OMA-URI policy to Windows 10 devices. What is the effect of this policy?

A.Windows Update is configured to defer updates.

B.Device telemetry is set to enhanced.

C.Windows Defender is disabled.

D.Cortana is enabled.

AnswerB

AllowTelemetry value 2 corresponds to enhanced.

Why this answer

The OMA-URI policy configured in the exhibit sets the 'System/AllowTelemetry' value to '2', which corresponds to the 'Enhanced' telemetry level in Windows 10. This policy enables Microsoft to collect additional diagnostic data, including how Windows and apps are used, to improve the user experience and device performance. It does not affect Windows Update deferral, Defender state, or Cortana.

Exam trap

The trap here is that candidates may confuse the telemetry policy with other common MDM policies, such as Windows Update deferral or Defender settings, because the exam often tests the specific numeric values and their corresponding telemetry levels rather than the broader functionality.

How to eliminate wrong answers

Option A is wrong because deferring Windows updates is configured via the 'Update/DeferUpdatePeriod' or 'Update/DeferFeatureUpdatesPeriod' OMA-URI, not through telemetry settings. Option C is wrong because disabling Windows Defender is controlled by policies such as 'Defender/DisableRealtimeMonitoring' or 'Defender/AllowUserUIAccess', not by the telemetry level. Option D is wrong because enabling Cortana is managed by policies like 'Experience/AllowCortana' or 'System/AllowCortana', not by the telemetry URI.

Full explanation →

344

MCQeasy

You need to ensure that all corporate devices have a standard set of security settings, including disk encryption and firewall configuration. Which Microsoft Intune feature should you use?

A.Update rings

B.Configuration profiles

C.Device enrollment profiles

D.Compliance policies

AnswerB

Configuration profiles apply settings to devices.

Why this answer

Configuration profiles in Microsoft Intune are the correct feature to deploy standard security settings such as disk encryption (e.g., BitLocker) and firewall configuration across corporate devices. These profiles define device-level policies that enforce specific configurations, including endpoint protection settings, and can be assigned to groups of devices to ensure consistent security baselines.

Exam trap

The trap here is that candidates often confuse compliance policies with configuration profiles, mistakenly thinking that compliance policies can apply settings, when in fact compliance policies only evaluate and report on settings that must already be configured by a profile or other means.

How to eliminate wrong answers

Option A (Update rings) is wrong because update rings manage the rollout and deferral of Windows updates, not the configuration of security settings like encryption or firewall rules. Option C (Device enrollment profiles) is wrong because enrollment profiles control the enrollment process and initial device setup (e.g., user affinity, enrollment restrictions), not ongoing security configurations. Option D (Compliance policies) is wrong because compliance policies define conditions that devices must meet to be considered compliant (e.g., requiring encryption), but they do not actually apply the settings; they only mark devices as non-compliant if the settings are missing, whereas configuration profiles actively enforce the settings.

Full explanation →

345

MCQmedium

A user reports that their Windows 11 device fails to enroll in Microsoft Intune. The device is Microsoft Entra joined and the user has a valid Intune license. What should you check first?

A.Verify that BitLocker is enabled on the device.

B.Check the Enrollment Status Page (ESP) profile configuration in Intune.

C.Ensure that the device has a local administrator password set.

D.Review the Windows Autopilot deployment profile assigned to the device.

AnswerB

ESP profiles can cause enrollment failures if they are not configured correctly or if they are blocked.

Why this answer

Enrollment Status Page (ESP) profiles can block enrollment if misconfigured, and checking the Intune console is the first step to see errors. Option A is wrong because BitLocker is not related to enrollment. Option C is wrong because the local admin password is not required for enrollment.

Option D is wrong because the Autopilot profile is only relevant for Autopilot deployments, not general enrollment.

Full explanation →

346

MCQhard

Refer to the exhibit. You have assigned the above Enrollment Status Page (ESP) policy to a Windows Autopilot deployment. A user reports that the provisioning process hangs on 'Installing apps' and never completes. What is the most likely cause?

A.The ESP policy is configured to track progress for Autopilot only, but the device is not using Autopilot.

B.One of the required apps failed to install.

C.The user attempted to retry the setup and it was blocked.

D.The device reset on failure is enabled, causing a reset loop.

AnswerB

The ESP waits for app installation, and if it fails without reset, it hangs.

Why this answer

The Enrollment Status Page (ESP) policy tracks the installation of required apps during Autopilot provisioning. If a required app fails to install, the ESP will hang on 'Installing apps' indefinitely because it waits for all required apps to succeed before proceeding. This is the most common cause of a stuck ESP at the app phase.

Exam trap

The trap here is that candidates often assume the ESP hangs due to a network issue or user error, but Microsoft explicitly designs the ESP to block on required app failures, making this the primary troubleshooting focus for 'Installing apps' hangs.

How to eliminate wrong answers

Option A is wrong because the ESP policy is explicitly assigned to an Autopilot deployment, and the device is using Autopilot (the user is in provisioning). Option C is wrong because the ESP does not block retry attempts; the user can retry, but if the app continues to fail, the hang persists. Option D is wrong because 'device reset on failure' is a separate setting that triggers a full reset only after a timeout or explicit failure, not a reset loop; the device would not hang indefinitely.

Full explanation →

347

MCQeasy

You need to configure Microsoft Intune to automatically retire a device if it has not checked in for 30 days. Where would you configure this setting?

A.Intune device cleanup rules

B.Conditional access policy

C.Device compliance policy

D.Device configuration profile

AnswerA

Cleanup rules can automatically retire inactive devices.

Why this answer

Intune device cleanup rules allow you to automatically retire or delete devices that have not checked in for a specified period, such as 30 days. Option B is incorrect because conditional access policies control access to resources based on conditions, not device cleanup. Option C is incorrect because device compliance policies evaluate device compliance based on conditions, not retirement from inactivity.

Option D is incorrect because device configuration profiles enforce settings and configurations, not cleanup rules.

Full explanation →

348

MCQeasy

Your organization is planning to deploy Microsoft Entra hybrid joined devices. What is a prerequisite for this configuration?

A.Azure AD Premium P1 license is required.

B.Microsoft Intune must be enabled for auto-enrollment.

C.Microsoft Defender for Endpoint must be deployed.

D.Microsoft Entra Connect must be installed and configured.

AnswerD

Entra Connect synchronizes on-premises AD to Entra ID, which is required for hybrid identity.

Why this answer

Microsoft Entra hybrid joined devices require synchronization of on-premises Active Directory identities to Microsoft Entra ID. Microsoft Entra Connect (or Microsoft Entra Connect Sync) is the tool that performs this identity synchronization, making it a mandatory prerequisite. Without it, the on-premises AD objects cannot be linked to Entra ID for hybrid join.

Exam trap

The trap here is that candidates often confuse licensing requirements (Premium P1) or optional management tools (Intune, Defender) with the core prerequisite of identity synchronization, which is the foundational step for hybrid join.

How to eliminate wrong answers

Option A is wrong because Azure AD Premium P1 is not a prerequisite for hybrid join; it is required for features like Conditional Access or self-service password reset, but hybrid join itself works with any Azure AD license, including Free. Option B is wrong because Microsoft Intune auto-enrollment is optional for managing hybrid joined devices but not a prerequisite for the join process itself. Option C is wrong because Microsoft Defender for Endpoint is a security solution that can be deployed on hybrid joined devices but is not required for the hybrid join configuration.

Full explanation →

349

MCQhard

Refer to the exhibit. You run the PowerShell command on a Windows 10 device to troubleshoot why a Win32 app did not install. What information does this command provide?

A.The start of an app installation attempt

B.The list of assigned policies

C.The result of a completed app installation

D.Errors from the last sync

AnswerA

Event 1001 logs the beginning of an installation.

Why this answer

The PowerShell command `Get-MgDeviceManagementManagedDevice -DeviceId <id> | Select-Object -ExpandProperty LastAppInstallStartTime` retrieves the timestamp of the most recent attempt to start installing an app on the managed device. This is useful for troubleshooting because it tells you when the installation process was initiated, helping to determine if the device is receiving the installation trigger from Intune. A correct start time indicates the policy was delivered and the client began processing, even if the installation later failed.

Exam trap

The trap here is that candidates confuse the start time of an installation attempt with the result or completion status, leading them to choose 'The result of a completed app installation' when the command only provides the initiation timestamp.

How to eliminate wrong answers

Option B is wrong because `Get-MgDeviceManagementManagedDevice` does not return assigned policies; to list assigned policies, you would use cmdlets like `Get-MgDeviceManagementDeviceConfiguration` or `Get-MgDeviceManagementManagedDeviceConfigurationState`. Option C is wrong because the command retrieves the start time of an installation attempt, not the result; to see the result, you would need to check `LastAppInstallResult` or `LastAppInstallStatus` properties. Option D is wrong because sync errors are tracked via `Get-MgDeviceManagementManagedDevice` property `LastSyncError` or `SyncState`, not by the `LastAppInstallStartTime` property.

Full explanation →

350

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices are compliant with a new security policy that requires Windows Defender Antivirus to be enabled and up-to-date. You create a device compliance policy with the setting 'Require' for Windows Defender Antivirus. After assigning the policy, you see that 90% of devices are compliant. The remaining 10% show 'Not evaluated'. You check the devices and find that they are online, enrolled, and have Windows Defender Antivirus enabled. What is the most likely reason for the 'Not evaluated' status?

A.The devices have not checked in with Intune since the policy was assigned

B.The devices are offline

C.The policy is not assigned to the devices

D.Windows Defender Antivirus is disabled

AnswerA

Compliance status requires a check-in; 'Not evaluated' means no evaluation has occurred yet.

Why this answer

A device must check in with Intune after the compliance policy is assigned for evaluation to occur. If the device has not checked in since the policy was assigned, it will show 'Not evaluated' even if it is online and has Windows Defender Antivirus enabled. Option B is incorrect because the devices are stated to be online.

Option C is incorrect because the policy is assigned, but the devices haven't checked in to receive it. Option D is incorrect because Windows Defender Antivirus is enabled, but the policy hasn't been evaluated yet.

Full explanation →

351

MCQhard

Refer to the exhibit. You are deploying a line-of-business app to Windows 10 devices. The JSON shows the app configuration in Microsoft Graph. Which of the following is true about this deployment?

A.The device will restart automatically after installation.

B.The app will only install if the product code matches.

C.The app will install in system context.

D.The app will be installed from the Microsoft Store for Business.

AnswerC

useDeviceContext: true means system context installation.

Why this answer

The JSON configuration includes the 'installExperience' property set to 'system', which means the app will be installed in the system context (as SYSTEM account) rather than per-user. This is typical for line-of-business apps deployed via Microsoft Intune, ensuring the app is available to all users on the device and can perform system-level operations without user interaction.

Exam trap

In Microsoft Intune, the trap here is that candidates confuse the 'productCode' in detection rules with a prerequisite for installation, or assume 'system' context implies automatic reboot, when in fact it only controls the security context under which the installer runs.

How to eliminate wrong answers

Option A is wrong because the JSON does not include any 'restartBehavior' or 'deviceRestart' property; automatic restart is not implied by system context installation. Option B is wrong because the JSON uses 'productCode' only for MSI detection, not as a prerequisite for installation; the app will install regardless of whether the product code exists beforehand. Option D is wrong because the JSON specifies 'msi' as the app type and includes a 'filePath' pointing to a local or network source, not a Microsoft Store for Business package.

Full explanation →

352

MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only approved corporate apps can be installed on these devices. Which restriction profile setting should you configure?

A.Allow app installation from App Store only

B.Require app store password

C.Allow managed apps to unmanaged accounts

D.Allow automatic app downloads

AnswerA

Correct. Setting 'Allow app installation from App Store only' to 'No' blocks the App Store, so only managed apps deployed via Intune can be installed, ensuring only approved corporate apps.

Why this answer

Configuring 'Allow app installation from App Store only' to 'No' effectively blocks the App Store, preventing users from installing any apps from the store. Only apps deployed via Intune (managed apps) can then be installed, ensuring only approved corporate apps are on the devices. Option B is incorrect because requiring a password for App Store transactions does not block the installation of unapproved apps if the user has the password.

Options C and D are unrelated to app installation restrictions.

Exam trap

Candidates may mistakenly think 'Require app store password' restricts installation to approved apps, but it only adds a password prompt. The correct approach is to block the App Store entirely via 'Allow app installation from App Store only' set to No, forcing all app installations to come from Intune management.

Full explanation →

353

MCQmedium

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

A.The devices are not enrolled in Microsoft Intune.

B.The Microsoft Defender for Endpoint sensor is not installed or configured correctly.

C.The devices are not compliant with conditional access policies.

D.The devices have lost connectivity to the internet.

AnswerB

The sensor must be onboarded to communicate with the Defender for Endpoint service.

Why this answer

The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Exam trap

The trap here is that candidates often confuse device enrollment (Intune) with sensor onboarding, assuming that a device must be managed by Intune to report to Defender for Endpoint, when in fact any Windows 10 device can be onboarded via a simple script or GPO.

How to eliminate wrong answers

Option A is wrong because enrollment in Microsoft Intune is not a prerequisite for Defender for Endpoint reporting; devices can be onboarded via Group Policy, local script, or other methods without Intune. Option C is wrong because conditional access compliance policies control access to cloud apps, not the reporting of security health to Defender for Endpoint; a non-compliant device can still report telemetry. Option D is wrong because while internet connectivity is required for the sensor to communicate with the cloud, the question states some devices are inactive, not all; if connectivity were the issue, all devices would likely be affected, and the sensor would still attempt to report (showing as 'misconfigured' rather than 'inactive').

Full explanation →

354

MCQeasy

Your organization uses Microsoft Intune for device management. You need to ensure that only corporate-owned devices can enroll in Intune. Which configuration should you use?

A.Use Device Enrollment Manager (DEM) accounts to enroll devices.

B.Assign a compliance policy that requires the device to be corporate-owned.

C.Create a device category for corporate devices and instruct users to select it during enrollment.

D.Configure enrollment restrictions to block personally owned devices.

AnswerA

DEM accounts allow enrollment of corporate-owned devices without pre-designation.

Why this answer

Device Enrollment Manager (DEM) accounts allow designated administrators to enroll devices on behalf of other users, and these devices are automatically marked as corporate-owned. Option B is incorrect because a compliance policy can require corporate ownership as a condition, but it does not block personal devices from enrolling; it only marks them noncompliant after enrollment. Option C is incorrect because device categories are for organizational grouping, not for enforcing corporate-only enrollment.

Option D is incorrect because enrollment restrictions can block personally owned devices, but they do not automatically designate devices as corporate-owned; DEM is the appropriate method for ensuring only corporate-owned devices enroll.

Full explanation →

355

Multi-Selecthard

Your organization is implementing a zero-trust security model using Microsoft Intune. Devices must be compliant before accessing corporate resources. You need to deploy compliance policies for Windows 10 devices that require BitLocker encryption and a minimum OS version. Which two policy settings should you configure? (Choose two.)

Select 2 answers

A.Minimum OS version.

B.Require device health attestation.

C.Require firewall (Windows Defender Firewall).

D.Require encryption of data storage on device.

E.Maximum OS version.

AnswersA, D

This setting ensures the device meets the minimum OS version requirement.

Why this answer

The 'Minimum OS version' setting in a Windows 10 compliance policy ensures that devices must be running at least a specified build number (e.g., 10.0.19041 for Windows 10 20H1). This directly enforces the zero-trust requirement that only devices with a supported, up-to-date OS can access corporate resources, reducing exposure to known vulnerabilities. Option D is correct because the 'Require encryption of data storage on device' setting mandates BitLocker encryption on the system drive, which is a core data protection control in a zero-trust model.

Exam trap

The trap here is that candidates often confuse 'Require encryption of data storage on device' with 'Require device health attestation,' mistakenly thinking health attestation covers encryption, when in fact health attestation focuses on boot integrity and does not enforce BitLocker status.

Full explanation →

356

MCQhard

Refer to the exhibit. You see the following Intune device properties for a Windows device. The device is noncompliant and the grace period expires on 2025-02-20. Today is 2025-02-15. The compliance policy requires a minimum OS version of 10.0.19041 but the device is on 10.0.18363. What will happen if the device does not become compliant before the grace period expires?

A.The device will automatically update to the required OS version

B.The device will be blocked from accessing corporate resources

C.The device will be retired immediately

D.The device will be retired after the grace period expires

AnswerD

After grace period, the configured noncompliance action (e.g., retire) will be applied.

Why this answer

When a noncompliant device's grace period expires, Intune enforces the compliance policy by retiring the device. Retirement removes the device from Intune management and revokes access to corporate resources, but it does not immediately block access or force an OS update. The grace period allows a window for remediation; after expiration, the device is marked for retirement.

Exam trap

The trap here is that candidates confuse the immediate conditional access block (which can occur during noncompliance) with the post-grace-period retirement action, or assume Intune can force OS updates automatically.

How to eliminate wrong answers

Option A is wrong because Intune does not have the capability to automatically push OS version updates to Windows devices; compliance policies only report noncompliance and trigger actions like blocking access or retirement, not OS upgrades. Option B is wrong because blocking access (conditional access) occurs when the device is noncompliant, but the grace period allows continued access until it expires; after expiration, the device is retired, not merely blocked. Option C is wrong because retirement is not immediate upon noncompliance; it occurs only after the grace period expires, as specified in the policy configuration.

Full explanation →

357

MCQeasy

A user reports that their Microsoft Intune enrolled device is not receiving required compliance policies. The device shows as 'Not evaluated' in the Microsoft Intune admin center. What is the most likely cause?

A.The device is not connected to the internet

B.The Intune Management Extension is not installed

C.The user does not have an Intune license assigned

D.The device is not enrolled in Intune

AnswerB

Without the extension, policies cannot be evaluated, leading to 'Not evaluated'.

Why this answer

When the Intune Management Extension is not installed, the device cannot process compliance policies, resulting in a 'Not evaluated' status. Option A (No internet) would typically show as 'Not compliant' or 'Unknown'. Option C (No license) would prevent enrollment, so the device wouldn't be enrolled.

Option D (Not enrolled) would show as 'Not enrolled', not 'Not evaluated'.

Full explanation →

358

MCQhard

Refer to the exhibit. You execute this PowerShell script to wipe noncompliant Windows devices. After running, you find that some compliant devices were also wiped. What is the most likely reason?

A.The filter 'operatingSystem eq 'Windows'' does not match any devices, so the script wiped all devices.

B.The script wipes only noncompliant devices, but some compliant devices had a null compliance state.

C.The script uses the wrong Graph API endpoint, causing all devices to be wiped.

D.The script does not check the device's compliance state before wiping.

AnswerC

The cmdlet Invoke-MgDeviceManagementManagedDevice does not exist; the correct cmdlet is Invoke-MgDeviceManagementManagedDeviceAction with proper parameters. The incorrect cmdlet might have unexpected behavior or default to wiping all devices.

Why this answer

The script uses the wrong Graph API endpoint. The correct endpoint for wiping a device is `/deviceManagement/managedDevices/{deviceId}/wipe`, but the script likely uses an incorrect or generic endpoint (e.g., `/devices/{deviceId}/wipe` or a non-existent path), which causes the API to misinterpret the request or apply the wipe action to all devices in the tenant, including compliant ones. This is a common misconfiguration when targeting the Microsoft Graph API for Intune device actions.

Exam trap

The trap here is that candidates assume the script logic is correct and focus on the compliance filter, but the real issue is the Graph API endpoint, which is a common misconfiguration that causes unintended mass actions.

How to eliminate wrong answers

Option A is wrong because the filter 'operatingSystem eq 'Windows'' would match Windows devices, not cause a mismatch that wipes all devices; if no devices matched, the script would simply not process any devices. Option B is wrong because a null compliance state is treated as noncompliant in Intune, so wiping devices with null compliance would be expected behavior, not an error that wipes compliant devices. Option D is wrong because the script explicitly checks compliance state with the filter 'complianceState eq 1' (noncompliant), so it does check compliance before wiping; the issue is the endpoint, not the absence of a compliance check.

Full explanation →

359

MCQeasy

You are deploying Microsoft Defender for Endpoint to Windows 10 devices managed by Microsoft Intune. After onboarding, you need to verify that the sensor is running. Which cmdlet should you use on the device?

A.Get-Service -Name WinDefend

B.Get-DefenderEndpoint

C.Get-MpComputerStatus

D.Get-Service -Name Sense

AnswerD

The Defender for Endpoint sensor service is named 'Sense'.

Why this answer

The correct cmdlet is Get-Service -Name Sense because the Microsoft Defender for Endpoint sensor runs as a Windows service named 'Sense' (Microsoft Defender Advanced Threat Protection Service). Checking this service confirms the sensor is installed and running, which is the standard verification step after onboarding devices to Defender for Endpoint.

Exam trap

The trap here is that candidates confuse the Defender for Endpoint sensor service (Sense) with the Windows Defender Antivirus service (WinDefend) or mistakenly use a non-existent cmdlet like Get-DefenderEndpoint, leading them to choose an incorrect verification method.

How to eliminate wrong answers

Option A is wrong because Get-Service -Name WinDefend checks the Windows Defender Antivirus service (WinDefend), not the Defender for Endpoint sensor. Option B is wrong because Get-DefenderEndpoint is not a valid PowerShell cmdlet; the correct cmdlet for checking sensor status is Get-MpComputerStatus or Get-Service -Name Sense. Option C is wrong because Get-MpComputerStatus retrieves antimalware status and definitions, not the running state of the Defender for Endpoint sensor service.

Full explanation →

360

MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom vertical market app that is not available in the Apple App Store. The app is distributed as an .ipa file signed with an enterprise certificate. You have uploaded the .ipa file to Intune. However, when you assign the app to a user group, the installation fails on devices with the error 'Unable to download app'. The devices are enrolled as user-affinity devices with Device Enrollment Program (DEP). You have verified that the enterprise certificate is trusted on the devices. What is the most likely cause of the failure?

A.The app package does not include an icon file.

B.The devices do not have a VPN configuration profile installed.

C.The app is not purchased through the Volume Purchase Program (VPP).

D.The devices are not in Supervised mode.

AnswerD

Enterprise apps require supervised mode for silent installation.

Why this answer

Enterprise-signed apps require the device to be in Supervised mode for silent installation without user prompts. Without supervision, the user must manually trust the enterprise certificate or the installation may fail. Option A is incorrect because the icon file is not critical for installation.

Option B is incorrect because a VPN configuration profile is not required for downloading enterprise apps. Option C is incorrect because VPP is for store apps, not enterprise-signed line-of-business apps.

Full explanation →

361

MCQhard

You are designing an app protection policy (APP) for Microsoft 365 mobile apps accessing corporate data on iOS devices. The security team requires that when a user opens a work document in the Microsoft Word app, the user must authenticate with Face ID or a passcode. Which setting should you configure?

A.Require PIN or Face ID for access (iOS)

B.Block managed apps from running on jailbroken devices

C.Encrypt app data

D.Require app PIN when device PIN is not set

AnswerA

This setting enforces authentication on app access.

Why this answer

The 'Require PIN or Face ID for access (iOS)' setting enforces biometric or passcode authentication specifically when a user launches a managed app or resumes it from the background. This directly meets the requirement that opening a work document in Word triggers Face ID or passcode verification, as the app protection policy (APP) intercepts the app launch and prompts for authentication before granting access to corporate data.

Exam trap

The trap here is that candidates confuse 'Require PIN or Face ID for access' with 'Require app PIN when device PIN is not set', mistakenly thinking the latter covers all scenarios, when in fact it only applies conditionally when the device lacks a PIN.

How to eliminate wrong answers

Option B is wrong because 'Block managed apps from running on jailbroken devices' prevents the app from running at all on compromised devices but does not enforce per-session authentication like Face ID or passcode. Option C is wrong because 'Encrypt app data' ensures data-at-rest encryption on the device but does not require user authentication at app launch. Option D is wrong because 'Require app PIN when device PIN is not set' only applies a PIN if the device lacks a PIN, whereas the requirement is to always require Face ID or passcode regardless of device PIN status.

Full explanation →

362

Multi-Selecthard

Which THREE conditions must be met for a device to automatically enroll in Windows Autopilot?

Select 3 answers

A.The device must have BitLocker Drive Encryption enabled

B.The device must be Azure AD joined or Hybrid Azure AD joined

C.The device must have internet connectivity during OOBE

D.The device must be running Windows 10 version 1709 or later

E.The user must be a Global Administrator in Azure AD

AnswersB, C, D

Autopilot requires Azure AD join.

Why this answer

Windows Autopilot requires the device to be either Azure AD joined or Hybrid Azure AD joined to establish a managed identity in the cloud. This identity enables the device to automatically receive a configuration profile that triggers the Autopilot deployment profile during the out-of-box experience (OOBE). Without this join state, the device cannot be recognized as an Autopilot-managed device.

Exam trap

The trap here is that candidates often confuse the prerequisites for Autopilot enrollment with post-enrollment security requirements, mistakenly selecting BitLocker (Option A) as a condition when it is actually a compliance setting applied after the device is enrolled.

Full explanation →

363

Multi-Selecteasy

Which TWO of the following are required to deploy an iOS line-of-business app via Microsoft Intune? (Select TWO.)

Select 2 answers

A.iOS app package file (.ipa)

B.Apple Developer signing certificate

C.iOS provisioning profile

D.Volume purchase program (VPP) token

E.MDM push certificate

AnswersA, C

The app binary.

Why this answer

An .ipa file is the app package. A provisioning profile is needed for app installation. An MDM push certificate is for device management, not app deployment.

A VPP token is for volume purchasing. A signing certificate is needed for development, but the provisioning profile includes signing info. So the two required are .ipa and provisioning profile.

Full explanation →

364

MCQmedium

Refer to the exhibit. You are evaluating a compliance policy for Windows 10. The policy is assigned to a group containing devices running Windows 10 version 1803 (build 17134.1). Which of the following devices will be marked as non-compliant?

A.A device with OS version 10.0.16299.0 (build 1709).

B.A device with OS version 10.0.17134.1 (build 1803).

C.A device with OS version 10.0.17134.2 (build 1803).

D.A device with OS version 10.0.15063.0 (build 1703).

AnswerA, D

This device has build 16299.0 (version 1709), which is below the minimum OS version of 10.0.17134.1 (build 1803). Therefore, it is non-compliant.

Why this answer

The compliance policy specifies a minimum OS version of 10.0.17134.1 (build 1803). Devices with an OS version lower than this minimum are marked non-compliant. Options A (build 16299.0, version 1709) and D (build 15063.0, version 1703) are both below the minimum, so they are non-compliant.

Option B matches exactly and is compliant. Option C has a higher build (17134.2), which exceeds the minimum, making it compliant.

Exam trap

The key trap is that this policy sets a *minimum* OS version (10.0.17134.1). Many candidates assume compliance policies only enforce a *maximum* version, so a higher build might be incorrectly deemed non-compliant. But with a minimum, any build below 17134.1 is non-compliant, while builds at or above are compliant.

How to eliminate wrong answers

Option A is wrong because OS version 10.0.16299.0 (build 1709) is lower than the policy's minimum version (1803), so it would be non-compliant, but the question asks which device will be marked non-compliant, and the correct answer is C. Option B is wrong because OS version 10.0.17134.1 (build 1803) exactly matches the policy's specified version, so it is compliant. Option D is wrong because OS version 10.0.15063.0 (build 1703) is lower than the minimum version, making it non-compliant, but again the correct answer is C.

Full explanation →

365

MCQeasy

You configure Windows Update for Business policies in Intune. Users report that updates are not installing during configured active hours. You verify that the policy is applied. What is the most likely cause?

A.Update notification level is set to 'Disable all notifications' and 'Automatic Updates behavior' is set to 'Notify download'.

B.Deadline for feature updates is set to 7 days.

C.Quality update deferral period is set to 0 days.

D.Active hours start is set to 8:00 AM and end to 5:00 PM.

AnswerA

'Notify download' means updates are not automatically downloaded; they must be manually initiated, so they won't install automatically during active hours.

Why this answer

When 'Automatic Updates behavior' is set to 'Notify download' and 'Disable all notifications' is enabled, the user never receives the notification to approve the download, so updates are never downloaded or installed. This overrides the active hours configuration because the update process never begins, even though the policy is applied.

Exam trap

The trap here is that candidates assume active hours are the sole reason updates fail to install, overlooking the fact that the update workflow must first be triggered by user interaction when 'Notify download' is configured, and disabling notifications completely halts that trigger.

How to eliminate wrong answers

Option B is wrong because a deadline for feature updates of 7 days sets a maximum time before updates are forced, but it does not prevent updates from installing during active hours if they are already downloaded. Option C is wrong because a quality update deferral period of 0 days means updates are offered immediately, which does not block installation during active hours. Option D is wrong because active hours from 8:00 AM to 5:00 PM define when updates should not restart the device, but they do not prevent updates from downloading or installing in the background; the issue is that updates never start due to the notification and behavior settings.

Full explanation →

366

MCQhard

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

A.The script execution exceeds the 60-minute timeout.

B.The user does not have local administrator privileges on the failing devices.

C.The script references a file path that does not exist on the failing devices.

D.The PowerShell execution policy is set to Restricted on the failing devices.

AnswerC

Error 0x80070002 is 'File not found'.

Why this answer

Error code 0x80070002 indicates 'File not found'. This occurs when the script references a file path that does not exist on the failing devices, making option C correct. Option A is incorrect because the PowerShell execution policy is bypassed by Intune when running scripts.

Option B is incorrect because Intune runs scripts in the system context (Local System account), not requiring user local admin privileges. Option D is incorrect because a script timeout would result in a different error (e.g., 0x80070057).

Full explanation →

367

MCQhard

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

A.The devices are not connected to the internet.

B.The hardware hashes are invalid.

C.The devices are not running Windows 11 Pro or Enterprise.

D.The user does not have an Intune license.

AnswerA

Autopilot requires internet connectivity to register with Intune.

Why this answer

Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Exam trap

The trap here is that candidates often assume hardware hash upload is the only prerequisite for Autopilot registration, overlooking the critical requirement for internet connectivity during the device's initial boot process.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that the hardware hashes are uploaded correctly, so invalid hashes are not the issue. Option C is wrong because Windows Autopilot supports Windows 11 Pro, Enterprise, and Education editions; the device not registering is not caused by running an unsupported edition. Option D is wrong because the user license is not required for device registration via Autopilot; device enrollment occurs before user sign-in, and Intune licenses are only needed for user-based management after enrollment.

Full explanation →

368

MCQhard

You have a Windows device with serial number ABC123 that is registered for Autopilot. The above PowerShell output shows the diagnostics. The device is not receiving the Autopilot profile. What is the most likely cause?

A.The device has not been successfully registered in Windows Autopilot.

B.The Autopilot profile is not assigned to the device group.

C.The device was previously manually imaged.

D.The device is not connected to the internet during OOBE.

AnswerA

RegistrationStatus should be 'Registered'.

Why this answer

'NotRegistered' indicates the device is not properly registered in Autopilot. Option B is incorrect because if the profile were not assigned, it would show 'NotAssigned' but still registered. Option C is incorrect because the diagnostics show registration status.

Option D is incorrect because the device can still be registered even if it has been imaged.

Full explanation →

369

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app to all macOS devices. What app type should you create in Intune?

A.macOS app (line-of-business)

B.Windows app (Win32)

C.Web link

D.iOS app (line-of-business)

AnswerA

macOS line-of-business app supports .pkg and .dmg files.

Why this answer

To deploy a custom .pkg app to macOS devices via Microsoft Intune, you must create a macOS line-of-business (LOB) app. LOB apps are designed for sideloading custom or in-house applications that are not available in the public app store, and Intune supports .pkg and .dmg formats for macOS LOB deployment. This app type allows you to upload the .pkg file directly and assign it to devices, handling installation through the Intune management agent.

Exam trap

The trap here is that candidates may confuse 'line-of-business' as a generic term and select the iOS LOB option, forgetting that each platform (macOS, iOS, Windows) has its own specific LOB app type in Intune.

How to eliminate wrong answers

Option B is wrong because 'Windows app (Win32)' is a deployment type for Windows applications using .exe or .msi installers, and it has no relevance to macOS device management. Option C is wrong because 'Web link' creates a shortcut to a URL on the device's home screen or portal, not an actual app installation, and cannot deploy a .pkg file. Option D is wrong because 'iOS app (line-of-business)' is used for deploying custom .ipa files to iOS devices, not macOS, and the platform-specific app types are not interchangeable.

Full explanation →

370

MCQhard

Your organization uses Microsoft Intune to manage devices. You have a compliance policy that requires devices to have a password of at least 6 characters. Some users report that their devices are marked as non-compliant even though they have a password set. What is the most likely cause?

A.The password length setting is set to '6' but the device requires a minimum of 8.

B.The compliance policy is assigned to device groups, but the devices are user-enrolled.

C.The compliance policy is assigned to a user group that does not include the affected users.

D.The device uses a PIN instead of a password, which is not evaluated.

AnswerC

If the policy is not assigned to the user or device group containing the users, they won't receive the policy and may be non-compliant by default.

Why this answer

The most likely cause is that the compliance policy is assigned to a user group that does not include the affected users. In Microsoft Intune, compliance policies are evaluated based on user or device group assignments. If a user is not a member of the assigned user group, the policy will not apply to their enrolled devices, and those devices will not be evaluated for compliance, often resulting in a non-compliant status or no status at all.

Exam trap

The trap here is that candidates often assume compliance policies apply to all devices automatically, overlooking the fact that policy assignment to specific user or device groups is required for evaluation to occur.

How to eliminate wrong answers

Option A is wrong because if the policy requires a minimum of 6 characters and the device has a password set, the device would be compliant; the issue is not about a higher device-level requirement, as Intune enforces the policy setting, not a device-imposed minimum. Option B is wrong because compliance policies can be assigned to either device groups or user groups; user-enrolled devices are still evaluated when the policy is assigned to a user group that includes the enrolling user, so this is not a fundamental limitation. Option D is wrong because Intune evaluates PINs and passwords equivalently for compliance; a PIN is considered a form of password, and the policy's password length requirement applies to both.

Full explanation →

371

MCQhard

Refer to the exhibit. You have configured the compliance policy shown above. A user reports that their Windows 11 device is compliant with all settings except the threat level. The device has no threat protection agent installed. What will happen when the user tries to access corporate resources?

A.Access is granted but the user receives a warning notification.

B.Access is blocked only after a 24-hour grace period.

C.Access is blocked immediately.

D.Access is granted because the device meets all other compliance requirements.

AnswerC

Device is noncompliant and action is to block immediately.

Why this answer

The compliance policy requires a minimum threat level, which cannot be evaluated because the device has no threat protection agent installed. In Microsoft Intune, when a required compliance setting cannot be assessed (e.g., no agent), the device is treated as non-compliant, and access is blocked immediately. There is no grace period for missing required agents, and conditional access enforces the block at the time of the access request.

Exam trap

The trap here is that candidates assume a grace period applies to all non-compliance scenarios, but grace periods are only applicable to specific settings (like password expiration) and not to missing required agents or unassessable settings.

How to eliminate wrong answers

Option A is wrong because access is not granted with a warning; Intune conditional access blocks non-compliant devices immediately, and a warning notification is only sent if the device is compliant but has a warning-level issue. Option B is wrong because a 24-hour grace period applies only to specific non-compliance actions (e.g., password expiration) when configured in a compliance policy, not to missing required agents like a threat protection agent. Option D is wrong because meeting all other compliance requirements does not override the specific threat level requirement; the device is non-compliant overall, and access is blocked.

Full explanation →

372

MCQmedium

You need to implement a solution that automatically wipes a company-owned Windows 10 device when it has not connected to Intune for 30 days. Which Intune feature should you configure?

A.A PowerShell script that runs on the device to self-destruct after 30 days.

B.Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.

C.Device cleanup rules to automatically delete devices after 30 days.

D.Device configuration profile with a setting to require periodic check-in.

AnswerB

Correct. A compliance policy can include a rule for 'Maximum days since last check-in' to mark the device non-compliant, and you can configure a non-compliance action to retire (wipe) the device after the specified period.

Why this answer

A compliance policy can include a rule for 'Maximum days since last check-in' that marks the device non-compliant if it hasn’t connected for 30 days. You then configure a non-compliance action to retire the device, which triggers a wipe. Option A is wrong because a PowerShell script cannot reliably execute on a device that hasn’t connected to Intune for 30 days—it requires connectivity to run.

Option C is wrong because device cleanup rules only remove stale device records from Intune, they do not trigger a wipe on the device. Option D is wrong because configuration profiles set settings but do not enforce check-in frequency or trigger wipe actions.

Full explanation →

373

MCQeasy

You are planning a Windows Autopilot deployment for your organization. You need to ensure that during the out-of-box experience (OOBE), the user is prompted to set up Windows Hello for Business. What should you configure in the Autopilot profile?

A.Ensure the device is Azure AD joined.

B.Create a separate Windows Hello for Business policy and assign it to the device group.

C.Configure the Enrollment Status Page to show Hello setup.

D.Set 'Enable Windows Hello for Business' in the Autopilot profile.

AnswerD

The profile includes a setting to enable Hello during OOBE.

Why this answer

The Windows Autopilot profile includes a setting called 'Enable Windows Hello for Business' that, when enabled, automatically configures the device to prompt the user to set up Windows Hello for Business during the out-of-box experience (OOBE). This setting is part of the Autopilot profile itself and does not require a separate policy or additional configuration to trigger the Hello setup prompt.

Exam trap

The trap here is that candidates often assume a separate Windows Hello for Business policy (Option B) is required to trigger the OOBE prompt, not realizing that the Autopilot profile itself has a dedicated toggle that directly controls this behavior during the initial setup flow.

How to eliminate wrong answers

Option A is wrong because ensuring the device is Azure AD joined is a prerequisite for Windows Hello for Business, but it does not by itself cause the OOBE prompt to appear; the Autopilot profile must explicitly enable the Hello setting. Option B is wrong because creating a separate Windows Hello for Business policy and assigning it to the device group will enforce Hello after the device is provisioned, but it will not trigger the interactive setup prompt during OOBE; the Autopilot profile's built-in setting is required for that. Option C is wrong because the Enrollment Status Page (ESP) controls the provisioning progress display and can block setup until policies are applied, but it does not contain a setting to enable or prompt for Windows Hello for Business; the Hello prompt is controlled solely by the Autopilot profile's Hello toggle.

Full explanation →

374

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices. A user reports that their device is not receiving critical security updates despite being compliant with all update policies. You verify that the device is online and communicating with Intune. Which action should you take to resolve the issue?

A.Verify that the device meets the minimum hardware requirements for the update.

B.Force a sync from the device via Intune Company Portal or Settings > Accounts > Access work or school.

C.Reassign the device to a different Update Ring policy that has no feature update deferral.

D.Review the Windows Update Rings policy assigned to the device and adjust the deferral settings for quality updates.

AnswerD

Deferral settings can delay updates; adjusting them can resolve the issue.

Why this answer

The user's device is compliant and online, but not receiving critical security updates. The most likely cause is that the Windows Update Rings policy assigned to the device has a deferral period configured for quality updates, which delays the installation of security patches. Adjusting the deferral settings for quality updates to 0 days ensures that critical security updates are installed immediately upon release, resolving the issue without changing the feature update deferral.

Exam trap

The trap here is that candidates confuse 'force sync' with 'force update installation,' not realizing that a sync only retrieves policy and update metadata, but the deferral period still prevents the update from being offered until it expires.

How to eliminate wrong answers

Option A is wrong because minimum hardware requirements are checked by Windows Update itself before offering an update, and a device that is compliant with update policies would already meet those requirements; this is not a policy-related issue. Option B is wrong because forcing a sync only triggers the device to check for new policies and pending updates from Intune, but if the deferral period is still in effect, the sync will not cause the critical updates to be installed—they will remain deferred. Option C is wrong because reassigning to a different Update Ring policy that has no feature update deferral does not address the quality update deferral; feature update deferral controls major version upgrades, not critical security patches, and changing it would not resolve the delay in receiving quality updates.

Full explanation →

375

MCQeasy

A company wants to deploy Microsoft 365 Apps for enterprise to Windows 10 devices using Intune. They need to ensure that the apps are updated automatically from the Office Content Delivery Network (CDN). Which update channel should they select in the Office app deployment configuration?

A.Semi-Annual Enterprise Channel

B.Current Channel

C.Monthly Enterprise Channel

D.Insider Channel

AnswerC

Monthly Enterprise Channel is the recommended channel for enterprises, delivering updates monthly from the CDN.

Why this answer

The Monthly Enterprise Channel is the correct choice because it provides a predictable, once-per-month update cadence with security and quality updates, and it is designed for enterprise environments that require automatic updates from the Office Content Delivery Network (CDN) via Intune. This channel balances receiving new features sooner than the Semi-Annual Enterprise Channel while still offering managed deployment through configuration profiles.

Exam trap

The trap here is that candidates often confuse the Monthly Enterprise Channel with the Current Channel, assuming that 'Monthly' implies the same rapid update frequency as Current Channel, when in fact Current Channel updates multiple times per month and is not the recommended default for managed enterprise deployments.

How to eliminate wrong answers

Option A is wrong because the Semi-Annual Enterprise Channel only receives updates twice per year, which would delay critical security updates and does not align with the requirement for automatic updates from the CDN with a more frequent cadence. Option B is wrong because the Current Channel delivers updates multiple times per month, which can introduce frequent feature changes that may not be suitable for enterprise environments needing stability and predictable testing cycles. Option D is wrong because the Insider Channel is intended for early testing and validation of pre-release builds, not for production deployment with automatic updates from the CDN.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 301–375