Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 376–450 | Page 6/13

376

MCQhard

A user reports that their Windows 11 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' in the Intune console but last check-in was three days ago. What is the most likely cause?

A.The Intune service is experiencing an outage

B.The device is powered off or not connected to the internet

C.The device has conflicting policies from another MDM

D.The device's enrollment certificate has expired

AnswerB

Prevents MDM check-in.

Why this answer

If the device is powered off or not connected to the internet, it cannot check in with Intune to receive new policies. Option A is wrong because an Intune service outage would affect multiple devices, not just one. Option C is wrong because conflicting policies would not prevent check-in; the device would still check in and report conflicts.

Option D is wrong because an expired enrollment certificate would prevent enrollment or cause immediate issues, not just a delayed check-in after three days.

Full explanation →

377

MCQmedium

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

A.The users are not members of the Azure AD group assigned to the required app.

B.The devices are not connected to a Wi-Fi network configured in Intune.

C.The devices are not compliant with the compliance policy.

D.The enrollment restrictions are blocking the devices from receiving apps.

AnswerA

App assignment targeting is based on group membership; if users are not in the group, the app won't be required.

Why this answer

In Microsoft Intune, app deployment is based on Azure AD group assignments. Even if a device is compliant and has recently checked in, the required app will not install unless the user or device is a member of the Azure AD group that the app is assigned to. Intune evaluates group membership at each check-in to determine which apps should be pushed, so missing group membership is the most likely cause when compliance and connectivity are verified.

Exam trap

The trap here is that candidates often assume compliance or device connectivity is the primary blocker for app installation, overlooking that Intune's app delivery is strictly gated by Azure AD group membership, not by device health or network type.

How to eliminate wrong answers

Option B is wrong because Intune does not require a specific Wi-Fi network configured in Intune for app installation; apps can be delivered over any network connection, including cellular, as long as the device has internet access. Option C is wrong because the question explicitly states that devices are compliant, so non-compliance cannot be the cause. Option D is wrong because enrollment restrictions control which devices can enroll in Intune, not the delivery of apps to already enrolled devices; once enrolled, restrictions do not block app assignments.

Full explanation →

378

MCQeasy

You need to retire a corporate-owned iOS device that is no longer in use. The device is enrolled in Intune with user affinity. Which action should you perform?

A.Disable the device in Intune.

B.Wipe the device from Intune.

C.Retire the device from Intune.

D.Delete the device from Microsoft Entra ID.

AnswerC

Retire removes management and corporate data.

Why this answer

The 'Retire' action in Intune removes the managed app data and policies from the device while preserving the user's personal data, which is appropriate for a corporate-owned device with user affinity that is no longer in use. Retiring also removes the device from Intune management and revokes the company portal access, ensuring compliance without unnecessary data loss.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Wipe' or 'Disable', not realizing that Retire is the correct action for removing corporate data without affecting personal data on a corporate-owned device with user affinity.

How to eliminate wrong answers

Option A is wrong because disabling a device in Intune only blocks it from synchronizing and receiving policies, but does not remove corporate data or unenroll the device, leaving it partially managed. Option B is wrong because wiping the device performs a factory reset, which would erase all data including personal content, which is excessive for a corporate-owned device that simply needs to be decommissioned. Option D is wrong because deleting the device from Microsoft Entra ID removes the device object from Azure AD but does not trigger the Intune retirement process, leaving the device still enrolled and potentially able to access resources.

Full explanation →

379

MCQeasy

You need to deploy Microsoft Edge for Business to Windows 10 devices using Microsoft Intune. Which app type should you select in the Intune portal?

A.Web link

B.Windows app (Win32)

C.Microsoft 365 Apps

D.Built-in app

AnswerD

Edge for Business is listed under built-in apps.

Why this answer

The 'Built-in app' type in Microsoft Intune is specifically designed for deploying pre-packaged Microsoft applications, including Microsoft Edge for Business. This option automatically handles the installation and configuration of Edge without requiring manual packaging or complex deployment rules, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse 'Built-in app' with 'Windows app (Win32)' because they assume all software installations require a custom package, but Microsoft Edge is a first-party app with a dedicated deployment option in Intune.

How to eliminate wrong answers

Option A is wrong because 'Web link' is used to deploy shortcuts to websites or web apps, not to install software like Microsoft Edge. Option B is wrong because 'Windows app (Win32)' is intended for custom or third-party Win32 applications that require manual packaging and dependency handling, not for built-in Microsoft products that are pre-configured in Intune. Option C is wrong because 'Microsoft 365 Apps' is specifically for deploying Office 365 ProPlus suite components (Word, Excel, etc.), not for standalone browser installations like Microsoft Edge.

Full explanation →

380

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are no longer receiving compliance policies. You verify that the devices are enrolled and show as active in Intune. What should you check first?

A.Verify that the compliance policy is assigned to the correct Windows version.

B.Check if the devices can connect to the Intune service.

C.Ensure the users are members of the correct Azure AD group.

D.Re-enroll the devices in Intune.

AnswerA

The update may have changed the OS version, and the policy might not target that version.

Why this answer

The correct first step is to verify that the compliance policy is assigned to the correct Windows version. After a Windows update, the OS version may change, and if the policy targets a specific version that no longer matches, devices may stop receiving it. Option B is incorrect because connectivity issues would affect all Intune communication, not just compliance policy receipt.

Option C is incorrect because group membership does not directly affect policy delivery to already-enrolled devices. Option D is incorrect because re-enrollment is unnecessary and disruptive; the issue is likely a policy targeting mismatch.

Full explanation →

381

MCQeasy

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

A.The user's Intune license has expired.

B.The Outlook app is not installed on the device.

C.A compliance policy was updated requiring a newer OS version or additional security settings.

D.The device is not enrolled in Intune.

AnswerC

Updated policies can cause previously compliant devices to become non-compliant.

Why this answer

Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Exam trap

The trap here is that candidates assume the error means the device is not enrolled or that the app is missing, but the question explicitly states the device is enrolled and compliant, so the most likely cause is a policy change that retroactively affects compliance status.

How to eliminate wrong answers

Option A is wrong because an expired Intune license would prevent the user from enrolling the device or accessing Intune-managed resources entirely, but the device is already enrolled and compliant, and the error specifically states non-compliance, not a licensing issue. Option B is wrong because if the Outlook app were not installed, the user would not be able to launch it or see an error within the app; the error is displayed by the app itself, confirming it is installed. Option D is wrong because the question explicitly states the device is enrolled in Intune and compliant, so the device is enrolled; the error is due to a change in compliance status, not enrollment status.

Full explanation →

382

MCQeasy

Your organization is deploying Microsoft Intune for the first time. You need to ensure that devices can enroll in Intune. Which of the following is a prerequisite for Intune enrollment?

A.A Microsoft Intune license assigned to the user

B.A VPN connection to the corporate network

C.An on-premises Active Directory domain

D.A Configuration Manager infrastructure

AnswerA

An Intune license is required for enrollment and management.

Why this answer

A Microsoft Intune license assigned to the user is a prerequisite because Intune uses Azure Active Directory (Azure AD) for identity and access management. Without an Intune license (e.g., Microsoft 365 E3, E5, or standalone Intune license) assigned to the user, the device cannot authenticate and enroll via the Intune enrollment service, as the license is required to authorize the enrollment request and apply device management policies.

Exam trap

The trap here is that candidates often confuse on-premises prerequisites (like AD or VPN) with cloud-only requirements, mistakenly thinking corporate network connectivity or legacy infrastructure is needed for Intune enrollment, when in fact only an Azure AD identity and an Intune license are required.

How to eliminate wrong answers

Option B is wrong because a VPN connection to the corporate network is not required for Intune enrollment; Intune uses internet-based enrollment over HTTPS (port 443) to the Microsoft Intune service, and devices can enroll from anywhere without a VPN. Option C is wrong because an on-premises Active Directory domain is not a prerequisite; Intune enrollment relies on Azure AD for identity, and while hybrid Azure AD join can be used, a standalone on-premises AD domain is not required for basic Intune enrollment. Option D is wrong because a Configuration Manager infrastructure is not a prerequisite; Intune is a cloud-only MDM solution, and while co-management with Configuration Manager is possible, it is optional and not required for enrollment.

Full explanation →

383

MCQhard

Users report that their Android Enterprise fully managed devices are not receiving email profiles pushed from Intune. You confirm the devices are enrolled and show as compliant. What is the most likely cause?

A.The devices are using work profile instead of fully managed.

B.The devices are not compliant with the compliance policy.

C.A device restrictions profile blocks the email app.

D.The 'Android Device Policy' app is not set to 'Required' in the app assignment.

AnswerD

This app is essential for managing fully managed devices.

Why this answer

For Android Enterprise fully managed devices, the Android Device Policy app must be deployed as a required app assignment to the device. Without this assignment, the device lacks the necessary app to receive and apply email profiles pushed from Intune. The app configuration policy does not make the app required; instead, the app must be assigned as required via Intune app deployment.

Exam trap

The trap here is that candidates often assume compliance is sufficient for profile delivery, but Intune requires the 'Android Device Policy' app to be explicitly assigned as a required app (via app deployment) for fully managed devices to receive email profiles. Confusing app assignment with app configuration policy is a common mistake.

How to eliminate wrong answers

Option A is wrong because the question specifies that the devices are 'Android Enterprise fully managed devices,' so they are not using a work profile; the issue is not about profile type. Option B is wrong because the question explicitly states the devices 'show as compliant,' so non-compliance is not the cause. Option C is wrong because a device restrictions profile blocking the email app would prevent the app from running, but the issue is that email profiles are not being received, not that the app is blocked from functioning.

Full explanation →

384

MCQeasy

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

A.Trigger a sync from Intune to force the device to check in.

B.Re-enroll the device.

C.Delete the device from Intune and re-register.

D.Assign a new compliance policy to the device.

AnswerA

Last sync is old; syncing may resolve.

Why this answer

The PowerShell command shown likely runs a compliance evaluation or sync action, but the device remains noncompliant because the evaluation results haven't been reported back to Intune. Triggering a sync from Intune forces the device to check in, upload its latest compliance status, and update the portal, which is the first troubleshooting step before considering re-enrollment or policy changes.

Exam trap

The trap here is that candidates assume noncompliance means a policy misconfiguration or enrollment failure, rather than recognizing that the device simply hasn't reported its latest compliance evaluation, making a sync the correct first action.

How to eliminate wrong answers

Option B is wrong because re-enrolling the device is unnecessary; the device is already enrolled and the issue is likely a stale compliance status, not a broken enrollment. Option C is wrong because deleting and re-registering the device is a drastic step that should only be taken if the device cannot sync or has a corrupted enrollment record, not as a first action for noncompliance. Option D is wrong because assigning a new compliance policy won't resolve noncompliance if the device hasn't reported its status; the existing policy is already assigned, and the device needs to sync to evaluate and report compliance.

Full explanation →

385

MCQhard

You configure a Windows 10 device compliance policy in Intune that requires 'Firewall' to be enabled. The device has Windows Defender Firewall enabled, but the device reports as non-compliant. You verify that the firewall is active. What is the most likely cause?

A.The firewall is configured to allow all inbound connections

B.The device uses a third-party firewall that Intune does not recognize

C.The firewall is enabled only on the Domain profile but not on Public or Private profiles

D.The device has multiple network adapters and the firewall is disabled on one

AnswerC

Compliance policy may require firewall on all profiles.

Why this answer

Intune compliance policies for firewall require that the firewall is enabled on all network profiles (Domain, Private, Public). If the firewall is only enabled on the Domain profile but not on Public or Private, the device will report as non-compliant. Option A is irrelevant because allowing inbound connections does not affect compliance status.

Option B is incorrect because the question states the device uses Windows Defender Firewall, not a third-party firewall. Option D is incorrect because the firewall status per adapter is not checked; the policy checks the firewall status per profile.

Full explanation →

386

Multi-Selectmedium

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Select 3 answers

A.Devices must be enrolled in Microsoft Intune.

B.The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

C.Devices must have Microsoft 365 Apps for enterprise installed.

D.Users must be assigned a Microsoft Defender for Endpoint license.

E.Devices must run a supported version of Windows 10.

AnswersA, D, E

Intune is the management platform for deployment.

Why this answer

Microsoft Defender for Endpoint (MDE) deployment via Intune requires devices to be enrolled in Intune (MDM) to receive the configuration policies and security baselines that enable and manage MDE. Without Intune enrollment, the device cannot process the MDE onboarding policy or the required Windows Security settings pushed through the Microsoft Endpoint Manager console.

Exam trap

The trap here is that candidates often confuse the MDE client download with the built-in sensor activation, leading them to select Option B, or they mistakenly think Office 365 apps are required for security features, selecting Option C.

Full explanation →

387

MCQmedium

You are reviewing an ARM template for Intune device configuration. The exhibit shows a snippet. What will be the effect on Windows 10 devices?

A.Automatic updates will be disabled.

B.Users can sideload trusted apps.

C.Devices will receive updates from WSUS.

D.Developer unlock is allowed.

AnswerC

Correct. The 'UpdateNotificationLevel' setting to 1, combined with other WSUS configuration, causes devices to receive updates from the configured WSUS server.

Why this answer

The ARM template sets 'UpdateNotificationLevel' to 1, which configures Windows Update to suppress notifications and directs devices to receive updates from a local WSUS server.

Exam trap

Candidates may mistakenly think that 'UpdateNotificationLevel' to 1 disables automatic updates, but it only affects notifications. The actual effect is directing updates to WSUS.

How to eliminate wrong answers

Option B is wrong because sideloading trusted apps is controlled by the 'ApplicationManagement' CSP, specifically the 'AllowAllTrustedApps' setting, which is not present in the template. Option C is wrong because receiving updates from WSUS requires the 'UpdateServiceUrl' or 'UpdateServiceUrlAlternate' setting to point to a WSUS server, which is not configured in the snippet. Option D is wrong because developer unlock is governed by the 'ApplicationManagement' CSP's 'AllowDeveloperUnlock' setting, which is not included in the template.

Full explanation →

388

Multi-Selecteasy

You need to configure conditional access for managed devices accessing Exchange Online. Which THREE conditions can be used?

Select 3 answers

A.Device platform (e.g., iOS, Android).

B.Device risk level from Microsoft Defender XDR.

C.Device compliance status.

D.App protection policy status.

E.User location based on IP address.

AnswersA, B, C

Platform can be restricted.

Why this answer

Conditional Access for managed devices can target specific device platforms (e.g., iOS, Android, Windows) to enforce policies like requiring a compliant device. This allows administrators to restrict access based on the operating system, which is a fundamental condition in Conditional Access policies for Exchange Online.

Exam trap

The trap here is that candidates often confuse App protection policy status (which applies to unmanaged devices with app-level controls) with device compliance status (which applies to managed devices), leading them to incorrectly select option D as a condition for managed devices.

Full explanation →

389

MCQhard

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. Devices that do not meet the policy are marked as non-compliant. Which diagnostic step would you take to identify why a specific device is non-compliant despite having BitLocker enabled?

A.Verify the compliance policy is assigned to the device's group.

B.Check the device's compliance status in Intune for details.

C.Review the device's hardware security features: Secure Boot and Code Integrity.

D.Modify the policy to remove the requireSecureBoot and requireCodeIntegrity settings.

AnswerC

These are additional requirements beyond encryption.

Why this answer

The correct diagnostic step is to review the device's hardware security features, specifically Secure Boot and Code Integrity. Even if BitLocker is enabled, these settings might be missing, causing non-compliance. Checking compliance status (option B) only confirms non-compliance, not the underlying reason.

Option A verifies policy assignment, which is not the issue. Option D modifies the policy, which is unnecessary for diagnosis.

Full explanation →

390

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?

A.Require device to be marked as compliant.

B.Require multi-factor authentication.

C.Require app protection policy.

D.Require device to be enrolled in Intune.

AnswerA

This ensures only compliant devices access corporate resources.

Why this answer

Conditional access in Microsoft Entra ID includes the grant control 'Require device to be marked as compliant,' which ensures that only devices meeting compliance policies can access corporate Exchange Online email. Option A is correct because this setting directly enforces compliance. Option B (Require multi-factor authentication) is separate—it adds identity verification but does not check device compliance.

Option C (Require app protection policy) applies to mobile app management, not device-level access. Option D (Require device to be enrolled in Intune) ensures enrollment but does not guarantee compliance; a device could be non-compliant even if enrolled. Therefore, only the compliance requirement meets the goal.

Full explanation →

391

MCQmedium

You are configuring an app protection policy (MAM) in Intune for iOS and Android devices. The policy should prevent users from copying corporate data to personal apps. Which setting should you configure?

A.Restrict cut, copy, and paste between apps.

B.Allow app to transfer data to other apps.

C.Save copies of org data.

D.Require PIN for access.

AnswerC

This setting prevents saving to personal locations.

Why this answer

The 'Save copies of org data' setting controls whether users can save corporate data to personal apps or locations, which directly prevents copying corporate data to personal apps. Option A is incorrect because 'Restrict cut, copy, and paste between apps' controls clipboard actions like cutting, copying, and pasting, not saving. Option B is incorrect because 'Allow app to transfer data to other apps' controls data sharing between apps, not saving.

Option D is incorrect because 'Require PIN for access' controls device access authentication, not data saving.

Full explanation →

392

MCQmedium

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

A.Replace the device's motherboard.

B.Enable the TPM in the device's BIOS settings.

C.Assign a grace period for the device.

D.Remove the tpmRequired setting from the compliance policy.

AnswerB

This will allow the TPM to be detected.

Why this answer

The device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Exam trap

The trap here is that candidates may assume a 'TPM not found' error indicates missing hardware, leading them to choose motherboard replacement or policy removal, rather than recognizing that a disabled TPM in BIOS is a common configuration issue that can be resolved without hardware changes.

How to eliminate wrong answers

Option A is wrong because replacing the motherboard is unnecessary when the TPM chip is already present and functional; the issue is only that it is disabled in BIOS. Option C is wrong because assigning a grace period would only delay enforcement of the non-compliance, not resolve the underlying TPM detection failure. Option D is wrong because removing the tpmRequired setting from the compliance policy would lower the security baseline, whereas the correct action is to enable the existing TPM hardware.

Full explanation →

393

Drag & Dropmedium

Order the steps for configuring a Windows 10 kiosk device using Assigned Access.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create the account, then navigate to Settings, set up the kiosk with the user, choose the app, and test by signing in.

Full explanation →

394

MCQeasy

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

A.A device compliance policy with a required passcode length of 6.

B.A device configuration profile with a passcode payload.

C.An app protection policy for Microsoft Outlook.

D.A conditional access policy requiring compliant devices.

AnswerA

Device compliance policies enforce device-level security requirements.

Why this answer

A device compliance policy in Microsoft Intune evaluates whether devices meet specific security requirements, such as a minimum passcode length. By creating a compliance policy with a required passcode length of 6, Intune marks any iOS device with a shorter passcode as noncompliant. This noncompliant status can then be used by a conditional access policy to block access to corporate email, achieving the stated goal.

Exam trap

The trap here is that candidates often confuse a device configuration profile (which enforces settings) with a device compliance policy (which evaluates and reports compliance), leading them to choose Option B instead of A.

How to eliminate wrong answers

Option B is wrong because a device configuration profile with a passcode payload enforces the passcode settings on the device (e.g., requiring the user to set a 6-character passcode), but it does not evaluate compliance or block access to corporate email on its own; it only configures the device. Option C is wrong because an app protection policy for Microsoft Outlook manages data protection within the app (e.g., preventing copy/paste or requiring a PIN for app access), but it does not enforce a device-level passcode length requirement. Option D is wrong because a conditional access policy requiring compliant devices is the mechanism that blocks access based on compliance status, but it does not define the passcode length requirement itself; you must first create the compliance policy (Option A) to set that requirement.

Full explanation →

395

MCQeasy

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved apps can be installed on corporate devices. Which policy type should you configure?

A.Device Configuration Profile with 'Allow app installation only from App Store' setting.

B.App Configuration Policy to restrict app installation.

C.Device Compliance Policy with 'Require approved apps' setting.

D.App Protection Policy with 'Allow only managed apps' setting.

AnswerD

This restricts installation to apps managed by Intune.

Why this answer

App Protection Policies (APP) in Microsoft Intune control which apps can access corporate data on iOS devices. The 'Allow only managed apps' setting restricts data transfer and app usage to apps that are managed by Intune, effectively preventing installation of unapproved apps. This is the appropriate policy for enforcing approved app installation on corporate devices.

Exam trap

The trap here is that candidates confuse App Protection Policies (which control app-level data access and approved app lists) with Device Compliance Policies (which evaluate device-level settings), leading them to select Option C despite the absence of a 'Require approved apps' setting in compliance policies.

How to eliminate wrong answers

Option A is wrong because Device Configuration Profiles with 'Allow app installation only from App Store' control the source of app installation (App Store vs. sideloading), not which specific apps are approved; it does not restrict unapproved apps from being installed from the App Store. Option B is wrong because App Configuration Policies are used to supply custom settings or managed app configurations to apps, not to restrict app installation or enforce approval lists. Option C is wrong because Device Compliance Policies evaluate device health and settings (e.g., jailbreak detection, minimum OS version), but they do not have a 'Require approved apps' setting; compliance policies can mark devices noncompliant based on app inventory but do not block installation.

Full explanation →

396

MCQhard

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is co-managed with Configuration Manager. You need to configure a policy that requires BitLocker encryption. You create a BitLocker policy in Intune and assign it to the device. After 24 hours, BitLocker is not enabled on the device. You verify that the device is online and the policy is assigned. What is the most likely cause?

A.The device is not online.

B.The encryption workload is set to Configuration Manager.

C.The device is not enrolled in Intune.

D.The BitLocker policy is not assigned to the correct group.

AnswerB

Configuration Manager manages encryption, not Intune.

Why this answer

In a co-managed environment, workload control determines which management authority (Configuration Manager or Intune) handles specific policies. If the encryption workload is set to Configuration Manager, Intune's BitLocker policy will be ignored, even if assigned and the device is online. This is the most likely reason the policy did not take effect after 24 hours.

Exam trap

The trap here is that candidates assume Intune policy always applies to enrolled devices, overlooking the co-management workload slider that can block Intune from managing specific workloads like encryption.

How to eliminate wrong answers

Option A is wrong because the device is verified as online, so connectivity is not the issue. Option C is wrong because the device is co-managed, meaning it is enrolled in both Configuration Manager and Intune; the policy assignment confirms enrollment. Option D is wrong because the policy is assigned to the device and verified, so group assignment is not the problem; the issue is workload control overriding Intune's authority.

Full explanation →

397

MCQeasy

You need to block users from enrolling personal Android devices in Microsoft Intune. Which enrollment restriction should you configure?

A.Set the 'Block personally owned devices' restriction for Android.

B.Set the 'Block Android' platform restriction.

C.Set the 'Block Android Enterprise' device type restriction.

D.Configure a device compliance policy to mark personal devices as non-compliant.

AnswerA

This blocks only personal devices while allowing corporate-owned.

Why this answer

The 'Block personally owned devices' restriction in Intune prevents users from enrolling personal (BYOD) Android devices. Option B is incorrect because the 'Block Android' platform restriction blocks all Android devices regardless of ownership, not just personal ones. Option C is incorrect because 'Block Android Enterprise' restricts Android Enterprise enrollment, not personally owned devices.

Option D is incorrect because device compliance policies evaluate devices after enrollment, they do not block enrollment itself.

Full explanation →

398

Multi-Selecthard

You need to configure Microsoft Intune remote help for Windows devices. Which THREE conditions must be met?

Select 3 answers

A.Users must have an Intune license assigned.

B.Devices must be connected via VPN.

C.Devices must run Windows 10/11.

D.Tenant must have Azure AD Premium P2.

E.Devices must be Intune enrolled.

AnswersA, C, E

License required for remote help.

Why this answer

Microsoft Intune remote help requires each user who initiates or receives a remote help session to have an Intune license assigned. This license grants the user access to the Intune service and the remote help feature, which is a premium capability within the Microsoft Endpoint Manager admin center. Without an assigned Intune license, the user cannot authenticate or authorize remote help sessions.

Exam trap

The trap here is that candidates often assume a VPN or premium Azure AD license is necessary for remote help, but Microsoft designed the feature to work over standard internet connectivity with only Intune licensing and device enrollment.

Full explanation →

399

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data is separated from personal data on the device. Which management approach should you use?

A.Android Enterprise kiosk mode

B.Android Enterprise fully managed

C.Android Enterprise work profile

D.Android device administrator

AnswerC

Work profile separates corporate and personal data.

Why this answer

Android Enterprise work profile creates a separate container for corporate data, keeping it isolated from personal data on the same device. Android Enterprise fully managed devices are for corporate-owned devices and do not have a personal space. Android Enterprise kiosk mode locks the device to a single app or set of apps, not designed for data separation.

Android device administrator is a legacy management method that does not provide data separation.

Full explanation →

400

MCQeasy

You need to ensure that Windows 11 devices automatically install critical updates as soon as they are released by Microsoft. Which update ring setting should you configure?

A.Set 'Update deferral period (days)' to 0 and 'Update deadline' to 0.

B.Set 'Update deferral period (days)' to 0 and 'Feature update deferral' to 7.

C.Set 'Update deferral period (days)' to 7.

D.Set 'Update deferral period (days)' to 30.

AnswerA

No deferral, immediate deadline.

Why this answer

Setting both 'Update deferral period (days)' to 0 and 'Update deadline' to 0 in a Windows 11 update ring ensures that critical updates are installed immediately upon release. The deferral period of 0 removes any delay before the update is offered, and the deadline of 0 forces the update to be installed without any grace period, achieving automatic and immediate installation of critical updates.

Exam trap

The trap here is that candidates often confuse 'Update deferral period' with 'Feature update deferral' or think that setting a deferral to 0 is unnecessary, but the question specifically requires immediate installation, which mandates both deferral and deadline to be 0.

How to eliminate wrong answers

Option B is wrong because setting 'Feature update deferral' to 7 introduces a 7-day delay for feature updates, which does not affect critical updates but indicates a misunderstanding that feature update deferral applies to critical updates. Option C is wrong because setting 'Update deferral period (days)' to 7 introduces a 7-day delay before critical updates are offered, preventing immediate installation. Option D is wrong because setting 'Update deferral period (days)' to 30 introduces a 30-day delay, which is the opposite of the required immediate installation.

Full explanation →

401

Multi-Selecthard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices with a passcode can access corporate resources. Which THREE configurations should you implement?

Select 3 answers

A.Device configuration profile with passcode settings

B.Windows Autopilot deployment profile

C.Conditional Access policy requiring compliant devices

D.App protection policy with passcode for managed apps

E.Device compliance policy with passcode requirement

AnswersA, C, E

Configures passcode on devices.

Why this answer

A device configuration profile with passcode settings enforces the passcode requirement directly on the iOS/iPadOS device via the MDM channel, ensuring the device itself is locked. Option C is correct because a Conditional Access policy requiring compliant devices checks the device's compliance status (which includes passcode compliance) before granting access to corporate resources like Exchange Online or SharePoint. Option E is correct because a device compliance policy with a passcode requirement defines the specific passcode rules (e.g., minimum length, complexity) and marks the device as noncompliant if unmet, which then triggers Conditional Access to block access.

Exam trap

The trap here is that candidates confuse app-level passcode enforcement (Option D) with device-level passcode enforcement, not realizing that Conditional Access and compliance policies require the device itself to be passcode-protected, not just the app.

Full explanation →

402

MCQeasy

You need to deploy Microsoft 365 Apps to Windows devices using Intune. Users should be able to install from Company Portal. What app type should you choose in Intune?

A.Windows app (Win32)

B.Microsoft 365 Apps

C.Web link

D.Microsoft Store app

AnswerB

Dedicated app type for Office.

Why this answer

The Microsoft 365 Apps app type in Intune is specifically designed to deploy Office 365 ProPlus (now Microsoft 365 Apps) suites, including Word, Excel, PowerPoint, and others, as a managed suite. This app type automatically configures the installation to use the Office Deployment Tool (ODT) with built-in settings for update channels, architecture (32-bit/64-bit), and language packs, and it makes the suite available in Company Portal for user-initiated installation. Unlike Win32 or other types, it handles the complex licensing and activation requirements for Microsoft 365 Apps without additional scripting.

Exam trap

The trap here is that candidates often choose 'Windows app (Win32)' because they think any desktop app must be deployed as a Win32 app, but they overlook that Intune has a dedicated app type for Microsoft 365 Apps that simplifies licensing, update management, and Company Portal integration, making it the correct and intended choice.

How to eliminate wrong answers

Option A is wrong because Windows app (Win32) is used for deploying traditional desktop applications (e.g., .exe or .msi files) via Intune, but it does not natively support the integrated licensing, update channel management, or suite-level configuration that Microsoft 365 Apps require; using Win32 would require manually packaging the Office Deployment Tool and scripts, which is unnecessary and error-prone. Option C is wrong because a Web link app type only creates a shortcut to a URL in Company Portal and does not perform any software installation, so users cannot install Microsoft 365 Apps from it. Option D is wrong because Microsoft Store app type is intended for deploying apps from the Microsoft Store (UWP or Store-licensed Win32 apps), and Microsoft 365 Apps is not distributed through the Microsoft Store for enterprise deployment via Intune.

Full explanation →

403

MCQhard

You are an endpoint administrator for a company that uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access Exchange Online. You have configured a Conditional Access policy that grants access to Exchange Online only if the device is marked as compliant. A user reports that they cannot access email from their iOS device, which is enrolled in Intune and shows as compliant. The user can access other Microsoft 365 services. What is the most likely cause?

A.The user does not have an Exchange Online license assigned.

B.The Conditional Access policy is configured to block access from non-corporate networks.

C.The device compliance policy is not set to require a PIN or password.

D.The Exchange Online workload is not enabled in Intune for mobile device management.

AnswerD

If the workload is not enabled, Intune cannot enforce compliance for Exchange Online access, causing the block.

Why this answer

The most likely cause is that the Exchange Online workload is not enabled in Intune for mobile device management (MDM). Even though the device is enrolled and compliant, Intune must have the Exchange Online workload enabled to apply Conditional Access policies that govern email access. Without this, the Conditional Access policy cannot enforce compliance checks specifically for Exchange Online, resulting in access being blocked despite the device showing as compliant.

Exam trap

The trap here is that candidates assume a compliant device automatically satisfies all Conditional Access requirements, but they overlook the prerequisite that the specific workload (e.g., Exchange Online) must be enabled in Intune for the policy to apply to that service.

How to eliminate wrong answers

Option A is wrong because the user can access other Microsoft 365 services, which also require an Exchange Online license if they were using Exchange features, but the issue is specific to email access; a missing license would affect all Exchange-dependent services, not just Conditional Access. Option B is wrong because the policy is configured to grant access only if the device is compliant, not to block based on network location; a non-corporate network block would affect all services, not just Exchange Online. Option C is wrong because the device is already marked as compliant in Intune, meaning it has passed all assigned compliance policies, including any PIN or password requirements; if a PIN were missing, the device would not show as compliant.

Full explanation →

404

MCQmedium

Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?

A.Device configuration profile with Administrative Templates.

B.Endpoint Protection profile in Device restrictions.

C.Device compliance policy.

D.Windows Update ring policy.

AnswerB

Endpoint Protection profile contains BitLocker settings.

Why this answer

The correct policy type is an Endpoint Protection profile within Device restrictions, because BitLocker settings for Windows 10/11 devices managed by Intune are configured under the 'Windows Encryption' category of an Endpoint Protection profile. This profile directly controls BitLocker drive encryption, including encryption method, recovery key management, and silent encryption enforcement, which is required for the scenario.

Exam trap

The trap here is that candidates confuse a compliance policy (which only reports and remediates non-compliance) with a configuration profile (which actually enforces the BitLocker encryption settings), leading them to select Option C.

How to eliminate wrong answers

Option A is wrong because Administrative Templates in a Device configuration profile are used for configuring Group Policy-like settings (e.g., registry-based policies) but do not include the specific BitLocker encryption settings; BitLocker is managed via the Endpoint Protection profile. Option C is wrong because a Device compliance policy evaluates whether a device meets security requirements (e.g., BitLocker enabled) but does not enforce or configure BitLocker settings; it only marks devices as compliant or non-compliant. Option D is wrong because a Windows Update ring policy controls update deferral and delivery optimization, not encryption or security settings like BitLocker.

Full explanation →

405

MCQmedium

You are planning the device enrollment strategy for a school that provides shared iPads to students. The iPads are used by multiple students throughout the day, and each student must have access to their own apps and data. Which enrollment method should you recommend?

A.Shared iPad enrollment using Apple Business Manager and Intune.

B.Automated Device Enrollment with user affinity.

C.User Enrollment

D.Device Enrollment (DEP) without user affinity.

AnswerA

Shared iPad supports multiple users with separate data.

Why this answer

Shared iPad enrollment using Apple Business Manager and Intune is the correct method because it enables multiple users to sign in with Managed Apple IDs on a single device, keeping their apps and data separate. This meets the requirement of providing each student access to their own apps and data on shared iPads. Option B (Automated Device Enrollment with user affinity) assigns the device to a single user and is not suitable for shared use.

Option C (User Enrollment) is intended for personally owned devices (BYOD), not organization-owned shared devices. Option D (Device Enrollment without user affinity) allows shared use but does not provide per-user data separation unless combined with Shared iPad mode, which is specifically option A.

Full explanation →

406

MCQeasy

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

A.Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

B.Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.

C.Use Windows Autopilot to reset the devices and enroll them in Intune.

D.Manually enroll each device by signing in to the Company Portal.

AnswerB

Staging reduces WAN traffic by syncing locally.

Why this answer

Deploying a staging server (or an Azure AD Connect staging server) allows the initial device synchronization to Azure AD to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Exam trap

The trap here is that candidates often assume Azure AD Connect is always the best choice for hybrid join, but they overlook the staging server feature specifically designed to minimize WAN traffic during initial bulk syncs.

How to eliminate wrong answers

Option A is wrong because using Azure AD Connect to sync devices directly over the WAN would transfer the full device objects and attributes across limited bandwidth links, increasing data transfer rather than minimizing it. Option C is wrong because Windows Autopilot resets the devices and requires internet connectivity for cloud-based provisioning, which would consume significant bandwidth and is not designed to minimize WAN data transfer during enrollment. Option D is wrong because manually enrolling each device via the Company Portal requires user interaction and still transfers enrollment data over the network, failing to minimize WAN traffic and being impractical for 200 devices.

Full explanation →

407

MCQeasy

A user's Windows 11 device is not receiving the Company Portal app after enrollment. The device is enrolled in Microsoft Intune. What is the most likely cause?

A.The device is not compliant with security policies.

B.The device is running Windows 10 instead of Windows 11.

C.The device is not connected to the internet.

D.The user does not have an Intune license.

AnswerC

Company Portal download requires internet connectivity.

Why this answer

The Company Portal app is delivered to enrolled devices via Intune, but the initial download and installation require an active internet connection to reach Microsoft's cloud services. If the device is not connected to the internet, the enrollment process may complete locally, but the Company Portal app will not be pushed or installed until connectivity is restored. This is the most likely cause because the question states the device is already enrolled, ruling out licensing or compliance issues that would prevent enrollment itself.

Exam trap

The trap here is that candidates often assume compliance policies or licensing are the root cause for missing apps, but the question explicitly states the device is enrolled, which already confirms a valid license and a successful initial connection, making internet connectivity the most logical remaining factor.

How to eliminate wrong answers

Option A is wrong because non-compliance with security policies does not block the installation of the Company Portal app; it may restrict access to resources or trigger remediation, but the app is still delivered. Option B is wrong because the Company Portal app is fully supported on Windows 10 (version 1607 and later) and Windows 11; the OS version is not a factor. Option D is wrong because the user must have an Intune license to enroll the device, and since the device is already enrolled, the license is present; a missing license would prevent enrollment entirely, not just the app delivery.

Full explanation →

408

Multi-Selectmedium

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Select 2 answers

A.Active Directory Federation Services (AD FS) deployed.

B.Windows 10 devices that are domain-joined to the on-premises Active Directory.

C.Azure AD Connect with device writeback enabled.

D.Azure AD Premium P1 licenses for all users.

E.Windows Hello for Business configured for all users.

AnswersB, C

Devices must be domain-joined to be hybrid Azure AD joined.

Why this answer

Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.

Exam trap

The trap here is that candidates often assume AD FS is mandatory for any hybrid identity scenario, but Microsoft supports multiple authentication methods (e.g., PHS, PTA) that do not require AD FS for Azure AD Join.

Full explanation →

409

Multi-Selecteasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to configure a policy that restricts the device from taking screenshots. Which setting can you use?

Select 1 answer

A.Disable screen capture.

B.Disable copy and paste.

C.Disable camera.

D.Disable Bluetooth.

E.Disable Wi-Fi.

AnswersA

Correct: Disable screen capture uses FLAG_SECURE to block screenshots at the OS level.

Why this answer

To restrict screenshots on Android Enterprise devices, only the 'Disable screen capture' setting directly prevents the device from taking screenshots by using the FLAG_SECURE window flag. Options B and C ('Disable copy and paste' and 'Disable camera') do not prevent screen capture; they restrict clipboard operations and camera usage respectively. Therefore, the only correct setting is A.

Exam trap

Candidates might mistakenly think that 'Disable copy and paste' or 'Disable camera' can prevent screenshots, but they do not. Only 'Disable screen capture' effectively blocks screenshots.

Full explanation →

410

MCQeasy

An organization uses Configuration Manager to deploy software updates to Windows 10 devices. The administrator wants to ensure that devices receive updates from the local distribution point rather than the cloud. Which boundary group option should be configured?

A.Prefer distribution points over cloud sources

B.Enable peer caching

C.Use cloud distribution points only

D.Fallback to cloud sources

AnswerA

This setting forces clients to use local distribution points first.

Why this answer

The 'Prefer distribution points over cloud sources' boundary group option ensures that clients will attempt to download software updates from a local distribution point before falling back to a cloud-based source. This setting directly controls client behavior to prioritize on-premises distribution points, which aligns with the administrator's goal of keeping traffic local and avoiding cloud egress.

Exam trap

The trap here is that candidates often confuse 'Prefer distribution points over cloud sources' with 'Fallback to cloud sources,' mistakenly thinking that allowing fallback is the same as prioritizing local sources, when in fact the fallback option only enables cloud use as a last resort without establishing a preference order.

How to eliminate wrong answers

Option B is wrong because 'Enable peer caching' configures clients to share content with each other within the same boundary group, but it does not influence the preference between local distribution points and cloud sources; it is a separate optimization for peer-to-peer content distribution. Option C is wrong because 'Use cloud distribution points only' would force clients to exclusively use cloud sources, which is the opposite of the desired behavior to avoid the cloud. Option D is wrong because 'Fallback to cloud sources' allows clients to use cloud distribution points as a backup when local distribution points are unavailable, but it does not prioritize local distribution points over cloud sources; it merely permits cloud fallback.

Full explanation →

411

MCQhard

A user on a Windows 11 device managed by Intune reports that a required Win32 app is not installing. The Intune console shows the app assignment is 'Required' and the device status is 'Error'. You review the detection rules and find that the app is detected by file version. The app installs successfully when run manually with admin rights. What is the most likely cause?

A.The installation script returns a non-zero exit code.

B.The detection rule is incorrectly matching an existing file version.

C.The Intune Management Extension is not running.

D.The installation script fails in system context.

AnswerB

A false positive detection can cause Intune to skip installation and report error.

Why this answer

The detection rule uses file version to determine if the app is installed. If an existing file on the device already matches the version specified in the detection rule, Intune will consider the app as already installed and skip the installation, even though the required app is not actually present. This causes a mismatch where the console shows an error because the app assignment is 'Required' but the detection logic falsely reports success, preventing the installation from running.

Exam trap

The trap here is that candidates often assume an 'Error' status always means the installation script failed, rather than considering that the detection rule might be incorrectly matching an existing file and preventing the installation from even starting.

How to eliminate wrong answers

Option A is wrong because a non-zero exit code would cause the installation to fail and show an error, but the user reports the app installs successfully when run manually with admin rights, indicating the script itself works. Option C is wrong because if the Intune Management Extension were not running, no Win32 app installations would occur at all, and the device would likely show a different status (e.g., 'Pending' or 'Not Applicable'), not an 'Error' with a specific detection rule mismatch. Option D is wrong because the installation script runs successfully in system context when triggered by Intune (as it does for all Win32 apps), and the user confirms manual installation with admin rights works, so the system context is not the issue.

Full explanation →

412

MCQhard

An organization uses Microsoft Intune to manage iOS devices. They need to deploy an internal line-of-business (LOB) app that is signed with an enterprise certificate. The app must be available to users who are members of a dynamic Microsoft Entra ID group. Which deployment method should you use?

A.Use a VPP token to deploy the app

B.Configure a managed open-in policy

C.Assign the LOB app as 'Required' to the dynamic group

D.Assign the LOB app as 'Available' to the dynamic group

AnswerD

Makes the app available in Company Portal for group members.

Why this answer

Deploying an internal LOB app signed with an enterprise certificate as 'Available' to a dynamic Microsoft Entra ID group allows users to install the app on demand from the Company Portal, while still targeting the group dynamically. This method supports enterprise-signed apps without requiring a VPP token, and 'Available' assignments are the only way to make the app visible in the Company Portal for optional installation by dynamic group members.

Exam trap

The trap here is that candidates often assume 'Required' assignments work with dynamic groups, but Intune only supports dynamic groups for 'Available' assignments, not for required installations, which is a key distinction tested in the MD-102 exam.

How to eliminate wrong answers

Option A is wrong because a VPP token is used for deploying volume-purchased apps from the Apple App Store, not for internal LOB apps signed with an enterprise certificate. Option B is wrong because a managed open-in policy controls data sharing between managed and unmanaged apps, not app deployment. Option C is wrong because assigning the LOB app as 'Required' forces installation on devices, but dynamic groups in Microsoft Entra ID cannot be used with 'Required' assignments; 'Required' assignments require user or device groups that are static or assigned, not dynamic, as Intune does not evaluate dynamic group membership for required installations.

Full explanation →

413

MCQhard

Refer to the exhibit. You query Microsoft Graph API and receive this JSON for a managed device. App2 installation failed. The app is a Win32 app deployed as required. The device is compliant and enrolled via MDM. What is the most likely reason for the failure?

A.The Intune Management Extension is not installed.

B.The app is not assigned to the user.

C.The app version is incompatible with the device OS.

D.The device is not compliant.

AnswerA

IME is required for Win32 apps on MDM devices.

Why this answer

Win32 apps deployed as required require the Intune Management Extension (IME) to be present on the device for installation. Since the device is enrolled via MDM and compliant, but the app installation failed, the most likely cause is that the IME is missing or not functioning. The IME handles Win32 app deployment, detection, and remediation, and without it, required Win32 apps cannot install.

Exam trap

The trap here is that candidates often assume a compliant device automatically has all required components, but the Intune Management Extension is a separate prerequisite that must be installed and running for Win32 app deployment to succeed.

How to eliminate wrong answers

Option B is wrong because the app is deployed as required, which means it is assigned to the device or user regardless of user-specific assignment; a missing user assignment would not cause a failure for a required deployment. Option C is wrong because the exhibit does not indicate any version incompatibility, and the device is compliant, so OS version issues would typically be flagged by Intune compliance policies or app requirements. Option D is wrong because the device is explicitly stated as compliant, so non-compliance cannot be the reason for the failure.

Full explanation →

414

MCQhard

You are deploying a custom Windows 10 image to 200 new laptops using MDT. The deployment fails on several devices at the 'Apply Operating System' step with error 0x80070070. The laptops have 60 GB SSDs and 4 GB RAM. What is the most likely cause?

A.The laptops have insufficient RAM (4 GB) to run the deployment.

B.The deployment share is not accessible over the network.

C.The custom image is missing critical drivers.

D.The custom image is too large for the 60 GB SSD.

AnswerD

Error 0x80070070 means 'Not enough disk space'. The image likely exceeds available space.

Why this answer

Error 0x80070070 translates to 'insufficient disk space' (ERROR_DISK_FULL). During the 'Apply Operating System' step, MDT decompresses the custom WIM image and applies it to the local disk. With a 60 GB SSD, if the custom image (including drivers, updates, and applications) exceeds the available free space after partitioning, the deployment fails.

This is the most direct cause given the error code and hardware constraints.

Exam trap

The trap here is that candidates often confuse error 0x80070070 with a RAM issue (since low RAM can cause other errors) or assume network connectivity is the problem, but the error code explicitly points to disk space, not memory or network.

How to eliminate wrong answers

Option A is wrong because 4 GB RAM is sufficient for MDT deployment of Windows 10; the minimum requirement is 2 GB (64-bit), and the error code specifically indicates disk space, not memory. Option B is wrong because network accessibility issues would typically produce error 0x80070035 (network path not found) or 0x80004005 (access denied), not a disk space error. Option C is wrong because missing critical drivers would cause a different error, such as 0x80070570 (corrupted or missing files) or a BSOD during boot, not a disk space error during the apply phase.

Full explanation →

415

MCQhard

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

A.It requires a password that meets the minimum length but no complexity

B.It uses the password type configured in the device's local policy

C.It does not require a password at all

D.It requires a password that contains at least one number and one letter

AnswerB

'deviceDefault' defers to the device's own settings.

Why this answer

When the password type is set to 'deviceDefault' in a Microsoft Intune compliance policy for Windows 10, the policy does not enforce a specific password type (e.g., alphanumeric or numeric). Instead, it defers to the password type already configured in the device's local security policy (via Local Group Policy or the SAM registry). This means the device can still be compliant even if the local policy requires only a simple PIN or no complexity, as long as the local password type meets the minimum length and other requirements defined in the compliance policy.

Exam trap

The trap here is that candidates assume 'deviceDefault' means the Intune policy enforces a default Microsoft-defined password type (like alphanumeric), when in fact it simply passes control to the device's local policy, which may be weaker or stronger.

How to eliminate wrong answers

Option A is wrong because 'deviceDefault' does not inherently require a password that meets minimum length without complexity; it simply inherits whatever password type is set locally, which could include complexity requirements or none at all. Option C is wrong because 'deviceDefault' does not mean no password is required; the device still must have a password configured locally, and the compliance policy will enforce other settings like minimum length and expiration. Option D is wrong because requiring at least one number and one letter corresponds to the 'alphanumeric' password type, not 'deviceDefault'; 'deviceDefault' does not mandate any specific character composition.

Full explanation →

416

MCQhard

Your organization uses Windows Defender Application Control (WDAC) to allow only approved apps. After deploying a WDAC policy via Intune, some users report that a critical line-of-business app is blocked. How should you troubleshoot?

A.Review CodeIntegrity/Operational logs in Event Viewer

B.Check AppLocker logs in Event Viewer

C.Review Intune device management events for policy errors

D.Check Microsoft 365 Defender portal for WDAC alerts

AnswerA

WDAC blocks are logged in CodeIntegrity/Operational.

Why this answer

WDAC blocks or allows applications based on code integrity rules, and when a policy is enforced, blocked execution events are logged in the CodeIntegrity/Operational event log under Event Viewer. Reviewing this log provides specific block events with file details and rule identifiers, enabling you to identify why the LOB app was blocked and adjust the policy accordingly.

Exam trap

The trap here is that candidates confuse WDAC with AppLocker and assume AppLocker logs are relevant, but WDAC uses its own dedicated CodeIntegrity logs for all block events.

How to eliminate wrong answers

Option B is wrong because AppLocker logs are used for AppLocker policies, not WDAC; WDAC uses its own CodeIntegrity logs. Option C is wrong because Intune device management events show policy deployment status (e.g., sync errors) but do not capture runtime block events from the WDAC driver on the client. Option D is wrong because the Microsoft 365 Defender portal aggregates WDAC alerts from devices that report to Defender for Endpoint, but it may not show granular block details for every locally blocked app, and the primary troubleshooting source is the local CodeIntegrity log.

Full explanation →

417

Multi-Selecteasy

Which TWO methods can you use to deploy Microsoft 365 Apps to Windows 10 devices managed by Intune?

Select 2 answers

A.Use the Microsoft 365 Apps (Windows) app type in Intune.

B.Use the Microsoft 365 Apps admin center to create a configuration and deploy via Intune.

C.Use the Office Deployment Tool wrapped as a Win32 app.

D.Use Group Policy to assign Office installation.

E.Deploy the Microsoft Store version of Office.

AnswersA, B

This built-in app type simplifies deployment.

Why this answer

The 'Microsoft 365 Apps (Windows)' app type in Intune is a built-in deployment method specifically designed to install Office 365 ProPlus (now Microsoft 365 Apps) on managed Windows 10 devices. It allows you to select the installation channel, language, and update settings directly from the Intune console without needing external tools.

Exam trap

The trap here is that candidates often confuse the 'Microsoft 365 Apps (Windows)' app type with the Office Deployment Tool wrapped as a Win32 app, thinking both are equally native Intune methods, but the question specifically asks for methods that use Intune—and the ODT wrapper is a custom deployment, not a native Intune app type.

Full explanation →

418

MCQmedium

A company with 500 users uses Microsoft 365 E3 licenses. They want to ensure that all users have multi-factor authentication (MFA) enforced. Currently, 80% of users have MFA enabled through the legacy per-user MFA setting. The security team wants to use Conditional Access policies instead. You need to migrate from per-user MFA to Conditional Access with no disruption to users. What should you do?

A.Create a Conditional Access policy requiring MFA for all cloud apps, including break-glass accounts. Then disable per-user MFA.

B.Create a Conditional Access policy requiring MFA for all users only when accessing from outside the corporate network.

C.Create a Conditional Access policy requiring MFA for all users, excluding break-glass accounts. Disable per-user MFA for all users.

D.Disable per-user MFA for all users, then create a Conditional Access policy requiring MFA for all cloud apps.

AnswerC

This ensures MFA is always enforced and provides emergency access via break-glass accounts.

Why this answer

You need to exclude the break-glass accounts from the Conditional Access policy to ensure admin access if something goes wrong. You should first create a Conditional Access policy that requires MFA for all users except the break-glass accounts, then disable the per-user MFA for all users. Option A is incorrect because disabling per-user MFA before creating the policy would leave users without MFA.

Option B is incorrect because using a Conditional Access policy to require MFA from outside the network only would not enforce MFA for internal access. Option D is incorrect because creating a policy without excluding break-glass accounts could lock out administrators.

Full explanation →

419

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires specific installation parameters. Which app type should you select?

A.Line-of-business app

B.macOS app (DMG)

C.Windows app (Win32)

D.macOS app (PKG)

AnswerD

Correct. macOS app (PKG) is designed for .pkg files and supports custom installation parameters via the 'Installation command' field, fulfilling the requirement.

Why this answer

The macOS app (PKG) type is correct for deploying a custom .pkg app that requires specific installation parameters. Intune's native PKG app type allows you to define a custom installation command (e.g., installer -pkg MyApp.pkg -target /) with the required flags, providing full control over the installation. In contrast, the DMG app type is designed for .dmg disk images, not standalone .pkg files.

Exam trap

Candidates often assume that the DMG app type is required for custom parameters, but Intune's PKG app type also provides a 'Installation command' field for .pkg files, making it the appropriate choice for deploying a custom .pkg with specific parameters.

How to eliminate wrong answers

Option A is wrong because Line-of-business (LOB) apps in Intune are intended for simple app deployment without custom installation parameters; they only support a basic installation command (e.g., `msiexec /i` for Windows) and do not allow you to specify custom flags for macOS .pkg files. Option C is wrong because Windows app (Win32) is a Windows-specific app type that cannot be used for macOS device management; Intune enforces platform-specific app types. Option D is wrong because macOS app (PKG) is a legacy app type in Intune that does not support custom installation parameters; it only allows you to upload a .pkg file and deploy it with default installation behavior, without the ability to specify additional flags or commands.

Full explanation →

420

MCQhard

You are troubleshooting an iPhone that cannot enroll in Microsoft Intune. The user receives an error stating 'This device is already enrolled in another MDM.' What is the most likely cause?

A.The device is already enrolled in Apple Business Manager or another MDM.

B.The device has a VPN configuration installed.

C.The device is not running the latest iOS version.

D.The user's license is expired.

AnswerA

Apple devices can only be enrolled in one MDM at a time. The device must be removed from the other MDM first.

Why this answer

The error 'This device is already enrolled in another MDM' indicates that the iPhone has an existing MDM profile that conflicts with Intune enrollment. This typically occurs when the device is already enrolled in Apple Business Manager (ABM) or another MDM solution, as iOS enforces a single MDM enrollment per device. Intune cannot overwrite an existing MDM profile without first removing it.

Exam trap

The trap here is that candidates may confuse MDM enrollment conflicts with other common issues like outdated OS or licensing, but the specific error message directly points to an existing MDM profile, not generic configuration or access problems.

How to eliminate wrong answers

Option B is wrong because a VPN configuration does not prevent MDM enrollment; it is a separate network setting that can coexist with an MDM profile. Option C is wrong because while an outdated iOS version might cause compatibility issues, it does not produce the specific 'already enrolled' error; Intune supports a range of iOS versions with appropriate requirements. Option D is wrong because an expired user license would block Intune enrollment with a different error (e.g., 'License not found' or 'Access denied'), not the 'already enrolled' message.

Full explanation →

421

MCQmedium

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

A.The device name template is invalid.

B.The device does not have a TPM 2.0 chip.

C.The profile requires a user to sign in during deployment.

D.The language settings are not configured.

AnswerB

TPM 2.0 is required for self-deploying mode attestation.

Why this answer

Windows Autopilot self-deploying mode requires a TPM 2.0 chip to perform hardware-based attestation and automatically enroll the device without user interaction. If the device lacks TPM 2.0, the provisioning process will fail because the required cryptographic keys for attestation cannot be generated, preventing the device from completing the self-deploying profile.

Exam trap

The trap here is that candidates assume any Autopilot mode can work without TPM 2.0, but Microsoft explicitly requires TPM 2.0 for self-deploying and pre-provisioning modes, while user-driven mode can proceed with software-based attestation if TPM is unavailable.

How to eliminate wrong answers

Option A is wrong because the device name template is validated during profile creation and would cause a profile creation error, not a provisioning failure after assignment. Option C is wrong because the exhibit shows a self-deploying mode profile, which explicitly does not require user sign-in; requiring user sign-in would contradict the mode's purpose. Option D is wrong because language settings are optional in Autopilot profiles and their absence does not prevent provisioning; the device will use default language settings.

Full explanation →

422

Multi-Selectmedium

You are planning to deploy Microsoft Intune for device management. Which ONE of the following is a prerequisite for enrolling Windows 10 devices in Intune?

Select 1 answer

A.Microsoft Entra ID (Azure AD) Premium P1 or P2.

B.Microsoft Intune license assigned to the user.

C.A Microsoft account (MSA) for each user.

D.Microsoft 365 E3 subscription.

E.Azure Information Protection license.

AnswersB

Each user must have an Intune license assigned to enroll devices; this is a core prerequisite.

Why this answer

Option B is the correct prerequisite: a Microsoft Intune license must be assigned to the user enrolling the device. Option A (Microsoft Entra ID Premium P1/P2) is not required; Microsoft Entra ID Free is sufficient for Intune enrollment. Option C (Microsoft account) is not needed for corporate devices.

Option D (Microsoft 365 E3) is a bundled subscription but not a standalone prerequisite. Option E (Azure Information Protection) is unrelated to device enrollment. Therefore, only one option is correct.

Exam trap

Candidates may mistakenly select multiple options, but the stem clearly asks for only one prerequisite, and only Option B is correct.

Full explanation →

423

MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps can be installed on corporate-owned devices. Which configuration profile type should you use?

A.Email profile.

B.Device features profile.

C.Apple Configurator enrollment profile.

D.Device restrictions profile with 'Allow app installation from App Store only' set to 'Block'.

AnswerD

This blocks installation of apps not from the App Store.

Why this answer

The 'Device restrictions profile' in Microsoft Intune includes the 'Allow app installation from App Store only' setting. Setting this to 'Block' prevents users from installing apps from the App Store, effectively restricting installations to only those apps that are deployed through Intune as managed apps or volume-purchased apps. This ensures that only approved apps can be installed on corporate-owned iOS/iPadOS devices.

Exam trap

The trap here is that candidates often confuse 'Device restrictions profile' with 'Device features profile' or think that enrollment profiles can enforce app restrictions, when in fact only the restrictions profile contains the granular app installation controls.

How to eliminate wrong answers

Option A is wrong because an Email profile is used to configure email account settings (e.g., Exchange ActiveSync, SMTP) on devices, not to control app installation policies. Option B is wrong because a Device features profile configures device-specific features like AirPrint, AirPlay, or wallpaper, and does not include app installation restrictions. Option C is wrong because an Apple Configurator enrollment profile is used for automated device enrollment (DEP/ABM) and initial setup, not for restricting app installations post-enrollment.

Full explanation →

424

MCQhard

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?

A.Create a security group in Microsoft Entra ID and manually add devices with high threat

B.Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'

C.Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy

D.Create a dynamic device group in Microsoft Intune using a rule based on threat level

AnswerB

Microsoft Defender for Endpoint can tag devices with threat levels, and Entra ID dynamic groups can use these tags.

Why this answer

Microsoft Defender for Endpoint (MDE) automatically tags devices with a 'HighThreat' security tag when they reach a high threat level. You can create a dynamic device group in Microsoft Entra ID using a rule that queries `device.securityTags -contains 'HighThreat'`, which will automatically include any device that receives this tag from MDE. This group can then be targeted with a compliance policy in Intune to mark those devices as non-compliant, enabling automated remediation or conditional access blocking.

Exam trap

The trap here is that candidates often assume Intune can directly query MDE threat levels for dynamic groups, but Intune's dynamic groups are limited to enrollment-based rules, while the actual threat tag integration is handled through Microsoft Entra ID's device object and security tags.

How to eliminate wrong answers

Option A is wrong because manually adding devices to a security group is not dynamic and cannot scale or react automatically to threat level changes from MDE. Option C is wrong because device groups created in Microsoft Defender for Endpoint are used for MDE-specific configurations (like automation levels or investigation scope) and cannot be directly assigned to an Intune compliance policy. Option D is wrong because Intune does not support creating dynamic device groups based on MDE threat level; dynamic groups in Intune rely on enrollment attributes or custom filters, not MDE security tags.

Full explanation →

425

MCQhard

You are designing a Windows 11 update strategy for a fleet of 500 devices managed by Intune. The organization requires that critical security updates be applied within 7 days, but feature updates can be delayed up to 60 days. Which Update Rings configuration should you use?

A.Assign a Quality Update policy with deferral of 7 days

B.Create an Update Ring with quality update deferral of 7 days and feature update deferral of 60 days

C.Configure Windows Update for Business via Group Policy on-premises

D.Assign a Feature Update policy with deferral of 60 days

AnswerB

Update Rings allow separate deferrals for quality and feature updates.

Why this answer

Update Rings in Intune allow you to independently configure deferral periods for quality updates (security fixes) and feature updates. Setting quality update deferral to 7 days ensures critical security patches are applied within the required window, while feature update deferral of 60 days delays non-security feature updates as needed, all managed via cloud-based Windows Update for Business policies.

Exam trap

The trap here is that candidates often confuse Update Rings with separate Quality or Feature Update policies, not realizing that Update Rings are the single object that can simultaneously control both deferral periods, while the other options only address one type of update.

How to eliminate wrong answers

Option A is wrong because a Quality Update policy (via Windows 10/11 feature update policies) only controls deferral for quality updates, but does not address the feature update deferral requirement of 60 days; it is an incomplete solution. Option C is wrong because configuring Windows Update for Business via on-premises Group Policy contradicts the requirement that devices are managed by Intune; Intune uses cloud-based policies, not local Group Policy, and this approach would not leverage the centralized mobile device management (MDM) capabilities. Option D is wrong because a Feature Update policy only controls deferral for feature updates, ignoring the quality update deferral requirement of 7 days; it addresses only half of the requirement.

Full explanation →

426

MCQhard

You are planning a Windows 11 deployment for 500 new devices using Windows Autopilot. The devices will be shipped directly to users from the manufacturer. You need to ensure that the devices are automatically enrolled in Intune and joined to Microsoft Entra ID. What should you do?

A.Register the device hashes in Intune and assign an Autopilot deployment profile

B.Pre-install the Intune Management Extension on each device

C.Configure a provisioning package and include it with the shipment

D.Create a hybrid Azure AD join configuration in Intune

AnswerA

Registering device hashes and assigning an Autopilot deployment profile with the desired join type is the standard approach.

Why this answer

Windows Autopilot uses device hashes (hardware IDs) to identify devices in Intune. By registering these hashes and assigning an Autopilot deployment profile, the devices are automatically enrolled in Intune and joined to Microsoft Entra ID during the out-of-box experience (OOBE), without requiring manual intervention or additional infrastructure.

Exam trap

The trap here is that candidates often confuse hybrid Azure AD join with Microsoft Entra ID join, or think provisioning packages are needed for Autopilot, when in fact Autopilot is designed for zero-touch, cloud-only scenarios without any on-premises dependency.

How to eliminate wrong answers

Option B is wrong because the Intune Management Extension is automatically installed during Intune enrollment, not pre-installed on devices before Autopilot runs. Option C is wrong because provisioning packages (PPKG files) are used for manual or bulk provisioning, not for the zero-touch, cloud-driven Autopilot scenario where devices are shipped directly to users. Option D is wrong because hybrid Azure AD join requires a connection to on-premises Active Directory and is not the default for Autopilot; the scenario specifies Microsoft Entra ID join, not hybrid.

Full explanation →

427

MCQeasy

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

A.Windows 10 20H2

B.Windows 10 1903

C.Windows 10 21H2

D.Windows 10 2004

AnswerD

10.0.19041 corresponds to Windows 10 version 2004.

Why this answer

The exhibit shows a compliance policy with a minimum OS version requirement set to '2004'. In Microsoft Intune, when you specify a minimum OS version for Windows 10 compliance, you must use the four-digit version number (e.g., 2004) rather than the marketing name (e.g., 20H2). Therefore, the minimum OS version required is Windows 10 2004.

Exam trap

The trap here is that candidates confuse the marketing names (like 20H2 or 21H2) with the actual version numbers used in Intune policies, leading them to select a later release instead of the exact version specified in the policy.

How to eliminate wrong answers

Option A is wrong because Windows 10 20H2 is a later feature update (released in 2020 H2) and is not the version specified in the policy; the policy explicitly requires 2004. Option B is wrong because Windows 10 1903 (version 1903) is an older release that does not meet the minimum version of 2004. Option C is wrong because Windows 10 21H2 is a newer version (released in 2021 H2) and is not the minimum version stated; the policy requires exactly 2004 as the baseline.

Full explanation →

428

MCQeasy

An organization needs to deploy Windows 11 to remote users who do not have access to the corporate network. The devices are brand new and have internet connectivity. Which deployment method should the administrator recommend?

A.Use Configuration Manager with a task sequence over VPN.

B.Use PXE boot from a distribution point at the local office.

C.Use Windows Autopilot with user-driven mode.

D.Deploy using MDT with a bootable USB drive.

AnswerC

Autopilot enables cloud-based deployment.

Why this answer

Windows Autopilot with user-driven mode is the correct choice because it enables remote, zero-touch deployment of new Windows 11 devices using only internet connectivity. The devices are pre-registered in Autopilot, and during the out-of-box experience (OOBE), they automatically download the organization-specific configuration, join Azure AD, and enroll in MDM without requiring any VPN or on-premises infrastructure.

Exam trap

The trap here is that candidates often assume VPN or PXE are viable for remote deployments, but they overlook the fundamental requirement that brand-new devices have no pre-existing network configuration or corporate connectivity, making internet-based Autopilot the only practical option.

How to eliminate wrong answers

Option A is wrong because Configuration Manager task sequences over VPN require the device to first establish a VPN connection to the corporate network, which is not possible for brand-new devices that lack pre-configured VPN profiles and have no prior network access. Option B is wrong because PXE boot relies on a local network broadcast and a distribution point on the same subnet; remote users without corporate network access cannot reach a PXE server, and PXE does not work over the internet. Option D is wrong because deploying with MDT using a bootable USB drive requires physical delivery of the USB media to each remote user, which is not a scalable or practical solution for a large number of remote devices and does not leverage internet connectivity for deployment.

Full explanation →

429

MCQhard

Refer to the exhibit. You apply this device configuration profile to a group of Windows 10 devices. Users report that they receive update notifications outside of active hours. Which setting should you modify to suppress notifications during active hours?

A.Set updateNotificationLevel to 'turnOffAllNotifications'.

B.Modify activeHoursStart and activeHoursEnd to cover the full day.

C.Set cloudBlockLevel to 'normal'.

D.Set detectionFrequency to a higher value.

AnswerA

This disables all Windows Update notifications.

Why this answer

The setting updateNotificationLevel controls whether Windows Update displays notifications to users. Setting it to 'turnOffAllNotifications' suppresses all update notifications, including those that appear outside of active hours. This is the correct configuration to prevent users from seeing update notifications during active hours.

Exam trap

The trap here is that candidates often confuse active hours (which control update installation timing) with notification suppression, leading them to incorrectly choose modifying active hours instead of the dedicated notification control setting.

How to eliminate wrong answers

Option B is wrong because modifying activeHoursStart and activeHoursEnd to cover the full day would prevent updates from being installed during that time, but it does not suppress the notifications themselves; users would still receive update notifications outside the defined active hours. Option C is wrong because cloudBlockLevel is a Microsoft Defender for Endpoint setting that controls cloud-delivered protection levels, not Windows Update notification behavior. Option D is wrong because detectionFrequency controls how often the device checks for updates, not whether notifications are shown; increasing it would not suppress notifications.

Full explanation →

430

Multi-Selectmedium

Which TWO actions should you take to prepare infrastructure for devices running macOS in your organization? (Select two.)

Select 2 answers

A.Deploy the Company Portal app to macOS devices.

B.Enroll macOS devices in Microsoft Intune.

C.Configure Windows Autopilot for macOS devices.

D.Join macOS devices to Microsoft Entra ID.

E.Use Group Policy to manage macOS settings.

AnswersA, B

Company Portal provides self-service app installation.

Why this answer

The Company Portal app is the primary interface for users to enroll macOS devices in Microsoft Intune, access corporate resources, and manage compliance. Deploying it ensures users can initiate enrollment and receive policies. Option B is correct because enrolling macOS devices in Intune is the foundational step to apply management policies, deploy apps, and enforce compliance settings via MDM.

Exam trap

The trap here is that candidates may confuse Windows-centric technologies like Autopilot and Group Policy as being cross-platform, when in fact macOS management relies on Apple-specific protocols and tools such as MDM, APNs, and Apple Business Manager.

Full explanation →

431

MCQeasy

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

A.Grace Period for Restarts (days)

B.Defer Quality Updates (days)

C.Update Deadline for Quality Updates (days)

D.Active Hours

AnswerC

This setting enforces installation by a deadline.

Why this answer

The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Exam trap

The trap here is that candidates confuse 'Defer Quality Updates' (which delays updates) with 'Update Deadline for Quality Updates' (which enforces installation timing), leading them to incorrectly select Option B thinking it controls installation speed.

How to eliminate wrong answers

Option A is wrong because 'Grace Period for Restarts (days)' controls how long after the deadline a user can postpone a restart, not the time to install the update. Option B is wrong because 'Defer Quality Updates (days)' delays the availability of updates, which would prevent automatic installation within 24 hours of release. Option D is wrong because 'Active Hours' defines a time window during which restarts are avoided, but does not enforce a deadline for update installation.

Full explanation →

432

MCQmedium

Your company uses Microsoft Defender for Endpoint (Defender XDR). You need to configure an automated investigation and remediation (AIR) rule that automatically quarantines a file when a specific alert is triggered. Which action should you take?

A.Add an indicator of compromise for the file.

B.Configure a device control policy.

C.Create a new automation rule in the Microsoft 365 Defender portal.

D.Create an attack surface reduction rule.

AnswerC

Automation rules define automated actions based on alerts.

Why this answer

Automated investigation and remediation (AIR) rules in Microsoft 365 Defender allow you to define automated actions—such as quarantining a file—when a specific alert is triggered. This is the native mechanism for orchestrating response actions based on alert conditions, directly supporting the requirement to automatically quarantine a file upon alert generation.

Exam trap

The trap here is that candidates often confuse indicators of compromise (IoC) with automated response rules, mistakenly thinking that adding an IoC for a file will automatically trigger a quarantine action when the file is detected, whereas IoCs only define detection or blocking logic, not conditional alert-triggered remediation workflows.

How to eliminate wrong answers

Option A is wrong because adding an indicator of compromise (IoC) for the file creates a custom threat intelligence indicator that can block or alert on the file, but it does not create an automated investigation and remediation rule that triggers a quarantine action based on a specific alert. Option B is wrong because a device control policy governs removable storage and peripheral device access (e.g., USB drives), not file-level quarantine actions in response to alerts. Option D is wrong because an attack surface reduction (ASR) rule is a set of behavioral-based rules that prevent common attack techniques (e.g., blocking Office apps from creating child processes), but it does not provide the ability to define automated quarantine actions triggered by a specific alert.

Full explanation →

433

Multi-Selectmedium

Which TWO actions can you perform to reduce the amount of time it takes for a Windows 10 device to receive a new policy from Microsoft Intune?

Select 2 answers

A.Increase the policy refresh interval in the device configuration profile.

B.Manually trigger a sync from the device's Settings > Accounts > Access work or school.

C.Restart the device.

D.Change the device's DNS to point to a local Intune server.

E.Configure the device to sync more frequently using the Intune management extension.

AnswersB, E

Manual sync triggers immediate policy retrieval.

Why this answer

Manually triggering a sync from Settings > Accounts > Access work or school forces the device to immediately check in with Microsoft Intune, bypassing the default polling interval. This action initiates an immediate policy retrieval and application cycle, reducing the wait time for new policies to be received.

Exam trap

The trap here is that candidates often confuse the 'policy refresh interval' setting (which controls how often the device checks for new policies) with a manual sync action, mistakenly thinking increasing the interval speeds up delivery, when in fact it does the opposite.

Full explanation →

434

MCQeasy

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

A.Select the device and choose 'Retire'.

B.Select the device and choose 'Wipe'.

C.Select the device and choose 'Reset'.

D.Select the device and choose 'Delete'.

AnswerB

Wipe performs a factory reset, removing all data.

Why this answer

The 'Wipe' action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost or stolen device to prevent unauthorized access to company data. The 'Retire' action only removes managed app data and policies but leaves personal data intact, which is insufficient for a security breach scenario.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Wipe', assuming both remove data equally, but 'Retire' only removes managed corporate data while leaving personal data and device access intact, making it unsuitable for lost or stolen scenarios.

How to eliminate wrong answers

Option A is wrong because 'Retire' removes only managed corporate data and policies from the device, leaving personal data and the device itself functional, which does not fully protect data on a lost or stolen device. Option C is wrong because 'Reset' is not a standard Intune action; the correct term is 'Wipe' for factory reset, and 'Reset' may be confused with a local device reset that is not initiated via Intune. Option D is wrong because 'Delete' removes the device object from Intune management but does not perform a remote wipe, leaving the device and its data untouched.

Full explanation →

435

Multi-Selectmedium

Which THREE of the following are required to deploy a Win32 app using Microsoft Intune?

Select 3 answers

A.Product code

B.Detection rule

C.Return codes for success

D.Dependencies

E.Installation command

AnswersB, C, E

Required to determine if app is installed.

Why this answer

A detection rule is mandatory for Win32 app deployment in Intune. It defines how Intune determines whether the app is already installed on the device (e.g., by checking a file, registry key, or MSI product code). Without a detection rule, Intune cannot verify installation success or prevent reinstallation.

Exam trap

The trap here is that candidates often confuse optional features like dependencies or product codes with mandatory requirements, but Intune explicitly requires only the installation command, detection rule, and at least one return code for success.

Full explanation →

436

MCQhard

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully, but the detection rule incorrectly reports the app as not installed, causing Intune to attempt reinstallation repeatedly. Which detection rule method is most likely causing this issue?

A.MSI product code detection uses a product code that does not match the installed app

B.File existence detection checks for a file that is installed by the app

C.Registry detection checks for a registry key that is created by the app

D.Custom script detection returns exit code 0 even if app is not present

AnswerA

Mismatched product code causes detection failure.

Why this answer

When an MSI product code detection rule uses a product code that does not match the GUID of the installed application, Intune will always evaluate the app as 'not installed' regardless of the actual installation state. This mismatch causes Intune to repeatedly attempt reinstallation on every check-in cycle, as the detection logic never finds a matching product code in the Windows Installer database.

Exam trap

The trap here is that candidates often assume any detection rule method will work as long as the app is installed, but they overlook that MSI product code detection requires an exact GUID match, and a mismatch will cause Intune to perpetually attempt reinstallation.

How to eliminate wrong answers

Option B is wrong because file existence detection checks for a file that is installed by the app; if the file is present, the rule correctly reports the app as installed, so it would not cause repeated reinstallation. Option C is wrong because registry detection checks for a registry key created by the app; if the key exists, the rule correctly identifies the app as installed, preventing reinstallation loops. Option D is wrong because a custom script that returns exit code 0 when the app is not present would incorrectly report the app as installed, which would stop reinstallation attempts, not cause them.

Full explanation →

437

MCQmedium

Your organization plans to deploy Windows 365 Cloud PCs. You need to ensure that users can connect only from compliant devices. Which configuration should you implement?

A.Create an app protection policy for Windows 365 app.

B.Configure the Cloud PC provisioning policy to allow only compliant devices.

C.Assign a device compliance policy to all users.

D.Create a Conditional Access policy requiring device to be marked as compliant.

AnswerD

Conditional Access enforces compliance requirement.

Why this answer

A Conditional Access policy that requires the device to be marked as compliant is the only configuration that enforces compliance at the authentication and access level. This policy evaluates the device's compliance status (reported by Microsoft Intune) before granting access to Windows 365 Cloud PCs, ensuring that only devices meeting your organization's compliance requirements can connect.

Exam trap

The trap here is that candidates often confuse provisioning policies (which configure Cloud PCs) with access control policies (Conditional Access), leading them to select Option B, but provisioning policies do not enforce compliance-based access restrictions.

How to eliminate wrong answers

Option A is wrong because app protection policies (MAM) manage data protection within apps and do not evaluate device compliance; they are designed for unmanaged devices and cannot block access based on device compliance status. Option B is wrong because a Cloud PC provisioning policy defines the configuration and assignment of Cloud PCs (e.g., image, network, user assignments) but does not enforce access controls or compliance checks at the time of connection. Option C is wrong because assigning a device compliance policy to all users defines the compliance requirements (e.g., encryption, OS version) but does not enforce access restrictions; it only marks the device as compliant or non-compliant—a separate Conditional Access policy is needed to block non-compliant devices.

Full explanation →

438

MCQhard

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running build 10.0.22621.1000. The device has BitLocker enabled, Secure Boot enabled, and code integrity enabled. The device is compliant?

A.No, the device's OS version exceeds the maximum allowed.

B.No, the device does not have a password set.

C.Yes, the device meets all requirements.

D.Yes, but only if the device is Windows 10 Pro.

AnswerA

The policy restricts max version to 22621.0.

Why this answer

The compliance policy specifies a maximum OS version of 10.0.22621.0, but the device runs build 10.0.22621.1000, which is higher. Therefore, the device is non-compliant due to exceeding the allowed OS version range, regardless of other security settings.

Exam trap

The trap here is that candidates assume meeting the three security requirements (BitLocker, Secure Boot, code integrity) guarantees compliance, overlooking the OS version constraint which is a separate and often forgotten condition.

How to eliminate wrong answers

Option B is wrong because the policy does not require a password; it only checks BitLocker, Secure Boot, and code integrity, and the device has all three enabled. Option C is wrong because although the device meets the BitLocker, Secure Boot, and code integrity requirements, it fails the OS version constraint. Option D is wrong because the policy applies to Windows 11, not Windows 10 Pro, and the device's OS version is the reason for non-compliance, not the edition.

Full explanation →

439

MCQhard

You are deploying a Win32 app that requires .NET Framework 4.8. You create a dependency in Intune for the .NET Framework app. However, some devices fail to install the parent app even though .NET Framework is present. What is the most likely issue?

A.The dependency version is set to 'Greater than' instead of 'Greater than or equal to'.

B.The dependency detection rule does not match the actual .NET installation.

C.The parent app is set to install before the dependency.

D.The dependency is set to 'Do not install automatically'.

AnswerB

Intune uses detection rules to determine if dependency is present.

Why this answer

Intune uses detection rules to verify whether a dependency is installed. If the detection rule for the .NET Framework dependency does not match the actual installation state (e.g., it checks for a registry key or file version that differs from what .NET 4.8 actually creates), Intune will incorrectly report the dependency as missing, blocking the parent app installation even though .NET is present.

Exam trap

The trap here is that candidates assume a dependency is automatically detected by its version number, but Intune requires an explicit detection rule that must exactly match the actual installation artifacts, and a mismatch in the detection rule (not the version logic) is the root cause of the failure.

How to eliminate wrong answers

Option A is wrong because setting the dependency version to 'Greater than' (instead of 'Greater than or equal to') would only cause failure if the installed .NET version is exactly 4.8 and the rule requires a version higher than 4.8, but the scenario states .NET is present, so version mismatch is not the core issue. Option C is wrong because Intune dependencies are designed to install the dependency before the parent app automatically; setting the parent to install before the dependency would violate dependency logic and is not a configurable option in Intune. Option D is wrong because setting a dependency to 'Do not install automatically' means Intune will not push the dependency to devices, but if the dependency is already present, the parent app should still install; the failure here is due to detection mismatch, not the auto-install setting.

Full explanation →

440

Multi-Selectmedium

A company is deploying Windows 11 using a task sequence in Configuration Manager. They encounter an issue where the task sequence fails on devices that have BitLocker enabled. Which TWO actions should you take to ensure the task sequence completes successfully on BitLocker-enabled devices?

Select 2 answers

A.Add a 'Preprovision BitLocker' step before the 'Apply Operating System' step

B.Ensure the boot image includes the Microsoft BitLocker Administration and Monitoring (MBAM) optional component

C.Add a 'Suspend BitLocker' step before the 'Format and Partition Disk' step

D.Ensure the boot image includes the BitLocker optional component in WinPE

E.Disable Secure Boot in the device BIOS

AnswersC, D

Suspending BitLocker allows partition modifications.

Why this answer

Suspending BitLocker before the 'Format and Partition Disk' step prevents the task sequence from failing due to BitLocker-protected volumes. When BitLocker is active, the disk cannot be repartitioned or formatted without first suspending protection, as the Trusted Platform Module (TPM) validation and encryption keys would be invalidated. Option D is correct because the boot image must include the BitLocker optional component in WinPE to enable BitLocker-related operations (e.g., suspend, resume, preprovision) during the task sequence execution.

Exam trap

The trap here is that candidates often confuse 'Preprovision BitLocker' (used to enable encryption after OS deployment) with 'Suspend BitLocker' (used to temporarily disable protection during disk operations), leading them to incorrectly select Option A instead of Option C.

Full explanation →

441

MCQhard

You apply the custom policy shown in the exhibit to a Windows 11 device. Users report that they cannot use Bluetooth devices (e.g., mouse, keyboard) after the policy applies. Which setting in the policy is causing this issue?

A.allowBluetooth set to false

B.allowStorageCard set to false

C.allowCopyPaste set to false

D.allowCamera set to false

AnswerA

Disabling Bluetooth prevents all Bluetooth devices from connecting.

Why this answer

The `allowBluetooth` setting set to `false` explicitly disables the Bluetooth radio on the device, preventing any Bluetooth peripherals (mouse, keyboard, etc.) from pairing or connecting. This is a common policy in Windows CSP (Policy CSP – Bluetooth/AllowBluetooth) that controls the Bluetooth stack at the OS level, and setting it to false blocks all Bluetooth functionality.

Exam trap

The trap here is that candidates may confuse `allowBluetooth` with other device restriction policies (like camera or storage) or assume Bluetooth issues are caused by a network or driver problem, rather than recognizing the specific CSP policy that directly disables the Bluetooth radio.

How to eliminate wrong answers

Option B is wrong because `allowStorageCard` controls the use of removable storage (e.g., SD cards), not Bluetooth connectivity. Option C is wrong because `allowCopyPaste` restricts clipboard sharing between the device and other systems (e.g., in Remote Desktop or Kiosk mode), not Bluetooth device pairing. Option D is wrong because `allowCamera` disables the built-in camera, which has no impact on Bluetooth radio or peripheral connections.

Full explanation →

442

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company-specific application (a .pkg file) to all macOS devices. The application requires a specific configuration file that must be placed in the /Library/Application Support/ directory. You also need to ensure that the application is installed silently without user interaction. How should you configure the deployment in Intune?

A.Use a shell script in Intune to download and install the .pkg file from a secure URL.

B.Create a device configuration profile for macOS that includes the app installation settings.

C.Add the .pkg file as a macOS line-of-business app in Intune, specify installation arguments for silent install, and include a script to copy the configuration file post-install.

D.Use Apple Volume Purchase Program (VPP) to distribute the app as a managed app.

AnswerC

This is the standard method for deploying custom macOS apps with configuration.

Why this answer

Intune's macOS line-of-business (LOB) app deployment supports .pkg files and allows you to specify installation arguments (e.g., `-silent` or `--acceptLicense`) for silent installation. To place the configuration file in /Library/Application Support/, you must use a post-install script because Intune does not natively copy files to specific directories during LOB app deployment. This combination ensures the app is installed silently and configured correctly.

Exam trap

The trap here is that candidates often confuse device configuration profiles (which only manage settings) with app deployment, or they assume a simple script can replace the structured LOB app deployment with its silent install and post-install script capabilities.

How to eliminate wrong answers

Option A is wrong because a shell script in Intune can download and install a .pkg, but it does not provide the built-in silent install arguments or the post-install script capability that LOB app deployment offers; additionally, Intune's script deployment lacks the same reporting and dependency management as LOB apps. Option B is wrong because device configuration profiles in Intune are used for settings (e.g., restrictions, preferences) and cannot deploy applications or run scripts. Option D is wrong because VPP is for distributing apps from the Apple App Store, not for deploying custom .pkg files or managing configuration files.

Full explanation →

443

MCQhard

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

A.Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.

B.Include the settings in the Windows 365 provisioning policy.

C.Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

D.Use a Group Policy Object (GPO) applied via on-premises AD.

AnswerA

Settings Catalog allows granular configuration of Defender and firewall settings.

Why this answer

Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Azure AD group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Exam trap

The trap here is that candidates mistakenly think Windows 365 provisioning policies can include security configurations, but in reality, they only define infrastructure settings, while all post-provisioning management (including Defender and firewall rules) must be handled by Intune policies.

How to eliminate wrong answers

Option B is wrong because Windows 365 provisioning policies only define Cloud PC configuration (e.g., region, network, image) and do not support granular security settings like Defender or custom firewall rules; those must be applied via Intune after provisioning. Option C is wrong because PowerShell scripts run during provisioning via Azure Automation are not natively integrated with Windows 365 provisioning; the recommended approach is to use Intune configuration profiles, which are designed for post-provisioning device management. Option D is wrong because Group Policy Objects (GPOs) require on-premises Active Directory and domain-joined devices, but Cloud PCs are Azure AD-joined or Hybrid Azure AD-joined by default and do not support direct GPO application without additional infrastructure like Group Policy Administrative Templates in Intune.

Full explanation →

444

Multi-Selecteasy

You are troubleshooting a Windows device that is not receiving policies from Intune. Which TWO actions should you take?

Select 2 answers

A.Configure a Conditional Access policy

B.Reset the user's password

C.Verify the device is enrolled in Intune

D.Check the device sync status in the Intune console

E.Review the app protection policy assignment

AnswersC, D

Device must be enrolled to receive policies.

Why this answer

A device must be enrolled in Intune to receive policies; if enrollment is missing, the device will not appear in the Intune console and cannot process MDM policies. Verifying enrollment status (e.g., via Settings > Accounts > Access work or school) confirms the device is managed and can receive policy payloads.

Exam trap

The trap here is that candidates confuse policy delivery issues with authentication or app-level controls, leading them to select Conditional Access or app protection policies instead of focusing on the fundamental enrollment and sync prerequisites.

Full explanation →

445

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 feature update using the Windows 10 Update Rings feature. However, the deployment fails and devices show error 0x800f0905. What is the most likely cause?

A.The device does not have enough free disk space.

B.The device is not set to the correct language for the update.

C.The feature update package is missing prerequisite updates.

D.The update ring is configured with a maintenance window that is too short.

AnswerC

Correct. Error 0x800f0905 indicates missing installation files, typically caused by prerequisite updates not being installed before attempting the feature update.

Why this answer

Error 0x800f0905 indicates missing installation files for the feature update. This typically occurs when prerequisite updates are not installed. Therefore, the most likely cause is that the feature update package is missing prerequisite updates (Option C).

Option A is incorrect because insufficient disk space would result in a different error. Option B is incorrect because the update ring does not involve language settings. Option D is incorrect because a maintenance window would not cause this error.

Full explanation →

446

MCQmedium

A user reports that a Microsoft 365 Apps for enterprise installation on a Windows 10 device fails with error code 30088-1028. The device is managed by Intune. What is the most likely cause?

A.Windows Update is disabled on the device.

B.The device does not have enough free disk space.

C.The user does not have an appropriate license assigned.

D.The device is behind a proxy that blocks the Microsoft CDN.

AnswerB

Error 30088-1028 is disk space related.

Why this answer

Error code 30088-1028 during Microsoft 365 Apps for enterprise installation specifically indicates insufficient disk space on the system drive. The Office deployment process requires a minimum of 4-8 GB of free space for download, extraction, and installation. Intune-managed devices will fail with this exact error when the Click-to-Run service cannot allocate the required temporary and permanent storage.

Exam trap

The trap here is that candidates often confuse network-related errors (proxy, CDN) with disk-space errors, but Microsoft assigns distinct error code ranges—30088-1028 is specifically reserved for disk space failures, not connectivity issues.

How to eliminate wrong answers

Option A is wrong because disabling Windows Update does not cause error 30088-1028; it would instead produce update-related errors or policy blocks. Option C is wrong because an unlicensed user would receive a licensing error (e.g., 0xC004F074 or activation prompts), not a disk-space-specific error code. Option D is wrong because a proxy blocking the Microsoft CDN would result in download failures or error codes like 30088-1000 or 30088-1015, not 30088-1028.

Full explanation →

447

MCQeasy

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

A.Require Hybrid Azure AD joined device.

B.Require multi-factor authentication.

C.Require approved client app.

D.Require device to be marked as compliant.

AnswerD

Compliance policies can be configured for corporate devices.

Why this answer

Conditional Access grant control 'Require device to be marked as compliant' ensures that only devices enrolled in Microsoft Intune and meeting your compliance policies (e.g., encryption, OS version, threat level) can access Microsoft 365 apps. This directly enforces the requirement that only corporate-owned devices are allowed, as compliance status is tied to managed devices. In contrast, other options either don't restrict to corporate-owned devices or address different security concerns.

Exam trap

The trap here is that candidates often confuse 'Hybrid Azure AD joined' (Option A) with device compliance, not realizing that a device can be joined to Azure AD without being compliant, and that compliance is the granular control needed to enforce corporate ownership and security posture.

How to eliminate wrong answers

Option A is wrong because requiring a Hybrid Azure AD joined device only ensures the device is domain-joined and registered with Azure AD, but it does not enforce compliance policies or distinguish corporate-owned from personal devices; a personal device could be Hybrid Azure AD joined if it is domain-joined. Option B is wrong because multi-factor authentication (MFA) is an identity-based control that verifies user identity, not device ownership; a user on a personal device could still satisfy MFA. Option C is wrong because requiring an approved client app (e.g., Microsoft Outlook) controls the application used, not the device itself; a user could install the approved app on an unmanaged personal device and still access corporate data.

Full explanation →

448

MCQhard

Refer to the exhibit. A KQL query is run in Microsoft Defender XDR for a device 'WIN10-PC'. The results show that a critical line-of-business app 'ContosoApp' version '2.0.0' has InstallationResult 'Failed' with ErrorCode '0x80073CF6'. What does this error code typically indicate?

A.The app package is not signed correctly

B.The device does not have internet connectivity

C.The user does not have permission to install apps

D.The device has insufficient disk space

AnswerA

0x80073CF6 means APPX deployment error, often signing.

Why this answer

Error code 0x80073CF6 in Microsoft Defender XDR corresponds to APPX_E_CORRUPT_CONTENT, which indicates that the app package's digital signature is invalid or the package content has been tampered with. This typically occurs when the .appx or .msix package is not signed correctly or the signature does not match the package contents, preventing installation on Windows 10/11 devices.

Exam trap

The trap here is that candidates often confuse error codes related to package signing (0x80073CF6) with generic installation failures caused by permissions or disk space, but Microsoft specifically uses distinct error codes for each failure type, and the exam expects you to recognize the signature-corruption meaning of this hex value.

How to eliminate wrong answers

Option B is wrong because error code 0x80073CF6 is not related to network connectivity; internet access issues would produce different error codes such as 0x80072EFD or 0x80072EE2. Option C is wrong because permission-related failures generate error codes like 0x80070005 (E_ACCESSDENIED) or 0x80073CF0 (APPX_E_BLOCKED), not 0x80073CF6. Option D is wrong because insufficient disk space results in error code 0x80070070 (ERROR_DISK_FULL) or 0x80070008 (ERROR_NOT_ENOUGH_MEMORY), not the signature-related 0x80073CF6.

Full explanation →

449

MCQmedium

A company is using Microsoft Deployment Toolkit (MDT) to deploy Windows 11 to 200 new laptops. The deployment includes applications such as Microsoft 365 Apps for enterprise and a line-of-business (LOB) application. The LOB application requires a specific registry key to be set before installation. You have added a 'Set Registry' step in the task sequence before the application installation step. During a test deployment, the LOB application fails to install. The MDT logs show that the registry key is set correctly, but the application installer still fails. You suspect the application requires a reboot after setting the registry key. The task sequence does not have a reboot step after the registry change. Which step should you add to the task sequence?

A.Add a 'Wait' step for 60 seconds

B.Add a 'Set Task Sequence Variable' step to set a reboot variable

C.Add a 'Restart Computer' step immediately after the 'Set Registry' step

D.Add a 'Run Command Line' step to run gpupdate /force

AnswerC

This ensures the registry change takes effect before application installation.

Why this answer

The LOB application requires a reboot after the registry key is set to make the change effective. In MDT, a 'Restart Computer' step forces a system restart, ensuring the registry modification is recognized by the application installer. Without this reboot, the installer may read stale registry data and fail, even though the key is correctly written.

Exam trap

The trap here is that candidates may think a simple wait or Group Policy refresh is sufficient, overlooking that some applications require a reboot to recognize registry changes, and that MDT's 'Restart Computer' step is the only way to enforce that reboot at the correct point in the task sequence.

How to eliminate wrong answers

Option A is wrong because a 60-second 'Wait' step does not cause a reboot; it merely pauses the task sequence, so the registry change remains unapplied from the installer's perspective. Option B is wrong because setting a task sequence variable like 'SMSTSRebootRequested' can trigger a reboot later, but without an explicit 'Restart Computer' step, the reboot may not occur at the correct point in the sequence, or the variable may be ignored if not properly handled. Option D is wrong because 'gpupdate /force' refreshes Group Policy settings, not registry keys set directly by the task sequence; it does not cause a reboot and is irrelevant to making a manually written registry key effective.

Full explanation →

450

MCQeasy

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. A device is marked as non-compliant even though it has a password of length 8, firewall enabled, and Defender enabled. What is the most likely cause?

A.Microsoft Defender is not running.

B.The device firewall is not active.

C.The device does not lock after inactivity.

D.The device password is not complex enough.

AnswerC

The policy requires lock after inactivity.

Why this answer

The compliance policy JSON includes a setting for 'requireDeviceLock' or similar inactivity lock enforcement. Even though the device has a password of length 8, firewall enabled, and Defender enabled, if the device does not lock after a period of inactivity, it violates the policy. The policy likely specifies a maximum inactivity timeout (e.g., 5 minutes) and a grace period; failure to meet this requirement results in non-compliance regardless of other settings.

Exam trap

The trap here is that candidates focus on the explicitly stated enabled features (password, firewall, Defender) and assume compliance is based solely on those, ignoring the hidden requirement for device lock after inactivity which is a common but easily missed policy setting.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that Defender is enabled, so Microsoft Defender is running. Option B is wrong because the question explicitly states that the firewall is enabled, so the device firewall is active. Option D is wrong because the password length is 8, which typically meets complexity requirements for Windows 10 compliance policies (e.g., minimum length of 6 or 8, and often no additional complexity requirement unless explicitly set); the issue is not password complexity but the lack of device lock after inactivity.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 376–450