MD-102 sample questions

Question 1

A financial services company is implementing Microsoft Intune to manage its Windows 11 devices. The security team requires that all devices have BitLocker encryption enabled and that recovery keys are backed up to Microsoft Entra ID. However, a specific group of legacy accounting devices lacks a Trusted Platform Module (TPM) 2.0 chip. You need to create a compliance policy that enforces BitLocker but accommodates these legacy devices. Which configuration is required to achieve this?

Accepted Answer

Create two separate compliance policies: one requiring BitLocker and TPM, and another requiring only BitLocker. Assign them to dynamic device groups based on the presence of a TPM chip.

Answer

Create a single compliance policy requiring BitLocker and assign it to all devices. The policy will automatically adapt to devices without a TPM.

Answer

Create a device configuration profile to allow BitLocker without a compatible TPM and a single compliance policy to require BitLocker.

Answer

Use a PowerShell script deployed via Intune to check for a TPM and enable BitLocker accordingly, then use a compliance policy with a custom script to verify the encryption status.

Question 2

Your organization uses Microsoft Intune Suite and has implemented Endpoint Privilege Management (EPM). A new policy is created to allow users to run a specific legacy application, `C:\Apps\LegacyApp.exe`, with administrative privileges. After deploying the policy, users report they are still prompted for admin credentials. You verify the policy is assigned to the correct user group and the file path is correct. What is the most likely cause of this issue?

Accepted Answer

The elevation rule for `LegacyApp.exe` is missing a valid file hash or certificate signature.

Answer

The EPM agent has not been deployed to the client devices.

Answer

The users are not members of the 'EPM Users' local group on their devices.

Answer

A device configuration profile is blocking the EPM service from starting.

Question 3

You are deploying Windows 11 devices using Windows Autopilot user-driven mode for a hybrid work environment. You need to ensure that specific business-critical applications are installed and security policies are applied before users can access the desktop. However, you want to allow users to start working as soon as possible, even if non-essential applications are still installing in the background. Which two components of the Enrollment Status Page (ESP) should you configure? (Select TWO)

Accepted Answer

Set 'Block device use until all apps and profiles are installed' to 'Yes'.

Accepted Answer

Select the specific business-critical applications in the 'Block device use until these required apps are installed' list.

Answer

Configure a long 'Show an error when installation takes longer than specified number of minutes' timeout.

Answer

Enable the 'Allow users to reset device if installation error occurs' option.

Answer

Assign the ESP profile to a user group instead of a device group.

Question 4

A university is deploying shared Windows 11 devices in a computer lab. The devices must be configured in kiosk mode to run only the Microsoft Edge browser. Additionally, after each user session, the device must automatically sign out the user and delete the local profile to ensure data privacy and a clean state for the next user. Which type of account should be configured for the kiosk profile to meet these requirements?

Accepted Answer

Guest account for multi-user devices

Answer

Auto logon user

Answer

Local user account

Answer

Microsoft Entra ID user

Question 5

True or False: When configuring an Intune app protection policy for iOS devices, setting the 'Save copies of org data' policy to 'Block' will prevent users from saving corporate files to any personal cloud storage app, but will still allow saving to the local device storage by default.

Accepted Answer

False

Answer

True

Question 6

A company is migrating its local administrator password management to Microsoft Entra LAPS. An administrator needs to retrieve the password for a specific device, `DESKTOP-ABC`, to perform a maintenance task. The administrator has been assigned the 'Cloud Device Administrator' role in Microsoft Entra ID. Where can the administrator retrieve the LAPS password for `DESKTOP-ABC`?

Accepted Answer

In the Microsoft Intune admin center, on the device's overview page.

Answer

In the Microsoft 365 admin center, under the device properties.

Answer

In the Microsoft Purview compliance portal, via an audit log search.

Answer

Using Microsoft Graph Explorer with a delegated permission.

Question 7

You are creating a filter in Microsoft Intune to target a device configuration profile to only corporate-owned Windows devices that are part of the marketing department. The department information is stored in the `department` device property. Which rule syntax should you use for this filter?

Accepted Answer

(device.deviceOwnership -eq "Corporate") -and (device.department -eq "Marketing")

Answer

device.deviceOwnership = "Corporate" AND device.department = "Marketing"

Answer

(device.ownership -eq "Company") && (device.department -like "Marketing")

Answer

SELECT * WHERE deviceOwnership IS "Corporate" AND department IS "Marketing"

Question 8

A global organization wants to optimize the delivery of Windows quality updates to its branch offices, which have limited WAN bandwidth. The goal is to have devices in each office share update content with each other before downloading from the internet. The network is segmented by subnet. What is the most effective Delivery Optimization download mode to configure in Intune to achieve this?

Accepted Answer

HTTP blended with peering across a private group (2)

Answer

HTTP only (0)

Answer

HTTP blended with peering behind the same NAT (1)

Answer

HTTP blended with Internet peering (3)

Question 9

A hospital is deploying dedicated Android Enterprise devices for patient check-in. These devices must be locked down to a single application and require a secure method of enrollment that can be easily performed by non-technical staff. The devices are new and will be unboxed on-site. Which enrollment method should be used?

Accepted Answer

Enrollment using a QR code

Answer

Google Zero Touch enrollment

Answer

Knox Mobile Enrollment

Answer

Enrollment using NFC

Question 10

You are packaging a complex Win32 application for deployment via Intune. The application has a dependency on the .NET Framework 4.8 runtime. You need to ensure the .NET Framework is installed before the main application attempts to install. How should you configure this in the Win32 app properties in Intune?

Accepted Answer

In the 'Dependencies' section, add the already-packaged .NET Framework 4.8 Win32 app and set it to automatically install.

Answer

In the 'Requirements' section, add a requirement rule for the specific .NET Framework registry key.

Answer

In the 'Detection rules' section, use a custom script to check for both the main app and the .NET Framework.

Answer

Use a PowerShell script as the installation command for the main app, which first installs .NET Framework and then installs the main app.

Top vendors

Top exams

Free MD-102 sample questions

True or False: When configuring an Intune app protection policy for iOS devices, setting the 'Save copies of org data' policy to 'Block' will prevent users from saving corporate files to any personal cloud storage app, but will still allow saving to the local device storage by default.

You are creating a filter in Microsoft Intune to target a device configuration profile to only corporate-owned Windows devices that are part of the marketing department. The department information is stored in the `department` device property. Which rule syntax should you use for this filter?

10 more free samples are waiting