Hard — MD-102 Practice Quiz

Question 1

Your organization wants to allow only trusted applications to run on corporate Windows 11 devices managed by Intune. Security requires that apps deployed through Intune (via the Intune Management Extension) are automatically trusted and allowed to run, while other unapproved executables are blocked. You plan to create an App Control for Business policy. Which configuration lets Intune-deployed apps run without individually authoring rules for each one?

Accepted Answer

Enable the Managed Installer feature so that apps installed by the Intune Management Extension are automatically trusted.

Answer

Configure the policy in Audit only mode and rely on Defender for Endpoint to allow the apps.

Answer

Add a file path rule pointing to C:\Program Files for all Intune-deployed applications.

Answer

Create individual publisher (certificate) rules for each application before deployment.

Question 2

Your organization has deployed an App Control for Business (WDAC) base policy in enforcement mode to a group of Windows 11 workstations. The base policy trusts apps installed by the Intune Management Extension as a managed installer. The finance team now needs to run a specialized line-of-business application that was installed manually by a technician using a USB drive, so it was not tracked by the managed installer. The app is being blocked. You must allow this specific app to run without weakening the base policy or re-enabling unmanaged installations broadly. What should you do?

Accepted Answer

Create a supplemental App Control policy that authorizes the application by its file signature or hash, and deploy it to the finance devices.

Answer

Switch the base policy from enforcement mode to audit mode on the finance devices.

Answer

Add the technician's account to the managed installer configuration so future manual installs are trusted.

Answer

Disable the App Control for Business policy assignment for the finance group and rely on Defender Antivirus instead.

Question 3

Your organization requires a weekly automated report that lists every managed Windows device currently in a noncompliant state, along with the specific compliance policy settings each device failed. You need to build an unattended script that runs on a schedule and outputs the data to a CSV file. Which approach correctly retrieves the per-setting failure details programmatically?

Accepted Answer

Call the Microsoft Graph endpoint deviceManagement/managedDevices to get device compliance state, then for each noncompliant device call deviceManagement/managedDevices/{id}/deviceCompliancePolicyStates and expand the setting states.

Answer

Use the Get-IntuneManagedDevice cmdlet with the -Filter parameter set to complianceState eq 'noncompliant' and export the returned object directly, which already includes each failed setting.

Answer

Query the Intune Data Warehouse OData feed for the devices entity, which returns the failed compliance settings for each device in the same response.

Answer

Run the Get-MgDeviceManagementDeviceConfiguration cmdlet and filter on the compliance status field to list the noncompliant settings per device.

Question 4

Your organization requires a nightly, automated export of the full Intune managed device inventory (approximately 40,000 devices) into a data lake for a custom Power BI model. A scheduled service runs unattended using an app registration. The built-in reports in the Intune admin center cannot be scheduled, and manual CSV exports are capped and cannot be automated. Which approach should you implement to retrieve the complete dataset reliably each night?

Accepted Answer

Call the Microsoft Graph exportJobs endpoint (deviceManagement/reports/exportJobs) to request the Devices report, then poll the job status and download the resulting file when the state is 'completed'.

Answer

Query the deviceManagement/managedDevices endpoint page-by-page and rely on the default response, since Graph returns all 40,000 records in a single call.

Answer

Configure a recurring email subscription on the Intune Devices report so the CSV is delivered nightly to a shared mailbox for automated parsing.

Answer

Use the Intune Data Warehouse OData feed with an interactive user sign-in each night to pull the device entity into the data lake.

Question 5

You deploy the Microsoft Defender for Endpoint security baseline and, separately, a device configuration profile to the same group of Windows 11 devices. The baseline sets a firewall setting to 'Enabled', while the configuration profile leaves the same firewall setting configured as 'Not configured' but sets a different value for the same underlying CSP setting to 'Disabled'. In the Intune admin center, the affected devices report a conflict for that setting. What is the resulting state applied to the devices, and how should you resolve it?

Accepted Answer

The setting remains in an error/conflict state and is not reliably applied; you must remove the conflicting value from one policy so only a single policy configures that setting.

Answer

The security baseline always wins over device configuration profiles, so the setting is applied as 'Enabled' and no action is needed.

Answer

The most recently modified policy wins automatically, so the setting is applied as 'Disabled' with no further action required.

Answer

The device configuration profile always takes precedence over baselines, so the setting is applied as 'Disabled' and you should delete the baseline.

Question 6

Your organization is deploying Microsoft HoloLens 2 devices to a warehouse for guided maintenance work. Multiple technicians share each headset across shifts, and no single technician should be tied to a device. You need to configure the devices in Intune so that any authorized technician can sign in with their own Entra ID credentials and the device does not retain a primary user. Which device configuration approach should you use?

Accepted Answer

Enroll the HoloLens devices using Windows Autopilot self-deploying mode and apply a 'Shared multi-user device' configuration profile targeting the devices.

Answer

Enroll the HoloLens devices with a Windows Autopilot user-driven profile and assign a device configuration profile of type 'Shared multi-user device'.

Answer

Create a personal iOS/iPadOS enrollment profile and assign a per-app VPN configuration profile.

Answer

Deploy an Android Enterprise dedicated device enrollment profile with a kiosk configuration profile.

Question 7

Contoso packages a Win32 line-of-business application as an .intunewin file and deploys it to a group of Windows 11 devices as Required. The application must install for all users on each device and must complete even if no user is currently signed in. During testing you notice the installation writes a per-user registry key under HKCU that the vendor requires for licensing. Which install behavior configuration should you choose for the Win32 app in Intune to satisfy both requirements?

Accepted Answer

Set the install behavior to System and use the Win32 app's ability to run the installer per-device while the vendor licensing key is written by an active setup mechanism at first user logon

Answer

Set the install behavior to System and add a detection rule pointing to the HKCU licensing key

Answer

Set the install behavior to User so the HKCU key is written correctly for the signed-in user

Answer

Deploy the app as Available instead of Required so users trigger the install in their own context

Question 8

Your organization uses Windows 365 Enterprise. A group of support staff must be able to restart, reprovision, and troubleshoot users' Cloud PCs, but they must NOT be able to create new provisioning policies or modify Azure network connections. You want to grant this access using the least-privileged approach with minimal administrative effort. What should you do?

Accepted Answer

Create a custom Intune role granting only the Cloud PC remote actions and assign it to the support staff

Answer

Assign the support staff the built-in Windows 365 Administrator role in Microsoft Entra ID

Answer

Assign the support staff the built-in Cloud PC Administrator Intune role

Answer

Assign the support staff the built-in Cloud PC Reader Intune role

Question 9

Contoso has a hybrid Microsoft Entra environment with on-premises Active Directory synced to Entra ID. The security team wants users on Entra hybrid-joined Windows 11 devices to sign in with a PIN or biometric gesture instead of a password. They do NOT want to deploy an internal PKI or issue certificates to each device, but users must still be able to access on-premises file shares that require Kerberos authentication after signing in. Which Windows Hello for Business deployment model should you implement?

Accepted Answer

Cloud Kerberos trust

Answer

Certificate trust

Answer

Key trust

Answer

Password-based smart card logon