Medium MD-102 practice questions

Your organization has purchased the Intune Suite. The service desk manager reports that a growing number of devices are experiencing unexplained startup slowdowns and application crashes, but the team lacks a proactive way to spot these problems before users file tickets. She wants a solution that surfaces device performance issues, provides a Startup Performance score, and can detect anomalies affecting groups of devices. Which Intune Suite capability should you use?

Contoso is deploying 200 company-owned Android devices to its warehouse. The devices have no user accounts assigned and will be shared across shifts. Each device must run only a single inventory-scanning app in kiosk mode, and no personal or corporate user data should be tied to a specific employee. Which Android Enterprise enrollment method should you use in Microsoft Intune?

Contoso is issuing new Android smartphones to its field sales team. Each device is company-owned, but management wants employees to be able to install personal apps and keep personal data completely separate from corporate apps, which must remain fully managed by Intune. Which Android Enterprise enrollment profile type should you configure to meet these requirements?

Contoso is deploying 200 new company-owned Android devices to warehouse staff. Each device must be fully managed by Intune (device owner mode) with no personal work profile separation, and staff will sign in with their own Entra ID accounts to receive assigned apps. The devices are not eligible for Google Zero Touch or Samsung Knox Mobile Enrollment. As the endpoint administrator, what must you configure in Intune so technicians can enroll each factory-reset device into fully managed mode?

Your organization deploys the Microsoft Outlook app to corporate-owned, Intune-enrolled iOS devices. You need to preconfigure the users' email accounts automatically so employees do not have to type their email address, username, or server details at first launch. The setting values must be delivered through the managed app configuration channel that only works when the app is deployed and managed by Intune. Which type of policy should you create?

Your company allows employees to access Outlook and Teams on personal (BYOD) iOS and Android devices that are NOT enrolled in Intune. Security requires that corporate data cannot be copied from managed Microsoft apps into the user's personal apps, and that copy/paste from personal apps into managed apps is still allowed. Which Intune app protection policy setting should you configure to meet this requirement?

Your company allows employees to access Microsoft 365 email and files from personal (BYOD) iOS and Android devices that are NOT enrolled in Intune. You have deployed an app protection policy (APP) targeting the Outlook and OneDrive mobile apps. An employee reports their personal phone was lost. Management wants only the corporate data removed from the affected apps while leaving the employee's personal photos and apps untouched. What should you do from the Microsoft Intune admin center?

Contoso purchases 200 new corporate iPhones through an authorized Apple reseller. The endpoint administrator wants these devices to enroll in Intune automatically during the initial setup (out-of-box experience), be marked as supervised, and prevent users from removing the management profile. Which combination must the administrator configure before the devices are distributed?

Your organization has purchased 200 Mac laptops that are already enrolled in Apple Business Manager (ABM). You have connected the ABM token to Intune and created an enrollment profile. Now the security team wants you to silently deploy purchased volume apps to these Macs without requiring an Apple ID on each device. Which additional configuration in Intune is required to meet this requirement?

Your organization wants to deploy attack surface reduction (ASR) rules to Windows 11 devices via Intune endpoint security policy. A line-of-business application relies on Office macros that call child processes, and you are concerned that enabling ASR rules in enforce mode could break this application. You need to identify which ASR rules would impact the application without disrupting users before enforcing the rules. What should you do?

Your organization uses Windows Autopilot user-driven mode with Microsoft Entra join. The security team requires that every provisioned device be named with the prefix 'CORP-' followed by a portion of the hardware serial number so that machines can be identified in inventory reports. You are configuring the Autopilot deployment profile. Which setting should you use to enforce this naming automatically during provisioning?

Your organization ships high-end engineering laptops that require several large Win32 apps to be installed before hand-off. The helpdesk wants devices imaged and app-loaded at the IT bench so users receive a machine that finishes setup in only a few minutes. You must use Windows Autopilot to install the device-targeted apps and policies during a technician-driven phase, then let users complete only the user-specific portion later. Which Autopilot mode should you configure?

Contoso is deploying 40 Windows 11 devices that will run as unattended digital signage kiosks in a warehouse. The devices have no keyboard or mouse attached, and no user should ever sign in during provisioning. IT wants each device to enroll into Intune, join Microsoft Entra ID, and apply configuration automatically as soon as it is powered on and connected to the network. Which Windows Autopilot mode should you configure in the deployment profile?

Your organization deploys corporate Windows 11 devices via Autopilot with Entra join. Security requires that the operating system drive be encrypted with BitLocker automatically during provisioning, with no interaction or prompts shown to end users, and recovery keys must be escrowed to Entra ID. All devices have a TPM 2.0 chip. Which combination of settings in the Intune disk encryption (endpoint security) policy achieves silent BitLocker enablement?

Contoso uses Microsoft Intune and Microsoft Entra ID. All corporate Windows and iOS devices are enrolled in Intune and evaluated by compliance policies. Management requires that users can only access Microsoft 365 services (Exchange Online and SharePoint Online) from devices that Intune reports as compliant. Non-compliant or unmanaged devices must be blocked, and you want this enforced at sign-in time. What should you configure?

Your organization wants a business analyst to build custom historical trend reports on Intune device compliance over the past 60 days using Power BI. The analyst needs to connect to a data source that exposes historical Intune data spanning multiple snapshots rather than only current-state values. Which approach should you use to provide this data?

Your organization uses Microsoft Intune. A specialized team is responsible only for creating, editing, and assigning device compliance policies. You must grant this team the minimum permissions needed using a custom role, and you want the role to apply only to devices in the 'Sales-Devices' Entra group. What should you do?

You have created an Intune endpoint detection and response (EDR) policy that references the Microsoft Defender for Endpoint connector and assigned it to a group of Windows 11 devices. In the Microsoft Defender portal, the affected devices show a Windows Defender Antivirus 'Sensor health status' of 'Inactive' and do not appear as onboarded. You confirm the Intune connector to Defender for Endpoint shows as 'Enabled' and the connection status is healthy. What is the most likely cause that must be corrected so the devices become onboarded?

Your organization has 300 Windows 11 devices in a single branch office that shares one metered WAN link to the internet. Users report the link becomes saturated whenever Windows quality updates roll out, because every device downloads update content directly from Microsoft. You want to minimize internet bandwidth for updates by having devices retrieve most content from other devices in the same office, while still allowing internet fallback if no peer has the content. Which Intune configuration should you deploy?

A security analyst asks you to identify all corporate Windows devices whose BIOS/firmware version is older than a specific build so they can be prioritized for updates. You want to retrieve this data on demand for a single device to validate the reporting logic before scaling out. From the Intune admin center, which remote action lets you run a live KQL-based query against an individual managed device to return its firmware details immediately?

Contoso allows employees to use their personal Windows 11 laptops to access Microsoft 365 email and SharePoint. The security team requires these personal devices to appear in Microsoft Entra ID so Conditional Access can evaluate them, but the company must NOT take full management ownership of the personal machines or place them under a corporate account sign-in. Which device identity option should you instruct users to configure?

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to create a group that automatically includes all corporate-owned Windows devices so that a compliance policy can be targeted to them without manual maintenance. The group must exclude personally owned and non-Windows devices. What should you configure?

Contoso wants a Microsoft Entra dynamic device group that automatically includes only devices that are actively managed by Microsoft Intune, so they can target a configuration profile to those devices. Which dynamic membership rule should the administrator use?

Contoso wants to automatically assign Microsoft 365 licenses and Intune app configurations to all users in the Sales department. The identity team creates an Entra ID group and wants membership to update automatically whenever a user's department attribute changes in Entra ID. Which group configuration should they use?

Your organization has enabled Endpoint Analytics for all Intune-managed Windows devices. Leadership asks you to determine whether your fleet's startup performance and app reliability are better or worse than similar organizations, and to track improvement over time against a fixed reference point. Which Endpoint Analytics configuration should you use?