View Full Microsoft MD-102 Exam Dumps and Practice Test Dumps.

 

Question 121

Which Intune enrollment method is intended for administrators who need to enroll and manage multiple devices on behalf of users?

1. Device Enrollment Manager
2. Windows Autopilot
3. Microsoft Entra registration
4. User-driven enrollment

Correct Answer: 1

Explanation

Device Enrollment Manager, or DEM, is an Intune capability that allows an authorized user to enroll and manage multiple devices. It is useful in scenarios such as shared devices, frontline environments, or situations where devices are prepared before being assigned to individual users. A DEM account can enroll a larger number of devices than a standard user enrollment scenario, subject to supported limitations and configuration. Windows Autopilot is focused on provisioning Windows devices, while Microsoft Entra registration is commonly used for personal-device access. User-driven enrollment is centered on individual users enrolling their own devices.

Question 122

Which Microsoft Entra group type can automatically add or remove devices based on defined device properties?

1. Assigned group
2. Dynamic device group
3. Security baseline
4. Distribution group

Correct Answer: 2

Explanation

A dynamic device group in Microsoft Entra ID can automatically determine group membership based on rules that evaluate device attributes. When a device meets the configured rule, it can be added to the group, and when it no longer meets the condition, it can be removed. Dynamic groups are useful for scalable Intune assignments because administrators can target policies or applications without manually maintaining device membership. Assigned groups require manual membership management. Security baselines are configuration policies, while distribution groups are primarily intended for communication and messaging rather than endpoint management.

Question 123

Which Intune application assignment makes an application automatically install on targeted devices?

1. Available
2. Uninstall
3. Required
4. Optional exclusion

Correct Answer: 3

Explanation

The Required assignment type instructs Intune to automatically install an application on targeted users or devices. It is commonly used for applications that the organization considers mandatory, such as security software, productivity applications, or required business tools. Available assignments allow users to install software voluntarily through Company Portal, while Uninstall assignments instruct Intune to remove an application. Exclusions can prevent selected users or devices from receiving an assignment. Required assignments are therefore appropriate when administrators need software to be installed automatically without requiring the user to initiate the installation.

Question 124

An organization wants Windows devices to remain on a specific Windows feature version until IT approves a newer release. Which Intune policy should be configured?

1. Quality update policy
2. Feature update policy
3. Compliance policy
4. Application configuration policy

Correct Answer: 2

Explanation

An Intune feature update policy allows administrators to specify the Windows feature update version that targeted devices should use. This provides greater control over Windows servicing when an organization wants to keep devices on an approved release until a newer version has been tested and authorized. A quality update policy focuses on monthly quality updates and related servicing behavior. Compliance policies evaluate whether devices satisfy organizational requirements, while application configuration policies manage application settings. Feature update policies are therefore the appropriate choice when controlling the Windows feature version installed on managed devices.

Question 125

Which Windows Update capability allows an administrator to deploy an important quality update to devices more quickly than the normal update schedule?

1. Update ring
2. Driver update policy
3. Expedite update policy
4. Device cleanup rule

Correct Answer: 3

Explanation

An expedite update policy in Intune can be used to accelerate the deployment of specified Windows quality updates to managed devices. Organizations may use this capability when an important security update needs to reach endpoints quickly rather than waiting for the normal update deferral or servicing schedule. Update rings control broader Windows Update behavior, including deferrals and restart settings. Driver update policies focus on hardware drivers, while device cleanup rules manage stale Intune records. An expedite update policy is therefore appropriate when administrators need to accelerate deployment of a specific quality update.

Question 126

Which Intune feature helps administrators control how Windows Update downloads content between devices and Microsoft-hosted services?

1. Delivery Optimization
2. Credential Guard
3. Windows Hello
4. App Control for Business

Correct Answer: 1

Explanation

Delivery Optimization helps manage how Windows devices obtain update content by allowing supported content to be downloaded efficiently from Microsoft services and, where configured, from other devices. This can reduce bandwidth consumption and improve update distribution across organizational networks. Administrators can configure Delivery Optimization settings through Intune to control supported behaviors. Credential Guard protects credentials, Windows Hello provides authentication capabilities, and App Control for Business controls application execution. Delivery Optimization is therefore the appropriate technology when the requirement concerns efficient distribution of Windows update content.

Question 127

A company wants to require BitLocker encryption on corporate Windows laptops. Which Intune endpoint security policy should be used?

1. Account protection
2. Antivirus
3. Disk encryption
4. Firewall

Correct Answer: 3

Explanation

The Intune endpoint security disk encryption policy is designed to configure and manage encryption settings such as BitLocker on supported Windows devices. Administrators can define requirements for operating system drive encryption and configure related recovery and encryption settings. This helps protect data stored on corporate laptops if a device is lost or stolen. Account protection policies focus on authentication and account security, antivirus policies configure malware protection, and firewall policies manage network traffic filtering. Disk encryption is therefore the appropriate endpoint security policy for enforcing BitLocker configuration on managed Windows laptops.

Question 128

Which Microsoft Entra authentication method allows users to sign in without entering a traditional password by using a security key?

1. Windows Hello for Business
2. FIDO2 security key
3. Microsoft Defender Antivirus
4. BitLocker recovery key

Correct Answer: 2

Explanation

FIDO2 security keys provide a passwordless authentication method that uses a physical or compatible security key to authenticate users. The method is based on modern authentication standards and can help reduce dependence on traditional passwords. Organizations can manage supported authentication methods through Microsoft Entra ID and integrate them with access policies. Windows Hello for Business also supports passwordless authentication but uses device-based credentials and supported biometric or PIN mechanisms. Microsoft Defender Antivirus provides malware protection, while a BitLocker recovery key is used to recover encrypted drives rather than authenticate users.

Question 129

Which Intune application feature allows administrators to specify that a newer application version should replace an older version?

1. Dependencies
2. Detection rules
3. Supersedence
4. Assignment filters

Correct Answer: 3

Explanation

Application supersedence in Intune allows administrators to define relationships where a newer application version replaces an older version. This can simplify software lifecycle management by providing a controlled upgrade path for applications. Administrators can specify whether the older application should be uninstalled as part of the replacement process, depending on the deployment configuration. Dependencies are used when another application must be installed as a prerequisite. Detection rules determine whether an application is installed, while assignment filters refine targeting. Supersedence is therefore the appropriate capability for replacing older application versions with newer ones.

Question 130

Which Intune policy can evaluate whether Microsoft Defender Antivirus is enabled on a Windows device?

1. Compliance policy
2. Application configuration policy
3. Device category
4. Enrollment restriction

Correct Answer: 1

Explanation

An Intune compliance policy can evaluate security conditions on managed Windows devices, including requirements related to antivirus protection. Administrators can configure compliance conditions that determine whether a device meets the organization’s security requirements. If Microsoft Defender Antivirus or another required protection is not enabled according to the configured condition, the device can be marked noncompliant. Application configuration policies manage supported application settings, device categories organize devices, and enrollment restrictions control which devices can enroll. A compliance policy is therefore appropriate when the goal is to evaluate antivirus protection as part of device compliance.

Question 131

Which Windows security feature helps protect users from malicious websites and potentially dangerous downloaded files?

1. BitLocker
2. Microsoft Defender SmartScreen
3. Windows LAPS
4. Credential Guard

Correct Answer: 2

Explanation

Microsoft Defender SmartScreen helps protect users from potentially malicious websites, downloads, applications, and files. It can use reputation-based information to warn users when content is considered suspicious or potentially unsafe. Organizations can manage supported SmartScreen settings through endpoint management policies. BitLocker protects stored data through encryption, Windows LAPS manages local administrator passwords, and Credential Guard helps protect authentication credentials. SmartScreen is therefore the Windows security feature most directly associated with helping users avoid malicious websites and potentially dangerous downloaded content.

Question 132

An administrator wants to configure Microsoft Defender Firewall rules for managed Windows devices. Which Intune policy category is most appropriate?

1. Endpoint security firewall
2. Application protection
3. Device enrollment
4. Windows Update

Correct Answer: 1

Explanation

The Intune endpoint security firewall policy is designed to configure Microsoft Defender Firewall settings on supported managed devices. Administrators can use it to establish firewall behavior and configure supported network protection rules according to organizational requirements. Application protection policies protect organizational data inside supported applications, while device enrollment policies manage how devices enter Intune. Windows Update policies manage operating system updates and servicing. The endpoint security firewall category is therefore the appropriate choice when an organization needs to centrally configure Microsoft Defender Firewall settings across managed Windows endpoints.

Question 133

Which Intune feature allows administrators to define what should happen when a device becomes noncompliant?

1. Assignment filters
2. Compliance policy actions
3. Device categories
4. Scope tags

Correct Answer: 2

Explanation

Compliance policy actions for noncompliance define the response associated with a device that fails configured compliance requirements. Depending on the available configuration, administrators can use actions such as marking devices noncompliant and applying related controls over time. These settings work together with compliance policies and can support access decisions through Conditional Access. Assignment filters refine which devices receive policies, device categories organize endpoints, and scope tags control administrative visibility. Compliance policy actions are therefore the appropriate mechanism for defining how Intune should respond when devices fail compliance requirements.

Question 134

Which Intune capability is primarily used to manage the configuration of applications rather than determining whether the applications should be installed?

1. App configuration policy
2. Device cleanup rule
3. Compliance action
4. Update ring

Correct Answer: 1

Explanation

App configuration policies allow administrators to provide configuration settings to supported applications. These settings can help configure application behavior for managed users and devices without necessarily controlling the application’s installation itself. The exact available settings depend on the application and platform. Device cleanup rules manage stale device records, compliance actions respond to noncompliance, and update rings manage Windows Update behavior. Application deployment assignments determine whether an application is required, available, or subject to another deployment action. App configuration policies are therefore appropriate when the primary requirement is centrally managing application settings.

Question 135

Which Intune feature allows an administrator to delegate management of specific Intune resources to administrators without giving them access to every resource in the tenant?

1. Windows Autopilot
2. Device query
3. Scope tags
4. Delivery Optimization

Correct Answer: 3

Explanation

Scope tags help organizations control which Intune objects certain administrators can view or manage. They are commonly used together with role-based access control to support delegated administration. For example, an organization may assign administrators to specific departments or regions and use scope tags to limit their visibility to the appropriate Intune resources. Windows Autopilot manages provisioning, Device query retrieves device information, and Delivery Optimization manages content distribution. Scope tags therefore provide an important administrative boundary when organizations need to delegate endpoint management without exposing the entire Intune environment.

Question 136

Which Windows capability provides a centralized method for managing local administrator account passwords with automatic password rotation?

1. Windows LAPS
2. File History
3. Task Scheduler
4. Windows Sandbox

Correct Answer: 1

Explanation

Windows LAPS provides centralized management of local administrator passwords and can automatically rotate those passwords according to configured policies. This reduces the security risk of shared or static local administrator credentials across multiple Windows devices. Intune can be used to deploy and manage Windows LAPS policies on supported devices. File History is intended for file backup and recovery, Task Scheduler automates tasks, and Windows Sandbox provides an isolated environment. Windows LAPS is therefore the appropriate capability when an organization needs secure local administrator password management and automatic rotation.

Question 137

A user reports that a required application is repeatedly failing to install. Which information is most useful for determining whether Intune recognizes the application as successfully installed?

1. Device category
2. Scope tag
3. Detection rule result
4. Enrollment restriction

Correct Answer: 3

Explanation

The detection rule result is important when troubleshooting Win32 application installation because Intune uses detection rules to determine whether the application is installed successfully. Even if an installer completes, an incorrectly configured detection rule can cause Intune to believe the application is missing and attempt the installation again. Administrators should therefore verify that the detection method accurately identifies the installed application. Device categories organize devices, scope tags control administrative visibility, and enrollment restrictions determine whether devices can enroll. Detection rules directly influence how Intune evaluates application installation status.

Question 138

Which Intune capability can help an organization identify devices that have not checked in recently and may no longer be actively managed?

1. Endpoint analytics
2. Device monitoring and inventory
3. App protection policy
4. Windows Hello for Business

Correct Answer: 2

Explanation

Intune device monitoring and inventory information can help administrators review device activity, management status, and recent check-in information. This information can be useful for identifying devices that may be stale, inactive, or experiencing management connectivity issues. Administrators can then investigate the devices or use appropriate cleanup processes when records are no longer needed. Endpoint analytics focuses more heavily on user experience and performance insights, while app protection policies protect application data. Windows Hello for Business provides authentication capabilities. Device monitoring and inventory are therefore most directly relevant to reviewing device activity and management status.

Question 139

Which Intune capability can be used to deploy a web-based application as an application entry for users?

1. Win32 app
2. Microsoft 365 Apps
3. Web app
4. Driver update policy

Correct Answer: 3

Explanation

A web app in Intune allows administrators to provide users with an application entry that directs them to a web-based resource. This can be useful for organizational services that are primarily accessed through a browser rather than installed as traditional desktop software. Win32 apps are used for traditional Windows application packages, while Microsoft 365 Apps deployments manage Office applications. Driver update policies are unrelated to application deployment. A web app is therefore the appropriate Intune application type when the organization wants users to access a web-based business application through a managed application listing.

Question 140

An organization wants to automatically assign a configuration policy to every device that belongs to a particular department. Which approach should the administrator use?

1. Assign the policy to the appropriate Microsoft Entra group
2. Configure a Windows Update ring
3. Use Remote Help
4. Create a device cleanup rule

Correct Answer: 1

Explanation

Assigning the configuration policy to an appropriate Microsoft Entra group is a standard method for targeting Intune policies to devices or users associated with a particular department. The group can contain the relevant devices directly or use supported dynamic membership rules to maintain membership automatically. Intune then applies the configuration according to the assignment and applicable filters or exclusions. Windows Update rings manage update behavior, Remote Help supports remote assistance, and device cleanup rules manage stale records. Group-based assignment is therefore the appropriate approach for departmental policy targeting.