{"id":14338,"date":"2026-09-17T04:42:08","date_gmt":"2026-09-17T04:42:08","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=14338"},"modified":"2026-09-17T04:42:08","modified_gmt":"2026-09-17T04:42:08","slug":"microsoft-md-102-practice-test-questions-and-exam-dumps-part4-q61-80","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-md-102-practice-test-questions-and-exam-dumps-part4-q61-80\/","title":{"rendered":"Microsoft MD-102 Practice Test Questions and Exam Dumps Part4 Q61-80"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>Microsoft MD-102 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 61<\/b><\/h3>\n

Which Intune feature allows administrators to deploy a specific Windows feature update version to targeted devices?<\/b><\/p>\n

    \n
  1. Update ring<\/span><\/li>\n
  2. Delivery Optimization<\/span><\/li>\n
  3. Driver update policy<\/span><\/li>\n
  4. Feature update policy<\/span><\/li>\n<\/ol>\n

    Correct Answer: 4<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    A feature update policy in Microsoft Intune allows administrators to control which Windows feature update version devices should receive. This is useful when an organization wants to keep devices on a specific Windows release rather than allowing them to automatically move to the newest available version. Administrators can assign the policy to user or device groups and specify a target feature update version. Update rings, by comparison, primarily control update behavior such as restart settings and deferral periods rather than enforcing a particular feature version.<\/span><\/p>\n

    Question 62<\/b><\/h3>\n

    An organization wants Windows devices to automatically enroll in Intune when users sign in with their Microsoft Entra accounts. Which setting is required?<\/b><\/p>\n

      \n
    1. Automatic MDM enrollment<\/span><\/li>\n
    2. Windows Sandbox<\/span><\/li>\n
    3. Device cleanup rules<\/span><\/li>\n
    4. App protection policy<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Automatic MDM enrollment allows eligible Windows devices to enroll in Microsoft Intune automatically when users sign in with their organizational Microsoft Entra accounts. The organization configures the MDM user scope so that selected users are automatically enrolled in device management. This reduces administrative effort because users do not need to manually start the enrollment process. The feature is commonly used with Microsoft Entra joined or hybrid joined devices. App protection policies manage application data, while device cleanup rules remove stale device records and do not perform enrollment.<\/span><\/p>\n

      Question 63<\/b><\/h3>\n

      Which Intune capability is designed to provide administrators with detailed analytics about device startup performance and application reliability?<\/b><\/p>\n

        \n
      1. Device categories<\/span><\/li>\n
      2. Company Portal<\/span><\/li>\n
      3. Endpoint analytics<\/span><\/li>\n
      4. Enrollment restrictions<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Endpoint analytics provides insights into the user experience and performance of managed Windows devices. Administrators can use it to review areas such as startup performance, application reliability, and other factors affecting productivity. The collected information can help identify devices or configurations that require attention. Company Portal is primarily used for application access and device-related user actions. Enrollment restrictions control which platforms or ownership types can enroll, while device categories help organize devices. Endpoint analytics therefore provides the analytical capabilities needed to identify performance-related issues across an organization.<\/span><\/p>\n

        Question 64<\/b><\/h3>\n

        A company wants to prevent personally owned Windows devices from enrolling in Intune. Which configuration should an administrator use?<\/b><\/p>\n

          \n
        1. Device compliance policy<\/span><\/li>\n
        2. Enrollment restrictions<\/span><\/li>\n
        3. Security baseline<\/span><\/li>\n
        4. Update ring<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Intune enrollment restrictions can control which device platforms and ownership types are permitted to enroll. If an organization wants to prevent personally owned Windows devices from being enrolled, administrators can configure enrollment restrictions to block personal device enrollment. This allows corporate-owned devices to remain eligible while limiting enrollment from unmanaged personal hardware. Compliance policies evaluate whether already enrolled devices meet security requirements, while security baselines configure recommended security settings. Update rings manage Windows Update behavior and do not control whether a device can enroll in Intune.<\/span><\/p>\n

          Question 65<\/b><\/h3>\n

          Which Windows Autopilot capability allows an IT technician to prepare a device for a user before the device is delivered to that user?<\/b><\/p>\n

            \n
          1. Autopilot Reset<\/span><\/li>\n
          2. Fresh Start<\/span><\/li>\n
          3. Deployment Status Page<\/span><\/li>\n
          4. Pre-provisioning<\/span><\/li>\n<\/ol>\n

            Correct Answer: 4<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Windows Autopilot pre-provisioning allows IT technicians or authorized partners to prepare a Windows device before delivering it to the end user. During the technician flow, required applications, policies, certificates, and other organizational configurations can be applied. This reduces the amount of setup the user must complete during the first sign-in experience. Autopilot Reset is intended to reset a device while retaining its organizational identity. Fresh Start reinstalls Windows, while the Deployment Status Page monitors deployment progress. Pre-provisioning specifically addresses preparation before the user receives the device.<\/span><\/p>\n

            Question 66<\/b><\/h3>\n

            Which Intune app assignment type makes an application available for users to install voluntarily from Company Portal?<\/b><\/p>\n

              \n
            1. Required<\/span><\/li>\n
            2. Uninstall<\/span><\/li>\n
            3. Available for enrolled devices<\/span><\/li>\n
            4. Available for enrolled users<\/span><\/li>\n<\/ol>\n

              Correct Answer: 3<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              An Available assignment makes an application available to targeted users or devices through Company Portal so that the application can be installed when needed. Unlike a Required assignment, Intune does not automatically install the application. This approach is useful when users should have access to optional applications without forcing installation on every managed device. An Uninstall assignment removes an application from targeted devices. Administrators can use available assignments to provide software catalogs while allowing users to decide which optional applications they want to install.<\/span><\/p>\n

              Question 67<\/b><\/h3>\n

              Which Microsoft Entra device identity represents a Windows device that is joined directly to the organization’s cloud identity service?<\/b><\/p>\n

                \n
              1. Microsoft Entra joined<\/span><\/li>\n
              2. Microsoft Entra registered<\/span><\/li>\n
              3. Hybrid Microsoft Entra joined<\/span><\/li>\n
              4. Workgroup joined<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                A Microsoft Entra joined device is joined directly to Microsoft Entra ID and is designed primarily for organizations using cloud-based identity management. Users can sign in to the Windows device using organizational credentials, while cloud services can use the device identity for authentication and access decisions. Microsoft Entra registered devices are commonly associated with personally owned or bring-your-own-device scenarios. Hybrid Microsoft Entra joined devices are connected to both on-premises Active Directory and Microsoft Entra ID. Workgroup devices do not have an organizational domain or Microsoft Entra join relationship.<\/span><\/p>\n

                Question 68<\/b><\/h3>\n

                An administrator needs to configure Windows settings that are not available through standard Intune configuration templates. Which option can provide a custom configuration?<\/b><\/p>\n

                  \n
                1. Device category<\/span><\/li>\n
                2. OMA-URI settings<\/span><\/li>\n
                3. Compliance action<\/span><\/li>\n
                4. Update ring<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  OMA-URI settings allow administrators to configure custom Windows settings through the Open Mobile Alliance Uniform Resource Identifier framework. They are useful when a required configuration is not exposed through the standard Intune settings catalog or available templates. Administrators specify the appropriate configuration path, data type, and value for the setting. Device categories organize devices, compliance actions define what happens when a device becomes noncompliant, and update rings control Windows Update behavior. OMA-URI therefore provides a flexible method for implementing specialized device configurations through Intune.<\/span><\/p>\n

                  Question 69<\/b><\/h3>\n

                  Which Intune policy type is specifically designed to configure Microsoft Defender Antivirus settings on managed Windows devices?<\/b><\/p>\n

                    \n
                  1. Device enrollment policy<\/span><\/li>\n
                  2. Application protection policy<\/span><\/li>\n
                  3. Endpoint security antivirus policy<\/span><\/li>\n
                  4. Device cleanup policy<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 3<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    An endpoint security antivirus policy in Microsoft Intune is designed to manage Microsoft Defender Antivirus settings on supported Windows devices. Administrators can configure protections such as real-time monitoring, cloud-delivered protection, scanning behavior, and other antivirus-related controls. This policy type is part of Intune’s endpoint security management capabilities and provides security-focused configuration options. Application protection policies protect organizational data within supported applications, while enrollment policies control device registration. Device cleanup policies address stale device records rather than configuring antivirus protection.<\/span><\/p>\n

                    Question 70<\/b><\/h3>\n

                    A company wants Windows devices to restart automatically after quality updates, but only during a defined maintenance period. Which Intune feature should be configured?<\/b><\/p>\n

                      \n
                    1. Feature update policy<\/span><\/li>\n
                    2. Compliance policy<\/span><\/li>\n
                    3. Driver update policy<\/span><\/li>\n
                    4. Update ring<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 4<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Windows Update rings in Intune provide controls for update behavior, including active hours, automatic restart settings, update deferrals, and user notification behavior. An administrator can configure an update ring so that devices install quality updates while minimizing disruption and schedule automatic restarts according to organizational requirements. Feature update policies instead control the Windows feature version that devices should remain on. Driver update policies focus on driver servicing, while compliance policies determine whether devices meet security and configuration requirements. Therefore, an update ring is appropriate for controlling restart and quality-update behavior.<\/span><\/p>\n

                      Question 71<\/b><\/h3>\n

                      Which Intune feature allows administrators to remove corporate data from a device while preserving a user’s personal data in a BYOD scenario?<\/b><\/p>\n

                        \n
                      1. Retire<\/span><\/li>\n
                      2. Wipe<\/span><\/li>\n
                      3. Autopilot Reset<\/span><\/li>\n
                      4. Fresh Start<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        The Retire action is designed for removing organizational management and corporate data from a device while generally preserving personal information. It is especially useful in bring-your-own-device scenarios where an employee may leave an organization or a device no longer needs corporate management. A Wipe action resets the device and removes its data, making it much more destructive. Autopilot Reset is designed for preparing Windows devices for reuse while maintaining organizational configuration, while Fresh Start reinstalls Windows. Retire is therefore the appropriate action when corporate data must be removed without intentionally deleting personal information.<\/span><\/p>\n

                        Question 72<\/b><\/h3>\n

                        Which Intune feature allows administrators to assign policies to a subset of devices based on device properties without creating separate groups for every condition?<\/b><\/p>\n

                          \n
                        1. Scope tags<\/span><\/li>\n
                        2. Assignment filters<\/span><\/li>\n
                        3. Device categories<\/span><\/li>\n
                        4. Enrollment managers<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Intune assignment filters allow administrators to refine policy and application assignments according to device properties. Instead of creating many separate groups, an administrator can assign a policy to a broader group and use a filter to include or exclude devices that meet specified criteria. This can simplify administration in environments with large numbers of devices. Scope tags serve a different purpose by controlling which administrators can view or manage specific Intune objects. Device categories help organize devices, while enrollment managers are used for specific enrollment scenarios.<\/span><\/p>\n

                          Question 73<\/b><\/h3>\n

                          Which Windows Autopilot feature displays the progress of applications and policies during the user’s initial device setup?<\/b><\/p>\n

                            \n
                          1. Windows Autopatch<\/span><\/li>\n
                          2. Company Portal<\/span><\/li>\n
                          3. Device compliance dashboard<\/span><\/li>\n
                          4. Enrollment Status Page<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 4<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            The Enrollment Status Page, commonly called ESP, displays the progress of device configuration during Windows Autopilot deployment and other enrollment scenarios. It can show the status of device setup, required applications, and policies before the user reaches a fully configured Windows desktop. Administrators can configure ESP behavior to help ensure that critical applications and policies are installed before users begin working. Company Portal provides access to applications and device actions after enrollment. Windows Autopatch manages update servicing, while the compliance dashboard focuses on compliance information.<\/span><\/p>\n

                            Question 74<\/b><\/h3>\n

                            An administrator wants to prevent users from running an application unless it is explicitly approved by the organization. Which security capability is most appropriate?<\/b><\/p>\n

                              \n
                            1. Microsoft Defender Antivirus<\/span><\/li>\n
                            2. Windows Defender Firewall<\/span><\/li>\n
                            3. App Control for Business<\/span><\/li>\n
                            4. Storage Sense<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 3<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              App Control for Business provides application control capabilities that can restrict which applications are allowed to run on Windows devices. Organizations can use application control policies to permit trusted applications while preventing unauthorized software from executing. This provides stronger application execution control than antivirus scanning alone. Microsoft Defender Antivirus primarily detects and blocks malware, while Windows Defender Firewall controls network traffic. Storage Sense manages storage space by removing unnecessary files. App Control for Business is therefore appropriate when the requirement is to enforce an approved application execution policy.<\/span><\/p>\n

                              Question 75<\/b><\/h3>\n

                              Which Intune feature allows an administrator to assign different administrative permissions to different IT staff members?<\/b><\/p>\n

                                \n
                              1. Scope tags<\/span><\/li>\n
                              2. Role-based access control<\/span><\/li>\n
                              3. Device categories<\/span><\/li>\n
                              4. Compliance policies<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 2<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Intune role-based access control, or RBAC, allows organizations to assign administrative permissions according to job responsibilities. Administrators can use built-in roles or create custom roles with specific permissions and assign them to appropriate users or groups. This supports the principle of least privilege by preventing administrators from receiving unnecessary permissions. Scope tags can further limit which Intune objects administrators can view or manage, but they do not replace RBAC. Device categories organize devices, while compliance policies evaluate device security and configuration requirements.<\/span><\/p>\n

                                Question 76<\/b><\/h3>\n

                                Which Windows security feature uses virtualization-based security to isolate sensitive credentials from the normal operating system environment?<\/b><\/p>\n

                                  \n
                                1. Credential Guard<\/span><\/li>\n
                                2. SmartScreen<\/span><\/li>\n
                                3. Storage Sense<\/span><\/li>\n
                                4. Delivery Optimization<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Credential Guard uses virtualization-based security to isolate and protect certain credential information from attacks that target the normal Windows operating system environment. It helps reduce the risk of credential theft by placing protected authentication secrets in an isolated security environment. This capability is particularly useful for reducing exposure to credential-based attacks on managed enterprise devices. SmartScreen focuses on protection against malicious websites and downloads. Storage Sense manages disk space, while Delivery Optimization helps distribute Windows updates efficiently across devices.<\/span><\/p>\n

                                  Question 77<\/b><\/h3>\n

                                  A company wants to deploy a Windows application only when a device meets specific hardware and software requirements. Which Win32 app capability should the administrator configure?<\/b><\/p>\n

                                    \n
                                  1. Scope tags<\/span><\/li>\n
                                  2. Compliance actions<\/span><\/li>\n
                                  3. Device categories<\/span><\/li>\n
                                  4. Requirements rules<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 4<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Requirements rules for Win32 applications allow Intune administrators to specify conditions that a device must meet before the application can be installed. Requirements can include operating system architecture, minimum operating system version, available disk space, or other supported conditions. These rules help prevent applications from being installed on devices that cannot properly support them. Detection rules serve a related but different purpose by determining whether an application is already installed. Scope tags control administrative visibility, while compliance actions respond to noncompliant devices.<\/span><\/p>\n

                                    Question 78<\/b><\/h3>\n

                                    Which Microsoft Entra device state is commonly associated with a personal device that accesses organizational resources without being fully joined to the organization’s directory?<\/b><\/p>\n

                                      \n
                                    1. Microsoft Entra joined<\/span><\/li>\n
                                    2. Microsoft Entra registered<\/span><\/li>\n
                                    3. Hybrid Microsoft Entra joined<\/span><\/li>\n
                                    4. Domain joined only<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Microsoft Entra registered is commonly used for personal or bring-your-own-device scenarios where the user needs access to organizational resources but the device does not need to become fully joined to the organization’s Microsoft Entra environment. Registration establishes a device identity that can be used with supported access and management capabilities. Microsoft Entra joined devices are fully joined to the cloud directory, while hybrid joined devices have relationships with both on-premises Active Directory and Microsoft Entra ID. Domain joined only describes a traditional Active Directory relationship without Microsoft Entra join.<\/span><\/p>\n

                                      Question 79<\/b><\/h3>\n

                                      Which Intune application feature determines whether an installed Win32 application is already present on a device?<\/b><\/p>\n

                                        \n
                                      1. Assignment filter<\/span><\/li>\n
                                      2. Requirement rule<\/span><\/li>\n
                                      3. Detection rule<\/span><\/li>\n
                                      4. Scope tag<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Detection rules determine whether a Win32 application is already installed on a managed Windows device. Intune uses the configured detection criteria to decide whether the application installation succeeded or whether the application needs to be installed again. Detection can use methods such as files, folders, registry information, or other supported checks. Requirement rules determine whether the device is eligible to install the application in the first place. Assignment filters refine targeting, while scope tags control administrative visibility and management boundaries.<\/span><\/p>\n

                                        Question 80<\/b><\/h3>\n

                                        Which Intune device action completely resets a Windows device and removes its existing user data and configuration?<\/b><\/p>\n

                                          \n
                                        1. Wipe<\/span><\/li>\n
                                        2. Sync<\/span><\/li>\n
                                        3. Restart<\/span><\/li>\n
                                        4. Remote lock<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          The Wipe action resets a managed device and removes its existing data, settings, and user information according to the selected wipe options. It is commonly used when a device is being repurposed, lost, or permanently removed from an organization’s control and the existing data must be erased. Sync simply requests the device to check in with Intune, while Restart reboots the operating system without removing data. Remote lock locks the device but does not reset or erase it. Therefore, Wipe is the appropriate action when a complete device reset is required.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Microsoft MD-102 Exam Dumps and Practice Test Dumps.   Question 61 Which Intune feature allows administrators to deploy a specific Windows feature update version to targeted devices? Update ring Delivery Optimization Driver update policy Feature update policy Correct Answer: 4 Explanation A feature update policy in Microsoft Intune allows administrators to control which […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14338"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=14338"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14338\/revisions"}],"predecessor-version":[{"id":14373,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14338\/revisions\/14373"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=14338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=14338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=14338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}