{"id":14342,"date":"2026-09-17T04:41:33","date_gmt":"2026-09-17T04:41:33","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=14342"},"modified":"2026-09-17T04:41:33","modified_gmt":"2026-09-17T04:41:33","slug":"microsoft-md-102-practice-test-questions-and-exam-dumps-part8-q141-160","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-md-102-practice-test-questions-and-exam-dumps-part8-q141-160\/","title":{"rendered":"Microsoft MD-102 Practice Test Questions and Exam Dumps Part8 Q141-160"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>Microsoft MD-102 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 141<\/b><\/h3>\n

Which Windows Autopilot capability allows IT staff to install applications and policies before the end user receives the device?<\/b><\/p>\n

    \n
  1. Self-deploying mode<\/span><\/li>\n
  2. User-driven mode<\/span><\/li>\n
  3. Autopilot Reset<\/span><\/li>\n
  4. Pre-provisioning<\/span><\/li>\n<\/ol>\n

    Correct Answer: 4<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Windows Autopilot pre-provisioning allows IT technicians, partners, or authorized personnel to prepare a Windows device before it is delivered to the end user. During the technician phase, required applications, policies, certificates, and other organizational configurations can be applied. This reduces setup time for the user and helps ensure the device is ready when delivered. User-driven mode requires the user to participate in deployment, while self-deploying mode minimizes user interaction. Autopilot Reset is intended for reusing an existing managed device rather than initially preparing it.<\/span><\/p>\n

    Question 142<\/b><\/h3>\n

    Which Intune feature can restrict enrollment based on the device platform or ownership type?<\/b><\/p>\n

      \n
    1. Enrollment restrictions<\/span><\/li>\n
    2. Compliance policy<\/span><\/li>\n
    3. Security baseline<\/span><\/li>\n
    4. Configuration profile<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Intune enrollment restrictions allow administrators to control which types of devices can enroll in the organization’s management environment. Restrictions can be configured according to supported platforms and, where applicable, ownership scenarios such as personally owned or corporate-owned devices. This helps organizations prevent unsupported or unauthorized devices from entering management. Compliance policies operate after enrollment to evaluate device requirements, while security baselines and configuration profiles configure settings on managed devices. Enrollment restrictions are therefore the appropriate capability when the requirement concerns controlling which devices are allowed to enroll.<\/span><\/p>\n

      Question 143<\/b><\/h3>\n

      Which Intune policy provides administrators with individual Windows settings that can be searched and configured without manually creating custom OMA-URI entries?<\/b><\/p>\n

        \n
      1. Administrative template<\/span><\/li>\n
      2. Security baseline<\/span><\/li>\n
      3. Settings Catalog<\/span><\/li>\n
      4. Compliance policy<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        The Intune Settings Catalog provides a searchable collection of individual device configuration settings. Administrators can locate a required Windows setting, configure its value, and deploy the resulting policy to targeted users or devices. This can be easier than creating custom OMA-URI configurations when the required setting is already available in the catalog. Administrative templates provide collections of settings based on supported policy templates, while security baselines focus on recommended security configurations. Compliance policies evaluate device conditions rather than primarily configuring device settings. Settings Catalog is therefore the appropriate choice for granular configuration.<\/span><\/p>\n

        Question 144<\/b><\/h3>\n

        A company wants to automatically install a Win32 application only on 64-bit Windows devices. Which configuration should be used?<\/b><\/p>\n

          \n
        1. Detection rule<\/span><\/li>\n
        2. Requirement rule<\/span><\/li>\n
        3. Assignment filter<\/span><\/li>\n
        4. Dependency<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Win32 application requirement rules can specify conditions that a device must satisfy before Intune installs the application. One supported condition can distinguish operating system architecture, allowing administrators to target applications to appropriate 64-bit or 32-bit environments. Detection rules determine whether an application is already installed, rather than whether the device is eligible for installation. Dependencies define prerequisite applications, while assignment filters provide additional targeting based on device properties. A requirement rule is therefore the appropriate mechanism when installation should occur only on devices meeting a specific architecture condition.<\/span><\/p>\n

          Question 145<\/b><\/h3>\n

          Which Intune feature is used to manage Microsoft Defender Antivirus configuration on Windows devices?<\/b><\/p>\n

            \n
          1. Device enrollment restriction<\/span><\/li>\n
          2. App protection policy<\/span><\/li>\n
          3. Compliance policy<\/span><\/li>\n
          4. Endpoint security antivirus policy<\/span><\/li>\n<\/ol>\n

            Correct Answer: 4<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            The Intune endpoint security antivirus policy provides settings for configuring Microsoft Defender Antivirus on supported Windows devices. Administrators can use it to manage protections such as real-time protection, cloud-delivered protection, scanning behavior, and other antivirus-related settings. This policy is focused specifically on endpoint antivirus configuration. Compliance policies can evaluate whether certain security requirements are met, but they are not primarily intended to configure Defender Antivirus. Enrollment restrictions control device registration, while app protection policies protect data within supported applications. Therefore, the endpoint security antivirus policy is the appropriate choice.<\/span><\/p>\n

            Question 146<\/b><\/h3>\n

            Which Microsoft Entra device identity is commonly used when a Windows device maintains an on-premises Active Directory domain relationship while also being represented in Microsoft Entra ID?<\/b><\/p>\n

              \n
            1. Microsoft Entra registered<\/span><\/li>\n
            2. Microsoft Entra joined<\/span><\/li>\n
            3. Hybrid Microsoft Entra joined<\/span><\/li>\n
            4. Workgroup<\/span><\/li>\n<\/ol>\n

              Correct Answer: 3<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Hybrid Microsoft Entra joined devices maintain a relationship with an on-premises Active Directory domain while also having a corresponding device identity in Microsoft Entra ID. This configuration is commonly used by organizations that operate a hybrid identity environment and still depend on traditional domain-based services. Microsoft Entra joined devices are directly joined to the cloud directory, while registered devices are generally associated with scenarios where full device joining is not required. Workgroup devices have no organizational Active Directory domain relationship. Hybrid Microsoft Entra join therefore fits the described environment.<\/span><\/p>\n

              Question 147<\/b><\/h3>\n

              Which Intune feature allows an administrator to configure a device policy so that it applies only to devices matching specific attributes?<\/b><\/p>\n

                \n
              1. Assignment filters<\/span><\/li>\n
              2. Scope tags<\/span><\/li>\n
              3. Device cleanup rules<\/span><\/li>\n
              4. Enrollment restrictions<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Assignment filters allow administrators to refine policy and application assignments using device attributes. An administrator can assign a configuration to a broader Microsoft Entra group and then use a filter to include or exclude devices based on supported properties. This provides precise targeting without requiring numerous manually maintained groups. Scope tags control administrative visibility, device cleanup rules address stale device records, and enrollment restrictions control whether devices can enroll. Assignment filters are therefore particularly useful when an organization needs a policy to apply only to devices that meet specific characteristics.<\/span><\/p>\n

                Question 148<\/b><\/h3>\n

                Which Intune application assignment allows users to install an application themselves through Company Portal when they need it?<\/b><\/p>\n

                  \n
                1. Required<\/span><\/li>\n
                2. Available<\/span><\/li>\n
                3. Uninstall<\/span><\/li>\n
                4. Excluded<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  An Available application assignment makes an application accessible to targeted users through Company Portal so that they can choose whether to install it. This assignment type is useful for optional applications that users may need but that should not be automatically installed on every device. A Required assignment automatically installs the application according to the deployment configuration. An Uninstall assignment removes an application, while an exclusion prevents selected users or devices from receiving an assignment. Available is therefore the correct assignment type when users should control installation of optional software.<\/span><\/p>\n

                  Question 149<\/b><\/h3>\n

                  Which Windows feature can help protect sensitive authentication credentials by isolating them using virtualization-based security?<\/b><\/p>\n

                    \n
                  1. SmartScreen<\/span><\/li>\n
                  2. BitLocker<\/span><\/li>\n
                  3. Credential Guard<\/span><\/li>\n
                  4. Storage Sense<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 3<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Credential Guard uses virtualization-based security to isolate certain sensitive authentication information from the normal Windows operating system environment. This helps reduce the risk that attackers can obtain protected credentials through techniques targeting the operating system. Credential Guard is particularly relevant to enterprise endpoint security because stolen credentials can potentially be used to access additional organizational resources. SmartScreen focuses on reputation-based protection for websites and downloads, BitLocker encrypts stored data, and Storage Sense manages disk space. Credential Guard is therefore the feature specifically associated with protecting credentials through isolation.<\/span><\/p>\n

                    Question 150<\/b><\/h3>\n

                    An administrator wants a managed Windows device to remove user data while retaining organizational management information so the device can be reused. Which action is appropriate?<\/b><\/p>\n

                      \n
                    1. Retire<\/span><\/li>\n
                    2. Remote lock<\/span><\/li>\n
                    3. Wipe<\/span><\/li>\n
                    4. Autopilot Reset<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 4<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Autopilot Reset is designed to prepare a Windows device for reuse while retaining important organizational management information and identity. It removes user-specific data, settings, and applications while keeping the device in an organizationally managed state. This makes it useful when a corporate device is being reassigned to another employee. Retire removes organizational management and corporate data, while Wipe performs a broader device reset. Remote lock only prevents normal access. Autopilot Reset therefore provides the appropriate balance when an organization wants to remove the previous user’s information while preserving management readiness.<\/span><\/p>\n

                      Question 151<\/b><\/h3>\n

                      Which Intune feature allows administrators to configure policies that determine whether a device meets organizational security requirements?<\/b><\/p>\n

                        \n
                      1. Compliance policy<\/span><\/li>\n
                      2. Configuration profile<\/span><\/li>\n
                      3. App configuration policy<\/span><\/li>\n
                      4. Device category<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Intune compliance policies define requirements that managed devices must satisfy to be considered compliant. Administrators can configure conditions involving operating system versions, password settings, encryption, firewall status, antivirus protection, and other supported security requirements. Devices that fail the configured conditions can be marked noncompliant, and Conditional Access can use that state when making access decisions. Configuration profiles primarily configure device settings, app configuration policies manage supported application settings, and device categories organize endpoints. Compliance policies are therefore the appropriate tool for determining whether devices meet organizational security requirements.<\/span><\/p>\n

                        Question 152<\/b><\/h3>\n

                        Which Intune capability can configure Windows Update settings such as update deferrals and restart behavior?<\/b><\/p>\n

                          \n
                        1. Feature update policy<\/span><\/li>\n
                        2. Update ring<\/span><\/li>\n
                        3. Security baseline<\/span><\/li>\n
                        4. Compliance policy<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Windows Update rings in Intune provide controls for how Windows devices receive and process updates. Administrators can configure settings such as update deferral periods, restart behavior, active hours, notifications, and related servicing options. This makes update rings useful for controlling the general Windows Update experience across device groups. Feature update policies focus on keeping devices on a specified Windows feature version, while security baselines provide recommended security settings. Compliance policies determine whether devices meet requirements. Therefore, an update ring is the appropriate choice for managing general update behavior.<\/span><\/p>\n

                          Question 153<\/b><\/h3>\n

                          Which Windows Autopilot feature allows an administrator to monitor application and policy installation during device deployment?<\/b><\/p>\n

                            \n
                          1. Device cleanup<\/span><\/li>\n
                          2. Remote Help<\/span><\/li>\n
                          3. Windows LAPS<\/span><\/li>\n
                          4. Enrollment Status Page<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 4<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            The Enrollment Status Page, or ESP, provides information about the progress of Windows device setup during supported enrollment and Autopilot deployment scenarios. It can display the status of device configuration and required application installation, helping administrators and users identify whether setup is progressing successfully. Administrators can configure ESP to help ensure that important policies and applications are processed before users begin working on the device. Device cleanup manages stale records, Remote Help supports remote assistance, and Windows LAPS manages local administrator passwords. ESP is therefore the correct deployment-monitoring feature.<\/span><\/p>\n

                            Question 154<\/b><\/h3>\n

                            Which endpoint security policy category should be used to configure Microsoft Defender Firewall settings through Intune?<\/b><\/p>\n

                              \n
                            1. Disk encryption<\/span><\/li>\n
                            2. Account protection<\/span><\/li>\n
                            3. Firewall<\/span><\/li>\n
                            4. Antivirus<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 3<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              The Intune endpoint security Firewall policy category is designed to configure Microsoft Defender Firewall settings on supported managed devices. Administrators can use this policy to establish firewall behavior and supported rules that help control network traffic. Disk encryption policies manage BitLocker and other encryption settings, account protection policies address authentication and account security, and antivirus policies configure malware protection. Because the requirement specifically concerns Microsoft Defender Firewall, the Firewall endpoint security policy is the appropriate choice for centralized configuration across managed Windows devices.<\/span><\/p>\n

                              Question 155<\/b><\/h3>\n

                              Which Intune feature can help ensure that an application is installed only after its prerequisite application has been installed?<\/b><\/p>\n

                                \n
                              1. Detection rule<\/span><\/li>\n
                              2. Dependency<\/span><\/li>\n
                              3. Scope tag<\/span><\/li>\n
                              4. Compliance action<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 2<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Application dependencies allow administrators to specify prerequisite applications that must be installed before another application can be deployed. This is useful when a business application requires a runtime, framework, agent, or another supporting component. Intune can use the dependency relationship to manage the installation sequence. Detection rules determine whether an application is already installed, scope tags control administrative visibility, and compliance actions define responses to noncompliant devices. Dependencies therefore provide the appropriate mechanism when one application must be installed before another can be successfully deployed.<\/span><\/p>\n

                                Question 156<\/b><\/h3>\n

                                Which Intune feature can automatically remove stale device records after devices have not checked in for a configured period?<\/b><\/p>\n

                                  \n
                                1. Device cleanup rules<\/span><\/li>\n
                                2. Compliance policy<\/span><\/li>\n
                                3. Assignment filters<\/span><\/li>\n
                                4. App protection policy<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Device cleanup rules help organizations maintain a cleaner Intune device inventory by removing stale device records based on a configured period of inactivity. This is useful in environments where devices are replaced, retired, or no longer communicating with Intune but their records remain in the administrative portal. Compliance policies evaluate device requirements, assignment filters refine policy targeting, and app protection policies protect organizational data within supported applications. Device cleanup rules are therefore specifically suited to managing inactive or outdated device records and reducing unnecessary administrative clutter.<\/span><\/p>\n

                                  Question 157<\/b><\/h3>\n

                                  Which Intune capability can protect corporate data inside supported mobile applications without requiring full device enrollment?<\/b><\/p>\n

                                    \n
                                  1. Device compliance<\/span><\/li>\n
                                  2. Windows Autopilot<\/span><\/li>\n
                                  3. Security baseline<\/span><\/li>\n
                                  4. App protection policy<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 4<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Intune app protection policies can protect corporate data within supported applications, including in many scenarios where a personal device is not fully enrolled for device management. Administrators can configure controls for actions such as copy and paste, data transfer, saving organizational files, and application access requirements. This makes app protection especially useful for BYOD environments where organizations need to secure business information without taking full control of the personal device. Device compliance evaluates enrolled device conditions, Windows Autopilot manages Windows provisioning, and security baselines configure endpoint security settings.<\/span><\/p>\n

                                    Question 158<\/b><\/h3>\n

                                    Which Microsoft Entra group type is most suitable when membership should automatically change according to device attributes?<\/b><\/p>\n

                                      \n
                                    1. Assigned user group<\/span><\/li>\n
                                    2. Dynamic device group<\/span><\/li>\n
                                    3. Distribution group<\/span><\/li>\n
                                    4. Static security group<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      A dynamic device group automatically evaluates configured membership rules against device attributes. Devices that meet the rule can be added to the group, while devices that no longer meet the criteria can be removed automatically. This makes dynamic device groups useful for scalable Intune assignments, especially when policies need to target devices based on properties such as operating system, ownership, or other supported attributes. Assigned or static groups require membership to be maintained more directly, while distribution groups are intended primarily for communication. Dynamic device groups therefore provide automated device-based membership.<\/span><\/p>\n

                                      Question 159<\/b><\/h3>\n

                                      Which Intune application feature determines whether a Win32 application has already been installed successfully?<\/b><\/p>\n

                                        \n
                                      1. Requirements<\/span><\/li>\n
                                      2. Dependencies<\/span><\/li>\n
                                      3. Detection rules<\/span><\/li>\n
                                      4. Assignment filters<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Detection rules determine whether Intune recognizes a Win32 application as installed on a managed Windows device. Administrators can configure supported detection methods based on information such as files, folders, registry values, or other application indicators. If the detection rule does not find the expected condition, Intune may consider the application absent and attempt deployment again. Requirements determine whether a device qualifies for installation, dependencies identify prerequisite applications, and assignment filters refine targeting. Detection rules are therefore essential for accurately determining the installation state of Win32 applications.<\/span><\/p>\n

                                        Question 160<\/b><\/h3>\n

                                        Which Intune action should an administrator use to request that a managed device retrieve newly assigned policies without resetting or restarting it?<\/b><\/p>\n

                                          \n
                                        1. Sync<\/span><\/li>\n
                                        2. Wipe<\/span><\/li>\n
                                        3. Retire<\/span><\/li>\n
                                        4. Remote lock<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          The Sync action requests that a managed device communicate with Intune and check for newly available policies, applications, and configuration changes. It is commonly used during troubleshooting when a device has not yet received a recently assigned policy or application. Sync does not intentionally erase data or reset the device. Wipe removes device data according to the selected reset behavior, Retire removes organizational management and corporate data, and Remote lock restricts access to the device. Therefore, Sync is the appropriate and least disruptive action for requesting updated management instructions.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Microsoft MD-102 Exam Dumps and Practice Test Dumps.   Question 141 Which Windows Autopilot capability allows IT staff to install applications and policies before the end user receives the device? Self-deploying mode User-driven mode Autopilot Reset Pre-provisioning Correct Answer: 4 Explanation Windows Autopilot pre-provisioning allows IT technicians, partners, or authorized personnel to prepare […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14342"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=14342"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14342\/revisions"}],"predecessor-version":[{"id":14369,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14342\/revisions\/14369"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=14342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=14342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=14342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}