{"id":14352,"date":"2026-09-17T04:40:14","date_gmt":"2026-09-17T04:40:14","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=14352"},"modified":"2026-09-17T04:40:14","modified_gmt":"2026-09-17T04:40:14","slug":"microsoft-md-102-practice-test-questions-and-exam-dumps-part17-q321-340","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-md-102-practice-test-questions-and-exam-dumps-part17-q321-340\/","title":{"rendered":"Microsoft MD-102 Practice Test Questions and Exam Dumps Part17 Q321-340"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>Microsoft MD-102 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 321<\/b><\/h3>\n

Which Intune feature allows administrators to control whether personally owned Windows devices can enroll?<\/b><\/p>\n

    \n
  1. Enrollment restrictions<\/span><\/li>\n
  2. Device cleanup rules<\/span><\/li>\n
  3. Scope tags<\/span><\/li>\n
  4. Update rings<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Enrollment restrictions allow Intune administrators to control which types of devices can enroll into device management. Administrators can configure platform restrictions and ownership-related settings to prevent unsupported or unwanted devices from enrolling. This is particularly useful when an organization wants to restrict personally owned Windows devices while allowing corporate-owned endpoints. Device cleanup rules remove stale records, scope tags control administrative visibility, and update rings manage Windows Update behavior. Enrollment restrictions are therefore the appropriate feature for controlling which device types and ownership categories are permitted to enroll in Intune.<\/span><\/p>\n

    Question 322<\/b><\/h3>\n

    Which Microsoft Entra device state is commonly used when a user adds a personal device for access to organizational resources without fully joining it to the organization?<\/b><\/p>\n

      \n
    1. Microsoft Entra joined<\/span><\/li>\n
    2. Microsoft Entra registered<\/span><\/li>\n
    3. Microsoft Entra hybrid joined<\/span><\/li>\n
    4. Device Enrollment Manager<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Microsoft Entra registered is commonly used for personally owned devices that need an organizational identity for accessing resources without becoming fully joined to the organization’s Microsoft Entra environment. This model supports bring-your-own-device scenarios and can work with additional management or application protection controls. Microsoft Entra joined is intended for devices fully joined to the cloud identity environment, while hybrid joined combines on-premises Active Directory with Microsoft Entra ID. Device Enrollment Manager is an enrollment role rather than a device identity state. Microsoft Entra registered is therefore correct.<\/span><\/p>\n

      Question 323<\/b><\/h3>\n

      Which Windows Autopilot capability allows an IT technician or partner to prepare a device before it is delivered to the end user?<\/b><\/p>\n

        \n
      1. Self-deploying mode<\/span><\/li>\n
      2. User-driven deployment<\/span><\/li>\n
      3. Pre-provisioning<\/span><\/li>\n
      4. Device cleanup<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Windows Autopilot pre-provisioning allows an IT technician, reseller, or other authorized party to prepare a device before delivering it to the end user. During pre-provisioning, required applications, policies, and organizational configurations can be applied before the user receives the device. This can reduce the amount of setup the user must complete during first sign-in. User-driven deployment requires user participation, while self-deploying mode is intended for scenarios where user authentication is not required during provisioning. Pre-provisioning is therefore the appropriate choice for technician-assisted preparation.<\/span><\/p>\n

        Question 324<\/b><\/h3>\n

        Which Intune application assignment type automatically installs an application on targeted managed devices?<\/b><\/p>\n

          \n
        1. Available<\/span><\/li>\n
        2. Uninstall<\/span><\/li>\n
        3. Required<\/span><\/li>\n
        4. Dependency<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          A Required application assignment instructs Intune to automatically deploy an application to the targeted users or devices. This assignment type is appropriate for mandatory applications such as security agents, business software, or organizational tools that every applicable endpoint must have. Available assignments allow users to install applications from Company Portal when needed. Uninstall assignments remove applications, while dependencies identify prerequisite applications. Required is therefore the correct assignment type when administrators need an application to be automatically installed on targeted managed devices.<\/span><\/p>\n

          Question 325<\/b><\/h3>\n

          Which Windows management technology enables mobile device management policies to be applied to Windows without traditional Group Policy?<\/b><\/p>\n

            \n
          1. MDM<\/span><\/li>\n
          2. SMB<\/span><\/li>\n
          3. DNS<\/span><\/li>\n
          4. NTFS<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Mobile Device Management, or MDM, allows Windows devices to receive management policies through modern cloud-based management platforms such as Microsoft Intune. MDM uses supported management interfaces to configure settings, enforce security requirements, deploy applications, and perform management actions without requiring traditional domain-based Group Policy for every configuration. SMB is a file and printer sharing protocol, DNS provides name resolution, and NTFS is a Windows file system. MDM is therefore the correct technology for applying modern Windows management policies through Intune.<\/span><\/p>\n

            Question 326<\/b><\/h3>\n

            Which Intune feature can use a device attribute to include or exclude devices from a policy assignment without changing group membership?<\/b><\/p>\n

              \n
            1. Security baseline<\/span><\/li>\n
            2. Assignment filter<\/span><\/li>\n
            3. Device category<\/span><\/li>\n
            4. Compliance policy<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Assignment filters allow administrators to refine Intune policy and application assignments based on device attributes. They can be used to include or exclude devices from an assignment without requiring administrators to modify the underlying Microsoft Entra group membership. This provides more precise targeting for configuration profiles, applications, compliance policies, and other supported workloads. Security baselines provide predefined security configurations, device categories classify devices, and compliance policies evaluate device requirements. Assignment filters are therefore the appropriate feature for refining assignments according to device attributes.<\/span><\/p>\n

              Question 327<\/b><\/h3>\n

              Which Windows feature can automatically manage local administrator passwords by generating and rotating unique passwords?<\/b><\/p>\n

                \n
              1. Windows Hello for Business<\/span><\/li>\n
              2. Windows LAPS<\/span><\/li>\n
              3. Credential Guard<\/span><\/li>\n
              4. BitLocker<\/span><\/li>\n<\/ol>\n

                Correct Answer: 2<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Windows LAPS, or Windows Local Administrator Password Solution, manages local administrator passwords by securely generating, storing, and rotating passwords according to configured policies. This helps reduce the security risks associated with using identical or static local administrator credentials across multiple devices. Windows Hello for Business provides passwordless authentication, Credential Guard helps protect authentication credentials, and BitLocker provides disk encryption. Windows LAPS is therefore the appropriate feature when an organization needs centralized management and regular rotation of local administrator passwords on Windows devices.<\/span><\/p>\n

                Question 328<\/b><\/h3>\n

                Which Intune feature provides users with a self-service location for installing applications that have been assigned as available?<\/b><\/p>\n

                  \n
                1. Company Portal<\/span><\/li>\n
                2. Endpoint analytics<\/span><\/li>\n
                3. Settings Catalog<\/span><\/li>\n
                4. Windows Autopilot<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Company Portal provides users with a self-service interface for accessing applications, devices, and supported organizational resources managed through Intune. When an application is assigned as Available, users can typically locate it in Company Portal and choose whether to install it. Endpoint analytics focuses on endpoint performance and user experience, Settings Catalog provides administrative configuration options, and Windows Autopilot supports device provisioning. Company Portal is therefore the correct choice when users need a self-service interface for discovering and installing optional applications assigned through Intune.<\/span><\/p>\n

                  Question 329<\/b><\/h3>\n

                  Which Intune feature is specifically designed to deploy Microsoft 365 Apps such as Word, Excel, and PowerPoint to managed Windows devices?<\/b><\/p>\n

                    \n
                  1. Web app<\/span><\/li>\n
                  2. Microsoft 365 Apps<\/span><\/li>\n
                  3. App protection policy<\/span><\/li>\n
                  4. Device configuration profile<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    The Microsoft 365 Apps application type in Intune is designed to deploy supported Microsoft 365 productivity applications to managed devices. Administrators can configure which Office applications and supported settings should be included in the deployment and then assign the application to appropriate users or devices. Web apps provide shortcuts to browser-based resources, app protection policies protect organizational data within supported applications, and configuration profiles manage device settings. Microsoft 365 Apps is therefore the appropriate application type when deploying applications such as Word, Excel, and PowerPoint through Intune.<\/span><\/p>\n

                    Question 330<\/b><\/h3>\n

                    Which Windows feature helps protect files in selected folders from unauthorized modification by potentially malicious applications?<\/b><\/p>\n

                      \n
                    1. SmartScreen<\/span><\/li>\n
                    2. Credential Guard<\/span><\/li>\n
                    3. Controlled folder access<\/span><\/li>\n
                    4. Storage Sense<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 3<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Controlled folder access is a Microsoft Defender feature designed to help protect selected folders against unauthorized changes by potentially malicious applications. It can reduce the impact of ransomware and similar threats by restricting untrusted applications from modifying protected locations. SmartScreen provides reputation-based protection, Credential Guard protects sensitive authentication information, and Storage Sense helps manage disk space. Controlled folder access is therefore the appropriate security feature when the requirement is to prevent unauthorized applications from modifying files in protected folders.<\/span><\/p>\n

                      Question 331<\/b><\/h3>\n

                      Which Intune feature can provide a predefined collection of Microsoft-recommended security configuration settings for Windows devices?<\/b><\/p>\n

                        \n
                      1. Security baseline<\/span><\/li>\n
                      2. Device category<\/span><\/li>\n
                      3. Assignment filter<\/span><\/li>\n
                      4. Company Portal<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Security baselines provide predefined collections of recommended security settings that administrators can deploy to supported Windows devices. They help organizations establish a consistent security configuration without manually creating every individual setting. Administrators can review and customize supported baseline settings before assigning them to users or devices. Device categories classify endpoints, assignment filters refine targeting, and Company Portal provides user-facing functionality. Security baseline is therefore the correct choice when an organization wants a centralized collection of recommended Windows security configurations.<\/span><\/p>\n

                        Question 332<\/b><\/h3>\n

                        Which Windows Autopilot feature displays deployment progress and can prevent users from accessing the desktop until required configurations are completed?<\/b><\/p>\n

                          \n
                        1. Windows LAPS<\/span><\/li>\n
                        2. Enrollment Status Page<\/span><\/li>\n
                        3. Endpoint analytics<\/span><\/li>\n
                        4. Company Portal<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          The Enrollment Status Page, or ESP, displays deployment progress during Windows Autopilot and enrollment scenarios and can control whether the user is allowed to reach the Windows desktop before required configurations are completed. It can track the installation of required applications and the application of device configurations during provisioning. Windows LAPS manages local administrator passwords, Endpoint analytics provides performance insights, and Company Portal offers user-facing application management. The Enrollment Status Page is therefore the correct feature for controlling and displaying deployment progress during device provisioning.<\/span><\/p>\n

                          Question 333<\/b><\/h3>\n

                          Which Intune policy is primarily used to evaluate whether Windows devices meet requirements rather than directly configure most device settings?<\/b><\/p>\n

                            \n
                          1. Compliance policy<\/span><\/li>\n
                          2. Settings Catalog<\/span><\/li>\n
                          3. Administrative template<\/span><\/li>\n
                          4. Security baseline<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            A compliance policy evaluates whether a managed device satisfies defined organizational requirements. Examples can include operating system version, encryption status, firewall state, antivirus protection, password requirements, and other supported conditions. Compliance policies can also work with Conditional Access to help control access to organizational resources based on device compliance status. Settings Catalog, Administrative Templates, and Security Baselines are primarily configuration mechanisms. Compliance policy is therefore the correct choice when the main requirement is to evaluate whether a device meets defined security or management conditions.<\/span><\/p>\n

                            Question 334<\/b><\/h3>\n

                            Which Intune feature allows administrators to configure Windows settings using traditional policy-style templates for supported settings?<\/b><\/p>\n

                              \n
                            1. Device query<\/span><\/li>\n
                            2. Administrative Templates<\/span><\/li>\n
                            3. Remote Help<\/span><\/li>\n
                            4. Device cleanup<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Administrative Templates in Intune provide policy-style configuration settings for supported Windows devices. They offer a familiar approach for administrators who have previously managed Windows through traditional Group Policy templates. Administrators can configure supported settings and assign the resulting profile to users or devices. Device query retrieves endpoint information, Remote Help provides remote assistance, and device cleanup manages stale records. Administrative Templates are therefore the appropriate Intune feature when administrators need to configure Windows using template-based policy settings.<\/span><\/p>\n

                              Question 335<\/b><\/h3>\n

                              Which Windows update policy allows administrators to accelerate the installation of a specific quality update when a device needs urgent remediation?<\/b><\/p>\n

                                \n
                              1. Update ring<\/span><\/li>\n
                              2. Feature update policy<\/span><\/li>\n
                              3. Expedite update policy<\/span><\/li>\n
                              4. Compliance policy<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 3<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                An Expedite update policy can accelerate the deployment of specific Windows quality updates when organizations need devices to receive an update quickly. This is useful when a particular security update requires rapid deployment rather than waiting for the normal update ring schedule. Update rings control broader Windows Update behavior, feature update policies target Windows feature versions, and compliance policies evaluate device requirements. Expedite update policy is therefore the correct option when administrators need to speed up deployment of a specific quality update across applicable managed devices.<\/span><\/p>\n

                                Question 336<\/b><\/h3>\n

                                Which Intune capability can help administrators remotely assist a user by viewing or controlling a supported managed device?<\/b><\/p>\n

                                  \n
                                1. Remote Help<\/span><\/li>\n
                                2. Device cleanup<\/span><\/li>\n
                                3. Assignment filter<\/span><\/li>\n
                                4. Scope tag<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Remote Help is an Intune capability that allows authorized support personnel to remotely assist users on supported managed devices. It is designed for troubleshooting and support scenarios where an administrator or help-desk technician needs to interact with a user’s device remotely. Device cleanup manages inactive device records, assignment filters refine policy targeting, and scope tags control administrative visibility. Remote Help is therefore the appropriate capability when an organization needs a supported remote assistance solution integrated with its endpoint management environment.<\/span><\/p>\n

                                  Question 337<\/b><\/h3>\n

                                  Which Intune application mechanism determines whether a Win32 application is already installed on a device?<\/b><\/p>\n

                                    \n
                                  1. Requirement rule<\/span><\/li>\n
                                  2. Detection rule<\/span><\/li>\n
                                  3. Dependency<\/span><\/li>\n
                                  4. Assignment filter<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 2<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Detection rules determine whether a Win32 application is already installed or otherwise meets the configured detection condition. Intune uses the detection result to determine whether an application installation is required or whether the desired state has already been reached. Requirement rules determine whether the device is eligible for installation, dependencies define prerequisite applications, and assignment filters control targeting. Detection rule is therefore the correct mechanism when administrators need Intune to determine whether a Win32 application is present on a managed device.<\/span><\/p>\n

                                    Question 338<\/b><\/h3>\n

                                    Which device action is generally appropriate when an administrator needs to immediately reboot a managed Windows device remotely?<\/b><\/p>\n

                                      \n
                                    1. Wipe<\/span><\/li>\n
                                    2. Retire<\/span><\/li>\n
                                    3. Restart<\/span><\/li>\n
                                    4. Fresh Start<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 3<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      The Restart action allows administrators to remotely reboot a managed device without performing a broader device reset or removing organizational management. It can be useful when troubleshooting, completing configuration changes, or applying certain management operations that require a restart. Wipe resets the device and can remove data, Retire removes organizational management while generally preserving personal data, and Fresh Start reinstalls Windows while removing applications according to its configuration. Restart is therefore the appropriate action when the primary requirement is simply to remotely reboot the device.<\/span><\/p>\n

                                      Question 339<\/b><\/h3>\n

                                      Which Microsoft Intune feature helps administrators identify hardware information such as device model, manufacturer, and operating system details?<\/b><\/p>\n

                                        \n
                                      1. Device inventory<\/span><\/li>\n
                                      2. Remote Help<\/span><\/li>\n
                                      3. Conditional Access<\/span><\/li>\n
                                      4. Security baseline<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Device inventory provides administrators with information collected from managed endpoints, including supported hardware and software details. This information can help IT teams identify device models, manufacturers, operating system information, and other endpoint characteristics useful for management and troubleshooting. Remote Help is used for remote assistance, Conditional Access controls resource access based on configured conditions, and security baselines configure security settings. Device inventory is therefore the appropriate Intune capability when administrators need centralized information about managed device hardware and software characteristics.<\/span><\/p>\n

                                        Question 340<\/b><\/h3>\n

                                        Which Intune capability can automatically assign devices to a Microsoft Entra group based on device properties such as operating system or manufacturer?<\/b><\/p>\n

                                          \n
                                        1. Static group membership<\/span><\/li>\n
                                        2. Dynamic device group<\/span><\/li>\n
                                        3. Device Enrollment Manager<\/span><\/li>\n
                                        4. Scope tag<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Dynamic device groups in Microsoft Entra ID can automatically include devices based on defined membership rules that evaluate device properties. Administrators can use attributes such as operating system, manufacturer, model, or other supported properties to create dynamic membership rules. This allows device groups to update automatically as device information changes, reducing manual administration. Static groups require membership to be managed directly, Device Enrollment Manager is an enrollment role, and scope tags control administrative visibility. Dynamic device group is therefore the appropriate solution for property-based automatic device membership.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Microsoft MD-102 Exam Dumps and Practice Test Dumps.   Question 321 Which Intune feature allows administrators to control whether personally owned Windows devices can enroll? Enrollment restrictions Device cleanup rules Scope tags Update rings Correct Answer: 1 Explanation Enrollment restrictions allow Intune administrators to control which types of devices can enroll into device […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14352"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=14352"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14352\/revisions"}],"predecessor-version":[{"id":14360,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14352\/revisions\/14360"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=14352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=14352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=14352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}