Microsoft

MD-102 Free Practice Questions — Page 12

Question 58

HOTSPOT - You have a Microsoft 365 subscription that contains the devices shown in the following table. You need to use the remote actions shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise select No. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 58 Illustration for MD-102 question 58 Illustration for MD-102 question 58
Show Answer
Correct Answer: No No Yes
Explanation:
Device1 is not MDM-managed, so Intune remote actions aren't available. Remote lock isn't supported for Windows devices in Intune, so it can't be used on Device2. Remote lock is supported for Intune-managed Android devices, so it can be used on Device3.

Question 59

You have a Microsoft 365 E5 subscription. You purchase the following types of devices: • Windows • Android • iOS You plan to enroll the devices in Microsoft Intune. You need to configure enrollment restrictions. For which device types can you configure device manufacturer restrictions?

A. Android only
B. Windows only
C. Android and iOS only
D. Windows and iOS only
E. Windows, Android, and iOS
Show Answer
Correct Answer: A
Explanation:
Device manufacturer enrollment restrictions in Microsoft Intune are supported only for Android devices. Although the device platform restriction policy applies to multiple platforms, the specific 'Device manufacturer' restriction is applicable only to Android. Windows and iOS do not support manufacturer-based enrollment restrictions.

Question 60

HOTSPOT - You have a Microsoft 365 subscription that contains devices enrolled in Microsoft Intune as shown in the following table. You plan to use the following remote actions on the devices: • Collect diagnostics • Locate device • Remote lock Which remote actions does each device support? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 60 Illustration for MD-102 question 60
Show Answer
Correct Answer: Device1: Collect diagnostics and Locate device only Device2: Locate device and Remote lock only Device3: Remote lock only
Explanation:
Collect diagnostics is supported on Windows only. Locate device is supported on Windows and iOS, but not macOS. Remote lock is supported on iOS and macOS, but not Windows desktop.

Question 61

HOTSPOT - You have a Microsoft Entra tenant named contoso.com that contains the users shown in the following table. For contoso.com, you configure the following Microsoft Entra join and registration settings: • Users may join devices to Microsoft Entra: Selected o Selected: Group1 You purchase the devices shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 61 Illustration for MD-102 question 61 Illustration for MD-102 question 61
Show Answer
Correct Answer: Yes Yes No
Explanation:
Global Administrators can join Windows devices regardless of the selected 'Users may join devices' setting. User1 is in the allowed group and can Microsoft Entra join a Windows 10 device. Android devices support Microsoft Entra registration, not Microsoft Entra join.

Question 62

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Intune Suite. You need to recommend a solution that meets the following requirements: • Administrators must use a secure connection over a shared screen session to perform remote tasks on a user’s device. • Administrators must have elevated access to perform remote tasks on a user’s device. • The solution must follow the principle of least privilege. What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 62
Show Answer
Correct Answer: For the connection: Remote Help For elevated access: Help Desk Operator
Explanation:
Remote Help provides a secure, shared-screen remote assistance session. The Help Desk Operator Intune RBAC role grants the least-privilege permissions needed to perform Remote Help tasks, including elevation during supported remote assistance, whereas Endpoint Privilege Management is intended for elevating end-user application/process privileges rather than assigning administrator support permissions.

Question 64

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant named contoso.com. You need to deploy 100 Windows 11 devices to contoso.com. The solution must meet the following requirements: • Ensure that from the devices, users can access shares on an on-premises file server without being prompted for credentials. • Minimize reliance on the on-premises infrastructure for device identity management. Which join type should you use?

A. Active Directory domain-joined
B. Microsoft Entra hybrid joined
C. Microsoft Entra joined
D. Microsoft Entra registered
Show Answer
Correct Answer: C
Explanation:
Microsoft Entra joined best satisfies the requirement to minimize reliance on on-premises infrastructure for device identity management. Microsoft Entra joined devices can provide SSO access to on-premises file shares when the appropriate Microsoft Entra Kerberos/SSO configuration is in place, while avoiding traditional AD domain join. Hybrid join continues to rely on on-premises AD for device identity, which conflicts with the stated goal.

Question 65

HOTSPOT - You have a Microsoft Entra tenant that contains the devices shown in the following table. Which devices can be Microsoft Entra joined, and which devices can be Microsoft Entra registered? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 65 Illustration for MD-102 question 65
Show Answer
Correct Answer: Microsoft Entra joined: Device1 only Microsoft Entra registered: Device1, Device2, Device3, and Device4
Explanation:
Microsoft Entra join is supported for Windows devices. Android, iOS, and iPadOS devices are Microsoft Entra registered rather than joined. Windows devices can also be registered.

Question 66

You have a Microsoft Entra tenant that contains a device named Device1. Device1 is Microsoft Entra joined. You need to validate the Microsoft Entra ID primary refresh token (PRT) for Device1. Which command should you run?

A. klist tgt
B. dsregcmd /status
C. query session
D. sc.exe query state=all
Show Answer
Correct Answer: B
Explanation:
The correct command is `dsregcmd /status`. On a Microsoft Entra joined Windows device, this command displays device registration and SSO state information, including the Primary Refresh Token (PRT) status (for example, AzureAdPrt = YES/NO, update time, and expiry). The other commands are unrelated to validating the Microsoft Entra PRT: `klist tgt` shows Kerberos tickets, `query session` lists user sessions, and `sc.exe query state=all` queries Windows services.

Question 67

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune. You create a user named User1. You need to ensure that User1 can rotate BitLocker recovery keys by using Intune. Solution: From the Microsoft Intune admin center, you assign the Endpoint Security Manager role to User1. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: A
Explanation:
Yes. To rotate BitLocker recovery keys from Intune, the assigned Intune RBAC role must include the Remote tasks permission with the Rotate BitLockerKeys right. The built-in Endpoint Security Manager role includes this permission, so assigning it to User1 enables BitLocker recovery key rotation.

Question 68

You have a Microsoft 365 E5 subscription that contains a device named Device1. Device1 is Microsoft Entra joined. You manage Device1 by using Microsoft Intune. You need to use a remote action to reset the device as quickly as possible, if the device is turned off, the action must resume after the device is powered on. Which remote action should you use?

A. Autopilot reset
B. Wipe
C. Retire
D. Delete
Show Answer
Correct Answer: B
Explanation:
Use the Intune Wipe remote action. A wipe resets the device to factory settings and, if the device is offline or powered off when the command is issued, the command remains pending and is executed when the device next powers on and checks in. Autopilot Reset is intended to reprovision an enrolled device while preserving enrollment but is not the best fit for the requirement emphasizing a reset that resumes after power-on. Retire only removes management and company data where applicable, and Delete only removes the device record from Intune.

$19

Get all 371 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.