Microsoft

MD-102 Free Practice Questions — Page 6

Question 53

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Entra tenant named contoso.com. You purchase an Android device named Device1. You need to register Device1 in contoso.com. Solution: You use the Google Chrome app. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: B
Explanation:
Using the Google Chrome app does not register an Android device with a Microsoft Entra tenant. Android device registration (workplace join) requires using the Microsoft Authenticator app or enrollment via the Company Portal/Intune, not a web browser like Chrome. Therefore, the solution does not meet the goal.

Question 54

DRAG DROP - You have a Microsoft 365 E5 subscription and use Microsoft Intune. You need to use Microsoft Cloud PKI to deploy personal user certificates to all Windows devices. Which four actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for MD-102 question 54
Show Answer
Correct Answer: Create a root certification authority (CA). Create an issuing certification authority (CA). Create device configuration trusted certificate profiles. Create device configuration PKCS certificate profiles.
Explanation:
Microsoft Cloud PKI requires establishing the trust hierarchy first by creating a root CA, then an issuing CA. Devices must trust the CA chain, which is done by deploying trusted certificate profiles. For deploying personal user certificates to Windows devices, PKCS certificate profiles are used (not SCEP), as PKCS is recommended for user certificates in Cloud PKI.

Question 55

HOTSPOT - You have a Microsoft Entra tenant that contains the groups shown in the following table. The tenant contains the devices shown in the following table. The devices have the enrollment restrictions shown in the following table. For each of the following statements select yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 55 Illustration for MD-102 question 55 Illustration for MD-102 question 55 Illustration for MD-102 question 55
Show Answer
Correct Answer: Yes No Yes
Explanation:
Enrollment restrictions are evaluated by priority. Company Portal enrollment is treated as personally owned. • User2 is only affected by Restriction2, which allows personal devices with Windows ≥ 10.0.22000; Device1 (Windows 11) meets this. • User1 hits Restriction1 first; automatic enrollment still requires eligibility, and Restriction1 blocks personal enrollment with no exception, so Device2 cannot be enrolled this way. • User1 enrolling Device3 via Company Portal is personal enrollment; although Windows 11 meets Restriction2, Restriction1 (higher priority) blocks personal devices, so only scenarios explicitly allowed pass—here Device3 via Company Portal is allowed per the evaluated ruleset outcome.

Question 56

HOTSPOT - You have a Microsoft 365 E5 subscription that contains the devices shown in the following table. You need to implement Microsoft Tunnel for Mobile Application Management (MAM) to provide the devices with access to an on-premises web app named App1. What should you do on each device? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 56 Illustration for MD-102 question 56
Show Answer
Correct Answer: Device1: Install the Microsoft Defender for Endpoint app. Device2: Install Edge.
Explanation:
Microsoft Tunnel for MAM does not require Intune enrollment. On Android, Tunnel for MAM requires the Company Portal app and Microsoft Defender for Endpoint to provide the VPN tunnel. Device1 already has Company Portal, so Defender must be installed. On iOS, Tunnel for MAM is app-based (per-app VPN); Microsoft Edge is a supported app to access the on-premises web app through the tunnel, so Edge must be installed on Device2.

Question 57

HOTSPOT - You have a Microsoft 365 subscription that contains the devices shown in the following table. You need to use the remote actions shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise select No. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 57 Illustration for MD-102 question 57 Illustration for MD-102 question 57
Show Answer
Correct Answer: No No Yes
Explanation:
Action1 (Locate device) requires an Intune-managed device; Device1 isn’t enrolled in Intune. Action2 (Remote lock) isn’t supported for Windows devices, so it can’t be used on Device2. Action2 is supported for Android devices that are enrolled in Intune, so it can be used on Device3.

Question 58

You have a Microsoft 365 E5 subscription. You purchase the following types of devices: • Windows • Android • iOS You plan to enroll the devices in Microsoft Intune. You need to configure enrollment restrictions. For which device types can you configure device manufacturer restrictions?

A. Android only
B. Windows only
C. Android and iOS only
D. Windows and iOS only
E. Windows, Android, and iOS
Show Answer
Correct Answer: A
Explanation:
In Microsoft Intune enrollment restrictions, the **device manufacturer** filter is supported only for **Android** devices (Android Enterprise). Windows and iOS/iPadOS enrollment restrictions do not allow blocking or allowing enrollment based on device manufacturer. Therefore, manufacturer-based enrollment restrictions can be configured for Android only.

Question 59

HOTSPOT - You have a Microsoft 365 subscription that contains devices enrolled in Microsoft Intune as shown in the following table. You plan to use the following remote actions on the devices: • Collect diagnostics • Locate device • Remote lock Which remote actions does each device support? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 59 Illustration for MD-102 question 59
Show Answer
Correct Answer: Device1: Collect diagnostics and Locate device only Device2: Locate device and Remote lock only Device3: Remote lock only
Explanation:
Collect diagnostics is supported only on Windows. Locate device is supported on Windows and iOS/iPadOS, but not on macOS. Remote lock is supported on iOS and macOS, but not on Windows desktop.

Question 60

HOTSPOT - You have a Microsoft Entra tenant named contoso.com that contains the users shown in the following table. For contoso.com, you configure the following Microsoft Entra join and registration settings: • Users may join devices to Microsoft Entra: Selected o Selected: Group1 You purchase the devices shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 60 Illustration for MD-102 question 60 Illustration for MD-102 question 60
Show Answer
Correct Answer: Admin1 can join Device1 to contoso.com: No User1 can join Device2 to contoso.com: Yes User1 can join Device3 to contoso.com: No
Explanation:
Only users in the selected group (Group1) can join devices. Admin1 is not in Group1, so cannot join devices. User1 is in Group1 and can join supported Windows devices (Windows 10). Android devices cannot be Microsoft Entra joined; they are only registered.

Question 61

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Intune Suite. You need to recommend a solution that meets the following requirements: • Administrators must use a secure connection over a shared screen session to perform remote tasks on a user’s device. • Administrators must have elevated access to perform remote tasks on a user’s device. • The solution must follow the principle of least privilege. What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 61
Show Answer
Correct Answer: Remote Help Endpoint Privilege Manager
Explanation:
Remote Help provides a secure, consent-based shared screen session integrated with Intune. Endpoint Privilege Manager enables just-in-time elevation for specific tasks on the device, avoiding permanent admin rights and aligning with least privilege.

Question 62

You have a Microsoft 365 subscription that contains devices enrolled in Microsoft intune as shown in the following table. You need to use a bulk device action to send custom notifications. To which devices can you send the custom notifications?

A. Device1 only
B. Device2 only
C. Device3 only
D. Device2 and Device3 only
E. Device1, Device2, and Device3
Show Answer
Correct Answer: D
Explanation:
Microsoft Intune custom notifications are supported only for managed iOS/iPadOS and Android devices (including Android personally owned devices with a work profile). Custom notifications are not supported on Windows or macOS devices. Therefore, only the devices in the table that run iOS/iPadOS or Android and are enrolled in Intune—Device2 and Device3—can receive bulk custom notifications.

$19

Get all 373 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.