Microsoft

MD-102 Free Practice Questions — Page 8

Question 73

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Entra tenant named contoso.com. You purchase an Android device named Device1. You need to register Device1 in contoso.com. Solution: You use Microsoft Entra Connect. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: B
Explanation:
Microsoft Entra Connect is used to synchronize on‑premises directories (such as Active Directory) with Microsoft Entra ID. It is not used to register or enroll individual devices like Android devices. Android devices are registered through device enrollment methods (for example, Settings, Microsoft Authenticator, or MDM), so this solution does not meet the goal.

Question 74

You have a Microsoft 365 E5 subscription. You need to ensure that when a Windows device is joined to the Microsoft Entra tenant, the device is enrolled automatically in Microsoft Intune. What should you configure?

A. the Windows Information Protection (WIP) user scope
B. the Enterprise State Roaming settings
C. the Microsoft Entra join and registration settings
D. the mobile device management (MDM) user scope
Show Answer
Correct Answer: D
Explanation:
Automatic enrollment of Windows devices into Microsoft Intune upon Microsoft Entra ID join is controlled by the Mobile Device Management (MDM) user scope. Configuring the MDM user scope enables users’ devices to automatically enroll in Intune during Entra join. Other options like WIP, Enterprise State Roaming, or general join/registration settings do not trigger Intune MDM auto-enrollment.

Question 75

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Entra tenant named contoso.com. You purchase an Android device named Device1. You need to register Device1 in contoso.com. Solution: You use the Microsoft Intune Company Portal app. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: A
Explanation:
Using the Microsoft Intune Company Portal app is the standard and supported method to register (and enroll) an Android device with a Microsoft Entra tenant. During enrollment, the device is registered in Microsoft Entra ID and managed by Intune, which satisfies the requirement to register Device1 in contoso.com.

Question 76

You have a Microsoft 365 E5 subscription. You need to create a dynamic device group that will contain any device that has the word Marketing in its name. Which device membership rule should you use?

A. (device.displayName -in "Marketing")
B. (device.displayName -in "*Marketing*")
C. (device.displayName -contains "Marketing")
D. (device.displayName -contains "*Marketing*")
Show Answer
Correct Answer: C
Explanation:
In Entra ID dynamic device rules, the **-contains** operator checks whether a property includes a specified substring and does not require wildcards. Using (device.displayName -contains "Marketing") correctly matches any device name that includes the word Marketing anywhere in the name. The -in operator is for exact matching against a list, not substring searches.

Question 77

You have a Microsoft Entra tenant named contoso.com that contains a Windows 11 device named Device1 and a user named User1. User1 registers Device1 in contoso.com. Which capability is available to Device1 after registering in contoso.com?

A. authenticating to cloud resources by using single sign-on (SSO)
B. enforcing compliance policies
C. enforcing software updates
D. enforcing hard drive encryption
Show Answer
Correct Answer: A
Explanation:
Registering a Windows 11 device in Microsoft Entra ID (formerly Azure AD) enables device identity and allows the user to authenticate to cloud resources using single sign-on (SSO). Compliance policies, software updates, and disk encryption require MDM enrollment (for example, Intune), not simple device registration.

Question 78

HOTSPOT - You have a Microsoft 365 E5 subscription that contains the devices shown in the following table. You need to create two dynamic device groups named Group1 and Group2. The solution must meet the following requirements: • Group1 must contain Device1 and Device2 only. • Group2 must contain Device1 and Device3 only. Which device membership rule should you configure for each group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 78 Illustration for MD-102 question 78
Show Answer
Correct Answer: Group1: (device.displayName -startsWith "Device") and (device.deviceOSType -eq "Windows") Group2: (device.deviceTrustType -eq "AzureAD") or (device.deviceOSType -eq "iPhone")
Explanation:
Group1 selects only Windows devices whose names start with "Device" (Device1 and Device2), excluding the iOS device. Group2 uses an OR condition to include Microsoft Entra joined devices (Device1) or iOS/iPhone devices (Device3), while excluding the Entra-registered Windows device (Device2).

Question 79

You have a Microsoft 365 E5 subscription that contains a group named Group1. You need to ensure that only the members of Group1 can join devices to the Microsoft Entra tenant. What should you configure in the Microsoft Entra admin center?

A. Device settings
B. Mobility
C. Enterprise State Roaming
D. User settings
Show Answer
Correct Answer: A
Explanation:
To restrict which users can join devices to the Microsoft Entra tenant, you configure **Devices > Device settings** in the Microsoft Entra admin center. There, the setting **“Users may join devices to Microsoft Entra ID”** can be set to **Selected**, and Group1 is specified. This ensures only members of Group1 can join devices.

Question 80

HOTSPOT - You have a Microsoft 365 ES subscription and use Microsoft Intune Suite. You manage the following types of devices: • Windows 11 • Android • iOS You need to implement Microsoft Tunnel for Mobile Application Management (MAM) to provide the devices with access to on-premises company apps. What should you deploy first, and which device types can use Tunnel for MAM? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 80
Show Answer
Correct Answer: Deploy: Microsoft Tunnel Gateway Device types: Android and iOS only
Explanation:
Microsoft Tunnel for MAM requires deploying the Microsoft Tunnel Gateway first to enable secure access to on-premises resources. Tunnel for MAM is supported only on Android and iOS/iPadOS devices, not on Windows 11.

Question 81

HOTSPOT - You have a Microsoft 365 E5 subscription that contains three Windows devices named Device1, Device2, and Device3. Each device contains two apps named App1 and App2. You manage the devices by using Microsoft Intune. The subscription contains the groups shown in the following table. You have an Endpoint Privilege Management (EPM) elevation settings policy named Policy1 that has the following settings: • Endpoint Privilege Management: Enabled • Default elevation response: Require user confirmation • Validation: Windows authentication • Assignments: Group1, Group2 You create an Endpoint Privilege Management elevation rules policy named RulesPolicy1 that has the following settings: • Rule name: Rule1 • Elevation type: Automatic • Child process behavior: Deny all • File name: App1.exe • Assignments: Group1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for MD-102 question 81 Illustration for MD-102 question 81
Show Answer
Correct Answer: Yes No No
Explanation:
Policy1 enables EPM with default elevation requiring user confirmation and Windows authentication. RulesPolicy1 provides automatic elevation only for App1 on devices in Group1. • Device1 (Group1): App2 has no rule → default applies → credentials required (Yes). • Device2 (Group2): App1 has no automatic rule → default applies → credentials required, so cannot elevate without creds (No). • Device3 (Group1): App1 matches automatic elevation rule → no credentials required (No).

Question 82

DRAG DROP - You have a Microsoft 365 E5 subscription that is linked to a Microsoft Entra tenant named contoso.com. The subscription contains a user named User1 and a new Windows 11 device named Device1. User1 must enroll Device1 in Microsoft Intune automatically. You need to ensure that all other users cannot use automatic enrollment. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for MD-102 question 82
Show Answer
Correct Answer: Create a group named Group1 and add User1 to Group1. Configure the mobile device management (MDM) user scope. Instruct User1 to join Device1 to contoso.com.
Explanation:
Automatic Intune enrollment is controlled by the MDM user scope. Targeting the scope to Group1 limits auto-enrollment to User1 only. When User1 joins the Windows 11 device to Microsoft Entra, Intune enrollment occurs automatically. No additional roles or Entra join restrictions are required.

$19

Get all 373 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.