MD-102 Sample Questions & Answers

A company is migrating its local administrator password management to Microsoft Entra LAPS. An administrator needs to retrieve the password for a specific device, DESKTOP-ABC, to perform a maintenance task. The administrator has been assigned the 'Cloud Device Administrator' role in Microsoft Entra ID. Where can the administrator retrieve the LAPS password for DESKTOP-ABC?

You are creating a filter in Microsoft Intune to target a device configuration profile to only corporate-owned Windows devices that are part of the marketing department. The department information is stored in the department device property. Which rule syntax should you use for this filter?

A global organization wants to optimize the delivery of Windows quality updates to its branch offices, which have limited WAN bandwidth. The goal is to have devices in each office share update content with each other before downloading from the internet. The network is segmented by subnet. What is the most effective Delivery Optimization download mode to configure in Intune to achieve this?

A hospital is deploying dedicated Android Enterprise devices for patient check-in. These devices must be locked down to a single application and require a secure method of enrollment that can be easily performed by non-technical staff. The devices are new and will be unboxed on-site. Which enrollment method should be used?

You are packaging a complex Win32 application for deployment via Intune. The application has a dependency on the .NET Framework 4.8 runtime. You need to ensure the .NET Framework is installed before the main application attempts to install. How should you configure this in the Win32 app properties in Intune?

You are an endpoint administrator for a company that has adopted a Zero Trust security model. You need to create a Conditional Access policy that requires users accessing SharePoint Online from unmanaged Windows devices to use an app-protected browser and prevents them from downloading files. Which three conditions and controls should you configure? (Select THREE)

A company has onboarded all its Windows 11 devices to Microsoft Defender for Endpoint. An administrator needs to write a Kusto Query Language (KQL) query to find all devices that have executed powershell.exe in the last 7 days and display the device name and the user who initiated the process. Which KQL query should the administrator use?

Case Study:
Contoso, Ltd. is a manufacturing company with 5,000 employees, expanding its use of Microsoft 365 and Intune. They have a mix of corporate-owned Windows 11 laptops and a BYOD program for iOS and Android mobile devices.

Current Environment:
Contoso uses a hybrid Microsoft Entra ID setup, with an on-premises Active Directory synced to the cloud. All corporate Windows devices are Hybrid Azure AD Joined. The BYOD devices are currently unmanaged. Intune has been configured as the MDM authority.

Requirements:

1. Windows Devices: All new corporate laptops must be deployed using Windows Autopilot user-driven mode. These devices need to be provisioned with Microsoft 365 Apps, Microsoft Teams, and a proprietary line-of-business (LOB) Win32 app before the user accesses the desktop.
2. BYOD Policy: For personal iOS and Android devices, Contoso wants to protect corporate data within Outlook and OneDrive without enrolling the devices into MDM. Users should be prevented from copying data from these apps to personal apps like Gmail or Dropbox.
3. Security: All corporate Windows devices must have disk encryption enabled and be protected by a standard set of firewall rules defined by the security team. Devices that are not encrypted must be marked as non-compliant and blocked from accessing corporate resources.

Problem:
You need to design an Intune implementation that meets all of Contoso's requirements. Which Intune policy type should be used to enforce the data protection rules for the BYOD devices?

Your organization is deploying Windows 365 Cloud PCs to a group of developers. To improve security, you want to ensure that all network traffic from the Cloud PCs to the internet is routed through the corporate on-premises network for inspection. Which component must be configured to achieve this?

You have deployed a security baseline for Windows 11 to all corporate devices. Later, you create a device configuration profile from the Settings Catalog that configures a specific password setting differently than the baseline. Both policies are assigned to the same device group. Which policy will take precedence on the devices?