Free MD-102 practice test: 30 questions with answers

Autopilot configures new devices from the cloud at first use, joining them to Microsoft Entra and applying Intune policies. Manual imaging, personal setup, and manual domain joins require IT or user effort that the scenario avoids.

Microsoft Entra joined devices are managed in the cloud and are signed in with work accounts without requiring an on-premises domain. Workgroup devices have no central identity, and hybrid join needs on-premises Active Directory.

App protection policies with mobile application management protect and remove company data inside managed apps without controlling the whole personal device. Full wipes and admin passwords are excessive or unsafe, and disabling email blocks the need.

Configuration profiles deliver settings such as Wi-Fi, VPN, and BitLocker to managed devices. Compliance notifications report state, enrollment restrictions limit who can enroll, and app icons are not configuration.

Enrollment restrictions can limit enrollment by platform and ownership, so personal devices are blocked. Conditional access controls access, password policies apply to accounts, and wallpapers are unrelated.

Required assignments install the app automatically on targeted devices. Emailed installers and manual downloads depend on users, and disabling the app does not deploy it.

Conditional access evaluates sign-in conditions such as MFA and device compliance before granting access. Shared passwords, open firewall rules, and disabled MFA weaken security.

Dynamic groups update membership based on rules such as the user's department, so policies follow attribute changes. Manual lists and spreadsheets go stale, and random assignment ignores the requirement.

A narrowly scoped role grants only the permissions needed for password resets. Global or full Intune administrator roles give far more access than the scenario needs, and shared passwords are unsafe.

Access reviews periodically ask owners to confirm whether members still need access. Password writeback syncs password changes, device join registers devices, and Autopilot profiles configure new devices.

Risk-based policies respond to detected risk by requiring stronger verification or password change automatically. Monthly reports are too slow, disabling without review causes disruption, and ignoring risk leaves exposure.

Joined or registered devices use device identity and token-based single sign-on to access resources without repeated prompts. Shared password files, disabled authentication, and passwords in URLs are insecure.

Compliance policies evaluate settings such as BitLocker and OS version, and conditional access uses that state to block access. Wallpapers, reminders, and user password rules do not make the device compliance decision.

Actions for noncompliance let administrators set a grace period and notifications before enforcement, which gives users time to remediate. Silent blocks surprise users, disabled checks remove control, and infinite grace periods never enforce.

Security baselines bundle recommended settings and let administrators deploy and monitor them. Printer drivers, invitations, and backgrounds are not security configurations.

Defender for Endpoint provides endpoint detection and response, including alert investigation and device isolation. Excel, Teams, and Azure DevOps do not provide endpoint threat detection.

Device isolation through Defender for Endpoint limits network communication while preserving the device for investigation. Deleting profiles or resetting without evidence destroys data, and ignoring alerts lets the threat spread.

Safe attachments detonate suspicious attachments in a protected environment before delivery. Printer sharing, icon sorting, and monitors do not protect against email malware.

Deployment rings deliver updates to pilot and broad groups in stages, which reduces risk. Manual installs are inconsistent, blocking updates leaves devices exposed, and waiting for complaints is reactive.

Update rings can set deadlines so that devices install updates within the specified time. Chat reminders, quarterly windows, and disabling updates do not enforce a timeline.

Pausing an update ring temporarily stops updates for its devices while the issue is investigated. Uninstalling Windows, renaming devices, and deleting rings are disproportionate or unrelated.

Update compliance reports show installation status across devices, which helps track gaps. Printer lists, calendars, and bookmarks do not report update state.

The update channel setting determines how often Microsoft 365 Apps receive feature updates, such as a monthly enterprise channel. The other settings are unrelated to Office update cadence.

Piloting third-party app updates before broad deployment reduces the risk of breaking business processes. Manual and ad hoc updates are inconsistent, removal is disruptive, and updating one laptop does not represent the fleet.

Web link apps place an icon or link on managed devices and can integrate with sign-in. Emailed URLs and printed posters are manual, and installing a browser alone does not provide the application entry point.

Available assignments let users install apps from the company portal on demand. Required assignments install automatically, uninstall assignments remove apps, and hidden apps are not usable.

Targeted removal of managed apps or app protection wipes take out company data and apps while preserving personal content. Factory resets and photo deletion are destructive, and asking users to uninstall is unreliable.

Win32 apps are packaged for Intune with detection rules, and Store apps are assigned through their app type. The other statements misstate how these app types are handled.

Required assignments push apps automatically, and available assignments let users install from the company portal. Uninstall assignments apply to any app type, deployment can target specific groups, and apps need not go to every device.

Installing in the system context makes the app available to all users on the device. User context installs only for the signed-in user, and guest and printer contexts are not app installation contexts.