MD-102 Practice Test

Answer choices

1. A. Count every assigned device without a success result as an error, within the documented scope, ownership, and validation boundaries.
2. B. Separate assignment, check-in, applicability, conflict, error, and effective-state results before identifying actual failures, within the documented operational, security, ownership, and validation requirements.
3. C. Delete devices that have not checked in so the report reaches 100 percent, under the documented operational and governance requirements.
4. D. Export the report without its current filters and use the largest row count, under the organization’s defined implementation and exception-management process.

Wrong-answer review

• A. Count every assigned device without a success result as an error, within the documented scope, ownership, and validation boundaries.: This misclassifies devices that lack evaluation or are inapplicable as though they produced confirmed errors.
• C. Delete devices that have not checked in so the report reaches 100 percent, under the documented operational and governance requirements.: Deleting records manipulates the denominator and does not establish the policy result on those devices.
• D. Export the report without its current filters and use the largest row count, under the organization’s defined implementation and exception-management process.: Removing scope and status filters produces a count that cannot be compared reliably with the portal view.

Answer choices

1. A. Audit and stage the App Control rollout, preserve required security capabilities, and separately integrate Defender risk with compliance and Conditional Access
2. B. Enforce App Control tenant-wide immediately because baselines and pilots are unnecessary, for the described technical objective and its associated operational control requirements.
3. C. Replace App Control with disk encryption because encrypted disks prevent unapproved code from running, as the recommended implementation across the complete governed service lifecycle.
4. D. Use one attack surface reduction rule as a replacement for App Control, antimalware, firewall, and EDR, within the documented operational, security, ownership, and validation requirements.

Answer choices

1. A. The device preparation report for the application, policy, and deployment results from that provisioning session, within this context.
2. B. A Company Portal branding report unrelated to out-of-box preparation, for the described technical objective and its associated operational control requirements.
3. C. Only the device name, because naming proves every selected application installed, for the stated security, delivery, and accountability requirements.
4. D. A classic Autopilot hardware-hash import report even though device preparation is in use, within the described context.

Answer choices

1. A. Microsoft Entra registered devices and a static user group, under the proposed approach.
2. B. Microsoft Entra hybrid joined devices and no enrollment, under the documented operational and governance requirements.
3. C. Microsoft Entra joined devices with an appropriate dynamic device group
4. D. Workgroup devices, because a dynamic group creates the device identity, in context.

Answer choices

1. A. Manage Windows LAPS using Microsoft Intune, which is the recommended approach by Microsoft for organizations.
2. B. Configure Windows LAPS policy settings through Group Policy Objects (GPOs) within Active Directory.
3. C. Deploy Windows LAPS for Microsoft Entra ID manually, configuring policy settings directly on each device.
4. D. Utilize Microsoft Entra Application Proxy to securely manage and rotate local administrator passwords.

Answer choices

1. A. A device naming rule that identifies protected mobile apps, under the organization’s defined implementation and exception-management process.
2. B. An app protection policy with the required organizational-data transfer controls, for the specified implementation requirement.
3. C. A second copy of the same server-URL configuration key, in the described situation.
4. D. An enrollment platform restriction used as an application data-loss policy, for the affected environment.

Answer choices

1. A. A longer secret committed to the same repository, for the described technical objective and its associated operational control requirements, in context.
2. B. A supported protected authentication method for a least-privileged Graph identity, with consent and credential lifecycle governed outside the script, for the stated implementation and support requirements.
3. C. A local device administrator account because local privilege authorizes Graph, for the described technical objective and its associated operational control requirements, for evaluation.
4. D. Anonymous Graph access because the script reads inventory, for the described technical objective and its associated operational control requirements, within the described operational context.

Answer choices

1. A. Re-register every device because registration must be the only possible cause, for the described technical objective and its associated operational control requirements.
2. B. Force updates past all holds before checking the reported service condition, as the proposed design for the complete governed operational workflow.
3. C. Track the service incident for the broad interruption and separately investigate compatibility holds and exceptions for the affected subset
4. D. Remove the devices from managed rings and leave them permanently unserviced, for the described technical objective and its associated operational control requirements, in practice.

Answer choices

1. A. Use Remote Help for all three outcomes and grant helpers permanent local administration, for the described technical objective and its associated operational control requirements, for the required business outcome.
2. B. Create one automatic elevation rule for every executable in Program Files, for the described technical objective and its associated operational control requirements, within the described operational context.
3. C. Keep users as local administrators and document which programs they may launch, for the described technical objective and its associated operational control requirements, within this context.
4. D. Create narrowly scoped Endpoint Privilege Management rules with automatic elevation for the inventory agent, user-confirmed elevation for the updater, and no rule for unapproved files

Answer choices

1. A. App Control for Business policy configured and assigned through Intune
2. B. Microsoft Defender SmartScreen reputation-based protection settings in Intune
3. C. An Intune app protection policy for managed Office data and copy restrictions
4. D. Microsoft Defender Antivirus exclusions scoped to signed application publishers