MD-102 Practice Questions

Attack Surface Reduction policies in Intune allow for granular exclusions. To resolve this issue without weakening the overall security posture, you should add the full file path of the specific, trusted application (e.g., E:\LOBApp\tool.exe) to the exclusion list for that particular ASR rule. This allows only that application to bypass the rule, while the block action remains in effect for all other untrusted processes from USB drives.

To deploy macOS LOB apps (as .pkg files), you must first use the Microsoft Intune App Wrapping Tool for macOS. This command-line tool wraps the .pkg file into an .intunemac format, which is the file type that Intune requires for upload and deployment. This tool also extracts detection metadata from the package.

The statement is true. The enrollmentProfileName is a valid device attribute that can be used in dynamic membership rules for device groups in Microsoft Entra ID. For example, a rule like (device.enrollmentProfileName -eq "Kiosk_Profile") can be used to automatically group all devices that were enrolled using a specific Autopilot or device enrollment profile.

For Microsoft Tunnel for MAM on iOS and Android, the Microsoft Defender for Endpoint app acts as the tunnel client. If this app is not installed, not running, or the user has not signed into it, the tunnel connection cannot be established. Therefore, verifying the status of the Defender for Endpoint app is the first and most crucial troubleshooting step.

The device compliance policy itself must be configured with an 'Action for noncompliance', such as 'Send email to end user' or 'Send push notification'. If no action is configured, the device will be marked as non-compliant, and Conditional Access will block it, but the user will receive no proactive notification from Intune explaining why.

Intune compliance policies for BitLocker do not automatically adapt for devices without a TPM. The best practice for this scenario is to create two distinct policies and use dynamic device groups to target them appropriately. One group can be created with a rule like (device.deviceTrustType -eq "TPM") for TPM-enabled devices, and another for devices without a TPM or with an older version. This ensures that all devices are evaluated for compliance correctly based on their hardware capabilities.

Endpoint Privilege Management rules require more than just a file path for validation to prevent spoofing. A robust rule must include a file hash, a certificate signature, or both. If only the file path is defined, EPM will not trust the rule and will not elevate the application, resulting in the standard User Account Control (UAC) prompt. The most secure and reliable method is to include the file hash, which ensures the exact version of the executable is being elevated.

This setting is the core of the ESP's function. By setting it to 'Yes', you ensure the user is held at the ESP screen until the specified configurations are complete.

This allows you to define a subset of required applications that must be installed before the user can proceed. Other applications assigned as 'Required' but not on this blocking list will continue to install in the background after the user reaches the desktop.

The 'Guest account' option within the multi-app kiosk configuration is specifically designed for shared device scenarios. It creates a temporary local account for each session. When the user signs out or the session ends, this temporary account and all associated data are deleted, ensuring a clean and secure environment for the next user.

The statement is false. The 'Save copies of org data' policy setting controls where users can save corporate data. When set to 'Block', it prevents saving to any non-policy managed location, which includes both personal cloud storage apps AND the local device storage. To allow saving to a specific corporate location like OneDrive, you must configure policy-managed locations.