MD-102 Manage and maintain devices Practice Test 10 — 15 Questions

Question 1

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Intune portal, select the devices and click 'Sync'.. The Intune 'Sync' action sends a direct MDM policy refresh command to the device via the Microsoft Intune service. This triggers the device's enrollment client to immediately check in with the MDM server, download the latest policies, and apply them without waiting for the next scheduled sync interval. Since the devices are online and have connectivity, this remote sync forces an immediate policy refresh.

Answer

Ask users to restart their devices.

Answer

Ask users to run Windows Update.

Answer

Adjust the MDM sync interval in Intune.

Question 2

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only users in the Sales department can enroll their devices. What should you configure?

Accepted Answer

Enrollment restrictions that allow only users in the Sales group.. Enrollment restrictions in Intune can be configured to allow device enrollment only for users in specific groups, such as the Sales group. Option A is incorrect because RBAC roles control administrative permissions, not who can enroll devices. Option B is incorrect because device configuration profiles apply settings after enrollment, they do not control enrollment eligibility. Option C is incorrect because Conditional Access policies control access to resources after enrollment, not the enrollment process itself.

Answer

An Intune role-based access control (RBAC) role for Sales users.

Answer

A device configuration profile assigned to Sales users.

Answer

A Conditional Access policy that requires device compliance.

Question 3

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom shell script that runs once on each device. What should you configure?

Accepted Answer

A shell script with the 'Run script once per device' option.. Microsoft Intune provides a native 'Shell script' policy type for macOS that includes a 'Run script once per device' setting. This ensures the script executes exactly one time on each target device, meeting the requirement without additional configuration or workarounds.

Answer

A device compliance policy with a custom shell script.

Answer

A custom configuration profile with a script payload.

Answer

A managed app that includes the script.

Question 4

Which TWO actions can you perform in Microsoft Intune to remediate a noncompliant Windows device that has been marked as noncompliant due to missing antivirus? (Choose two.)

Accepted Answer

Deploy a proactive remediation script to detect and install antivirus.. Proactive remediations in Microsoft Intune allow you to deploy a detection and remediation script pair that can automatically detect the absence of antivirus and install it, ensuring compliance without user intervention. This leverages Intune's built-in remediation capabilities for Windows devices, which run on a schedule and can fix common compliance issues like missing security software.

Answer

Send a sync command to the device to re-evaluate compliance.

Answer

Send a notification to the user to install antivirus via Windows Security.

Answer

Create a Conditional Access policy to block the device until fixed.

Question 5

Which THREE conditions can be used to create a dynamic device group in Microsoft Entra ID for Intune management? (Choose three.)

Accepted Answer

Enrollment profile name (e.g., 'Autopilot Profile'). Microsoft Entra ID dynamic device groups can use the 'enrollmentProfileName' property as a rule attribute. This allows you to target devices based on the specific Autopilot profile assigned during enrollment, enabling precise management of devices that underwent a particular provisioning process.

Answer

Last sign-in time of the user

Answer

Installed application version

Question 6

Which TWO are valid methods to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune? (Choose two.)

Accepted Answer

Package the Office Deployment Tool as a Win32 app.. The Office Deployment Tool (ODT) can be packaged as a Win32 app in Intune, allowing administrators to customize the installation of Microsoft 365 Apps (e.g., select specific products, languages, and update channels) and deploy it to Windows devices via the Microsoft Intune Management Extension. Option D is correct because Intune provides a built-in 'Microsoft 365 Apps for Windows 10 and later' deployment profile that simplifies the process by automatically configuring the installation using the ODT under the hood, requiring only a few settings in the Intune console.

Answer

Use the iOS Microsoft 365 Apps deployment method.

Answer

Upload an MSI file for Microsoft 365 Apps.

Answer

Add a web link to the Office 365 portal.

Question 7

Refer to the exhibit. The JSON snippet shows a device compliance policy for Windows 10. You assign this policy to a device group. Some devices report as noncompliant even though they have BitLocker enabled and meet password requirements. What is the most likely cause?

Accepted Answer

The devices are not enrolled in Microsoft Defender for Endpoint.. The deviceThreatProtectionEnabled setting requires devices to be enrolled in Microsoft Defender for Endpoint to report threat levels. Without this enrollment, the compliance policy cannot evaluate the threat status, causing devices to be marked as noncompliant even if BitLocker and password policies are satisfied.

Answer

The deviceThreatProtectionEnabled setting should be false.

Answer

The password minimum length is too short.

Answer

The storageRequireEncryption setting conflicts with BitLocker.

Question 8

Refer to the exhibit. You run the PowerShell cmdlet in Microsoft Graph to list managed Windows devices. The output shows that several devices have a complianceState of 'noncompliant' but lastSyncDateTime is recent. What is the most likely reason for noncompliance?

Accepted Answer

The devices do not meet the assigned compliance policies.. A device's complianceState is determined by evaluating its configuration against assigned compliance policies. Even if lastSyncDateTime is recent, the device will be marked 'noncompliant' if it fails any of the policy checks (e.g., missing required updates, encryption not enabled, or a required antivirus solution not running). The sync timestamp only indicates when the device last communicated with Intune, not whether it meets policy requirements.

Answer

The devices are running a non-Windows OS.

Answer

The devices have not synced recently.

Answer

The admin lacks permissions to view compliance details.

Question 9

Refer to the exhibit. The JSON snippet shows a Windows Update for Business policy assigned to a device group. Users report that quality updates are installed 7 days after release. Which setting controls this behavior?

Accepted Answer

qualityUpdateDeferralPeriodInDays. The setting `qualityUpdateDeferralPeriodInDays` controls how long quality updates (security fixes) are deferred after release. A value of 7 means updates are installed 7 days post-release, matching the user report. This is a Windows Update for Business policy configured via CSP (Policy CSP - Update).

Answer

featureUpdateDeferralPeriodInDays

Answer

businessReadyUpdatesOnly

Answer

automaticUpdateMode

Question 10

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Windows Update for Business policy is not applying to some devices. You verify the devices are assigned the correct update ring. What should you check first?

Accepted Answer

Ensure the Windows Update service is not disabled on the devices.. The Windows Update for Business policy requires the Windows Update service to be enabled. If the service is disabled, updates cannot be applied regardless of update ring assignment. Option A is incorrect: increasing sync frequency may speed up policy delivery but does not prevent the policy from applying; the issue is likely a service issue, not sync timing. Option B is incorrect: device compliance policies are separate from update rings; non-compliant devices can still receive update policies. Option D is incorrect: the Intune Management Extension is used for Win32 app deployment, not for Windows Update policy; update rings rely on the Windows Update service directly.

Answer

Increase the sync frequency for the devices.

Answer

Check if the devices are compliant with device compliance policies.

Answer

Verify the Intune Management Extension is installed.

Question 11

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps can be installed on corporate-owned devices. Which configuration profile type should you use?

Accepted Answer

Device restrictions profile with 'Allow app installation from App Store only' set to 'Block'.. The 'Device restrictions profile' in Microsoft Intune includes the 'Allow app installation from App Store only' setting. Setting this to 'Block' prevents users from installing apps from the App Store, effectively restricting installations to only those apps that are deployed through Intune as managed apps or volume-purchased apps. This ensures that only approved apps can be installed on corporate-owned iOS/iPadOS devices.

Answer

Email profile.

Answer

Device features profile.

Answer

Apple Configurator enrollment profile.

Question 12

You need to deploy a line-of-business (LOB) app to Windows 10 devices managed by Intune. The app is a .msi file. Which app type should you select when adding the app in Intune?

Accepted Answer

Windows line-of-business app. The correct app type for deploying a line-of-business (LOB) .msi file to Windows 10 devices managed by Intune is 'Windows line-of-business app'. This app type is specifically designed for sideloading enterprise LOB apps that are not distributed through the Microsoft Store, and it supports .msi and .appx file formats. It uses Intune's built-in LOB deployment channel, which handles the app package directly without requiring the Win32 app preparation tool or complex detection rules.

Answer

Microsoft Store app

Answer

Web link

Answer

Windows app (Win32)

Question 13

Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile in Device restrictions.. The correct policy type is an Endpoint Protection profile within Device restrictions, because BitLocker settings for Windows 10/11 devices managed by Intune are configured under the 'Windows Encryption' category of an Endpoint Protection profile. This profile directly controls BitLocker drive encryption, including encryption method, recovery key management, and silent encryption enforcement, which is required for the scenario.

Answer

Device configuration profile with Administrative Templates.

Answer

Device compliance policy.

Answer

Windows Update ring policy.

Question 14

Users report that their Android Enterprise fully managed devices are not receiving email profiles pushed from Intune. You confirm the devices are enrolled and show as compliant. What is the most likely cause?

Accepted Answer

The 'Android Device Policy' app is not set to 'Required' in the app assignment.. For Android Enterprise fully managed devices, the Android Device Policy app must be deployed as a required app assignment to the device. Without this assignment, the device lacks the necessary app to receive and apply email profiles pushed from Intune. The app configuration policy does not make the app required; instead, the app must be assigned as required via Intune app deployment.

Answer

The devices are using work profile instead of fully managed.

Answer

The devices are not compliant with the compliance policy.

Answer

A device restrictions profile blocks the email app.

Question 15

You need to remotely wipe a lost corporate-owned iOS device that is managed by Intune. Which action should you use?

Accepted Answer

Wipe. The 'Wipe' action in Microsoft Intune performs a factory reset on a corporate-owned iOS device, removing all data and settings to protect sensitive information. This is the appropriate action for a lost device because it restores the device to its out-of-box state, ensuring no corporate data remains accessible.

Answer

Reset

Answer

Delete

Answer

Retire