MD-102 Manage and maintain devices Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. The JSON snippet shows a Windows Update for Business policy assigned to a device group. Users report that quality updates are installed 7 days after release. Which setting controls this behavior?

Accepted Answer

qualityUpdateDeferralPeriodInDays. Option C is correct because qualityUpdateDeferralPeriodInDays is set to 7, deferring quality updates by 7 days. Option A is wrong because featureUpdateDeferralPeriodInDays controls feature updates. Option B is wrong because automaticUpdateMode controls restart behavior. Option D is wrong because businessReadyUpdatesOnly controls which updates are offered.

Answer

featureUpdateDeferralPeriodInDays

Answer

businessReadyUpdatesOnly

Answer

automaticUpdateMode

Question 2

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Windows Update for Business policy is not applying to some devices. You verify the devices are assigned the correct update ring. What should you check first?

Accepted Answer

Ensure the Windows Update service is not disabled on the devices.. Option C is correct because the Windows Update for Business policy requires Windows Update service to be enabled. If it's disabled, updates won't apply. Option A is wrong because compliance policies don't block update rings. Option B is wrong because the Intune Management Extension is for Win32 apps, not updates. Option D is wrong because sync interval doesn't prevent policy application.

Answer

Increase the sync frequency for the devices.

Answer

Check if the devices are compliant with device compliance policies.

Answer

Verify the Intune Management Extension is installed.

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps can be installed on corporate-owned devices. Which configuration profile type should you use?

Accepted Answer

Device restrictions profile with 'Allow app installation from App Store only' set to 'Block'.. Option B is correct because a device restrictions profile with 'Allow app installation from App Store only' and a compliant apps policy can restrict apps. Option A is wrong because the Apple Configurator enrollment profile is for device enrollment, not app control. Option C is wrong because the Device Features profile manages settings like wallpaper. Option D is wrong because the Email profile configures mail settings.

Answer

Email profile.

Answer

Device features profile.

Answer

Apple Configurator enrollment profile.

Question 4

You need to deploy a line-of-business (LOB) app to Windows 10 devices managed by Intune. The app is a .msi file. Which app type should you select when adding the app in Intune?

Accepted Answer

Windows line-of-business app. Option C is correct because Windows line-of-business apps are used for .msi files. Option A is wrong because Windows app (Win32) is for .exe or .intunewin files. Option B is wrong because Microsoft Store app is for store apps. Option D is wrong because Web link is for web apps.

Answer

Microsoft Store app

Answer

Web link

Answer

Windows app (Win32)

Question 5

Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile in Device restrictions.. Option A is correct because BitLocker settings are configured in the Endpoint Protection profile under device restrictions. Option B is wrong because the Update ring policy manages Windows Update settings. Option C is wrong because the Device compliance policy evaluates compliance but does not enforce BitLocker. Option D is wrong because the Device configuration profile for 'Administrative Templates' can include BitLocker, but the standard method is the Endpoint Protection profile.

Answer

Device configuration profile with Administrative Templates.

Answer

Device compliance policy.

Answer

Windows Update ring policy.

Question 6

Users report that their Android Enterprise fully managed devices are not receiving email profiles pushed from Intune. You confirm the devices are enrolled and show as compliant. What is the most likely cause?

Accepted Answer

The 'Android Device Policy' app is not set to 'Required' in the app configuration policy.. Option B is correct because the Android Enterprise system app 'Android Device Policy' must be set to 'Required' in the app configuration policy. Without it, profiles may not apply. Option A is wrong because compliance does not affect profile delivery. Option C is wrong because the device restrictions profile does not block email profiles. Option D is wrong because work profile vs fully managed is a separate enrollment method; profiles should work on fully managed devices.

Answer

The devices are using work profile instead of fully managed.

Answer

The devices are not compliant with the compliance policy.

Answer

A device restrictions profile blocks the email app.

Question 7

You need to remotely wipe a lost corporate-owned iOS device that is managed by Intune. Which action should you use?

Accepted Answer

Wipe. Option C is correct because the 'Wipe' action performs a factory reset. Option A is wrong because 'Retire' removes management but keeps user data. Option B is wrong because 'Delete' removes the device from Intune without wiping. Option D is wrong because 'Reset' is not a standard Intune action; the correct term is 'Wipe'.

Answer

Reset

Answer

Delete

Answer

Retire

Question 8

You need to configure a Windows 10 device to automatically install updates from a specific branch readiness level. Which setting in the Update ring policy should you configure?

Accepted Answer

Branch readiness level. Option A is correct because 'Branch readiness level' defines which updates the device receives (e.g., Windows Insider, Semi-Annual Channel). Option B is wrong because 'Quality update deferral period' delays updates but does not set branch. Option C is wrong because 'Feature update deferral period' delays feature updates. Option D is wrong because 'Automatic update behavior' controls installation behavior.

Answer

Automatic update behavior

Answer

Quality update deferral period

Answer

Feature update deferral period

Question 9

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

Accepted Answer

Add as a macOS line-of-business app.. Option B is correct because macOS LOB apps support .pkg files. Option A is wrong because macOS web apps are for web links. Option C is wrong because Windows LOB app is for Windows devices. Option D is wrong because Microsoft Store app is for Windows.

Answer

Add as a Windows line-of-business app.

Answer

Add as a macOS web app.

Answer

Add as a Microsoft Store app.

Question 10

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Option B is correct because Conditional Access with device compliance evaluates compliance. Option A is wrong because a compliance policy defines compliance but does not enforce access. Option C is wrong because a device configuration profile configures settings. Option D is wrong because an app protection policy manages app-level protection.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 11

Which TWO actions can you perform on a managed device from the Microsoft Intune admin center?

Accepted Answer

Restart the device. Option A and D are correct. A: You can sync a device to force a check-in. D: You can restart a device remotely. Option B is wrong because you cannot change the primary user from the device blade; you need to re-enroll. Option C is wrong because you cannot change the device name for corporate-owned devices; it's usually auto-generated. Option E is wrong because you cannot change the enrolled user; you need to wipe and re-enroll.

Answer

Change the primary user

Answer

Change the enrolled user

Answer

Change the device name

Question 12

Which THREE are supported reporting options in Microsoft Intune for device compliance?

Accepted Answer

Export compliance data to CSV. Options A, B, and D are correct. A: You can export compliance reports to CSV. B: You can view compliance status per device. D: You can view compliance trends over time. Option C is wrong because Intune does not have a built-in dashboard for real-time compliance; it updates periodically. Option E is wrong because you cannot schedule automatic email reports natively; you would need Power Automate.

Answer

Real-time compliance dashboard

Answer

Scheduled email reports

Question 13

Which TWO are valid methods to enroll Windows devices in Microsoft Intune?

Accepted Answer

Manual enrollment using work or school account. Options A and D are correct. A: Windows Autopilot is a modern enrollment method. D: Manual enrollment via Settings > Accounts > Access work or school is valid. Option B is wrong because Apple Business Manager is for Apple devices. Option C is wrong because Android Enterprise is for Android. Option E is wrong because Azure AD Join is a prerequisite, not an enrollment method.

Answer

Apple Business Manager

Answer

Android Enterprise

Answer

Azure AD Join

Question 14

Refer to the exhibit. You are reviewing a Windows 10 compliance policy JSON. What is the purpose of the 'osMinimumVersion' setting?

Accepted Answer

It defines the minimum OS build version that the device must have to be compliant.. Option B is correct because osMinimumVersion specifies the minimum OS build version required for compliance. Option A is wrong because it does not enforce automatic updates. Option C is wrong because it does not check the update ring. Option D is wrong because it does not require a specific feature update; it's a build number.

Answer

It sets the Windows Update for Business ring to that version.

Answer

It requires the device to be on a specific feature update.

Answer

It forces the device to update to that version.

Question 15

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. Option C is correct because compliance state is evaluated during the last sync; if the device hasn't synced, the state may be outdated. Option A is wrong because compliance state does not trigger sync. Option B is wrong because the policy may still apply. Option D is wrong because the device is still enrolled.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

MD-102 Manage and maintain devices Practice Test 10 — 15 Questions

Exhibit

MD-102 Manage and maintain devices Practice Test 10 — 15 Questions

Exhibit