MD-102 Manage and maintain devices Practice Test 10 — 15 Questions

Question 1

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved apps can be installed on corporate devices. Which policy type should you configure?

Accepted Answer

App Protection Policy with 'Allow only managed apps' setting.. App Protection Policies (APP) in Microsoft Intune control which apps can access corporate data on iOS devices. The 'Allow only managed apps' setting restricts data transfer and app usage to apps that are managed by Intune, effectively preventing installation of unapproved apps. This is the appropriate policy for enforcing approved app installation on corporate devices.

Answer

Device Configuration Profile with 'Allow app installation only from App Store' setting.

Answer

App Configuration Policy to restrict app installation.

Answer

Device Compliance Policy with 'Require approved apps' setting.

Question 2

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

Accepted Answer

Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.. Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Answer

Create a device configuration profile with a custom OMA-URI setting to execute the script.

Answer

Use a device compliance policy to trigger the script when noncompliant.

Answer

Use Intune proactive remediations and configure the script to run as a detection script.

Question 3

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

Accepted Answer

Selective wipe from the Intune console.. A selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Answer

Full wipe from the Intune console.

Answer

Delete the device from Microsoft Entra ID.

Answer

Retire the device from Intune.

Question 4

Refer to the exhibit. You are creating a device filter in Microsoft Intune to target a policy to Windows 10 Pro devices. The filter should only apply to devices running OS build 1904x (20H1 or later). However, some devices with build 1904x and SKU Professional are not receiving the policy. What is the most likely reason?

Accepted Answer

The device.skuFamily property value is case-sensitive and may not match 'Professional'.. The `device.skuFamily` property in Microsoft Intune is case-sensitive. When creating a device filter rule, the value 'Professional' must exactly match the case of the SKU family string returned by the device. If the actual SKU family is reported as 'Professional' with a different casing (e.g., 'professional' or 'PROFESSIONAL'), the filter will not match, causing the policy not to apply to those devices.

Answer

The -startsWith operator does not work for osVersion property.

Answer

The device must be enrolled via Autopilot for filters to apply.

Answer

The filter rule syntax is incorrect because of the parentheses.

Question 5

You need to configure Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. What is the recommended method to onboard devices?

Accepted Answer

Use a device configuration profile in Intune to deploy the onboarding package.. Intune's device configuration profiles allow you to deploy the Defender for Endpoint onboarding package (a .zip containing the onboarding script and required files) directly to Windows 10 devices. This method is recommended as it integrates seamlessly with Intune's management framework, supports bulk deployment via policies, and ensures devices are properly configured without manual intervention or user interaction.

Answer

Install the Defender for Endpoint client manually on each device.

Answer

Use the Microsoft 365 Defender portal to generate a script that users run.

Answer

Use Group Policy to configure the onboarding registry keys.

Question 6

Which TWO actions should you take to ensure that Windows Update for Business settings are applied to all Windows 10 devices in your organization? (Choose two)

Accepted Answer

Create an update ring policy in Microsoft Intune.. B is correct because Windows Update for Business (WUfB) policies are configured through update ring policies in Microsoft Intune, which control how and when Windows 10 devices receive updates from Microsoft's update servers. This allows organizations to manage update deployment without needing on-premises infrastructure like WSUS.

Answer

Configure a WSUS server to synchronize updates.

Answer

Enable peer-to-peer content sharing for Windows updates.

Answer

Create a device compliance policy to enforce update installation.

Question 7

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are planning to upgrade them to Windows 11. The devices must meet the Windows 11 hardware requirements. You need to identify which devices are eligible for upgrade and then deploy Windows 11 using a feature update policy in Intune. You have the following requirements: (1) Generate a report of devices that are not eligible due to TPM 2.0 or CPU incompatibility. (2) Deploy Windows 11 to eligible devices using a phased approach: first to IT department (200 devices), then to pilot users (500 devices), and finally to all remaining devices. (3) Ensure that devices in the IT department receive the update within 7 days of Microsoft's release, while pilot users receive it after 30 days, and remaining devices after 60 days. (4) Monitor deployment progress and roll back if critical issues are detected. What should you do?

Accepted Answer

Create feature update policies for Windows 10 and later, targeting each group with appropriate deferral settings. Use the Windows 11 readiness report to identify eligible devices.. Feature update policies in Intune (Windows 10 and later) are the native mechanism for deploying Windows 11 upgrades, and they support deferral settings per policy so different groups can receive the update at different times. The Windows 11 readiness report in Intune's Endpoint Analytics surfaces devices that fail TPM 2.0, CPU, or other hardware checks, satisfying the eligibility reporting requirement. Targeting separate policies at IT, pilot, and remaining groups with 0/30/60-day deferrals maps directly to the phased rollout.

Answer

Configure Windows Update for Business group policies in on-premises AD.

Answer

Use update rings with different deferral periods for each group.

Answer

Use Windows Autopilot to deploy Windows 11 images to devices.

Question 8

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

Accepted Answer

Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.. Deploying a staging server (or an Microsoft Entra Connect staging server) allows the initial device synchronization to Microsoft Entra ID to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Answer

Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

Answer

Use Windows Autopilot to reset the devices and enroll them in Intune.

Answer

Manually enroll each device by signing in to the Company Portal.

Question 9

You need to deploy a critical security update to 500 Windows 10 devices managed by Intune. The update must be installed by the end of the week. Which deployment method should you use?

Accepted Answer

Create a Windows 10 update ring in Intune and enable expedited quality updates.. Intune's expedited quality updates allow you to bypass standard deferral periods and force-install critical security updates within days, not weeks. This is the only method that guarantees installation by the end of the week for 500 devices managed solely by Intune, as it leverages the Windows Update service with a reduced deadline (e.g., 2 days) and immediate restart behavior.

Answer

Configure a Windows Update for Business deferral policy in Intune.

Answer

Use Windows Autopatch to automatically deploy the update.

Answer

Create a WSUS policy and push it via Group Policy.

Question 10

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

Accepted Answer

Configure a selective wipe policy.. A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Answer

Configure a compliance policy to mark the device as noncompliant.

Answer

Configure a remote lock action.

Answer

Configure a full wipe action.

Question 11

You have a Windows 11 device enrolled in Intune that is not receiving configuration profiles. The device shows 'Pending' status for all profiles. You confirm the device is connected to the internet and can reach Microsoft's servers. What is the most likely cause?

Accepted Answer

The device is not syncing with Intune.. If the device is not syncing, it will show 'Pending'. Option A is wrong because group membership is for assignment, not sync. Option B is wrong because certificate issues affect authentication, not profile delivery. Option D is wrong because the Intune service health is for global issues, not a single device.

Answer

The device is not in the correct security group for the profile assignment.

Answer

The device has a certificate issue preventing it from receiving profiles.

Answer

The Intune service is experiencing an outage.

Question 12

You are troubleshooting a Windows 11 device that fails to receive a PowerShell script deployed via Intune. The script is assigned to a group containing the device. Other policies on the device apply successfully. What should you check first?

Accepted Answer

Check the Windows PowerShell execution policy on the device.. The Windows PowerShell execution policy controls whether scripts can run on the device. Even if the script is successfully delivered by Intune, a restrictive execution policy (e.g., Restricted) will block its execution. Since other policies apply successfully, connectivity and group membership are not the issue, making the execution policy the most likely cause.

Answer

Ensure the device has internet connectivity.

Answer

Check that the script is digitally signed.

Answer

Verify that the device is in the correct security group.

Question 13

You need to ensure that all corporate-owned Windows 11 devices automatically install critical security updates as soon as they are released by Microsoft. Which Intune feature should you configure?

Accepted Answer

Expedited quality updates in a Windows 10 update ring.. Expedited quality updates in a Windows 10 update ring allow you to push critical security updates immediately, bypassing any deferral periods or gradual rollout settings. This feature uses the Windows Update for Business service to force the installation of a specific update as soon as it is released by Microsoft, ensuring compliance with security requirements for corporate-owned devices.

Answer

A WSUS policy pushed via Group Policy.

Answer

Windows 10 update rings with a deferral period of 0 days.

Answer

Windows Autopatch.

Question 14

A user reports that their iOS device is unable to access corporate email after updating to a new iOS version. Other iOS devices are working fine. The device is enrolled in Intune and shows as compliant. What should you check?

Accepted Answer

Check the conditional access policy in Microsoft Entra ID to ensure the device platform is still supported.. When a device is compliant but still fails to access corporate email after an iOS update, the most likely cause is that the conditional access policy in Microsoft Entra ID (formerly Azure AD) has been updated to block the new iOS version. Conditional access policies can specify allowed device platforms and OS versions; if the new iOS version is not explicitly permitted, access will be denied even though the device is compliant. This is a common scenario after major OS updates, as administrators must update the policy to include the new version.

Answer

Ensure the email profile is configured correctly.

Answer

Confirm that the device is still enrolled in Intune.

Answer

Verify that the device compliance policy includes the new iOS version.

Question 15

You are planning to deploy a custom line-of-business (LOB) app to 200 Windows 11 devices using Intune. The app requires a specific registry key to be present before installation. What should you do?

Accepted Answer

Add a requirement rule to the app deployment that runs a PowerShell script to check for the registry key.. Intune's requirement rules allow you to run a PowerShell script that checks for the existence of a specific registry key before the app installs. If the script returns a non-zero exit code, Intune will not proceed with the installation, ensuring the prerequisite is met. This is the only option that directly enforces a precondition for the app installation without requiring additional apps or policies.

Answer

Add the app as a dependency for another app that creates the registry key.

Answer

Use an app configuration policy to set the registry key before the app installs.

Answer

Create a custom compliance policy to enforce the registry key.