MD-102 Manage and maintain devices Practice Test 11 — 15 Questions

Question 1

You need to provide remote assistance to a Windows 11 device managed by Intune. The user is not technically savvy. Which Intune feature should you use?

Accepted Answer

TeamViewer integration in Intune.. TeamViewer integration in Intune allows an IT admin to initiate a remote assistance session directly from the Intune admin center, without requiring the user to install additional software or share a session code. This is ideal for non-technical users because the admin can start the session, and the user only needs to accept a consent prompt on their device.

Answer

Company Portal.

Answer

Quick Assist.

Answer

Remote Desktop connection.

Question 2

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Accepted Answer

Create a device compliance policy that checks for required settings.. Option D is correct because a device compliance policy in Intune defines the rules a device must meet (for example, BitLocker enabled, minimum OS version, or no jailbreak) and marks the device as compliant or non-compliant, which is the prerequisite signal that conditional access evaluates. Option E is correct because a Microsoft Entra ID conditional access policy targeting Exchange Online (the Office 365 Exchange Online cloud app) with the grant control 'Require device to be marked as compliant' is what actually blocks non-compliant devices from accessing corporate email. Together, D supplies the compliance state and E enforces it at authentication time for Exchange Online. Option A is not correct because an Exchange Active Sync policy in Intune controls mailbox-level EAS settings such as password requirements and sync restrictions, but it does not itself gate access based on device compliance. Option B is not correct because a device configuration profile only applies settings to devices; it does not evaluate compliance or block access. Option C is not correct because an app protection policy for Outlook protects corporate data within the app (PIN, encryption, selective wipe) but does not require the device itself to be compliant for Exchange Online access.

Answer

Configure an Exchange Active Sync policy in Intune.

Answer

Create a device configuration profile to enforce security settings.

Answer

Deploy an app protection policy for Outlook for iOS and Android.

Question 3

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Accepted Answer

Create a Windows 10 feature update deployment policy.. Option A is correct because deploying a Windows 10 feature update in Intune requires creating a Feature updates for Windows 10 and later policy (under Devices > Windows > Update rings or Feature updates), which defines the target Windows version such as Windows 10 22H2. Option B is correct because the deployment must be scoped to an Microsoft Entra ID group containing the test devices, since Intune assignments are group-based and the feature update policy only applies to devices in the targeted group. Option E is correct because after creating the feature update policy, you must assign it to the test device group (the same group referenced in B) for the update to be offered to those devices. Option C is not required because a device compliance policy enforces conditional access and configuration rules, not feature update deployment. Option D is not required because an update ring with expedited updates is used for quality updates and expedited patching, not for deploying a specific feature update version.

Answer

Create a device compliance policy for the target version.

Answer

Create a Windows 10 update ring with expedited updates.

Question 4

Which TWO troubleshooting steps should you take when a Windows 11 device fails to enroll in Intune with error code 0x80180014?

Accepted Answer

Check if the device is already enrolled in another MDM provider.. Error 0x80180014 is the Intune/MDM enrollment failure code that typically indicates the device is already managed by another MDM provider or the user lacks a valid Intune license, so option C is correct because an existing MDM enrollment (for example, a leftover ConfigMgr or third-party MDM record) blocks a new Intune enrollment and must be removed via Settings > Accounts > Access work or school or by clearing the MDM enrollment key. Option D is also correct because Intune enrollment requires the user to hold an Intune license (for example, Microsoft 365 E3/E5, EMS E3/E5, or an Intune standalone license); without it, the service rejects the enrollment with 0x80180014. Option A is not correct because enrollment profile groups (Autopilot deployment profiles or enrollment restrictions) affect targeting and device group membership, not this specific error code. Option B is not correct because compliance policies are evaluated after enrollment and do not cause 0x80180014. Option E is not correct because TPM 2.0 is a prerequisite for features like Windows Hello for Business or Autopilot, but a missing TPM does not produce this enrollment error.

Answer

Ensure that the device is in the correct enrollment profile group.

Answer

Recreate the device compliance policy.

Answer

Check if the device has TPM 2.0 enabled.

Question 5

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

Accepted Answer

Restart the Microsoft Intune Management Extension service on the device.. The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Answer

Unenroll and re-enroll the device.

Answer

Verify that the device is compliant with BitLocker encryption requirements.

Answer

Check the device's compliance policy assignment.

Question 6

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

Accepted Answer

Set 'Allow application store' to 'Block' for non-admin users.. The 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Answer

Enable 'Private store only' in Microsoft Store for Business settings.

Answer

Disable 'Automatic app updates' in the device restriction policy.

Answer

Configure 'Require a password for app purchases' to 'Yes'.

Question 7

A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?

Accepted Answer

Device compliance policy.. Device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level. Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.

Answer

Device configuration policy (settings catalog).

Answer

Conditional Access policy.

Answer

App protection policy.

Question 8

You have a Windows 11 device that is co-managed with Configuration Manager and Microsoft Intune. After migrating the Windows Update workload to Intune, users report that they can still manually check for updates in Windows Settings and install optional driver and firmware updates that are not signed by Microsoft. You need to prevent users from installing these optional updates. Which setting should you configure in Intune?

Accepted Answer

Set 'Allow non-Microsoft signed updates' to 'Block'.. Setting 'Allow non-Microsoft signed updates' to 'Block' directly prevents users from installing the optional driver and firmware updates that are not signed by Microsoft, which are precisely the updates described in the scenario. Option A changes notification behavior, Option B defers quality updates, and Option D redirects to WSUS, none of which block optional updates.

Answer

Set 'Configure Automatic Updates' to '2 - Notify for download and notify for install'.

Answer

Set 'Defer quality updates' to '30 days'.

Answer

Set 'Specify intranet Microsoft update service location' to point to WSUS.

Question 9

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

Accepted Answer

Remove work profile. The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Answer

Wipe

Answer

Retire

Answer

Delete

Question 10

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

Accepted Answer

The user is blocked by a Conditional Access policy due to sign-in risk.. The user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Microsoft Entra ID Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Answer

The app protection policy is misconfigured.

Answer

The device model is blocked by a Conditional Access policy.

Answer

The device is not compliant with the compliance policy.

Question 11

Which TWO actions can you perform using the Microsoft Intune admin center to manage a Windows device that is enrolled in Intune?

Accepted Answer

Restart the device. The Microsoft Intune admin center provides a 'Restart' remote action that triggers a reboot on a managed Windows device. This action is useful for applying pending updates or troubleshooting without requiring end-user interaction, and it leverages the Intune management extension to execute the restart command.

Answer

Format the hard disk

Answer

Install a printer driver

Answer

Change BIOS settings

Question 12

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Accepted Answer

Device compliance policy. Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

Windows update ring

Question 13

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

Accepted Answer

Use the 'Update Immediately' setting in the Windows Update for Business policy.. The 'Update Immediately' setting in the Windows Update for Business policy forces devices to check for and install updates immediately, overriding the configured deadline. Option A is incorrect because restarting alone does not trigger installation of pending updates. Option B is incorrect because reassigning the update ring does not affect the urgency of already applied policies. Option D is incorrect because increasing the deadline would allow more delay, not cause immediate installation.

Answer

Ask users to restart their devices.

Answer

Reassign the update ring to a broader device group.

Answer

Increase the 'Quality update deadline' to 3 days.

Question 14

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

Accepted Answer

Remote lock. The Remote lock action in Microsoft Intune allows an administrator to remotely lock a device and display a custom message on the lock screen, such as a phone number to call if found. This is exactly what is needed for lost or stolen devices. Remote lock is supported on iOS devices and does not erase data, making it ideal for this scenario.

Answer

Reset passcode

Answer

Wipe

Answer

Retire

Question 15

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. Users report that after a recent update, their devices are stuck at the login screen and cannot access corporate resources. You suspect a configuration conflict. Which action should you take first to restore device functionality without affecting other settings?

Accepted Answer

Use the Test and remediate feature to apply a temporary configuration to a subset of devices.. The correct first action is to use the 'Test and remediate' feature in Intune, which allows you to apply a temporary configuration to a test group of devices to identify and resolve conflicts without affecting the broader device population. This approach isolates the issue, preserves existing settings, and provides a controlled rollback if needed, aligning with best practices for troubleshooting configuration conflicts in Intune-managed Windows devices.

Answer

Create a new device configuration profile that overrides the conflicting settings.

Answer

Reset the devices remotely using Intune.

Answer

Perform a selective wipe on the affected devices.