MD-102 Manage and maintain devices Practice Test 11 — 15 Questions

Question 1

You need to configure a Windows 10 device to automatically install updates from a specific branch readiness level. Which setting in the Update ring policy should you configure?

Accepted Answer

Branch readiness level. The Branch readiness level setting in an Update ring policy directly controls which Windows Insider or semi-annual channel (e.g., Preview, Broad) a device receives updates from, determining the specific branch readiness level for automatic updates. This is the correct setting to configure when you need to specify a branch readiness level for automatic installation.

Answer

Automatic update behavior

Answer

Quality update deferral period

Answer

Feature update deferral period

Question 2

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

Accepted Answer

Add as a macOS line-of-business app.. The recommended method to deploy a .pkg app to macOS devices managed by Microsoft Intune is to add it as a macOS line-of-business (LOB) app. This app type is specifically designed for deploying macOS installer packages (.pkg) and requires the file to be uploaded directly to Intune, which then pushes the installation to enrolled devices using the Intune management agent for macOS.

Answer

Add as a Windows line-of-business app.

Answer

Add as a macOS web app.

Answer

Add as a Microsoft Store app.

Question 3

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 4

Which THREE actions can you perform on a managed device from the Microsoft Intune admin center?

Accepted Answer

Change the primary user. The Microsoft Intune admin center supports several remote actions on managed devices. Changing the primary user (A), Restart (C), and Sync (D) are all valid remote actions. Options B (Change the enrolled user) and E (Change the device name) are not available remotely.

Answer

Change the enrolled user

Answer

Change the device name

Question 5

Which THREE are supported reporting options in Microsoft Intune for device compliance?

Accepted Answer

Export compliance data to CSV. Microsoft Intune allows administrators to export compliance data to a CSV file from the compliance dashboard. This is a supported reporting option that enables offline analysis and archival of device compliance status.

Answer

Real-time compliance dashboard

Answer

Scheduled email reports

Question 6

Which TWO are valid methods to enroll Windows devices in Microsoft Intune?

Accepted Answer

Manual enrollment using work or school account. Manual enrollment using a work or school account is a standard Intune enrollment method where users sign in with their Azure AD credentials on the Windows device, which triggers automatic MDM enrollment via the Enrollment Status Page (ESP) and the MDM enrollment URL (https://enrollment.manage.microsoft.com). This method works for both Azure AD joined and hybrid Azure AD joined devices, and it is the most common fallback when automated methods like Autopilot are not used.

Answer

Apple Business Manager

Answer

Android Enterprise

Answer

Azure AD Join

Question 7

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. The ComplianceState property in Microsoft Intune reflects the compliance status at the time of the last device check-in. If a device has not synced for 7 days, the stored ComplianceState is stale and may no longer represent the actual compliance posture. The device could have become non-compliant since its last sync due to policy changes, missing updates, or configuration drift, but Intune will not update the state until the next successful sync.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

Question 8

Refer to the exhibit. You are reviewing a Windows 10 update ring configuration JSON. What does the 'automaticUpdateBehavior' setting control?

Accepted Answer

Whether updates are installed automatically and if the user can control reboot timing. The 'automaticUpdateBehavior' setting in a Windows 10 update ring configuration JSON controls whether updates are downloaded and installed automatically, and whether the user can control reboot timing. When set to 'autoInstallAndRebootWithNoUserControl', updates install automatically and reboots occur without user interaction; when set to 'autoInstallAndRebootWithUserControl', the user can schedule or postpone reboots. This directly matches option C, as it governs both automatic installation and reboot control.

Answer

The level of update notifications

Answer

How long to defer feature updates

Answer

The branch readiness level

Question 9

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the Start menu layout resets to default every time they sign in. Which Intune policy setting is most likely causing this issue?

Accepted Answer

Start layout policy under Device Restrictions. The Start layout policy under Device Restrictions (D) is the most likely cause because it enforces a specific Start menu configuration on Windows 11 devices. When this policy is set to 'Enabled' and configured with a layout XML, it reapplies the layout at every user sign-in, overriding any user customizations. This behavior matches the reported issue of the Start menu resetting to default after a recent update.

Answer

Import Microsoft Edge assets policy

Answer

Show 'Recommended' section policy

Answer

Allow pinned folders policy

Question 10

You are designing a Windows 11 update strategy for a fleet of 500 devices managed by Intune. The organization requires that critical security updates be applied within 7 days, but feature updates can be delayed up to 60 days. Which Update Rings configuration should you use?

Accepted Answer

Create an Update Ring with quality update deferral of 7 days and feature update deferral of 60 days. Update Rings in Intune allow you to independently configure deferral periods for quality updates (security fixes) and feature updates. Setting quality update deferral to 7 days ensures critical security patches are applied within the required window, while feature update deferral of 60 days delays non-security feature updates as needed, all managed via cloud-based Windows Update for Business policies.

Answer

Assign a Quality Update policy with deferral of 7 days

Answer

Configure Windows Update for Business via Group Policy on-premises

Answer

Assign a Feature Update policy with deferral of 60 days

Question 11

A user reports that their Microsoft Intune enrolled device is not receiving required compliance policies. The device shows as 'Not evaluated' in the Microsoft Intune admin center. What is the most likely cause?

Accepted Answer

The Intune Management Extension is not installed. When the Intune Management Extension is not installed, the device cannot process compliance policies, resulting in a 'Not evaluated' status. Option A (No internet) would typically show as 'Not compliant' or 'Unknown'. Option C (No license) would prevent enrollment, so the device wouldn't be enrolled. Option D (Not enrolled) would show as 'Not enrolled', not 'Not evaluated'.

Answer

The device is not connected to the internet

Answer

The user does not have an Intune license assigned

Answer

The device is not enrolled in Intune

Question 12

You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?

Accepted Answer

OS version is above the maximum allowed. The compliance policy in the exhibit specifies a maximum OS version of 10.0.22621.1000, but the Windows 11 device is running build 10.0.22621.1500, which is above that maximum. Intune compares the device's OS version against the configured maximum OS version setting; if the device's version exceeds the maximum, it is marked as noncompliant. This setting is used to prevent devices with newer, potentially untested builds from accessing corporate resources.

Answer

Password minimum length is not met

Answer

Device threat protection level is below medium

Answer

TPM is not present

Question 13

You are troubleshooting a user's Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is managed by Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The certificate is issued by your internal CA. The device shows 'No internet access' though it connects. What is the most likely issue?

Accepted Answer

The root CA certificate is not deployed to the device. The device connects to the Wi-Fi network but shows 'No internet access,' indicating the SSID and connectivity are functional. With SCEP certificate authentication, the client must trust the issuing CA's root certificate to validate the server-side certificate during the EAP-TLS handshake. If the root CA certificate is not deployed to the device via Intune, the certificate chain cannot be verified, causing the connection to fail at the authentication layer even though the Wi-Fi association succeeds.

Answer

The SSID in the profile is incorrect

Answer

The user does not have an Intune license

Answer

The Wi-Fi profile is not assigned to the device

Question 14

You need to ensure that all iOS devices enrolled in Intune automatically install required apps (e.g., Microsoft Outlook, Teams) during enrollment. Which enrollment profile setting should you configure?

Accepted Answer

Install required apps during enrollment. The 'Install required apps during enrollment' setting in an iOS enrollment profile directs Intune to push mandatory apps (like Outlook and Teams) to the device as part of the Automated Device Enrollment (ADE) process. This leverages the Device Enrollment Program (DEP) workflow to install apps before the user gains full access, ensuring compliance with corporate policies from the outset.

Answer

Apple Volume Purchase Program token

Answer

Company Portal branding

Answer

Device type restriction

Question 15

You manage Windows 10 devices with Intune. You need to collect diagnostic logs from a remote device that is experiencing application crashes. Which Intune feature should you use?

Accepted Answer

Collect diagnostics. The 'Collect diagnostics' feature in Intune allows you to remotely gather diagnostic logs from Windows 10 devices without user interaction. This is the correct tool for troubleshooting application crashes because it collects system logs, event logs, and crash dumps directly from the device via the Intune management channel, enabling analysis of the failure.

Answer

Company Portal app

Answer

Autopilot Reset

Answer

Windows Update for Business