MD-102 Manage and maintain devices Practice Test 12 — 15 Questions

Question 1

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.. Deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Answer

Modify the existing Windows Update for Business policy to set the deferral period to 0 days.

Answer

Create a compliance policy that requires the update to be installed and assign it to all devices.

Answer

Use Configuration Manager to push the update via on-premises WSUS.

Question 2

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

Accepted Answer

Create an App Protection Policy (MAM) that restricts the transfer of corporate data to other apps and a Device Configuration Profile that sets the default mail app to Outlook.. An App Protection Policy (MAM) applied to Outlook for iOS enforces controls such as blocking cut/copy/paste to unmanaged apps and requiring a PIN, effectively preventing corporate data from reaching the native Mail app. A device configuration profile that sets the default mail app to Outlook steers users to the sanctioned client. Together they satisfy the requirement to allow only Outlook for corporate email while blocking native Mail from corporate data.

Answer

Create a device compliance policy that requires the device to have Outlook installed.

Answer

Use device enrollment restrictions to block devices that have the native Mail app installed.

Answer

Create a conditional access policy for Exchange Online that blocks the native Mail app and allows only Outlook.

Question 3

You are an Intune administrator for a company that has recently deployed Windows 11 devices. Management wants to ensure that all devices are running the latest feature update (Windows 11 23H2) within 60 days of release. You need to configure a Windows Update for Business policy in Intune to achieve this goal. Which settings should you configure?

Accepted Answer

Set the feature update deferral period to 60 days and assign the policy to all devices.. Setting the feature update deferral period to 60 days in a Windows Update for Business policy ensures that devices will wait up to 60 days after Microsoft releases a feature update (e.g., Windows 11 23H2) before installing it. This meets the requirement of having all devices running the latest feature update within 60 days of release, as the deferral period defines the maximum delay from the release date. Assigning the policy to all devices ensures blanket coverage across the Windows 11 fleet.

Answer

Set the feature update deferral period to 60 days and pause updates for 30 days.

Answer

Set the feature update deadline to 60 days and assign the policy to a device group.

Answer

Set the feature update deferral period to 0 days and assign to all users.

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

Accepted Answer

Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.. The issue is likely a misconfiguration of the compliance policy assignment or evaluation. Android Enterprise work profile devices use file-based encryption by default, which Intune considers compliant. If devices are marked non-compliant despite encryption being enabled, you should verify that the compliance policy is correctly assigned to the target groups and re-evaluate the policy. Option A is incorrect because the work profile is already enabled on the device. Option B is incorrect because Intune cannot change the encryption method on Android devices; encryption type is device-specific. Option D is incorrect because device configuration profiles cannot enforce encryption on the work profile; encryption is managed by the device OS.

Answer

Enable the work profile on the devices via a device configuration profile.

Answer

Change the device encryption method to full-disk encryption using a device configuration profile.

Answer

Create a device configuration profile that enforces encryption on the work profile.

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs at every device startup to map network drives based on the user's security group membership. The script should run in the system context and should not require user interaction. How should you configure the script deployment in Intune?

Accepted Answer

Add the PowerShell script as a Windows PowerShell script in Intune, set the execution context to 'System', and configure the script to run at device startup.. Intune allows PowerShell scripts to run in the system context and be configured to run at device startup, fulfilling the requirement. Option A is incorrect because assigning the script to users and running at user logon does not run in the system context and requires user interaction. Option B is incorrect because Proactive remediations run on a schedule or on demand, not at startup. Option D is incorrect because device configuration profiles cannot execute scripts directly.

Answer

Add the script as a Windows PowerShell script in Intune and assign it to users, so it runs when users log in.

Answer

Use Proactive remediations in Intune to run the script on a schedule.

Answer

Create a device configuration profile that includes the script as a custom setting.

Question 6

Your organization uses Microsoft Intune to manage Windows 10 and iOS devices. You need to deploy a certificate-based authentication solution for Wi-Fi and VPN access. You have set up a Certificate Connector for Microsoft Intune and issued a root CA certificate. You have created a trusted certificate profile for the root CA and a SCEP certificate profile for client certificates. However, iOS devices are failing to enroll for client certificates. You verify that the SCEP profile is correctly configured and assigned. What is the most likely cause?

Accepted Answer

The SCEP profile does not reference the trusted certificate profile for the root CA, or the trusted certificate profile is not assigned to iOS devices.. For iOS SCEP enrollment in Intune, the SCEP certificate profile must chain to a trusted root CA certificate that is delivered to the device via a Trusted Certificate profile. If the SCEP profile does not reference the trusted certificate profile (or that trusted profile is not assigned to the iOS devices), the device cannot validate the SCEP server's issuing chain and enrollment fails silently. This is the most common cause of iOS SCEP failures in Intune.

Answer

The Certificate Connector is not configured to support iOS devices.

Answer

iOS devices require user affinity for SCEP enrollment, which is not configured.

Answer

The iOS devices are not compliant with the compliance policy.

Question 7

You need to deploy Windows updates to a group of devices using Microsoft Intune. Which TWO policies should you configure to ensure updates are applied within a maintenance window?

Accepted Answer

Windows 10 and later update ring. (Windows 10 and later update ring) is correct because update rings in Microsoft Intune allow you to configure a maintenance window by setting the 'Active hours start' and 'Active hours end' values, which define a period during which updates are deferred and applied outside of those hours. This ensures updates are installed only during the specified maintenance window, aligning with the requirement to control update timing.

Answer

Assignment filter

Answer

Device compliance policy

Answer

Windows 10 and later quality update

Question 8

You need to onboard devices to Microsoft Defender for Endpoint using Microsoft Intune. Which THREE methods are supported?

Accepted Answer

Group Policy with administrative templates. Option A is correct because Group Policy with administrative templates can be used to configure the Defender for Endpoint onboarding blob on domain-joined Windows devices, making it a supported onboarding method. Option C is correct because Intune's endpoint security policy for Microsoft Defender for Endpoint is a native Intune method that deploys the onboarding configuration to managed devices. Option E is correct because the Microsoft Defender for Endpoint onboarding configuration profile in Intune is another supported Intune-based method for onboarding devices. Option B is incorrect because the Microsoft 365 Apps admin center is used for managing Office app deployment and updates, not for Defender for Endpoint onboarding. Option D is incorrect because Windows Server Update Services (WSUS) is a patching and update distribution role and does not provide Defender for Endpoint onboarding.

Answer

Microsoft 365 Apps admin center

Answer

Windows Server Update Services

Question 9

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices with a passcode can access corporate resources. Which THREE configurations should you implement?

Accepted Answer

Device configuration profile with passcode settings. Option A is correct because a Device configuration profile with passcode settings lets you enforce passcode requirements (such as length, complexity, and timeout) directly on iOS/iPadOS devices via Intune, establishing the device-level passcode control needed to protect corporate resources. Option C is correct because a Conditional Access policy requiring compliant devices blocks access to corporate resources from any device that is not marked compliant, so devices without a passcode are denied access at the authentication/authorization layer. Option E is correct because a Device compliance policy with a passcode requirement defines the passcode rule that Intune evaluates; devices failing this rule are marked non-compliant, which then feeds into Conditional Access to enforce the access restriction. Option B is incorrect because Windows Autopilot deployment profiles only apply to Windows device provisioning and have no relevance to iOS/iPadOS passcode enforcement. Option D is incorrect because an App protection policy with a passcode for managed apps only protects app-level data within managed apps (via MAM) and does not enforce a device-level passcode or restrict overall device access to corporate resources as required by the scenario.

Answer

Windows Autopilot deployment profile

Answer

App protection policy with passcode for managed apps

Question 10

You manage devices at Fabrikam Inc. using Microsoft Intune. You have a Windows 11 device that is not compliant because it is missing a required application. The device shows as 'Not evaluated' in Intune for the compliance policy. The user reports that the device syncs manually but still shows as non-compliant. You have verified that the device is enrolled and policy is assigned. What should you do first to resolve the issue?

Accepted Answer

From the Intune console, select the device and run the 'Sync' action with the option 'Re-evaluate compliance policies'.. When a device shows 'Not evaluated' for compliance, the compliance state has not been recalculated on the device. Running the 'Sync' action with 'Re-evaluate compliance policies' from the Intune console forces the device to re-evaluate and report its compliance status immediately.

Answer

Verify that the user has a valid Microsoft 365 license.

Answer

Create a new compliance policy with the same requirements and assign it to the device.

Answer

Remove the device from Intune and re-enroll it.

Question 11

Adventure Works uses Microsoft Intune for device management. You need to deploy a custom PowerShell script to all Windows 10 devices to configure a registry key for security compliance. The script is already uploaded to Intune as a PowerShell script. However, the script is not running on some devices. You have confirmed that the devices are enrolled, have the Intune Management Extension installed, and are online. What should you check first?

Accepted Answer

Verify that the PowerShell execution policy on the devices allows script execution (e.g., RemoteSigned or Bypass).. The script execution policy may block scripts. The Intune Management Extension runs scripts under the system account, which respects the local execution policy. Checking the execution policy is the first step. The script assignment should be verified if it wasn't assigned, but the question states it is uploaded; assignment is a separate step. The user's role does not affect script execution. The device's OS architecture is unlikely the issue.

Answer

Check that the user has administrative privileges on the device.

Answer

Confirm that the device is running a 64-bit version of Windows.

Answer

Ensure the script is assigned to the device group.

Question 12

You manage a fleet of Windows 11 Enterprise devices enrolled in Microsoft Intune. A security policy requires that all devices receive quality updates no later than 3 days after release and feature updates no later than 60 days after release. You create a Windows Update ring and assign it to a pilot group of 50 devices. Users report that devices are still receiving updates immediately upon release and are installing feature updates within 10 days. You need to enforce the required deferral periods. What should you configure in the Windows Update ring?

Accepted Answer

Set the 'Quality update deferral period (days)' to 3 and the 'Feature update deferral period (days)' to 60.. Windows Update rings in Intune allow granular control over deferral periods for quality and feature updates. By setting the quality update deferral to 3 days and feature update deferral to 60 days, the pilot devices will receive updates after those periods, satisfying the security policy. Other options either use incorrect tools or settings that do not affect update timing.

Answer

Create a device configuration profile with the 'Update channel' setting set to Semi-Annual Channel.

Answer

Configure a Windows Update for Business policy via Group Policy and link it to the pilot group.

Answer

Set the 'Active hours' to 3 and 'Restart behavior' to 60 minutes.

Question 13

You manage Windows 11 devices with Microsoft Intune. A group of devices must run a custom PowerShell script that installs a line-of-business app at every startup without user interaction. The script must run even when no user is signed in. You need to configure a device configuration profile to deliver this script. What should you use?

Accepted Answer

A device configuration profile with a Windows PowerShell script that runs at startup. To run a PowerShell script at every system startup without user interaction, a device configuration profile with the Windows PowerShell script setting is required. It runs in the SYSTEM context, ensuring the app installs even when no user is signed in. Platform scripts, proactive remediations, and Win32 requirement scripts do not provide this startup-triggered behavior.

Answer

A proactive remediation script assigned to the device group

Answer

A platform script assigned to the device group

Answer

A Win32 app with a custom requirement script

Question 14

You manage 500 Windows 10 devices enrolled in Microsoft Intune. The security team requires that all devices have Microsoft Defender Antivirus enabled and that real-time protection cannot be disabled by users. You deploy an Endpoint Protection profile with the 'Real-time protection' setting set to 'Allow'. After deployment, users report they can still disable real-time protection. You need to ensure real-time protection cannot be disabled. What should you do?

Accepted Answer

Enable 'Tamper protection' in the Endpoint Protection profile.. To prevent users from disabling real-time protection, you must enable Tamper protection in the Endpoint Protection profile. Tamper protection locks security settings, ensuring real-time protection remains active. Setting real-time protection to 'Allow' permits users to disable it, while 'Block' disables it entirely. Audit mode does not enforce protection. Thus, enabling Tamper protection is the correct action.

Answer

Set the 'Real-time protection' setting to 'Block' in the Endpoint Protection profile.

Answer

Configure a device restriction policy to prevent users from accessing Windows Security settings.

Answer

Set the 'Real-time protection' setting to 'Audit' in the Endpoint Protection profile.

Question 15

You manage a fleet of Windows 10 and Windows 11 devices with Microsoft Intune. You need to ensure that devices automatically receive security intelligence updates for Microsoft Defender Antivirus multiple times per day. What should you configure?

Accepted Answer

An endpoint protection policy with the Security Intelligence Update Interval setting configured.. Security intelligence updates for Microsoft Defender Antivirus are managed through an Intune endpoint protection policy. The Security Intelligence Update Interval setting defines how frequently the device checks for and downloads new definitions. By setting this to a low value, such as every hour, you ensure devices receive multiple updates per day. Other settings like realtime monitoring or update channels do not control the update frequency.

Answer

An endpoint protection policy with the Allow Realtime Monitoring setting enabled.

Answer

A Windows Update ring with a deadline for quality updates.

Answer

A device configuration profile with the Defender Update Channel setting set to Beta.