MD-102 Manage and maintain devices Practice Test 12 — 15 Questions

Question 1

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

Accepted Answer

Screen timeout exceeds the policy setting. The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Answer

Device threat protection level is not set to high

Answer

Storage encryption is not enabled

Answer

OS version is above the maximum allowed

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

Accepted Answer

Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.. Option B is correct because the 'Start layout' setting in Devices > Configuration profiles > Windows 10 > Device restrictions allows you to specify an XML file that defines the Start menu layout. Option A is wrong because this is for Windows 11. Option C is wrong because Administrative Templates do not include Start layout. Option D is wrong because the Start layout policy is under Device restrictions, not Administrative Templates.

Answer

Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

Answer

Create a configuration profile for Windows 11 using 'Start layout' setting.

Answer

Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

Question 3

Your company has iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot remove the Microsoft Intune Company Portal app from their devices. What should you configure?

Accepted Answer

Configure a Required app assignment with removal prevention.. Option C is correct because configuring a Required app assignment with removal prevention in Microsoft Intune ensures that the Company Portal app is installed as a required app and users cannot uninstall it. This setting is specifically designed to prevent removal of managed apps on iOS/iPadOS devices enrolled in Intune, leveraging the MDM channel to enforce the policy.

Answer

Configure an App Configuration policy for Company Portal.

Answer

Configure an App Protection policy for Company Portal.

Answer

Configure a Device Compliance policy to require Company Portal installation.

Question 4

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs in the user context to configure user settings. What type of script should you use?

Accepted Answer

A PowerShell script deployed via Intune Management Extension.. Option B is correct because Microsoft Intune supports PowerShell scripts that can run in the user context. Option A is wrong because remediation scripts are for proactive remediations. Option C is wrong because platform scripts are for macOS/Linux. Option D is wrong because discovery scripts are for detecting issues.

Answer

A platform script for Windows.

Answer

A discovery script.

Answer

A remediation script.

Question 5

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

Accepted Answer

Device compliance policies.. Option A is correct because device compliance policies evaluate device health and report compliance status to Entra ID, which Conditional Access uses. Option B is wrong because device configuration policies do not affect compliance. Option C is wrong because app protection policies are for mobile apps, not device compliance. Option D is wrong because compliance policies are required, not optional.

Answer

No additional configuration is needed.

Answer

Device configuration policies.

Answer

App protection policies.

Question 6

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

Accepted Answer

The administrative template does not configure the update channel; you must use the Office Deployment Tool.. Option A is correct because when you configure the update channel for Microsoft 365 Apps via an Intune administrative template (ADMX), the setting is applied as a Group Policy preference but does not actually trigger the update mechanism. Microsoft 365 Apps updates require the Office Deployment Tool (ODT) or the Office CDN to deliver the correct channel bits. The administrative template only sets the registry key for the channel; without the ODT or a corresponding update policy, devices remain on their current channel and do not receive new updates.

Answer

Devices are not configured for Windows Update for Business.

Answer

Devices need to be in the Semi-Annual Channel (Targeted) to receive updates.

Answer

The Semi-Annual Enterprise Channel is not supported for Microsoft 365 Apps.

Question 7

Which TWO settings can you configure in a Microsoft Intune device compliance policy for Android Enterprise devices?

Accepted Answer

Require a password to unlock the device. Option B is correct because Microsoft Intune device compliance policies for Android Enterprise require a password to unlock the device as a configurable setting. This setting enforces a lock screen password, which is a fundamental security requirement for compliance evaluation. It directly controls device access and is a standard compliance check for Android Enterprise work profiles and fully managed devices.

Answer

Encryption

Answer

Disable camera

Answer

Maximum OS version

Question 8

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Accepted Answer

Run a detection script to identify issues.. Proactive remediations in Microsoft Intune are designed to detect and automatically fix common issues on Windows devices without requiring user intervention. Option A is correct because the workflow begins with a detection script that runs on the device to identify specific problems, such as registry misconfigurations or missing files. This script must return an exit code indicating whether an issue exists, which then triggers the remediation script if needed.

Answer

Send email alerts when issues are detected.

Answer

Mark devices as non-compliant if remediation fails.

Question 9

Which TWO methods can you use to enroll macOS devices in Microsoft Intune?

Accepted Answer

User-initiated enrollment via Company Portal. Options A and B are correct because Automated Device Enrollment (ADE) and user-initiated enrollment are supported for macOS. Option C is wrong because Windows Autopilot is for Windows. Option D is wrong because Google Zero Touch is for Android. Option E is wrong because Apple Configurator is for iOS only.

Answer

Google Zero Touch Enrollment

Answer

Windows Autopilot

Answer

Apple Configurator

Question 10

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

Accepted Answer

bitLockerDisableWarningForOtherDiskEncryption set to false. Option C is correct because setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Answer

bitLockerEncryptionMethod set to aes256

Answer

passwordRequired set to true

Answer

bitLockerDisableWarningForOtherDiskEncryption set to true

Question 11

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

Accepted Answer

Enable the TPM in the device's BIOS settings.. Option B is correct because the device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Answer

Replace the device's motherboard.

Answer

Assign a grace period for the device.

Answer

Remove the tpmRequired setting from the compliance policy.

Question 12

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

Accepted Answer

uninstallPrevious: true. Option A is correct because 'uninstallPrevious' set to true removes previous versions. Option B is wrong because channel does not affect removal. Option C is wrong because appVersion is the version to install. Option D is wrong because intent is 'required' meaning it must be installed.

Answer

appVersion: 96.0.1054.62

Answer

channel: Stable

Answer

intent: required

Question 13

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Accepted Answer

Create a device compliance policy that uses Defender for Endpoint risk level, then use Conditional Access.. Option A is correct because it combines a device compliance policy that evaluates the Defender for Endpoint risk level with a Conditional Access policy that blocks access when the device is noncompliant. This is the only supported method to automatically block corporate resource access based on real-time risk assessment from Defender for Endpoint.

Answer

Configure a device compliance policy with 'Require Defender for Endpoint' setting.

Answer

Configure a device configuration policy to block access based on risk.

Answer

Configure an app protection policy to block access based on device risk.

Question 14

Your company uses Microsoft Intune to manage Windows 10 devices. You need to ensure that all devices have Windows Defender Antivirus real-time protection enabled. What should you configure?

Accepted Answer

Create a device configuration policy for Windows Defender Antivirus and enable Real-time protection.. Option C is correct because the 'Real-time protection' setting in a device configuration policy for Windows Defender Antivirus enables real-time scanning. Option A is wrong because compliance policies do not enable features. Option B is wrong because Administrative Templates include similar settings but the dedicated Antivirus policy is more straightforward. Option D is wrong because endpoint security policies include Antivirus settings as well.

Answer

Create a device compliance policy requiring antivirus.

Answer

Use Administrative Templates to configure Windows Defender Antivirus.

Answer

Use the Endpoint security node to configure Antivirus policies.

Question 15

Which THREE features are available in Microsoft Intune's Windows Autopilot for existing devices?

Accepted Answer

Collect hardware hash from the existing device.. Options A, C, and D are correct because Windows Autopilot for existing devices supports collecting hardware hash, deploying a provisioning package, and resetting the device. Option B is wrong because converting a device to Autopilot is done via hardware hash upload, not during deployment. Option E is wrong because Autopilot is for Windows, not macOS.

Answer

Automatically convert the device to an Autopilot device without user interaction.

Answer

Apply Autopilot profiles to macOS devices.

MD-102 Manage and maintain devices Practice Test 12 — 15 Questions

Exhibit

MD-102 Manage and maintain devices Practice Test 12 — 15 Questions

Exhibit