MD-102 Manage and maintain devices Practice Test 12 — 15 Questions

Question 1

A user reports that their Android Enterprise work profile device is not receiving email from the corporate Exchange Online account. The device is enrolled in Intune and shows as compliant. The Outlook app is installed but cannot connect. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Email profile configuration in Intune. The most common reason for an Outlook connection failure on a compliant Android Enterprise work profile device is an incorrect email profile configuration in Intune. Since the device is compliant and licensed, and app protection policies affect data leakage rather than connectivity, the first step should be to verify the email profile settings (server, authentication method, and user identity) in the Intune console. Option A is correct.

Answer

App protection policy settings

Answer

Device compliance policy settings

Answer

Intune license assignment

Question 2

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows 11 devices remotely? (Choose two.)

Accepted Answer

Collect diagnostics. Collecting diagnostics is a remote action available in the Microsoft Intune admin center under the 'Devices' blade. It allows administrators to gather detailed logs (e.g., MDM diagnostic logs, event logs, and registry keys) from a Windows 11 device without user interaction, which is critical for troubleshooting issues remotely.

Answer

Deploy a line-of-business app

Answer

Create a VPN profile

Answer

Assign a compliance policy

Question 3

Which THREE conditions must be met for a Windows device to be able to enroll in Microsoft Intune using Microsoft Entra ID join? (Choose three.)

Accepted Answer

The device must be running Windows 10 or later. Microsoft Entra ID join requires a minimum of Windows 10 (any edition) to support the modern authentication and device registration protocols. Devices running earlier versions like Windows 8.1 or Windows 7 lack the necessary components (e.g., the Device Registration Service client) to complete the join process. This requirement ensures the device can communicate using OAuth 2.0 and the Microsoft Entra ID device registration endpoint.

Answer

The device must have a TPM 2.0 chip

Answer

The device must be joined to an on-premises Active Directory domain

Question 4

Which TWO of the following are valid remote assistance tools for Windows devices managed by Microsoft Intune? (Choose two.)

Accepted Answer

Quick Assist. Quick Assist is a built-in Windows tool that allows remote assistance connections and is fully supported for managed devices in Microsoft Intune. It uses Remote Desktop Protocol (RDP) for screen sharing and control, and can be deployed and configured via Intune policies, making it a valid remote assistance option.

Answer

Windows Remote Management (WinRM)

Answer

Remote Desktop

Answer

Skype

Question 5

You apply the custom policy shown in the exhibit to a Windows 11 device. Users report that they cannot use Bluetooth devices (e.g., mouse, keyboard) after the policy applies. Which setting in the policy is causing this issue?

Accepted Answer

allowBluetooth set to false. The `allowBluetooth` setting set to `false` explicitly disables the Bluetooth radio on the device, preventing any Bluetooth peripherals (mouse, keyboard, etc.) from pairing or connecting. This is a common policy in Windows CSP (Policy CSP – Bluetooth/AllowBluetooth) that controls the Bluetooth stack at the OS level, and setting it to false blocks all Bluetooth functionality.

Answer

allowStorageCard set to false

Answer

allowCopyPaste set to false

Answer

allowCamera set to false

Question 6

You need to deploy a custom Windows 11 feature update to a pilot group of 50 devices before rolling out to the entire organization. The devices are managed by Intune and are in a 'Pilot' Azure AD group. What is the best approach?

Accepted Answer

Create a feature update profile for Windows 11 and assign to the pilot group. Intune's feature update profiles are specifically designed to deploy Windows 11 feature updates to targeted Azure AD groups, such as the 'Pilot' group. This approach allows you to control the exact feature update version (e.g., Windows 11 23H2) and assign it only to the pilot devices, enabling a controlled rollout before expanding to the entire organization.

Answer

Configure a Windows Update for Business deferral policy for all devices

Answer

Create a custom configuration profile with update settings

Answer

Use Group Policy to configure Windows Update settings for the pilot group

Question 7

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

Accepted Answer

Screen timeout exceeds the policy setting. The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Answer

Device threat protection level is not set to high

Answer

Storage encryption is not enabled

Answer

OS version is above the maximum allowed

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

Accepted Answer

Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.. The Start layout for Windows 10 devices managed by Intune is configured under Device restrictions, not Administrative Templates. The 'Start layout' setting in Device restrictions allows you to upload an XML file that defines the Start menu layout, which can be applied to restore the missing layout after a software update.

Answer

Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

Answer

Create a configuration profile for Windows 11 using 'Start layout' setting.

Answer

Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

Question 9

Your company has iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot remove the Microsoft Intune Company Portal app from their devices. What should you configure?

Accepted Answer

Configure a Required app assignment with removal prevention.. Configuring a Required app assignment with removal prevention in Microsoft Intune ensures that the Company Portal app is installed as a required app and users cannot uninstall it. This setting is specifically designed to prevent removal of managed apps on iOS/iPadOS devices enrolled in Intune, leveraging the MDM channel to enforce the policy.

Answer

Configure an App Configuration policy for Company Portal.

Answer

Configure an App Protection policy for Company Portal.

Answer

Configure a Device Compliance policy to require Company Portal installation.

Question 10

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs in the user context to configure user settings. What type of script should you use?

Accepted Answer

A PowerShell script deployed via Intune Management Extension.. The Intune Management Extension (IME) is the component that handles PowerShell script execution on Windows 10 devices managed by Intune. When you deploy a PowerShell script via Intune, it is automatically executed by the IME, and you can choose to run it in the user context (as the logged-on user) or the system context. This is the correct mechanism for deploying a user-context PowerShell script to configure user settings.

Answer

A platform script for Windows.

Answer

A discovery script.

Answer

A remediation script.

Question 11

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

Accepted Answer

Device compliance policies.. A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.

Answer

No additional configuration is needed.

Answer

Device configuration policies.

Answer

App protection policies.

Question 12

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

Accepted Answer

The administrative template does not configure the update channel; you must use the Office Deployment Tool.. When you configure the update channel for Microsoft 365 Apps via an Intune administrative template (ADMX), the setting is applied as a Group Policy preference but does not actually trigger the update mechanism. Microsoft 365 Apps updates require the Office Deployment Tool (ODT) or the Office CDN to deliver the correct channel bits. The administrative template only sets the registry key for the channel; without the ODT or a corresponding update policy, devices remain on their current channel and do not receive new updates.

Answer

Devices are not configured for Windows Update for Business.

Answer

Devices need to be in the Semi-Annual Channel (Targeted) to receive updates.

Answer

The Semi-Annual Enterprise Channel is not supported for Microsoft 365 Apps.

Question 13

Which TWO settings can you configure in a Microsoft Intune device compliance policy for Android Enterprise devices?

Accepted Answer

Require a password to unlock the device. Microsoft Intune device compliance policies for Android Enterprise require a password to unlock the device as a configurable setting. This setting enforces a lock screen password, which is a fundamental security requirement for compliance evaluation. It directly controls device access and is a standard compliance check for Android Enterprise work profiles and fully managed devices.

Answer

Encryption

Answer

Disable camera

Answer

Maximum OS version

Question 14

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Accepted Answer

Run a detection script to identify issues.. Proactive remediations in Microsoft Intune are designed to detect and automatically fix common issues on Windows devices without requiring user intervention. Option A is correct because the workflow begins with a detection script that runs on the device to identify specific problems, such as registry misconfigurations or missing files. This script must return an exit code indicating whether an issue exists, which then triggers the remediation script if needed.

Answer

Send email alerts when issues are detected.

Answer

Mark devices as non-compliant if remediation fails.

Question 15

Which TWO methods can you use to enroll macOS devices in Microsoft Intune?

Accepted Answer

User-initiated enrollment via Company Portal. The Company Portal app on macOS allows users to initiate enrollment themselves, which registers the device with Microsoft Intune and applies compliance policies. This method is suitable for bring-your-own-device (BYOD) scenarios where the user controls enrollment. Option E is correct because Automated Device Enrollment (ADE), formerly DEP, uses Apple Business Manager to silently enroll corporate-owned macOS devices during initial setup, enforcing Intune management without user intervention.

Answer

Google Zero Touch Enrollment

Answer

Windows Autopilot

Answer

Apple Configurator