MD-102 Manage and maintain devices Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

bitLockerDisableWarningForOtherDiskEncryption set to false. Setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Answer

bitLockerEncryptionMethod set to aes256

Answer

passwordRequired set to true

Answer

bitLockerDisableWarningForOtherDiskEncryption set to true

Question 2

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

Accepted Answer

Enable the TPM in the device's BIOS settings.. The device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Answer

Replace the device's motherboard.

Answer

Assign a grace period for the device.

Answer

Remove the tpmRequired setting from the compliance policy.

Question 3

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

Accepted Answer

uninstallPrevious: true. The `uninstallPrevious` setting in the Microsoft Edge Intune deployment profile forces the removal of any existing version of Edge (e.g., Beta, Dev, or older Stable) before the new version is installed. This ensures a clean installation and prevents conflicts, which is critical when deploying Edge as a required app via Intune for Windows devices.

Answer

appVersion: 96.0.1054.62

Answer

channel: Stable

Answer

intent: required

Question 4

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Accepted Answer

Create a device compliance policy that uses Defender for Endpoint risk level, then use Conditional Access.. It combines a device compliance policy that evaluates the Defender for Endpoint risk level with a Conditional Access policy that blocks access when the device is noncompliant. This is the only supported method to automatically block corporate resource access based on real-time risk assessment from Defender for Endpoint.

Answer

Configure a device compliance policy with 'Require Defender for Endpoint' setting.

Answer

Configure a device configuration policy to block access based on risk.

Answer

Configure an app protection policy to block access based on device risk.

Question 5

Your company uses Microsoft Intune to manage Windows 10 devices. You need to ensure that all devices have Windows Defender Antivirus real-time protection enabled. What should you configure?

Accepted Answer

Create a device configuration policy for Windows Defender Antivirus and enable Real-time protection.. A device configuration policy is the most direct method to enforce Windows Defender Antivirus real-time protection, using the Defender CSP to set 'AllowRealtimeMonitoring'. While the Endpoint security node provides a dedicated Antivirus policy, device configuration policies are the straightforward administrative path for granular settings like real-time protection. A compliance policy only checks for antivirus but does not enforce the setting. Administrative Templates can also configure this via GPO-style settings, but they are less direct for this specific requirement in Intune. Therefore, Option B is the best single answer.

Answer

Create a device compliance policy requiring antivirus.

Answer

Use Administrative Templates to configure Windows Defender Antivirus.

Answer

Use the Endpoint security node to configure Antivirus policies.

Question 6

Which THREE features are available in Microsoft Intune's Windows Autopilot for existing devices?

Accepted Answer

Collect hardware hash from the existing device.. The 'Collect hardware hash' step is a core requirement for Windows Autopilot for existing devices. The hardware hash uniquely identifies the device and must be uploaded to the Microsoft Intune Autopilot service to register it for Autopilot deployment. This hash is collected using a PowerShell script (Get-WindowsAutopilotInfo.ps1) or via the Configuration Manager console.

Answer

Automatically convert the device to an Autopilot device without user interaction.

Answer

Apply Autopilot profiles to macOS devices.

Question 7

Which TWO settings can be configured in a Microsoft Intune device compliance policy for iOS/iPadOS?

Accepted Answer

Require a password. Intune device compliance policies for iOS/iPadOS include a setting to require a password on the device, which can enforce specific password complexity rules such as minimum length, number of complex characters, and lockout behavior. This setting is a core compliance requirement for securing devices that access corporate resources.

Answer

Allow app installation from App Store only

Answer

Block USB devices

Answer

Jailbroken devices

Question 8

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. The user has confirmed that the device is enrolled and connected to the internet. Which is the most likely cause?

Accepted Answer

The Intune Management Extension is not installed or not running.. The Intune Management Extension (IME) is the component responsible for processing and applying compliance policies on Windows devices. If the IME is not installed or not running, the device cannot evaluate compliance policies, resulting in a 'Not evaluated' status in the Intune admin center, even though the device is enrolled and connected to the internet.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device has a Device Lock policy applied that blocks evaluation.

Answer

The user does not have a Microsoft 365 E3 license assigned.

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs during the device provisioning process, before the user signs in. The script should be assigned to a device group containing all Autopilot devices. Which method should you use?

Accepted Answer

Use a device context PowerShell script in Intune and assign it to the device group.. A device context PowerShell script in Intune runs in the system context before the user signs in, making it ideal for provisioning tasks on Autopilot devices. Assigning it to a device group ensures the script executes on the target devices regardless of which user signs in, aligning with the requirement for pre-user-sign-in execution.

Answer

Add the script as a Windows 10 platform script in Intune.

Answer

Assign the script to a user group containing the users.

Answer

Deploy the script as a device configuration profile.

Question 10

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage endpoint security. You need to ensure that all Windows 10 devices are onboarded to Defender for Endpoint via Microsoft Intune. Which policy type should you use?

Accepted Answer

Endpoint detection and response policy. To onboard Windows 10 devices to Microsoft Defender for Endpoint via Intune, you must use an Endpoint detection and response (EDR) policy. This policy type deploys the required onboarding configuration package (a .cmd script or .xml file) that registers the device with the Defender for Endpoint service, enabling sensor data collection and threat detection. Antivirus, Firewall, and Windows Security experience policies manage separate security features but do not handle the initial onboarding process.

Answer

Antivirus policy

Answer

Firewall policy

Answer

Windows Security experience policy

Question 11

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. The app requires installation in the system context. Which deployment method should you use?

Accepted Answer

Win32 app. Win32 apps in Microsoft Intune support installation in the system context via the 'Install behavior' setting, and they can be deployed using a custom installation script that handles certificate trust issues (e.g., by installing the signing certificate first or using a silent install switch). This method also allows the app to run with elevated privileges, which is required for system-context installation, and does not depend on the device trusting the app's signing certificate at deployment time.

Answer

Microsoft Store for Business app

Answer

Microsoft Intune LOB app (msi/appx)

Answer

Web link

Question 12

A user's mobile device is lost. You need to remotely wipe the device using Microsoft Intune. What is the correct sequence of actions?

Accepted Answer

In the Microsoft Intune admin center, select the device and choose Retire/Wipe.. The Retire/Wipe action in the Microsoft Intune admin center is the direct, administrator-initiated method to remotely wipe a lost device. This action sends a wipe command to the device via the Intune service, which the device's management agent (Company Portal or MDM agent) processes to perform a factory reset, removing all corporate and personal data.

Answer

Ask the user to reset the device from the Company Portal app.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Remote wipe'.

Answer

Remove the device from Microsoft Entra ID and it will automatically wipe.

Question 13

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a minimum OS version can access corporate email via Microsoft Outlook for iOS. Which policy type should you configure?

Accepted Answer

App protection policy (MAM). App Protection Policies (MAM) allow you to target specific apps like Microsoft Outlook for iOS with conditional launch settings, including minimum OS version requirements. This policy applies at the app layer without requiring device enrollment, making it ideal for controlling access to corporate data in Outlook on iOS devices based on OS version.

Answer

Device configuration policy

Answer

Conditional Access policy

Answer

Device compliance policy

Question 14

You are troubleshooting a Windows 10 device that is not receiving Intune policies. The device is enrolled and shows as 'Active' in the Intune admin center. You run the Get-MgDeviceManagementManagedDevice cmdlet and the device's managementAgent is 'mdm'. Which of the following is the most likely cause of the issue?

Accepted Answer

The device's last sync time is more than 24 hours ago.. The device's last sync time being more than 24 hours ago indicates that the device has not checked in with Intune within the required interval. Intune policies are delivered during a sync cycle, and if the device hasn't synced recently, it will not receive new or updated policies. The managementAgent being 'mdm' confirms the device is MDM-managed, so the sync interval is critical for policy delivery.

Answer

The device is co-managed and the workload is set to Configuration Manager.

Answer

The device's enrollment certificate has expired.

Answer

The device is retired from Intune.

Question 15

Your organization wants to use Windows Autopilot for user-driven deployment. Users should be able to self-deploy their devices by signing in with their corporate credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven (Azure AD join). User-driven (Azure AD join) deployment mode is correct because it allows users to self-deploy their devices by signing in with their corporate credentials during the out-of-box experience (OOBE). This mode joins the device to Azure AD and enrolls it in Microsoft Intune, enabling the user to complete the setup without IT intervention.

Answer

Pre-provisioned deployment

Answer

Hybrid Azure AD join

Answer

Self-deploying (Azure AD join)