MD-102 Manage and maintain devices Practice Test 14 — 15 Questions

Question 1

Which TWO actions can you perform using Microsoft Intune to manage devices that are not compliant? (Choose two.)

Accepted Answer

Send a push notification to the user.. Microsoft Intune can send push notifications to noncompliant devices via the Company Portal app, alerting users about compliance issues and required actions. Option E is correct because marking a device as noncompliant in the Intune admin center is a manual action that updates the device's compliance state, which then triggers conditional access policies to block resources. Both actions are available for managing noncompliant devices without requiring user interaction or remote wipe.

Answer

Automatically send an email to the user's manager.

Answer

Remotely wipe the device.

Answer

Block access to corporate resources.

Question 2

Which TWO of the following are device configuration settings you can manage with Microsoft Intune? (Choose two.)

Accepted Answer

Device restrictions (e.g., camera, Bluetooth). Device restrictions, such as disabling the camera or Bluetooth, are a core configuration setting in Microsoft Intune. These are managed through device configuration profiles that enforce policies on devices, regardless of the user logged in. Option B is correct because Intune's device restrictions profile allows administrators to control hardware and system features at the device level.

Answer

Application settings for Microsoft 365 Apps

Answer

Wi-Fi profiles

Answer

Email profiles for Exchange Online

Question 3

Refer to the exhibit. You are reviewing a JSON policy for Windows 10 compliance. Which of the following is required by this policy?

Accepted Answer

A TPM chip present and enabled. The JSON policy includes the setting 'requireTPM' with a value of 'true', which mandates that a Trusted Platform Module (TPM) chip must be present and enabled on the device to be compliant. TPM provides hardware-level security for cryptographic operations and is a key requirement for features like BitLocker, but the policy itself specifically enforces TPM presence, not encryption status.

Answer

Secure Boot disabled

Answer

BitLocker drive encryption enabled

Answer

A password of at least 8 characters

Question 4

Refer to the exhibit. You run a PowerShell cmdlet to get managed devices and see the output above. The device is noncompliant. What is the most likely reason?

Accepted Answer

The device has not synced recently.. The device is noncompliant because it has not synced recently. In Microsoft Intune, devices must regularly check in to report their compliance status; if a device fails to sync within the configured grace period (typically 30 days by default), it is marked as noncompliant. The PowerShell output shows the device is enrolled and managed, but the last sync time is missing or outdated, triggering the noncompliant state.

Answer

The device is not enrolled.

Answer

The device name is too long.

Answer

The OS version is not supported.

Question 5

Refer to the exhibit. You are reviewing a Win32 app configuration in Microsoft Intune. The app is not installing on some Windows 10 devices. Which is the most likely reason?

Accepted Answer

The devices have an OS version lower than 10.0.19041.. The exhibit shows the 'Minimum OS version' requirement set to 10.0.19041 (Windows 10 version 20H1/2004). Devices with an OS build lower than this threshold will fail to install the Win32 app, as Intune enforces this requirement before executing the installation command. This is a common configuration issue when deploying apps to a mixed-OS environment.

Answer

The install command line is missing the /silent switch.

Answer

The detection rule path is incorrect.

Answer

The install experience is set to system, but should be user.

Question 6

A company uses Microsoft Intune to manage Windows 11 devices. Users report that the Company Portal app is not showing required applications. You verify that the devices show as 'Compliant' in Microsoft Intune. Which configuration should you check first?

Accepted Answer

Check the application assignments in Intune.. The most common reason required applications are not visible in Company Portal is that the applications have not been assigned to the user or device group. Even if a device is compliant, Intune will only display applications that are assigned with an 'Available' intent to the user or device. Checking application assignments first directly addresses the symptom without assuming other configurations are misconfigured.

Answer

Check the Microsoft Entra ID (Azure AD) configuration for the device.

Answer

Check the Windows Update for Business ring assignments.

Answer

Check the device compliance policy settings.

Question 7

You are troubleshooting an iPhone that cannot enroll in Microsoft Intune. The user receives an error stating 'This device is already enrolled in another MDM.' What is the most likely cause?

Accepted Answer

The device is already enrolled in Apple Business Manager or another MDM.. The error 'This device is already enrolled in another MDM' indicates that the iPhone has an existing MDM profile that conflicts with Intune enrollment. This typically occurs when the device is already enrolled in Apple Business Manager (ABM) or another MDM solution, as iOS enforces a single MDM enrollment per device. Intune cannot overwrite an existing MDM profile without first removing it.

Answer

The device has a VPN configuration installed.

Answer

The device is not running the latest iOS version.

Answer

The user's license is expired.

Question 8

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

Accepted Answer

Assign the device to a different update ring with a 0-day deferral.. The device is assigned to an update ring that defers updates by 30 days, which is why it is not receiving the latest security updates despite being compliant. To immediately receive the latest updates, you must assign the device to a different update ring with a 0-day deferral, as update rings in Microsoft Intune control the deferral period for Windows Update for Business. Changing the ring triggers the device to check for updates based on the new policy, ensuring immediate availability of security updates.

Answer

Change the compliance policy to require immediate updates.

Answer

Run Windows Update manually on the device.

Answer

Re-enroll the device in Intune.

Question 9

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy a custom configuration profile to configure Wi-Fi settings for corporate devices. Which method should you use?

Accepted Answer

Use a custom configuration profile in Intune.. Intune's custom configuration profile allows you to deploy Apple Configurator–generated .mobileconfig files or custom XML/PLIST settings that are not available in the built-in Wi-Fi policy. This is the only method in Intune that supports arbitrary key-value pairs for iOS Wi-Fi configurations, such as EAP-TLS with specific certificate requirements or advanced proxy settings.

Answer

Use a Microsoft Entra ID (Azure AD) device configuration policy.

Answer

Use a PowerShell script to apply the settings.

Answer

Use a Microsoft Defender for Endpoint security policy.

Question 10

You need to ensure that Windows 10 devices automatically receive Microsoft 365 Apps updates from the Internet when not connected to the corporate network. Which update channel should you configure?

Accepted Answer

Current Channel. The Current Channel is the correct choice because it provides the most frequent updates for Microsoft 365 Apps, and it is the only channel that supports automatic updates from the Internet (via the Office Content Delivery Network) when devices are not connected to the corporate network. This channel is designed for devices that need the latest features and security updates without relying on on-premises update infrastructure.

Answer

Monthly Enterprise Channel

Answer

Office Insider

Answer

Semi-Annual Channel

Question 11

A user's Windows 11 device is not receiving the Company Portal app after enrollment. The device is enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The device is not connected to the internet.. The Company Portal app is delivered to enrolled devices via Intune, but the initial download and installation require an active internet connection to reach Microsoft's cloud services. If the device is not connected to the internet, the enrollment process may complete locally, but the Company Portal app will not be pushed or installed until connectivity is restored. This is the most likely cause because the question states the device is already enrolled, ruling out licensing or compliance issues that would prevent enrollment itself.

Answer

The device is not compliant with security policies.

Answer

The device is running Windows 10 instead of Windows 11.

Answer

The user does not have an Intune license.

Question 12

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate apps are installed automatically on new devices without user interaction. Which enrollment method should you use?

Accepted Answer

Android Enterprise fully managed. Android Enterprise fully managed (A) is the correct enrollment method because it allows IT to enroll corporate-owned devices into Intune with full device control, enabling automatic, silent installation of required corporate apps without any user interaction. This mode uses the Android Enterprise API to push apps via managed Google Play as required or kiosk apps, ensuring they are installed before the device is handed to the user.

Answer

Android Enterprise dedicated device

Answer

Android Legacy device administrator

Answer

Android Enterprise work profile

Question 13

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

Accepted Answer

The devices are not connected to the internet.. Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Answer

The hardware hashes are invalid.

Answer

The devices are not running Windows 11 Pro or Enterprise.

Answer

The user does not have an Intune license.

Question 14

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

Accepted Answer

The current OS version on the device.. The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Answer

The user's license status.

Answer

The compliance policy is assigned to the device.

Answer

The device is connected to the internet.

Question 15

Which THREE actions can you perform using Microsoft Intune's remote assistance feature for Windows devices?

Accepted Answer

View the user's screen.. Microsoft Intune's remote assistance feature, built on Windows Remote Assistance (WRA) using the Remote Desktop Protocol (RDP) over HTTPS, allows a help desk operator to view the user's screen with the user's explicit consent. This is a core capability for troubleshooting without taking control, enabling the administrator to see what the user sees in real time.

Answer

Reset the device's password.

Answer

Restart a Windows service.