MD-102 Manage and maintain devices Practice Test 14 — 15 Questions

Question 1

You manage 500 Windows 11 Enterprise devices with Microsoft Intune. Users report that after a recent configuration change, they can no longer access the corporate Wi-Fi network, which uses 802.1X with a certificate for authentication. The certificate is issued by your internal certification authority (CA) and is deployed by using an Intune SCEP certificate profile. You need to ensure that devices receive a new certificate before the current one expires and that the renewal occurs automatically without user interaction. What should you configure in the SCEP certificate profile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the certificate validity period to 1 year and enable automatic renewal at 80% of the validity period.. The correct answer is to set the certificate validity period and enable automatic renewal at a percentage of that period. Intune SCEP certificate profiles include a 'Renewal threshold (%)' setting that triggers automatic renewal when the certificate reaches that percentage of its validity. This ensures devices obtain a new certificate before expiration without user action, maintaining Wi-Fi access.

Answer

Deploy a PKCS certificate profile instead of SCEP and configure the certificate to renew automatically.

Answer

Configure the certificate template in Active Directory Certificate Services to auto-enroll and set the Intune SCEP profile to use that template.

Answer

Enable the 'Renew certificate automatically' setting and set the renewal period to 30 days before expiration.

Question 2

You manage 200 Windows 11 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant due to missing security updates, it is automatically wiped after 30 days. The solution must notify the user at 7 days and 14 days before the wipe. What should you configure?

Accepted Answer

A compliance policy with actions for non-compliance: mark device noncompliant immediately, send email at 7 days, send email at 14 days, and wipe the device at 30 days.. Compliance policies in Intune allow multiple actions for non-compliance, each with a configurable schedule. You can set the device to be marked noncompliant immediately, send email notifications at 7 and 14 days, and then wipe the device at 30 days. This automates the notification and wipe process, ensuring the device is wiped if it remains noncompliant.

Answer

A Windows Update ring with a deadline of 30 days and an automatic wipe action.

Answer

A device configuration profile with a custom OMA-URI to trigger a wipe after 30 days of noncompliance.

Answer

A compliance policy with actions for non-compliance: mark device noncompliant immediately, send email at 7 days, send email at 14 days, and retire the device at 30 days.

Question 3

You manage Windows 11 devices with Microsoft Intune. You need to configure a device to automatically connect to a Wi-Fi network that uses certificate-based authentication. The certificate must be deployed to the device before the Wi-Fi profile. What should you do?

Accepted Answer

Create a PKCS certificate profile and a Wi-Fi profile, and assign the Wi-Fi profile to a group that includes only devices that have already received the certificate. To ensure the certificate is deployed before the Wi-Fi profile, you must sequence the deployments. Assigning the Wi-Fi profile to a group that only includes devices that already have the certificate ensures the certificate is present first. Other options do not guarantee ordering, as Intune does not automatically sequence profiles based on dependencies.

Answer

Create a SCEP certificate profile and a Wi-Fi profile, and use a filter to target the Wi-Fi profile to devices that have the certificate

Answer

Create a PKCS certificate profile and a Wi-Fi profile, and assign both to the device group

Answer

Create a PKCS certificate profile and a Wi-Fi profile, and configure the Wi-Fi profile to use the certificate

Question 4

You manage a set of Windows 10 devices with Microsoft Intune. You need to ensure that these devices automatically install critical security updates as soon as they are available, without user interaction. What should you configure?

Accepted Answer

A Windows Update ring with automatic update behavior set to 'Auto install and restart without end-user control'.. Windows Update rings in Intune provide granular control over update behavior. The setting 'Auto install and restart without end-user control' ensures updates install automatically as soon as they are available and the device restarts without user action, satisfying the requirement for immediate, unattended installation of critical security updates.

Answer

A Windows Update ring with automatic update behavior set to 'Auto install and restart at maintenance time'.

Answer

A device configuration profile with the 'Configure Automatic Updates' setting set to 'Auto download and notify for install'.

Answer

A Windows Update ring with automatic update behavior set to 'Auto install and restart at a scheduled time'.

Question 5

Your organization has 2,000 Windows 11 devices enrolled in Microsoft Intune. A security requirement states that devices must be wiped automatically if they fail to check in with Intune for 90 consecutive days. You need to implement this with the least administrative effort. What should you configure?

Accepted Answer

A compliance policy with an 'Unable to check in' rule set to 90 days and a noncompliance action of 'Wipe the device'.. Intune compliance policies can evaluate device inactivity and trigger noncompliance actions, one of which is a remote wipe. By setting the 'Unable to check in' threshold to 90 days and selecting the wipe action, the service issues a wipe to the device when it next communicates. Cleanup rules only remove console records, conditional access only blocks access, and retire actions only remove corporate data, so none of these satisfy a true wipe requirement.

Answer

A device compliance policy with an 'Unable to check in' rule set to 90 days and a noncompliance action of 'Retire the device'.

Answer

A compliance policy inactivity rule set to 90 days, combined with a conditional access policy that blocks the device and an Intune remote wipe action triggered by a scheduled script.

Answer

A device cleanup rule in the Intune tenant administration settings that deletes devices after 90 days of inactivity.

Question 6

You manage a group of macOS devices enrolled in Microsoft Intune. You need to ensure that when a device is reported lost, you can remotely lock it and prevent access to corporate email until it is recovered. The solution must not wipe the device. What should you configure?

Accepted Answer

A compliance policy that marks the device as noncompliant and a conditional access policy that blocks email access.. To prevent email access on a lost macOS device without wiping it, use a compliance policy to mark it noncompliant and a conditional access policy to block Exchange Online access for noncompliant devices. This secures corporate email while preserving data. Remote lock can be used separately to lock the device.

Answer

A full wipe to reset the device to factory settings.

Answer

A device configuration profile with a passcode policy that requires a complex password.

Answer

A selective wipe to remove only corporate data.

Question 7

You use Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to ensure that when a device is marked as noncompliant due to a missing security update, the device loses access to Microsoft 365 services within 15 minutes. You have already created a compliance policy that marks devices noncompliant if the required update is not installed. What should you configure next?

Accepted Answer

In Microsoft Entra ID, create a conditional access policy that requires compliant devices and set the 'Grant' control to 'Require device to be marked as compliant'. Ensure the policy applies to Microsoft 365 services.. The correct answer is to create a conditional access policy in Microsoft Entra ID that requires compliant devices for Microsoft 365 services. Intune compliance policies determine the compliance state; conditional access enforces it. When a device becomes noncompliant, conditional access blocks access. With continuous access evaluation, the block can occur within minutes.

Answer

In Microsoft Entra ID, create a conditional access policy that requires compliant devices and set the 'Mark device as compliant' action to 15 minutes.

Answer

In Intune, configure the compliance policy to automatically retire the device after 15 minutes of noncompliance.

Answer

In Intune, create a device compliance policy and set the 'Action for noncompliance' to 'Mark device noncompliant' with a schedule of 15 minutes.

Question 8

You manage a group of Windows 10 devices with Microsoft Intune. You need to ensure that users can install apps from the Microsoft Store for Business without administrator rights. What should you configure?

Accepted Answer

Configure a device restriction policy to enable 'Allow all trusted apps to install' and allow the Microsoft Store.. To allow users to install apps from the Microsoft Store without administrator rights, enable the device restriction setting 'Allow all trusted apps to install' and ensure the Microsoft Store is allowed. This permits signed Store apps to install without elevation. Other options either push apps, do not grant installation rights, or grant excessive privileges.

Answer

Configure a device restriction policy to allow the Microsoft Store and set 'Require private store only' to No.

Answer

Assign the Microsoft Store for Business apps as required to the user group.

Answer

Deploy a PowerShell script that adds users to the local Administrators group.

Question 9

You use Microsoft Intune to manage Windows 11 devices. You need to ensure that when a device is retired, the device is removed from Intune and the primary user is removed from Microsoft Entra ID. Which action should you perform?

Accepted Answer

Use the Delete action on the device and then delete the user in Microsoft Entra ID.. The requirement is to remove the device from Intune and remove the primary user from Microsoft Entra ID. Deleting the device in Intune removes its management record, and deleting the user in Entra ID removes the user account. No single action in Intune performs both; therefore, a two-step process is necessary. Retire and Wipe do not delete the user, and deleting only the device leaves the user.

Answer

Wipe the device in the Intune admin center.

Answer

Retire the device in the Intune admin center.

Answer

Delete the device in the Intune admin center.

Question 10

You manage a fleet of Windows 11 devices with Microsoft Intune. You need to ensure that when a user enrolls a personal device, only the work profile data can be wiped by IT, leaving personal files intact. Which enrollment method should you use?

Accepted Answer

Enrollment as a personally owned device with a work profile using Microsoft Intune app protection policies and selective wipe. For personally owned devices, enrolling with a work profile and using app protection policies enables selective wipe of corporate data without affecting personal files. Other methods enroll the device as corporate-owned or do not provide a management boundary that supports selective wipe. The correct approach balances user privacy with IT control.

Answer

Enrollment with a work profile using Windows Information Protection (WIP)

Answer

Enrollment with Windows Autopilot self-deploying mode

Answer

Automatic enrollment with user-driven Microsoft Entra join

Question 11

You manage a fleet of Windows 11 devices with Microsoft Intune. A new corporate policy requires that all devices automatically receive quality updates outside of active hours and that users cannot defer them indefinitely. You need to configure Windows Update for Business settings in Intune. Which policy type should you create?

Accepted Answer

A Windows update ring under Devices > Windows > Update rings for Windows 10 and later.. Windows update rings in Intune are the modern mechanism for configuring Windows Update for Business. They expose settings for active hours, quality and feature update deferrals, deadlines, and automatic installation behavior. By setting a deadline and configuring active hours, you ensure updates install outside the user's working time and cannot be postponed indefinitely, which is exactly what the corporate policy requires.

Answer

An endpoint security policy using the Antivirus profile.

Answer

A device compliance policy that requires the device to be up to date.

Answer

A device configuration profile using the Templates > Windows Update for Business ring.

Question 12

You manage a group of iOS/iPadOS devices enrolled in Microsoft Intune. Users report that they cannot access corporate email after their devices were marked noncompliant. You need to ensure that users can regain access by remediating the compliance issue directly from the Company Portal app. What should you configure?

Accepted Answer

Configure a compliance policy action for noncompliance to 'Send push notification to end users' and enable 'Remediation' in the Company Portal.. To allow users to remediate compliance issues directly from the Company Portal, you should configure the noncompliance action to send a push notification to end users. The Company Portal app then displays the compliance issue and provides remediation steps, such as updating the OS or enabling a passcode. Other actions like email, remote lock, or simply marking noncompliant do not offer in-app remediation. Therefore, the push notification action is the correct choice.

Answer

Configure a compliance policy action for noncompliance to 'Send email to end users'.

Answer

Configure a compliance policy action for noncompliance to 'Remotely lock the device'.

Answer

Configure a compliance policy action for noncompliance to 'Mark device noncompliant' and set a schedule for the action.

Question 13

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is enrolled, it automatically receives a specific set of applications and configurations. You also need to ensure that if a user uninstalls a required application, it is reinstalled automatically. What should you configure?

Accepted Answer

Assign the applications as 'Required' to a device group and configure a device configuration profile.. Assigning applications as 'Required' to a device group ensures they are installed and automatically reinstalled if removed. Device configuration profiles deliver the desired settings. Together, these meet the requirements for automatic application deployment, reinstallation, and configuration.

Answer

Assign the applications as 'Available' to a user group and configure a compliance policy.

Answer

Assign the applications as 'Uninstall' to a device group and configure a compliance policy.

Answer

Assign the applications as 'Required' to a user group and configure a device configuration profile.

Question 14

You manage Windows 10 devices with Microsoft Intune. You need to ensure that devices receive quality updates as soon as possible after they are released, but you want to defer feature updates for 60 days. What should you configure?

Accepted Answer

Windows Update rings with quality update deferral set to 0 days and feature update deferral set to 60 days.. Update rings in Intune are designed to manage Windows Update settings, including deferral periods for quality and feature updates. By setting quality update deferral to 0 days, devices receive quality updates immediately. Setting feature update deferral to 60 days delays feature updates. This combination meets the requirement. Other options either refer to incorrect configuration objects or do not control update timing.

Answer

Windows Update for Business profiles with feature update deferral set to 60 days and quality update deferral set to 0 days.

Answer

Compliance policy requiring a specific Windows version.

Answer

Device configuration profile with Windows Update settings for deferrals.

Question 15

You use Microsoft Intune to manage Windows 11 devices. You need to remotely assist a user by viewing and controlling their device from the Intune admin center. Which TWO actions must you perform? (Choose two.)

Accepted Answer

Enable Remote Help in Intune and assign the Remote Help app to the device.. To use Remote Help from the Intune admin center, you must enable the Remote Help service and deploy the Remote Help app to the target device. Additionally, the device must be enrolled in Intune and online to receive the session request. Conditional access, admin roles for the user, and Application Guard are not required for this functionality.

Answer

Enable Windows Defender Application Guard on the device.

Answer

Assign the Intune Administrator role to the user.

Answer

Configure a conditional access policy to allow Remote Help.