MD-102 Manage and maintain devices Practice Test 15 — 15 Questions

Question 1

Which TWO Windows Update for Business policies can you configure using Microsoft Intune?

Accepted Answer

Feature update version targeting. Microsoft Intune allows you to configure a 'Feature update version targeting' policy, which specifies a target feature update version (e.g., Windows 11 23H2) for devices. Option B is correct because you can configure a 'Quality update deferral period' within an update ring policy to delay quality updates. Option C is incorrect because, although a driver update deferral period can be configured in an update ring policy, it is not a separate Windows Update for Business policy type; the question expects the two distinct policy types: Feature update version targeting and Quality update deferral period. Option D is incorrect because Windows Defender definition update schedule is not a Windows Update for Business policy; it is managed via Microsoft Defender for Endpoint or other settings. Option E is incorrect because Microsoft 365 Apps update channel is not a Windows Update for Business policy; it is configured separately for Office applications.

Answer

Driver update deferral period

Answer

Windows Defender definition update schedule

Answer

Microsoft 365 Apps update channel

Question 2

Which THREE are valid Windows Autopilot deployment scenarios?

Accepted Answer

Self-deploying. Windows Autopilot self-deploying is a valid deployment scenario where a device can be automatically configured without user interaction, using a hardware hash to enroll in Azure AD and Intune. This scenario is ideal for kiosks, digital signage, or shared devices that require zero-touch provisioning.

Answer

App-driven

Answer

Policy-driven

Question 3

You have a Windows 10 device running OS version 10.0.19043.1234. The device is compliant with all settings except password requirements. The device does not have a password set. What is the compliance status?

Accepted Answer

Noncompliant because passwordRequired is true and no password set.. The device is noncompliant due to the passwordRequired policy setting being set to true while no password is configured on the device. In Microsoft Intune, compliance policies evaluate each setting independently; if a required setting like passwordRequired is not met, the device is marked noncompliant regardless of other compliant settings. The OS version 10.0.19043.1234 is within a supported range, and storage encryption is not evaluated unless explicitly required by a policy, so only the missing password triggers noncompliance.

Answer

Noncompliant because storage encryption is not enabled.

Answer

Noncompliant because OS version is not within range.

Answer

Compliant

Question 4

A Windows 10 device is assigned this update ring policy. A new quality update is released today. When will the device install the update?

Accepted Answer

Today. The update ring policy is configured with 'Automatic update behavior' set to 'Auto install and restart without end-user control' and 'Servicing channel' set to 'Current branch (CB)'. When a new quality update is released, devices in this configuration will download and install the update immediately, typically within 24 hours of release, without any deferral period. The policy does not specify any deferral for quality updates, so the installation occurs today.

Answer

In 7 days

Answer

In 30 days

Answer

Never, because automatic update mode requires reboot with warning.

Question 5

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

Accepted Answer

The policy has not been applied to the device yet.. If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer

Real-time scanning is set to monitorAllFiles, but the file was an archive.

Answer

The scan type is set to quick, which does not scan downloaded files.

Answer

The cloud block level is set to high, which may block unknown files, but known files might be missed.

Question 6

You manage a hybrid Microsoft Entra ID environment with 5,000 Windows 10 devices enrolled in Microsoft Intune. You need to deploy a critical security update that requires a reboot to all devices within the next 4 hours. Users must be able to postpone the reboot for up to 8 hours. You configure a device restart policy in Intune. Which deadline and grace period settings should you use?

Accepted Answer

Deadline: 4 hours, Grace period: 8 hours. The deadline (4 hours) matches the required deployment window for the critical update, and the grace period (8 hours) allows users to postpone the reboot for up to 8 hours after the deadline. In Intune device restart policies, the deadline specifies when the update must be installed and the reboot initiated, while the grace period defines how long users can delay the restart after the deadline. With a 4-hour deadline and 8-hour grace period, the update is enforced within 4 hours, and users can postpone the reboot for up to 8 hours from that point, meeting both requirements.

Answer

Deadline: 8 hours, Grace period: 4 hours

Answer

Deadline: 2 hours, Grace period: 12 hours

Answer

Deadline: 4 hours, Grace period: 30 minutes

Question 7

Your organization uses Microsoft Intune for Windows device management. Users report that after a recent update, the company VPN client fails to start. You suspect a driver conflict. Which Intune feature should you use to roll back the problematic driver without affecting other updates?

Accepted Answer

Windows Driver Update Rings. Windows Driver Update Rings (D) is the correct feature. This Intune policy type allows you to manage driver updates separately from quality updates. You can decline a problematic driver update that has already been installed, which will trigger the device to uninstall it and revert to the previous driver version. This provides granular rollback without affecting other updates. Option A (Windows Update Rings) manages all Windows updates but does not directly support rolling back a driver that is already installed. Option B (Group Policy Administrative Templates) is for device configuration, not driver rollback. Option C (Microsoft 365 Apps Admin Center) manages Office apps. Option D is the appropriate tool for this scenario.

Answer

Windows Update Rings

Answer

Group Policy Administrative Templates

Answer

Microsoft 365 Apps Admin Center

Question 8

You need to ensure that all Windows 11 devices in your organization have BitLocker enabled and the recovery key escrowed to Microsoft Entra ID. Which Intune policy should you configure?

Accepted Answer

Endpoint Protection profile. The Endpoint Protection profile in Microsoft Intune contains the BitLocker settings, including the requirement to enable BitLocker and automatically escrow the recovery key to Microsoft Entra ID. This profile is specifically designed for security configurations like disk encryption, firewall, and antivirus, making it the correct choice for this task.

Answer

Compliance Policy

Answer

Device Restrictions profile

Answer

Device Configuration profile

Question 9

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Accepted Answer

Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.. Intune security policies are assigned to Microsoft Entra ID groups. If the device is not a member of the targeted group, it will not receive the policy, resulting in a 'Not compliant' status. Verifying group membership ensures the policy scope is correctly applied.

Answer

Reissue the user's Microsoft 365 license from the admin center.

Answer

Reset the device's enrollment state via the Company Portal.

Answer

Run Invoke-Command to remotely execute gpupdate /force.

Question 10

Your organization requires that all managed Windows devices have Microsoft Defender Antivirus enabled and running. Which TWO methods can you use to verify this compliance?

Accepted Answer

Create an Intune compliance policy for Windows Defender.. Intune compliance policies include a 'Microsoft Defender for Endpoint' category that allows you to require Defender Antivirus to be enabled and running. When a device reports its Defender status via the Intune Management Extension, the compliance policy evaluates the real-time protection state and marks the device as noncompliant if Defender is off or disabled. Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides device health reports that aggregate antivirus status across all enrolled devices, including whether Defender is active and up to date.

Answer

Check Microsoft Entra ID device settings.

Answer

Review the Local Group Policy Editor on each device.

Answer

Run a Configuration Manager hardware inventory.

Question 11

Refer to the exhibit. You apply this Intune custom OMA-URI policy to a Windows 10 device. What is the expected outcome?

Accepted Answer

VPN connections over cellular are blocked.. The OMA-URI ./Device/Vendor/MSFT/Policy/Config/Connectivity/AllowCellularData refers to the policy that controls whether cellular data is allowed for VPN connections. When set to 0, it blocks VPN connections over cellular networks, enforcing that VPN traffic must use Wi-Fi or Ethernet. This is a device-level policy, not user-specific, and the OMA-URI is valid for Windows 10 devices managed by Intune.

Answer

VPN connections are allowed over cellular networks.

Answer

The policy will fail to apply due to an invalid OMA-URI.

Answer

The policy applies only to users, not devices.

Question 12

Refer to the exhibit. A Windows 11 device assigned to this update ring is running a released version. What is the immediate behavior after the policy applies?

Accepted Answer

The device will be offered the latest Windows Insider Dev Channel build.. The exhibit shows an update ring policy configured with the 'Windows Insider Program' enabled and the 'Insider Channel' set to 'Dev Channel'. Since the device is currently on a released version, applying this policy will enroll it in the Windows Insider Program and offer the latest Dev Channel build. This is the immediate behavior because the policy triggers a check for the specified Insider build, not a deferral or quality update.

Answer

The device will uninstall the current Insider build and revert to the released version.

Answer

The device will defer all updates by 10 days.

Answer

The device will install the latest released quality update immediately.

Question 13

Refer to the exhibit. You run this PowerShell command using the Microsoft Graph PowerShell SDK. What is the primary purpose of this command?

Accepted Answer

To retrieve a list of all Windows managed devices with their compliance status.. The PowerShell command uses `Get-MgDeviceManagementManagedDevice` with a filter for `operatingSystem eq 'Windows'` and selects properties including `complianceState`. This retrieves all Windows managed devices and their compliance status, making option D correct. The command does not filter by compliance state, so it returns both compliant and non-compliant devices, and it does not enforce any compliance action.

Answer

To list only non-compliant Windows devices.

Answer

To retrieve all managed devices regardless of operating system.

Answer

To enforce compliance on Windows devices.

Question 14

You need to ensure that users can access corporate resources on their personal iOS devices only if they are jailbroken. Which Intune policy should you configure?

Accepted Answer

Device Compliance Policy. Device Compliance Policy in Microsoft Intune allows you to set rules that devices must meet to be considered compliant, including a jailbreak detection rule for iOS devices. When a device is detected as jailbroken, you can mark it as non-compliant and then use Conditional Access to block access to corporate resources. This directly addresses the requirement to control access based on jailbreak status.

Answer

App Protection Policy

Answer

Device Configuration Policy

Answer

Conditional Access Policy

Question 15

You manage devices with Microsoft Intune and have enabled co-management with Configuration Manager. You need to ensure that Windows Update policies are managed by Intune for all co-managed Windows 10 devices. Which workload slider should you set in Configuration Manager?

Accepted Answer

Windows Update Policies. In a co-management scenario, the workload slider determines which management authority handles specific workloads. Setting the 'Windows Update Policies' slider to 'Intune' directs Windows Update for Business policies to be applied via Intune, overriding Configuration Manager policies for co-managed Windows 10 devices. This ensures that update rings and deferral settings configured in Intune are enforced.

Answer

Endpoint Protection

Answer

Client Apps

Answer

Device Configuration