MD-102 Manage and maintain devices Practice Test 15 — 15 Questions

Question 1

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

Accepted Answer

The policy has not been applied to the device yet.. Option D is correct because if the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer

Real-time scanning is set to monitorAllFiles, but the file was an archive.

Answer

The scan type is set to quick, which does not scan downloaded files.

Answer

The cloud block level is set to high, which may block unknown files, but known files might be missed.

Question 2

You manage a hybrid Microsoft Entra ID environment with 5,000 Windows 10 devices enrolled in Microsoft Intune. You need to deploy a critical security update that requires a reboot to all devices within the next 4 hours. Users must be able to postpone the reboot for up to 8 hours. You configure a device restart policy in Intune. Which deadline and grace period settings should you use?

Accepted Answer

Deadline: 4 hours, Grace period: 8 hours. Option C is correct because the deadline (4 hours) matches the required deployment window for the critical update, and the grace period (8 hours) allows users to postpone the reboot for up to 8 hours after the deadline. In Intune device restart policies, the deadline specifies when the update must be installed and the reboot initiated, while the grace period defines how long users can delay the restart after the deadline. With a 4-hour deadline and 8-hour grace period, the update is enforced within 4 hours, and users can postpone the reboot for up to 8 hours from that point, meeting both requirements.

Answer

Deadline: 8 hours, Grace period: 4 hours

Answer

Deadline: 2 hours, Grace period: 12 hours

Answer

Deadline: 4 hours, Grace period: 30 minutes

Question 3

Your organization uses Microsoft Intune for Windows device management. Users report that after a recent update, the company VPN client fails to start. You suspect a driver conflict. Which Intune feature should you use to roll back the problematic driver without affecting other updates?

Accepted Answer

Windows Driver Update Rings. Windows Driver Update Rings (D) is the correct feature because it allows you to selectively roll back a specific driver update without affecting other Windows updates or configuration changes. This feature is designed to manage driver updates independently from quality or feature updates, enabling targeted rollbacks when a driver causes conflicts like a VPN client failure.

Answer

Windows Update Rings

Answer

Group Policy Administrative Templates

Answer

Microsoft 365 Apps Admin Center

Question 4

You need to ensure that all Windows 11 devices in your organization have BitLocker enabled and the recovery key escrowed to Microsoft Entra ID. Which Intune policy should you configure?

Accepted Answer

Endpoint Protection profile. The Endpoint Protection profile in Microsoft Intune contains the BitLocker settings, including the requirement to enable BitLocker and automatically escrow the recovery key to Microsoft Entra ID. This profile is specifically designed for security configurations like disk encryption, firewall, and antivirus, making it the correct choice for this task.

Answer

Compliance Policy

Answer

Device Restrictions profile

Answer

Device Configuration profile

Question 5

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Accepted Answer

Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.. Option A is correct because Intune security policies are assigned to Microsoft Entra ID groups. If the device is not a member of the targeted group, it will not receive the policy, resulting in a 'Not compliant' status. Verifying group membership ensures the policy scope is correctly applied.

Answer

Reissue the user's Microsoft 365 license from the admin center.

Answer

Reset the device's enrollment state via the Company Portal.

Answer

Run Invoke-Command to remotely execute gpupdate /force.

Question 6

You are designing a Windows 10 update strategy using Windows Update for Business and Intune. Which THREE settings should you configure to ensure updates are delivered efficiently while minimizing user disruption?

Accepted Answer

Set active hours to prevent restarts during work.. Setting active hours prevents restarts during work by defining a window during which Windows Update will not automatically reboot the device. This minimizes user disruption by ensuring that updates only restart the device outside of specified active hours, aligning with the goal of delivering updates efficiently while maintaining productivity.

Answer

Enable Delivery Optimization for update distribution.

Answer

Configure a deferral period for driver updates.

Question 7

Your organization requires that all managed Windows devices have Microsoft Defender Antivirus enabled and running. Which TWO methods can you use to verify this compliance?

Accepted Answer

Create an Intune compliance policy for Windows Defender.. Option A is correct because Intune compliance policies include a 'Microsoft Defender for Endpoint' category that allows you to require Defender Antivirus to be enabled and running. When a device reports its Defender status via the Intune Management Extension, the compliance policy evaluates the real-time protection state and marks the device as noncompliant if Defender is off or disabled. Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides device health reports that aggregate antivirus status across all enrolled devices, including whether Defender is active and up to date.

Answer

Check Microsoft Entra ID device settings.

Answer

Review the Local Group Policy Editor on each device.

Answer

Run a Configuration Manager hardware inventory.

Question 8

Refer to the exhibit. You apply this Intune custom OMA-URI policy to a Windows 10 device. What is the expected outcome?

Accepted Answer

VPN connections over cellular are blocked.. The OMA-URI ./Device/Vendor/MSFT/Policy/Config/Connectivity/AllowCellularData refers to the policy that controls whether cellular data is allowed for VPN connections. When set to 0, it blocks VPN connections over cellular networks, enforcing that VPN traffic must use Wi-Fi or Ethernet. This is a device-level policy, not user-specific, and the OMA-URI is valid for Windows 10 devices managed by Intune.

Answer

VPN connections are allowed over cellular networks.

Answer

The policy will fail to apply due to an invalid OMA-URI.

Answer

The policy applies only to users, not devices.

Question 9

Refer to the exhibit. A Windows 11 device assigned to this update ring is running a released version. What is the immediate behavior after the policy applies?

Accepted Answer

The device will be offered the latest Windows Insider Dev Channel build.. The exhibit shows an update ring policy configured with the 'Windows Insider Program' enabled and the 'Insider Channel' set to 'Dev Channel'. Since the device is currently on a released version, applying this policy will enroll it in the Windows Insider Program and offer the latest Dev Channel build. This is the immediate behavior because the policy triggers a check for the specified Insider build, not a deferral or quality update.

Answer

The device will uninstall the current Insider build and revert to the released version.

Answer

The device will defer all updates by 10 days.

Answer

The device will install the latest released quality update immediately.

Question 10

Refer to the exhibit. You run this PowerShell command using the Microsoft Graph PowerShell SDK. What is the primary purpose of this command?

Accepted Answer

To retrieve a list of all Windows managed devices with their compliance status.. The PowerShell command uses `Get-MgDeviceManagementManagedDevice` with a filter for `operatingSystem eq 'Windows'` and selects properties including `complianceState`. This retrieves all Windows managed devices and their compliance status, making option D correct. The command does not filter by compliance state, so it returns both compliant and non-compliant devices, and it does not enforce any compliance action.

Answer

To list only non-compliant Windows devices.

Answer

To retrieve all managed devices regardless of operating system.

Answer

To enforce compliance on Windows devices.

Question 11

You need to ensure that users can access corporate resources on their personal iOS devices only if they are jailbroken. Which Intune policy should you configure?

Accepted Answer

Device Compliance Policy. Device Compliance Policy in Microsoft Intune allows you to set rules that devices must meet to be considered compliant, including a jailbreak detection rule for iOS devices. When a device is detected as jailbroken, you can mark it as non-compliant and then use Conditional Access to block access to corporate resources. This directly addresses the requirement to control access based on jailbreak status.

Answer

App Protection Policy

Answer

Device Configuration Policy

Answer

Conditional Access Policy

Question 12

You manage devices with Microsoft Intune and have enabled co-management with Configuration Manager. You need to ensure that Windows Update policies are managed by Intune for all co-managed Windows 10 devices. Which workload slider should you set in Configuration Manager?

Accepted Answer

Windows Update Policies. In a co-management scenario, the workload slider determines which management authority handles specific workloads. Setting the 'Windows Update Policies' slider to 'Intune' directs Windows Update for Business policies to be applied via Intune, overriding Configuration Manager policies for co-managed Windows 10 devices. This ensures that update rings and deferral settings configured in Intune are enforced.

Answer

Endpoint Protection

Answer

Client Apps

Answer

Device Configuration

Question 13

You deploy a new line-of-business app to Windows 10 devices via Intune. Users report that the app does not appear in the Company Portal. You verify that the app is assigned to the correct group. What is the most likely cause?

Accepted Answer

The app's installation behavior is set to 'System'.. When a line-of-business (LOB) app is deployed with installation behavior set to 'System', it installs in the device context and runs as SYSTEM. The Company Portal only displays apps installed in the user context. Even though the app is assigned to the correct group, it will not appear in the Company Portal because the portal filters out system-context apps. To make it visible, the installation behavior must be set to 'User'.

Answer

The app is not supported on Windows 10.

Answer

Users need to add the app manually.

Answer

The app is assigned to the wrong group.

Question 14

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

Accepted Answer

Automated investigation and response. The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Answer

Threat analytics

Answer

Device inventory

Answer

Alert queue

Question 15

You need to wipe a lost corporate-owned Windows 10 device that is enrolled in Intune. Which action should you take?

Accepted Answer

Select the device and choose Wipe.. The Wipe action in Intune restores a Windows 10 device to its factory default settings, removing all data and corporate access. This is the appropriate action for a lost corporate-owned device because it ensures sensitive data is erased while retaining the device's enrollment record for potential recovery or re-provisioning.

Answer

Delete the device from Intune.

Answer

Select the device and choose Retire.

Answer

Reset the device using the Company Portal.

MD-102 Manage and maintain devices Practice Test 15 — 15 Questions

Exhibit

MD-102 Manage and maintain devices Practice Test 15 — 15 Questions

Exhibit