MD-102 Manage and maintain devices Practice Test 16 — 15 Questions

Question 1

You deploy a new line-of-business app to Windows 10 devices via Intune. Users report that the app does not appear in the Company Portal. You verify that the app is assigned to the correct group. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The app's installation behavior is set to 'System'.. When a line-of-business (LOB) app is deployed with installation behavior set to 'System', it installs in the device context and runs as SYSTEM. The Company Portal only displays apps installed in the user context. Even though the app is assigned to the correct group, it will not appear in the Company Portal because the portal filters out system-context apps. To make it visible, the installation behavior must be set to 'User'.

Answer

The app is not supported on Windows 10.

Answer

Users need to add the app manually.

Answer

The app is assigned to the wrong group.

Question 2

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

Accepted Answer

Automated investigation and response. The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Answer

Threat analytics

Answer

Device inventory

Answer

Alert queue

Question 3

You need to wipe a lost corporate-owned Windows 10 device that is enrolled in Intune. Which action should you take?

Accepted Answer

Select the device and choose Wipe.. The Wipe action in Intune restores a Windows 10 device to its factory default settings, removing all data and corporate access. This is the appropriate action for a lost corporate-owned device because it ensures sensitive data is erased while retaining the device's enrollment record for potential recovery or re-provisioning.

Answer

Delete the device from Intune.

Answer

Select the device and choose Retire.

Answer

Reset the device using the Company Portal.

Question 4

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the result?

Accepted Answer

A count of unique Windows devices per device name in the last 7 days.. The KQL query uses `DeviceInfo` (a Microsoft Sentinel table for device inventory), filters with `where` to include only rows where `OperatingSystem` contains 'Windows', then uses `summarize` with `dcount(DeviceName)` to count distinct device names, and `bin(TimeGenerated, 7d)` to group by 7-day intervals. This produces a count of unique Windows devices per device name over the last 7 days, making option C correct.

Answer

A list of all devices regardless of operating system.

Answer

A list of all Windows devices with their last activity.

Answer

A count of security alerts per device.

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

Accepted Answer

Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.. Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Answer

Set up an automatic enrollment policy that retires devices after 30 days of inactivity.

Answer

Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.

Answer

Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.

Question 6

Refer to the exhibit. You are configuring a Windows Update Ring policy in Microsoft Intune. You want the pilot devices to install feature updates 30 days after Microsoft releases them, but you also need to ensure that users cannot postpone updates indefinitely. However, users are reporting that updates are installing outside of active hours. What is the most likely cause?

Accepted Answer

The device's time zone is not aligned with the active hours configured in the policy.. Windows Update for Business uses the device's local time zone to determine active hours. If the device's time zone does not match the active hours configured in the Intune policy, updates can install outside the intended window, even if the policy settings are otherwise correct.

Answer

The 'updateNotificationLevel' is set to 2, which suppresses user notifications about updates.

Answer

The 'automaticUpdateBehavior' value of 4 is incorrect; it should be set to 3 to install during active hours.

Answer

The feature update deferral of 30 days is too short; it should be 60 days to align with the pilot timeline.

Question 7

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved apps can be installed on corporate devices. Which policy type should you configure?

Accepted Answer

App Protection Policy with 'Allow only managed apps' setting.. App Protection Policies (APP) in Microsoft Intune control which apps can access corporate data on iOS devices. The 'Allow only managed apps' setting restricts data transfer and app usage to apps that are managed by Intune, effectively preventing installation of unapproved apps. This is the appropriate policy for enforcing approved app installation on corporate devices.

Answer

Device Configuration Profile with 'Allow app installation only from App Store' setting.

Answer

App Configuration Policy to restrict app installation.

Answer

Device Compliance Policy with 'Require approved apps' setting.

Question 8

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

Accepted Answer

Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.. Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Answer

Create a device configuration profile with a custom OMA-URI setting to execute the script.

Answer

Use a device compliance policy to trigger the script when noncompliant.

Answer

Use Intune proactive remediations and configure the script to run as a detection script.

Question 9

You are troubleshooting a Windows 11 device that is enrolled in Microsoft Intune. The device shows 'Pending' status for a required app deployment. The app is a line-of-business (LOB) app. The device has been online for the past 24 hours. What is the most likely cause?

Accepted Answer

The Intune management extension is not installed on the device.. The Intune management extension is responsible for deploying line-of-business (LOB) apps and PowerShell scripts on Windows devices. If this extension is not installed, the device will show a 'Pending' status for required app deployments because the Intune service cannot initiate the download or installation. Since the device has been online, connectivity is not the issue, and the extension must be present to process the deployment.

Answer

The device does not have internet connectivity to download the app.

Answer

The device's certificate for Intune is expired.

Answer

The device requires a restart to complete previous updates.

Question 10

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

Accepted Answer

Selective wipe from the Intune console.. A selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Answer

Full wipe from the Intune console.

Answer

Delete the device from Microsoft Entra ID.

Answer

Retire the device from Intune.

Question 11

You are implementing Windows Autopilot for your organization. You need to ensure that during the first boot, the device automatically enrolls in Microsoft Intune and joins Microsoft Entra ID. What is the minimum requirement for the device?

Accepted Answer

The device must be registered in Autopilot with a valid profile.. Windows Autopilot requires the device to be registered in the Autopilot service with a valid profile assigned. This profile contains the settings that dictate the out-of-box experience (OOBE), including automatic enrollment into Microsoft Intune and joining Microsoft Entra ID (formerly Azure AD). Without a registered Autopilot profile, the device will not trigger the automated enrollment and join process during first boot.

Answer

The device must have a local administrator account.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

The device must have a TPM 2.0 chip.

Question 12

Refer to the exhibit. You are creating a device filter in Microsoft Intune to target a policy to Windows 10 Pro devices. The filter should only apply to devices running OS build 1904x (20H1 or later). However, some devices with build 1904x and SKU Professional are not receiving the policy. What is the most likely reason?

Accepted Answer

The device.skuFamily property value is case-sensitive and may not match 'Professional'.. The `device.skuFamily` property in Microsoft Intune is case-sensitive. When creating a device filter rule, the value 'Professional' must exactly match the case of the SKU family string returned by the device. If the actual SKU family is reported as 'Professional' with a different casing (e.g., 'professional' or 'PROFESSIONAL'), the filter will not match, causing the policy not to apply to those devices.

Answer

The -startsWith operator does not work for osVersion property.

Answer

The device must be enrolled via Autopilot for filters to apply.

Answer

The filter rule syntax is incorrect because of the parentheses.

Question 13

You need to configure Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. What is the recommended method to onboard devices?

Accepted Answer

Use a device configuration profile in Intune to deploy the onboarding package.. Intune's device configuration profiles allow you to deploy the Defender for Endpoint onboarding package (a .zip containing the onboarding script and required files) directly to Windows 10 devices. This method is recommended as it integrates seamlessly with Intune's management framework, supports bulk deployment via policies, and ensures devices are properly configured without manual intervention or user interaction.

Answer

Install the Defender for Endpoint client manually on each device.

Answer

Use the Microsoft 365 Defender portal to generate a script that users run.

Answer

Use Group Policy to configure the onboarding registry keys.

Question 14

Which TWO actions should you take to ensure that Windows Update for Business settings are applied to all Windows 10 devices in your organization? (Choose two)

Accepted Answer

Create an update ring policy in Microsoft Intune.. B is correct because Windows Update for Business (WUfB) policies are configured through update ring policies in Microsoft Intune, which control how and when Windows 10 devices receive updates from Microsoft's update servers. This allows organizations to manage update deployment without needing on-premises infrastructure like WSUS.

Answer

Configure a WSUS server to synchronize updates.

Answer

Enable peer-to-peer content sharing for Windows updates.

Answer

Create a device compliance policy to enforce update installation.

Question 15

Which THREE steps are required to configure a Windows 10 device for kiosk mode using Microsoft Intune? (Choose three)

Accepted Answer

Create a device configuration profile with the kiosk settings.. A device configuration profile in Microsoft Intune is the mechanism used to define the specific kiosk settings, such as the user account, app type (e.g., single-app or multi-app kiosk), and browser configuration. This profile applies the kiosk mode configuration to the device via the Windows 10/11 kiosk policy CSP (Policy Configuration Service Provider).

Answer

Configure Autopilot for the device.

Answer

Create a device compliance policy to enforce kiosk mode.