MD-102 Manage and maintain devices Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the result?

Accepted Answer

A count of unique Windows devices per device name in the last 7 days.. The KQL query uses `DeviceInfo` (a Microsoft Sentinel table for device inventory), filters with `where` to include only rows where `OperatingSystem` contains 'Windows', then uses `summarize` with `dcount(DeviceName)` to count distinct device names, and `bin(TimeGenerated, 7d)` to group by 7-day intervals. This produces a count of unique Windows devices per device name over the last 7 days, making option C correct.

Answer

A list of all devices regardless of operating system.

Answer

A list of all Windows devices with their last activity.

Answer

A count of security alerts per device.

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

Accepted Answer

Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.. Option C is correct because Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Answer

Set up an automatic enrollment policy that retires devices after 30 days of inactivity.

Answer

Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.

Answer

Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.

Question 3

Refer to the exhibit. You are configuring a Windows Update Ring policy in Microsoft Intune. You want the pilot devices to install feature updates 30 days after Microsoft releases them, but you also need to ensure that users cannot postpone updates indefinitely. However, users are reporting that updates are installing outside of active hours. What is the most likely cause?

Accepted Answer

The device's time zone is not aligned with the active hours configured in the policy.. Option C is correct because Windows Update for Business uses the device's local time zone to determine active hours. If the device's time zone does not match the active hours configured in the Intune policy, updates can install outside the intended window, even if the policy settings are otherwise correct.

Answer

The 'updateNotificationLevel' is set to 2, which suppresses user notifications about updates.

Answer

The 'automaticUpdateBehavior' value of 4 is incorrect; it should be set to 3 to install during active hours.

Answer

The feature update deferral of 30 days is too short; it should be 60 days to align with the pilot timeline.

Question 4

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved apps can be installed on corporate devices. Which policy type should you configure?

Accepted Answer

App Protection Policy with 'Allow only managed apps' setting.. Option D is correct because App Protection Policies (APP) in Microsoft Intune control which apps can access corporate data on iOS devices. The 'Allow only managed apps' setting restricts data transfer and app usage to apps that are managed by Intune, effectively preventing installation of unapproved apps. This is the appropriate policy for enforcing approved app installation on corporate devices.

Answer

Device Configuration Profile with 'Allow app installation only from App Store' setting.

Answer

App Configuration Policy to restrict app installation.

Answer

Device Compliance Policy with 'Require approved apps' setting.

Question 5

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

Accepted Answer

Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.. Option A is correct because Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Answer

Create a device configuration profile with a custom OMA-URI setting to execute the script.

Answer

Use a device compliance policy to trigger the script when noncompliant.

Answer

Use Intune proactive remediations and configure the script to run as a detection script.

Question 6

You are troubleshooting a Windows 11 device that is enrolled in Microsoft Intune. The device shows 'Pending' status for a required app deployment. The app is a line-of-business (LOB) app. The device has been online for the past 24 hours. What is the most likely cause?

Accepted Answer

The Intune management extension is not installed on the device.. The Intune management extension is responsible for deploying line-of-business (LOB) apps and PowerShell scripts on Windows devices. If this extension is not installed, the device will show a 'Pending' status for required app deployments because the Intune service cannot initiate the download or installation. Since the device has been online, connectivity is not the issue, and the extension must be present to process the deployment.

Answer

The device does not have internet connectivity to download the app.

Answer

The device's certificate for Intune is expired.

Answer

The device requires a restart to complete previous updates.

Question 7

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

Accepted Answer

Selective wipe from the Intune console.. Option B is correct because a selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Answer

Full wipe from the Intune console.

Answer

Delete the device from Microsoft Entra ID.

Answer

Retire the device from Intune.

Question 8

You are implementing Windows Autopilot for your organization. You need to ensure that during the first boot, the device automatically enrolls in Microsoft Intune and joins Microsoft Entra ID. What is the minimum requirement for the device?

Accepted Answer

The device must be registered in Autopilot with a valid profile.. Option D is correct because Windows Autopilot requires the device to be registered in the Autopilot service with a valid profile assigned. This profile contains the settings that dictate the out-of-box experience (OOBE), including automatic enrollment into Microsoft Intune and joining Microsoft Entra ID (formerly Azure AD). Without a registered Autopilot profile, the device will not trigger the automated enrollment and join process during first boot.

Answer

The device must have a local administrator account.

Answer

The device must be joined to an on-premises Active Directory domain.

Answer

The device must have a TPM 2.0 chip.

Question 9

Refer to the exhibit. You are creating a device filter in Microsoft Intune to target a policy to Windows 10 Pro devices. The filter should only apply to devices running OS build 1904x (20H1 or later). However, some devices with build 1904x and SKU Professional are not receiving the policy. What is the most likely reason?

Accepted Answer

The device.skuFamily property value is case-sensitive and may not match 'Professional'.. Option D is correct because the `device.skuFamily` property in Microsoft Intune is case-sensitive. When creating a device filter rule, the value 'Professional' must exactly match the case of the SKU family string returned by the device. If the actual SKU family is reported as 'Professional' with a different casing (e.g., 'professional' or 'PROFESSIONAL'), the filter will not match, causing the policy not to apply to those devices.

Answer

The -startsWith operator does not work for osVersion property.

Answer

The device must be enrolled via Autopilot for filters to apply.

Answer

The filter rule syntax is incorrect because of the parentheses.

Question 10

You need to configure Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. What is the recommended method to onboard devices?

Accepted Answer

Use a device configuration profile in Intune to deploy the onboarding package.. Option B is correct because Intune's device configuration profiles allow you to deploy the Defender for Endpoint onboarding package (a .zip containing the onboarding script and required files) directly to Windows 10 devices. This method is recommended as it integrates seamlessly with Intune's management framework, supports bulk deployment via policies, and ensures devices are properly configured without manual intervention or user interaction.

Answer

Install the Defender for Endpoint client manually on each device.

Answer

Use the Microsoft 365 Defender portal to generate a script that users run.

Answer

Use Group Policy to configure the onboarding registry keys.

Question 11

Which TWO actions should you take to ensure that Windows Update for Business settings are applied to all Windows 10 devices in your organization? (Choose two)

Accepted Answer

Create an update ring policy in Microsoft Intune.. B is correct because Windows Update for Business (WUfB) policies are configured through update ring policies in Microsoft Intune, which control how and when Windows 10 devices receive updates from Microsoft's update servers. This allows organizations to manage update deployment without needing on-premises infrastructure like WSUS.

Answer

Configure a WSUS server to synchronize updates.

Answer

Enable peer-to-peer content sharing for Windows updates.

Answer

Create a device compliance policy to enforce update installation.

Question 12

Which THREE steps are required to configure a Windows 10 device for kiosk mode using Microsoft Intune? (Choose three)

Accepted Answer

Create a device configuration profile with the kiosk settings.. Option C is correct because a device configuration profile in Microsoft Intune is the mechanism used to define the specific kiosk settings, such as the user account, app type (e.g., single-app or multi-app kiosk), and browser configuration. This profile applies the kiosk mode configuration to the device via the Windows 10/11 kiosk policy CSP (Policy Configuration Service Provider).

Answer

Configure Autopilot for the device.

Answer

Create a device compliance policy to enforce kiosk mode.

Question 13

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows devices? (Choose two)

Accepted Answer

View hardware inventory of a device.. Option B is correct because the Microsoft Intune admin center provides a hardware inventory view for managed Windows devices, displaying details such as processor, RAM, disk space, and firmware version. This data is collected via the Intune Management Extension and device inventory reports, enabling administrators to assess device compliance and readiness without requiring on-premises tools.

Answer

Reset a user's password.

Answer

Manage on-premises Active Directory objects.

Answer

Assign Microsoft 365 licenses to a user.

Question 14

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are planning to upgrade them to Windows 11. The devices must meet the Windows 11 hardware requirements. You need to identify which devices are eligible for upgrade and then deploy Windows 11 using a feature update policy in Intune. You have the following requirements: (1) Generate a report of devices that are not eligible due to TPM 2.0 or CPU incompatibility. (2) Deploy Windows 11 to eligible devices using a phased approach: first to IT department (200 devices), then to pilot users (500 devices), and finally to all remaining devices. (3) Ensure that devices in the IT department receive the update within 7 days of Microsoft's release, while pilot users receive it after 30 days, and remaining devices after 60 days. (4) Monitor deployment progress and roll back if critical issues are detected. What should you do?

Accepted Answer

Create feature update policies for Windows 10 and later, targeting each group with appropriate deferral settings. Use the Windows 11 readiness report to identify eligible devices.. Option C is correct because feature update policies allow you to specify deferral periods and target groups. The readiness report identifies incompatibilities. Option A is wrong because update rings are for quality updates, not feature updates. Option B is wrong because Autopilot is for initial provisioning, not upgrades. Option D is wrong because Windows Update for Business group policies are not managed via Intune.

Answer

Configure Windows Update for Business group policies in on-premises AD.

Answer

Use update rings with different deferral periods for each group.

Answer

Use Windows Autopilot to deploy Windows 11 images to devices.

Question 15

Your organization uses Microsoft Intune to manage 1,000 Windows 10 devices and 500 iOS devices. You need to enforce device compliance policies. For Windows devices, you require BitLocker encryption and Windows Defender Antivirus enabled. For iOS devices, you require a passcode of at least 6 characters and device encryption. Devices that become noncompliant should be marked as such and users should receive a notification email. After 7 days of noncompliance, the device should be blocked from accessing corporate email. You also need to create a report that shows the compliance status of all devices. Which combination of actions should you take?

Accepted Answer

Create Windows and iOS compliance policies with the required settings. Configure actions for noncompliance: send email immediately and block access after 7 days. Use the built-in compliance report.. Option A is correct because compliance policies define the rules, and conditional access blocks access. The compliance report is built-in. Option B is wrong because configuration profiles do not enforce compliance. Option C is wrong because app protection policies do not enforce device-level compliance. Option D is wrong because Autopilot does not enforce compliance.

Answer

Create app protection policies to require encryption and passcode. Use conditional access to block noncompliant devices.

Answer

Create device configuration profiles for BitLocker and encryption. Use conditional access to block noncompliant devices. Manually generate reports using PowerShell.

Answer

Use Autopilot to enforce encryption and passcode. Use Intune reporting for compliance status.

MD-102 Manage and maintain devices Practice Test 16 — 15 Questions

Exhibit

MD-102 Manage and maintain devices Practice Test 16 — 15 Questions

Exhibit