MD-102 Manage and maintain devices Practice Test 16 — 15 Questions

Question 1

Your company uses Microsoft Intune to manage Windows 11 devices. A new regulatory requirement mandates that all company-owned devices must have their disk encrypted and that the recovery keys must be stored centrally. You have already enabled BitLocker through an Intune disk encryption policy. You need to ensure that the recovery keys are escrowed to Microsoft Entra ID and that only a specific group of administrators can view them. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the disk encryption policy to store recovery information in Microsoft Entra ID and assign the 'BitLocker key reader' role to the administrators.. The Intune disk encryption policy includes a setting that controls where recovery information is escrowed, and Microsoft Entra ID is the cloud option. To view those keys, administrators need the BitLocker key reader role, which is scoped specifically to key recovery and follows least privilege. Broader roles such as Cloud device administrator or Helpdesk administrator either over-privilege or fail to grant key access, and AD DS escrow does not meet the cloud storage requirement.

Answer

Configure the disk encryption policy to store recovery information in Microsoft Entra ID and assign the 'Cloud device administrator' role to the administrators.

Answer

Configure the disk encryption policy to store recovery information in Microsoft Entra ID and assign the 'Helpdesk administrator' role to the administrators.

Answer

Configure the disk encryption policy to store recovery information in Active Directory Domain Services and assign the 'BitLocker key reader' role to the administrators.

Question 2

You manage Windows 11 devices with Microsoft Intune. You need to deploy a new line-of-business (LOB) app that requires a specific registry key to be present before installation. The app package is an .intunewin file. You must ensure the registry key is created only if it does not exist, and the app installs only after the key is present. What should you do?

Accepted Answer

Create a proactive remediation that detects the missing registry key and creates it, and assign it to the device group before deploying the LOB app.. Proactive remediations are ideal for ensuring prerequisites are met before app deployment. By assigning a remediation that detects and creates the required registry key, you guarantee the key exists on target devices. This runs independently of the app deployment and can be scheduled to run before the app installs. It avoids the limitations of requirement rules and app dependencies, which cannot execute scripts to create registry keys.

Answer

Use a Win32 app dependency to chain a script that creates the registry key before the LOB app installs.

Answer

Add a requirement rule to the LOB app that checks for the registry key, and include a PowerShell script in the app package to create the key.

Answer

Deploy a PowerShell script as a platform script that creates the registry key, and configure the LOB app to depend on the script.

Question 3

You manage 500 Windows 11 devices with Microsoft Intune. A security requirement states that after a device has been idle for 15 minutes, the screen must lock and a PIN must be required to unlock it. You create a device configuration profile. Which policy type should you configure to meet the requirement?

Accepted Answer

Settings catalog policy. The requirement is to push a device-level restriction that locks the screen after idle time and requires a PIN. Settings catalog is the Intune configuration profile type that surfaces the DeviceLock CSP settings needed to enforce this on Windows 11, whereas compliance policies only assess, endpoint security policies target other areas, and app protection policies act at the app layer.

Answer

App protection policy

Answer

Endpoint security policy

Answer

Compliance policy

Question 4

You manage devices in Microsoft Intune. You need to ensure that when a device is marked as noncompliant, it is automatically retired after 30 days. Which TWO actions should you perform? (Choose two.)

Accepted Answer

Assign the compliance policy to the target device groups.. To automatically retire noncompliant devices after 30 days, you need a compliance policy that defines the action for noncompliance as retire after 30 days, and you must assign that policy to the relevant device groups. Compliance policies are the only Intune feature that can trigger automatic retirement based on noncompliance.

Answer

Set the device compliance policy to mark devices as noncompliant immediately.

Answer

Create a conditional access policy to block access for noncompliant devices.

Answer

Configure a device configuration profile to retire noncompliant devices.

Question 5

You manage Windows 11 devices with Microsoft Intune. You need to configure a Windows Update ring policy to meet the following requirements: (1) updates must be installed outside of business hours, and (2) users must be able to control when to restart. Which two settings should you configure? (Choose two.)

Accepted Answer

Active hours. Active hours ensure updates do not install during business hours, and engaged restart with a grace period gives users control over when the device restarts. Together, these settings meet both requirements. Other settings either force restarts or are unrelated to timing and user control.

Answer

Deadline for quality updates: '7 days'

Answer

Delivery Optimization: 'HTTP only'

Answer

Automatic update behavior: 'Auto install and restart at a scheduled time'

Question 6

You manage Windows 10 and Windows 11 devices in Microsoft Intune. You need to create a device configuration profile that applies a set of settings to all Windows devices in a group, but a subset of devices must receive different values for a few of those settings. What should you do to minimize administrative effort?

Accepted Answer

Create a settings catalog policy that includes all required settings, assign it to all devices, and create a second settings catalog policy containing only the differing settings assigned to the subset with a higher priority.. Using two settings catalog policies, one broad and one narrow, limits duplication to only the settings that differ. The base policy covers all devices, while the second policy refines values for the subset. This approach reduces administrative overhead compared with duplicating an entire profile and is more precise than using filters, which apply only at the assignment level.

Answer

Create a configuration profile and assign it to the group, then use filters to exclude the subset of devices from specific settings.

Answer

Create a second configuration profile with the different settings and assign it to the subset of devices.

Answer

Use a settings catalog policy and configure the settings that need different values as variables that can be overridden per device.

Question 7

You manage a fleet of Windows 11 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant, the user receives an email notification with details about the noncompliance and steps to remediate. The email must be sent to the user's Microsoft 365 mailbox. What should you configure?

Accepted Answer

In the compliance policy, add an action for noncompliance to send an email to the user. The email is automatically sent to the user's Microsoft 365 mailbox if the user has an Exchange Online mailbox.. The compliance policy action to send an email to the user for noncompliance sends the notification to the user's primary email address, which is their Microsoft 365 mailbox if they have Exchange Online. You do not need to specify a recipient; Intune uses the user's UPN or primary SMTP address. This is the correct way to ensure the user receives an email about noncompliance.

Answer

Configure a Conditional Access policy to require compliant devices, and set the grant control to 'Require device to be marked as compliant'. Then, in the compliance policy, add an action for noncompliance to send an email to the user.

Answer

In the compliance policy, add an action for noncompliance to send an email to the user. Ensure the user has a valid email address in their Azure AD profile.

Answer

In the compliance policy, add an action for noncompliance to send an email to the user, and specify the recipient as the user's email address.

Question 8

You are the endpoint administrator for a company that uses Microsoft Intune. You need to ensure that all Windows 11 devices automatically receive the latest security intelligence updates for Microsoft Defender Antivirus. You want to minimize administrative effort. What should you configure?

Accepted Answer

An Intune update ring for Microsoft Defender definitions with the update interval set to daily. Microsoft Intune offers a specific update ring for Microsoft Defender definitions, separate from Windows quality and feature update rings. By creating and assigning this update ring with a daily update interval, you ensure that all targeted Windows 11 devices automatically download and install the latest security intelligence updates. This requires minimal administrative effort and directly addresses the requirement.

Answer

A Windows Update ring for Business with the 'Defender update' setting configured

Answer

A Microsoft Defender for Endpoint security baseline with the security intelligence update schedule set

Answer

A device configuration profile with the Defender security intelligence update setting set to 'Enabled'

Question 9

You are troubleshooting a Windows 11 device that is enrolled in Microsoft Intune. The device is not receiving any policies or apps. You have verified that the device is online and the user can sign in. You need to diagnose why the device is not communicating with Intune. Which action should you take first?

Accepted Answer

Verify the MDM certificate on the device.. The MDM certificate is essential for device authentication with Intune. If it is expired or missing, the device cannot communicate with the service, resulting in no policies or apps being received. Verifying the certificate is the first diagnostic step to identify communication failures. Other actions may be part of troubleshooting but do not directly address the root cause.

Answer

Restart the Intune Management Extension service.

Answer

Run a sync from the Company Portal app.

Answer

Check the device's compliance status in the Intune portal.

Question 10

You manage Windows 11 devices with Microsoft Intune. You need to ensure that devices receive quality updates on a controlled schedule and that users cannot defer them indefinitely. Which TWO configurations should you use? (Choose two.)

Accepted Answer

Windows Update rings with a deferral period and a deadline. Update rings are the Intune mechanism for controlling quality updates. A deferral period stages the update, a deadline ensures it installs and restarts even if the user defers, and active hours restrict restarts to non-working times. Together these satisfy a controlled schedule that users cannot postpone forever. Feature update profiles, Delivery Optimization, and endpoint protection policies do not address quality update timing.

Answer

Delivery Optimization download mode policy

Answer

Windows Update for Business feature update profile

Answer

Endpoint protection disk encryption policy

Question 11

You manage Windows 10 and Windows 11 devices with Microsoft Intune. You need to deploy a Windows quality update to a group of devices as soon as possible. The update must be installed outside of active hours and the device must restart automatically to complete installation. What should you configure?

Accepted Answer

A Windows Update ring with 'Automatic update behavior' set to 'Auto install and restart at a scheduled time' and configure the 'Active hours' setting to exclude the desired installation window, and set a deadline.. To install outside active hours, you must define active hours to cover the user's typical working hours, so the installation window falls outside. The update ring setting 'Auto install and restart at a scheduled time' allows you to specify a time for installation and restart. A deadline ensures the update is enforced. This combination guarantees installation outside active hours and automatic restart.

Answer

A Windows Update ring with 'Automatic update behavior' set to 'Auto install and restart without end-user control' and set a deadline.

Answer

A Windows Update ring with 'Automatic update behavior' set to 'Auto install and restart at a scheduled time' and configure the 'Active hours' setting to start and end times that cover the desired installation window.

Answer

A Windows Update ring with 'Automatic update behavior' set to 'Auto install and restart at a scheduled time' and configure active hours.

Question 12

You manage 200 Windows 11 devices with Microsoft Intune. You need to configure a remediation that runs a custom script to clear the Temp folder if it exceeds 1 GB. The script must run only when the device is idle and not during business hours. What should you do?

Accepted Answer

Create a proactive remediation, enable the 'Run script when device is idle' option, and set a schedule outside business hours.. Proactive remediations support a condition to run only when the device is idle. By enabling this option and scheduling the remediation outside business hours, you ensure the script executes when the device is not actively used. This combination meets both requirements: running only when idle and not during business hours, while automating the cleanup of the Temp folder.

Answer

Create a proactive remediation and set the schedule to run daily at 2:00 AM.

Answer

Create a platform script and deploy it with a schedule that runs at 2:00 AM daily.

Answer

Create a proactive remediation and configure the 'Run script in 64-bit PowerShell' and 'Enforce script signature check' options.

Question 13

You manage a fleet of Windows 11 Enterprise devices enrolled in Microsoft Intune. A security requirement mandates that a specific set of registry values be enforced on all devices in the 'Finance' group, and these values must be re-applied automatically if changed. You need to implement this with the least administrative effort. What should you do?

Accepted Answer

Create a settings catalog policy that includes the required registry settings and assign it to the Finance group.. The settings catalog is the recommended way to configure and enforce registry settings at scale in Intune. It provides a single pane of glass for many settings, including those based on registry keys, and ensures they are reapplied if changed. Deploying a platform script or Win32 app only applies settings once, and custom OMA-URI profiles require more manual effort.

Answer

Create a PowerShell script and deploy it as a platform script to the Finance group.

Answer

Create a custom configuration profile using the 'Custom' OMA-URI settings for each registry value and assign it to the Finance group.

Answer

Deploy a Win32 app that writes the registry values and set it as required for the Finance group.

Question 14

You are troubleshooting a Windows 11 device that is enrolled in Microsoft Intune and configured with Windows Hello for Business. Users report that they can sign in with their PIN, but they are not prompted to set up biometric authentication (fingerprint or facial recognition). You need to ensure that users can use biometrics. What should you configure in Intune?

Accepted Answer

Enable the 'Use biometrics' setting in the Windows Hello for Business configuration.. The Windows Hello for Business configuration in Intune includes a 'Use biometrics' setting that controls whether users can enroll and use biometric authentication. When enabled, users are prompted to set up fingerprints or facial recognition during Windows Hello enrollment. Other settings like requiring Windows Hello or device restrictions do not directly control biometric availability.

Answer

Configure a device restriction policy to allow camera and fingerprint reader.

Answer

Configure a Windows Hello for Business policy with 'Convenience PIN' disabled.

Answer

Set the 'Require Windows Hello for Business' policy to 'Enabled'.

Question 15

You manage a large group of Windows 11 devices with Microsoft Intune. You need to run a script on all devices that requires administrator privileges, and you must ensure the script runs only once per device and reports success or failure to Intune. What should you create?

Accepted Answer

A platform script assigned to the device group with Run this script using the logged-on credentials set to No.. Platform scripts in Intune are designed to run PowerShell scripts on Windows devices. Setting Run this script using the logged-on credentials to No executes the script in the system context with administrator privileges. By default the script runs once per device, and Intune reports success or failure in the device status, which matches the requirement for privileged, single-run execution with reporting.

Answer

A proactive remediation script with a detection script and a remediation script.

Answer

A custom attribute script configured in the Intune admin center and assigned to all devices.

Answer

A PowerShell script deployed through a Win32 app with the install command set to run as system.