MD-102 Manage and maintain devices Practice Test 17 — 15 Questions

Question 1

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows devices? (Choose two)

Accepted Answer

View hardware inventory of a device.. The Microsoft Intune admin center provides a hardware inventory view for managed Windows devices, displaying details such as processor, RAM, disk space, and firmware version. This data is collected via the Intune Management Extension and device inventory reports, enabling administrators to assess device compliance and readiness without requiring on-premises tools.

Answer

Reset a user's password.

Answer

Manage on-premises Active Directory objects.

Answer

Assign Microsoft 365 licenses to a user.

Question 2

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are planning to upgrade them to Windows 11. The devices must meet the Windows 11 hardware requirements. You need to identify which devices are eligible for upgrade and then deploy Windows 11 using a feature update policy in Intune. You have the following requirements: (1) Generate a report of devices that are not eligible due to TPM 2.0 or CPU incompatibility. (2) Deploy Windows 11 to eligible devices using a phased approach: first to IT department (200 devices), then to pilot users (500 devices), and finally to all remaining devices. (3) Ensure that devices in the IT department receive the update within 7 days of Microsoft's release, while pilot users receive it after 30 days, and remaining devices after 60 days. (4) Monitor deployment progress and roll back if critical issues are detected. What should you do?

Accepted Answer

Create feature update policies for Windows 10 and later, targeting each group with appropriate deferral settings. Use the Windows 11 readiness report to identify eligible devices.. Feature update policies in Intune allow you to deploy Windows 11 to specific groups with deferral settings (days after release). The Windows 11 readiness report identifies devices that are not eligible due to TPM 2.0 or CPU incompatibility. Option B is incorrect because Windows Update for Business group policies in on-premises AD are not managed via Intune and cannot use the readiness report. Option C is incorrect because update rings are for quality updates, not feature updates. Option D is incorrect because Windows Autopilot is used for initial provisioning, not for upgrading existing devices.

Answer

Configure Windows Update for Business group policies in on-premises AD.

Answer

Use update rings with different deferral periods for each group.

Answer

Use Windows Autopilot to deploy Windows 11 images to devices.

Question 3

Your organization uses Microsoft Intune to manage 1,000 Windows 10 devices and 500 iOS devices. You need to enforce device compliance policies. For Windows devices, you require BitLocker encryption and Windows Defender Antivirus enabled. For iOS devices, you require a passcode of at least 6 characters and device encryption. Devices that become noncompliant should be marked as such and users should receive a notification email. After 7 days of noncompliance, the device should be blocked from accessing corporate email. You also need to create a report that shows the compliance status of all devices. Which combination of actions should you take?

Accepted Answer

Create Windows and iOS compliance policies with the required settings. Configure actions for noncompliance: send email immediately and block access after 7 days. Use the built-in compliance report.. Intune compliance policies directly enforce device-level settings like BitLocker and passcode length, and they include built-in actions for noncompliance (e.g., send email, block access after a specified number of days). The built-in compliance report in the Intune portal provides an immediate view of all devices' compliance status without requiring manual scripting or additional tools.

Answer

Create app protection policies to require encryption and passcode. Use conditional access to block noncompliant devices.

Answer

Create device configuration profiles for BitLocker and encryption. Use conditional access to block noncompliant devices. Manually generate reports using PowerShell.

Answer

Use Autopilot to enforce encryption and passcode. Use Intune reporting for compliance status.

Question 4

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

Accepted Answer

Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.. Deploying a staging server (or an Azure AD Connect staging server) allows the initial device synchronization to Azure AD to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Answer

Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

Answer

Use Windows Autopilot to reset the devices and enroll them in Intune.

Answer

Manually enroll each device by signing in to the Company Portal.

Question 5

You manage Windows 10 devices with Microsoft Intune. A user reports that their device is not receiving required compliance policies, and the device status in Intune shows 'Not evaluated' for compliance. You confirm the device is enrolled and able to sync. What should you check first?

Accepted Answer

Ensure the compliance policy is assigned to a group that includes the user or device.. A compliance policy must be assigned to a group containing the user or device for it to be evaluated. Even if the device is enrolled and syncing, without assignment the policy will not apply, resulting in a 'Not evaluated' status in Intune.

Answer

Verify that the user is assigned an Intune license.

Answer

Run the 'dsregcmd /status' command to check the device registration status.

Answer

Check that the device has a TPM chip enabled and Secure Boot turned on.

Question 6

You need to deploy a critical security update to 500 Windows 10 devices managed by Intune. The update must be installed by the end of the week. Which deployment method should you use?

Accepted Answer

Create a Windows 10 update ring in Intune and enable expedited quality updates.. Intune's expedited quality updates allow you to bypass standard deferral periods and force-install critical security updates within days, not weeks. This is the only method that guarantees installation by the end of the week for 500 devices managed solely by Intune, as it leverages the Windows Update service with a reduced deadline (e.g., 2 days) and immediate restart behavior.

Answer

Configure a Windows Update for Business deferral policy in Intune.

Answer

Use Windows Autopatch to automatically deploy the update.

Answer

Create a WSUS policy and push it via Group Policy.

Question 7

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

Accepted Answer

Configure a selective wipe policy.. A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Answer

Configure a compliance policy to mark the device as noncompliant.

Answer

Configure a remote lock action.

Answer

Configure a full wipe action.

Question 8

You have a Windows 11 device enrolled in Intune that is not receiving configuration profiles. The device shows 'Pending' status for all profiles. You confirm the device is connected to the internet and can reach Microsoft's servers. What is the most likely cause?

Accepted Answer

The device is not syncing with Intune.. If the device is not syncing, it will show 'Pending'. Option A is wrong because group membership is for assignment, not sync. Option B is wrong because certificate issues affect authentication, not profile delivery. Option D is wrong because the Intune service health is for global issues, not a single device.

Answer

The device is not in the correct security group for the profile assignment.

Answer

The device has a certificate issue preventing it from receiving profiles.

Answer

The Intune service is experiencing an outage.

Question 9

You are troubleshooting a Windows 11 device that fails to receive a PowerShell script deployed via Intune. The script is assigned to a group containing the device. Other policies on the device apply successfully. What should you check first?

Accepted Answer

Check the Windows PowerShell execution policy on the device.. The Windows PowerShell execution policy controls whether scripts can run on the device. Even if the script is successfully delivered by Intune, a restrictive execution policy (e.g., Restricted) will block its execution. Since other policies apply successfully, connectivity and group membership are not the issue, making the execution policy the most likely cause.

Answer

Ensure the device has internet connectivity.

Answer

Check that the script is digitally signed.

Answer

Verify that the device is in the correct security group.

Question 10

You need to ensure that all corporate-owned Windows 11 devices automatically install critical security updates as soon as they are released by Microsoft. Which Intune feature should you configure?

Accepted Answer

Expedited quality updates in a Windows 10 update ring.. Expedited quality updates in a Windows 10 update ring allow you to push critical security updates immediately, bypassing any deferral periods or gradual rollout settings. This feature uses the Windows Update for Business service to force the installation of a specific update as soon as it is released by Microsoft, ensuring compliance with security requirements for corporate-owned devices.

Answer

A WSUS policy pushed via Group Policy.

Answer

Windows 10 update rings with a deferral period of 0 days.

Answer

Windows Autopatch.

Question 11

A user reports that their iOS device is unable to access corporate email after updating to a new iOS version. Other iOS devices are working fine. The device is enrolled in Intune and shows as compliant. What should you check?

Accepted Answer

Check the conditional access policy in Microsoft Entra ID to ensure the device platform is still supported.. When a device is compliant but still fails to access corporate email after an iOS update, the most likely cause is that the conditional access policy in Microsoft Entra ID (formerly Azure AD) has been updated to block the new iOS version. Conditional access policies can specify allowed device platforms and OS versions; if the new iOS version is not explicitly permitted, access will be denied even though the device is compliant. This is a common scenario after major OS updates, as administrators must update the policy to include the new version.

Answer

Ensure the email profile is configured correctly.

Answer

Confirm that the device is still enrolled in Intune.

Answer

Verify that the device compliance policy includes the new iOS version.

Question 12

You are planning to deploy a custom line-of-business (LOB) app to 200 Windows 11 devices using Intune. The app requires a specific registry key to be present before installation. What should you do?

Accepted Answer

Add a requirement rule to the app deployment that runs a PowerShell script to check for the registry key.. Intune's requirement rules allow you to run a PowerShell script that checks for the existence of a specific registry key before the app installs. If the script returns a non-zero exit code, Intune will not proceed with the installation, ensuring the prerequisite is met. This is the only option that directly enforces a precondition for the app installation without requiring additional apps or policies.

Answer

Add the app as a dependency for another app that creates the registry key.

Answer

Use an app configuration policy to set the registry key before the app installs.

Answer

Create a custom compliance policy to enforce the registry key.

Question 13

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Accepted Answer

Create a device compliance policy that checks for required settings.. A device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Answer

Configure an Exchange Active Sync policy in Intune.

Answer

Create a device configuration profile to enforce security settings.

Answer

Deploy an app protection policy for Outlook for iOS and Android.

Question 14

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Accepted Answer

Create a Windows 10 feature update deployment policy.. A Windows 10 feature update deployment policy is the specific Intune policy type designed to deliver feature updates (like version 22H2) to devices. This policy allows you to specify the target version and control the rollout, which is required for deploying feature updates via Intune.

Answer

Create a device compliance policy for the target version.

Answer

Create a Windows 10 update ring with expedited updates.

Question 15

Which TWO troubleshooting steps should you take when a Windows 11 device fails to enroll in Intune with error code 0x80180014?

Accepted Answer

Check if the device is already enrolled in another MDM provider.. Error code 0x80180014 typically indicates that the device is already enrolled with another MDM provider, such as Microsoft Configuration Manager (with co-management) or a third-party MDM like VMware Workspace ONE. Intune enforces a single-MDM enrollment policy per device; if a prior MDM enrollment is detected, the new enrollment attempt fails. Checking for existing MDM enrollment is therefore the correct first step.

Answer

Ensure that the device is in the correct enrollment profile group.

Answer

Recreate the device compliance policy.

Answer

Check if the device has TPM 2.0 enabled.