MD-102 Manage and maintain devices Practice Test 17 — 15 Questions

Question 1

You manage Windows 10 and Windows 11 devices with Microsoft Intune. You need to configure a compliance policy that requires devices to have a specific minimum OS version and to have BitLocker enabled. You also want to ensure that noncompliant devices are marked and can be targeted by conditional access. Which two actions should you perform? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a compliance policy with the 'Minimum OS version' setting configured for Windows 10 and Windows 11.. To meet the requirements, you need a compliance policy that includes both the minimum OS version and the BitLocker requirement. These settings are configured within the compliance policy, and then the policy is assigned to devices. Conditional access can then use the compliance state to control access.

Answer

Assign the compliance policy to all devices and set the action for noncompliance to 'Mark device noncompliant'.

Answer

Create a device configuration profile with the 'Require BitLocker' setting.

Answer

Create a conditional access policy that requires compliant devices.

Question 2

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

Accepted Answer

Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.. Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Microsoft Entra ID group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Answer

Include the settings in the Windows 365 provisioning policy.

Answer

Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

Answer

Use a Group Policy Object (GPO) applied via on-premises AD.

Question 3

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

Accepted Answer

A compliance policy was updated requiring a newer OS version or additional security settings.. Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Answer

The user's Intune license has expired.

Answer

The Outlook app is not installed on the device.

Answer

The device is not enrolled in Intune.

Question 4

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

Accepted Answer

The root CA certificate required to validate the RADIUS server certificate is not installed on the device.. The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Answer

The user's password has expired.

Answer

The Wi-Fi profile is not assigned to the user's device.

Answer

The device's Wi-Fi adapter driver is outdated.

Question 5

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

Accepted Answer

Check if the user has logged in and acknowledged the FileVault prompt.. FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Answer

Ensure that a compliance policy is also assigned requiring encryption.

Answer

Ensure the devices are supervised.

Answer

Verify that the profile is assigned to the correct device group.

Question 6

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

Accepted Answer

The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.. The compliance policy includes a rule for 'Maximum days since last check-in', which checks the `lastSyncDateTime` property. Devices that have not synced within the configured threshold (e.g., 30 days) are marked as noncompliant. This is a common Intune compliance setting for Windows devices to ensure they regularly communicate with the service.

Answer

The devices failed to enroll properly.

Answer

The devices are running a non-Windows operating system.

Answer

The devices have names that do not match the naming convention.

Question 7

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 8

Your organization is planning to deploy Windows 10 updates using Windows Update for Business. You need to ensure that critical security updates are installed within 7 days of release. Which configuration should you use?

Accepted Answer

Set a deadline for quality updates to 7 days. To ensure critical security updates are installed within 7 days of release, set a deadline for quality updates to 7 days. A deadline specifies the maximum number of days after the update is offered that the device has to install it. This enforces installation within the desired timeframe. A deferral period delays when the update is offered, which would not guarantee installation within 7 days.

Answer

Create a feature update policy for Windows 10

Answer

Configure a deferral period of 7 days for quality updates

Answer

Pause quality updates for 7 days

Question 9

You are troubleshooting an Intune-managed Windows 10 device that is not receiving a required application. Which THREE steps should you take to diagnose the issue? (Choose three.)

Accepted Answer

Ensure the device has network connectivity. Option A is correct because an Intune-managed Windows 10 device must have network connectivity to reach the Intune service (and the Microsoft Store/CDN or Win32 app content source), otherwise it cannot download policies or the required application. Option B is correct because Intune app requirement rules (such as OS version, architecture, or minimum OS) are evaluated before delivery; if the device fails a rule, the app will not be offered or installed. Option C is correct because checking the app assignment status in the Intune console shows whether the app is targeted to the user/device group and whether the assignment is required, available, or uninstall, which directly explains why the app is not being received. Option D is not correct because compliance policies govern conditional access and device health, not app delivery; a noncompliant device can still receive required apps. Option E is not correct because a factory reset is a drastic remediation step, not a diagnostic step, and it would not identify the root cause.

Answer

Verify the device is compliant with compliance policies

Answer

Perform a factory reset on the device

Question 10

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

Accepted Answer

Compliance policy. A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Answer

Device configuration policy

Answer

Windows Update for Business policy

Answer

Device health attestation policy

Question 11

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

Accepted Answer

Hybrid Azure AD join. Hybrid Microsoft Entra ID join is the correct approach because it allows devices that are joined to on-premises Active Directory to also register with Microsoft Entra ID, enabling Intune management while maintaining access to on-premises resources via Kerberos/NTLM authentication. This configuration synchronizes the device object from AD to Entra ID using Microsoft Entra Connect, creating a device identity that can be managed by Intune and can authenticate against both cloud and on-premises services without requiring a VPN.

Answer

Entra ID registered with on-premises domain join

Answer

Windows Autopilot self-deploying mode

Answer

Entra ID joined with VPN to on-premises

Question 12

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

Accepted Answer

PowerShell scripts (Devices > Scripts). PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Answer

Proactive remediations

Answer

Compliance policy

Answer

Device configuration profile

Question 13

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

Accepted Answer

Endpoint security > Disk encryption policy. To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Answer

Compliance policy for Windows 10

Answer

Windows Update for Business policy

Answer

Device configuration profile for Windows 10

Question 14

You are planning a Windows 11 deployment for 500 new devices using Windows Autopilot. The devices will be shipped directly to users from the manufacturer. You need to ensure that the devices are automatically enrolled in Intune and joined to Microsoft Entra ID. What should you do?

Accepted Answer

Register the device hashes in Intune and assign an Autopilot deployment profile. Windows Autopilot uses device hashes (hardware IDs) to identify devices in Intune. By registering these hashes and assigning an Autopilot deployment profile, the devices are automatically enrolled in Intune and joined to Microsoft Entra ID during the out-of-box experience (OOBE), without requiring manual intervention or additional infrastructure.

Answer

Pre-install the Intune Management Extension on each device

Answer

Configure a provisioning package and include it with the shipment

Answer

Create a hybrid Azure AD join configuration in Intune

Question 15

Which TWO actions can you perform using Microsoft Intune to manage Windows 10 devices?

Accepted Answer

Remotely wipe a device. Option B is correct because Microsoft Intune supports remote device actions such as a full wipe (and also selective wipe/retire) for Windows 10 devices enrolled in MDM, allowing an administrator to reset the device to factory settings and remove corporate data. Option D is correct because Intune provides built-in BitLocker disk encryption policies (via the Endpoint Security Disk Encryption profile or configuration profiles) that let you enforce and manage BitLocker on Windows 10 devices, including storing recovery keys in Microsoft Entra ID/Intune. Option A is not correct because Intune does not create local user accounts on Windows 10 devices; local account management is done via Group Policy, PowerShell, or other on-premises tools, not Intune MDM policy. Option C is not correct because DHCP settings are configured on the DHCP server or network infrastructure, not through Intune device management policies. Option E is not correct because adding a device to an Active Directory group is an on-premises AD/Group Policy or Microsoft Entra ID dynamic group operation, not an Intune device management action.

Answer

Create local user accounts on the device

Answer

Configure DHCP settings

Answer

Add the device to an Active Directory group