MD-102 Manage and maintain devices Practice Test 17 — 15 Questions

Question 1

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

Accepted Answer

Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.. Option B is correct because deploying a staging server (or an Azure AD Connect staging server) allows the initial device synchronization to Azure AD to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Answer

Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

Answer

Use Windows Autopilot to reset the devices and enroll them in Intune.

Answer

Manually enroll each device by signing in to the Company Portal.

Question 2

You manage Windows 10 devices with Microsoft Intune. A user reports that their device is not receiving required compliance policies, and the device status in Intune shows 'Not evaluated' for compliance. You confirm the device is enrolled and able to sync. What should you check first?

Accepted Answer

Ensure the compliance policy is assigned to a group that includes the user or device.. Option D is correct because a compliance policy must be assigned to a group containing the user or device for it to be evaluated. Even if the device is enrolled and syncing, without assignment the policy will not apply, resulting in a 'Not evaluated' status in Intune.

Answer

Verify that the user is assigned an Intune license.

Answer

Run the 'dsregcmd /status' command to check the device registration status.

Answer

Check that the device has a TPM chip enabled and Secure Boot turned on.

Question 3

You need to deploy a critical security update to 500 Windows 10 devices managed by Intune. The update must be installed by the end of the week. Which deployment method should you use?

Accepted Answer

Create a Windows 10 update ring in Intune and enable expedited quality updates.. Option A is correct because Intune's expedited quality updates allow you to bypass standard deferral periods and force-install critical security updates within days, not weeks. This is the only method that guarantees installation by the end of the week for 500 devices managed solely by Intune, as it leverages the Windows Update service with a reduced deadline (e.g., 2 days) and immediate restart behavior.

Answer

Configure a Windows Update for Business deferral policy in Intune.

Answer

Use Windows Autopatch to automatically deploy the update.

Answer

Create a WSUS policy and push it via Group Policy.

Question 4

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

Accepted Answer

Configure a selective wipe policy.. A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Answer

Configure a compliance policy to mark the device as noncompliant.

Answer

Configure a remote lock action.

Answer

Configure a full wipe action.

Question 5

You have a Windows 11 device enrolled in Intune that is not receiving configuration profiles. The device shows 'Pending' status for all profiles. You confirm the device is connected to the internet and can reach Microsoft's servers. What is the most likely cause?

Accepted Answer

The device is not syncing with Intune.. Option C is correct because if the device is not syncing, it will show 'Pending'. Option A is wrong because group membership is for assignment, not sync. Option B is wrong because certificate issues affect authentication, not profile delivery. Option D is wrong because the Intune service health is for global issues, not a single device.

Answer

The device is not in the correct security group for the profile assignment.

Answer

The device has a certificate issue preventing it from receiving profiles.

Answer

The Intune service is experiencing an outage.

Question 6

You are troubleshooting a Windows 11 device that fails to receive a PowerShell script deployed via Intune. The script is assigned to a group containing the device. Other policies on the device apply successfully. What should you check first?

Accepted Answer

Check the Windows PowerShell execution policy on the device.. Option B is correct because PowerShell scripts require the execution policy to be set to allow scripts. Option A is wrong because group assignment is correct. Option C is wrong because network issues would affect all policies. Option D is wrong because script signing is required if the execution policy is restricted, but the first step is to check the execution policy.

Answer

Ensure the device has internet connectivity.

Answer

Check that the script is digitally signed.

Answer

Verify that the device is in the correct security group.

Question 7

You need to ensure that all corporate-owned Windows 11 devices automatically install critical security updates as soon as they are released by Microsoft. Which Intune feature should you configure?

Accepted Answer

Expedited quality updates in a Windows 10 update ring.. Expedited quality updates in a Windows 10 update ring allow you to push critical security updates immediately, bypassing any deferral periods or gradual rollout settings. This feature uses the Windows Update for Business service to force the installation of a specific update as soon as it is released by Microsoft, ensuring compliance with security requirements for corporate-owned devices.

Answer

A WSUS policy pushed via Group Policy.

Answer

Windows 10 update rings with a deferral period of 0 days.

Answer

Windows Autopatch.

Question 8

A user reports that their iOS device is unable to access corporate email after updating to a new iOS version. Other iOS devices are working fine. The device is enrolled in Intune and shows as compliant. What should you check?

Accepted Answer

Check the conditional access policy in Microsoft Entra ID to ensure the device platform is still supported.. Option A is correct because when a device is compliant but still fails to access corporate email after an iOS update, the most likely cause is that the conditional access policy in Microsoft Entra ID (formerly Azure AD) has been updated to block the new iOS version. Conditional access policies can specify allowed device platforms and OS versions; if the new iOS version is not explicitly permitted, access will be denied even though the device is compliant. This is a common scenario after major OS updates, as administrators must update the policy to include the new version.

Answer

Ensure the email profile is configured correctly.

Answer

Confirm that the device is still enrolled in Intune.

Answer

Verify that the device compliance policy includes the new iOS version.

Question 9

You are planning to deploy a custom line-of-business (LOB) app to 200 Windows 11 devices using Intune. The app requires a specific registry key to be present before installation. What should you do?

Accepted Answer

Add a requirement rule to the app deployment that runs a PowerShell script to check for the registry key.. Option C is correct because Intune's requirement rules allow you to run a PowerShell script that checks for the existence of a specific registry key before the app installs. If the script returns a non-zero exit code, Intune will not proceed with the installation, ensuring the prerequisite is met. This is the only option that directly enforces a precondition for the app installation without requiring additional apps or policies.

Answer

Add the app as a dependency for another app that creates the registry key.

Answer

Use an app configuration policy to set the registry key before the app installs.

Answer

Create a custom compliance policy to enforce the registry key.

Question 10

You need to provide remote assistance to a Windows 11 device managed by Intune. The user is not technically savvy. Which Intune feature should you use?

Accepted Answer

TeamViewer integration in Intune.. TeamViewer integration in Intune allows an IT admin to initiate a remote assistance session directly from the Intune admin center, without requiring the user to install additional software or share a session code. This is ideal for non-technical users because the admin can start the session, and the user only needs to accept a consent prompt on their device.

Answer

Company Portal.

Answer

Quick Assist.

Answer

Remote Desktop connection.

Question 11

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Accepted Answer

Create a device compliance policy that checks for required settings.. Option D is correct because a device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Answer

Configure an Exchange Active Sync policy in Intune.

Answer

Create a device configuration profile to enforce security settings.

Answer

Deploy an app protection policy for Outlook for iOS and Android.

Question 12

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Accepted Answer

Create a Windows 10 feature update deployment policy.. Option A is correct because a Windows 10 feature update deployment policy is the specific Intune policy type designed to deliver feature updates (like version 22H2) to devices. This policy allows you to specify the target version and control the rollout, which is required for deploying feature updates via Intune.

Answer

Create a device compliance policy for the target version.

Answer

Create a Windows 10 update ring with expedited updates.

Question 13

Which TWO troubleshooting steps should you take when a Windows 11 device fails to enroll in Intune with error code 0x80180014?

Accepted Answer

Check if the device is already enrolled in another MDM provider.. Error code 0x80180014 typically indicates that the device is already enrolled with another MDM provider, such as Microsoft Configuration Manager (with co-management) or a third-party MDM like VMware Workspace ONE. Intune enforces a single-MDM enrollment policy per device; if a prior MDM enrollment is detected, the new enrollment attempt fails. Checking for existing MDM enrollment is therefore the correct first step.

Answer

Ensure that the device is in the correct enrollment profile group.

Answer

Recreate the device compliance policy.

Answer

Check if the device has TPM 2.0 enabled.

Question 14

Refer to the exhibit. You have configured the compliance policy shown above. A user reports that their Windows 11 device is compliant with all settings except the threat level. The device has no threat protection agent installed. What will happen when the user tries to access corporate resources?

Accepted Answer

Access is blocked immediately.. The compliance policy requires a minimum threat level, which cannot be evaluated because the device has no threat protection agent installed. In Microsoft Intune, when a required compliance setting cannot be assessed (e.g., no agent), the device is treated as non-compliant, and access is blocked immediately. There is no grace period for missing required agents, and conditional access enforces the block at the time of the access request.

Answer

Access is granted but the user receives a warning notification.

Answer

Access is blocked only after a 24-hour grace period.

Answer

Access is granted because the device meets all other compliance requirements.

Question 15

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

Accepted Answer

The devices have exceeded the grace period and should be blocked from accessing resources.. Option B is correct because the grace period expiration in the past means the device has been noncompliant beyond the grace period, so it should be blocked. Option A is wrong because the grace period has expired. Option C is wrong because the device is noncompliant. Option D is wrong because compliance policies are still applied.

Answer

The compliance policy has been removed from these devices.

Answer

The devices are still within the grace period and can access resources.

Answer

The devices were recently remediated and are now compliant.