MD-102 Manage and maintain devices Practice Test 18 — 15 Questions

Question 1

You are the Intune administrator for Contoso Ltd., a company with 5,000 Windows 11 devices and 1,000 iOS devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint for threat detection. You need to implement a solution that ensures devices are compliant before they can access corporate resources. You have the following requirements: 1. Windows devices must have Defender for Endpoint running and report a threat level of 'low' or better. 2. iOS devices must have a PIN of at least 6 characters and be jailbreak-detected as 'not jailbroken'. 3. If a device becomes noncompliant, it should be blocked immediately with no grace period. 4. Noncompliant devices should receive a notification to the user. You create compliance policies for Windows and iOS. You also create a conditional access policy in Microsoft Entra ID to require compliant devices. After deploying, you find that some Windows devices that are missing Defender for Endpoint are still able to access email. What should you do to resolve this issue?

Accepted Answer

Enable the 'Require Defender for Endpoint' setting in the Windows compliance policy.. Option C is correct because the Windows compliance policy must explicitly have the 'Require Defender for Endpoint' setting enabled to enforce that the Defender for Endpoint sensor is present and active on the device. Without this setting, the compliance policy only checks the threat level reported by Defender for Endpoint but does not require the sensor to be installed or running. Enabling this setting ensures that devices missing the Defender for Endpoint sensor are marked as noncompliant, which then triggers the conditional access policy to block access to corporate resources like email.

Answer

Configure a notification to users when their device is noncompliant.

Answer

Modify the conditional access policy to require a compliant device and a specific client app.

Answer

Set the required threat level to 'medium' in the Windows compliance policy.

Question 2

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

Accepted Answer

Restart the Microsoft Intune Management Extension service on the device.. The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Answer

Unenroll and re-enroll the device.

Answer

Verify that the device is compliant with BitLocker encryption requirements.

Answer

Check the device's compliance policy assignment.

Question 3

You are designing a Windows Update for Business deployment for a hybrid environment with 5,000 devices. You need to ensure that critical security updates are deployed within 48 hours while allowing feature updates to be delayed up to 60 days. Which policy configuration should you use?

Accepted Answer

Configure a 'Quality update deadline' of 2 days and a 'Feature update deadline' of 60 days.. Option A is correct because Windows Update for Business uses 'deadline' policies to enforce when updates must be installed, not deferral periods. A 'Quality update deadline' of 2 days ensures critical security updates are installed within 48 hours, while a 'Feature update deadline' of 60 days allows feature updates to be delayed up to 60 days. Deferral periods only postpone when an update is offered, not when it must be installed, making deadlines the appropriate mechanism for enforcing installation timelines.

Answer

Use a 'Quality update deferral period' of 48 hours and a 'Feature update deferral period' of 60 days in a Windows 10 update ring.

Answer

Set the 'Update notification level' to '2 - Disable all notifications' and configure active hours.

Answer

Configure a 'Quality update deferral period' of 2 days and a 'Feature update deferral period' of 60 days.

Question 4

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

Accepted Answer

Set 'Allow application store' to 'Block' for non-admin users.. Option C is correct because the 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Answer

Enable 'Private store only' in Microsoft Store for Business settings.

Answer

Disable 'Automatic app updates' in the device restriction policy.

Answer

Configure 'Require a password for app purchases' to 'Yes'.

Question 5

A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?

Accepted Answer

Device compliance policy.. Option C is correct because device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level. Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.

Answer

Device configuration policy (settings catalog).

Answer

Conditional Access policy.

Answer

App protection policy.

Question 6

You have a Windows 11 device that is co-managed with Configuration Manager and Microsoft Intune. After migrating the Windows Update workload to Intune, users report that they can still manually check for updates in Windows Settings and install optional updates. You need to prevent users from installing optional updates. Which setting should you configure in Intune?

Accepted Answer

Set 'Allow non-Microsoft signed updates' to 'Block'.. Option C is correct because the 'Allow non-Microsoft signed updates' policy, when set to 'Block', prevents the installation of optional updates that are not signed by Microsoft. In a co-managed environment where the Windows Update workload is moved to Intune, this setting specifically targets and blocks optional updates from being installed via Windows Settings, while still allowing critical and security updates to be delivered as configured.

Answer

Set 'Configure Automatic Updates' to '2 - Notify for download and notify for install'.

Answer

Set 'Defer quality updates' to '30 days'.

Answer

Set 'Specify intranet Microsoft update service location' to point to WSUS.

Question 7

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

Accepted Answer

Remove work profile. The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Answer

Wipe

Answer

Retire

Answer

Delete

Question 8

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

Accepted Answer

The user is blocked by a Conditional Access policy due to sign-in risk.. Option D is correct because the user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Azure AD Identity Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Answer

The app protection policy is misconfigured.

Answer

The device model is blocked by a Conditional Access policy.

Answer

The device is not compliant with the compliance policy.

Question 9

You are implementing Windows Autopilot for a new fleet of devices. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and is enrolled in Intune. Which configuration is required?

Accepted Answer

Create an Autopilot deployment profile assigned to the devices.. Option C is correct because an Autopilot deployment profile specifies the out-of-box experience (OOBE) settings, including the option to automatically join the device to Microsoft Entra ID and enroll it in Intune. Without a deployment profile assigned to the device, Autopilot will not enforce these behaviors during OOBE.

Answer

Upload corporate identifiers for each device.

Answer

Configure the Enrollment Status Page in Intune.

Answer

Create a dynamic device group in Microsoft Entra ID.

Question 10

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

Accepted Answer

.intunewin. The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Answer

.msi

Answer

.appx

Answer

.exe

Question 11

Which TWO actions can you perform using the Microsoft Intune admin center to manage a Windows device that is enrolled in Intune?

Accepted Answer

Restart the device. Option B is correct because the Microsoft Intune admin center provides a 'Restart' remote action that triggers a reboot on a managed Windows device. This action is useful for applying pending updates or troubleshooting without requiring end-user interaction, and it leverages the Intune management extension to execute the restart command.

Answer

Format the hard disk

Answer

Install a printer driver

Answer

Change BIOS settings

Question 12

Which THREE components are required to deploy a Win32 app via Microsoft Intune?

Accepted Answer

Detection rule. A detection rule is required because Intune needs a method to verify whether the Win32 app is already installed on the device. Without a detection rule, Intune cannot determine if the installation succeeded or if the app needs to be reinstalled. The detection rule can be based on a file, registry key, or custom script, and it is mandatory for any Win32 app deployment.

Answer

PowerShell script for post-installation

Answer

Dependency on another app

Question 13

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Accepted Answer

Device compliance policy. Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

Windows update ring

Question 14

Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced recently; the compliance policy may require a more recent check-in.. The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant. Option A correctly identifies this as the most likely cause.

Answer

The device is company-owned, which is noncompliant by default.

Answer

The device is a userless device and cannot be compliant.

Answer

The device's operating system version is not supported.

Question 15

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.. Option B is correct because Conditional Access policies use the device compliance status from Intune to grant or block access to cloud apps like Exchange Online. Option A is wrong because configuring a device configuration policy only enforces settings but does not block access. Option C is wrong because app protection policies protect data within apps but do not block access based on device compliance. Option D is wrong because blocking all devices from Azure AD would prevent access even for compliant devices.

Answer

Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

Answer

Create a device configuration policy that blocks access to corporate resources.

Answer

Create an app protection policy in Intune to block access to apps.