MD-102 Manage and maintain devices Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. You manage a Windows 11 device that is marked as compliant and has OS version 10.0.22621.0. You need to upgrade the device to Windows 11 version 23H2. Which Intune feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows feature update profile. A Windows feature update profile is the correct Intune feature to upgrade a Windows 11 device from one version to another (e.g., from 10.0.22621.0 to 23H2). Feature update profiles deploy new OS builds that enable feature-level changes, whereas quality updates deliver only security and cumulative fixes. This profile targets the specific version upgrade required for the device.

Answer

Windows quality update profile

Answer

Driver update policy

Answer

Compliance policy

Question 2

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

Accepted Answer

Update Deadline for Quality Updates (days). The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Answer

Grace Period for Restarts (days)

Answer

Defer Quality Updates (days)

Answer

Active Hours

Question 3

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

Accepted Answer

Check the device's last check-in time with Intune.. The device is already compliant and enrolled, and the email profile is assigned, so the most likely issue is that the device has not recently checked in with Intune to receive the latest policy or profile. Checking the last check-in time is the first troubleshooting step because Intune relies on periodic device check-ins to push configuration profiles, including email profiles. If the device hasn't checked in recently, it won't have the email profile applied, even if it's compliant and enrolled.

Answer

Verify that the device meets the compliance policy for Android.

Answer

Confirm that the user has an Exchange Online license.

Answer

Ensure the device is enrolled in Intune.

Question 4

A company uses Microsoft Intune to manage iOS devices. They want to ensure that only devices with a passcode of at least 6 characters and without jailbreak can access corporate email. Which policy type should they configure?

Accepted Answer

Device compliance policy. Device compliance policies in Microsoft Intune evaluate device-level security settings such as jailbreak status and passcode length. By configuring a compliance policy that requires a passcode of at least 6 characters and detects jailbroken devices, Intune can mark non-compliant devices and, when combined with Conditional Access, block access to corporate email. This is the correct policy type because it directly assesses the device's security posture rather than app-level or configuration settings.

Answer

Conditional Access policy

Answer

App protection policy

Answer

Device configuration policy

Question 5

You are troubleshooting a Windows 11 device that fails to install an Intune-managed update. The device has been offline for two weeks. After reconnecting, the update does not install. In the Intune console, the update shows 'Failed to install' with error code 0x800f0831. What is the most likely cause?

Accepted Answer

The device's Windows component store is corrupted due to missing prerequisites.. Error code 0x800f0831 indicates that the Windows component store (CBS) is corrupted because a required servicing stack or prerequisite update is missing. When a device has been offline for two weeks, it may lack the necessary baseline updates that the current update depends on, causing the installation to fail even after reconnecting to the network.

Answer

The device does not have internet connectivity.

Answer

The device does not have enough disk space.

Answer

The update is superseded and no longer applicable.

Question 6

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with TPM 2.0 and Secure Boot enabled can access Microsoft 365 resources. What is the best approach?

Accepted Answer

Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.. Device compliance policies in Microsoft Intune can evaluate hardware attributes like TPM version and Secure Boot status. When combined with a Conditional Access policy that blocks non-compliant devices, this enforces the security requirements before granting access to Microsoft 365 resources. This two-step approach ensures only devices meeting the hardware security baseline can authenticate.

Answer

Create an app protection policy targeting Microsoft 365 apps.

Answer

Create a device configuration policy to enable TPM and Secure Boot.

Answer

Create a Conditional Access policy requiring TPM and Secure Boot.

Question 7

A user's iOS device is enrolled in Microsoft Intune. The user reports that they cannot install the Company Portal app from the App Store. What is the most likely reason?

Accepted Answer

The App Store is disabled by a device restriction policy.. A device restriction policy in Microsoft Intune can block access to the App Store on iOS devices. When the App Store is disabled via a configuration profile, users cannot install or update any apps from the App Store, including the Company Portal app. This is a common policy setting used by organizations to control app installation sources.

Answer

The user does not have an Apple ID.

Answer

The device is not enrolled in Intune.

Answer

The device is not supervised.

Question 8

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Accepted Answer

Non-compliant, because the firewall is disabled.. The compliance policy requires the firewall to be enabled. Since the device has a disabled firewall, it fails that specific requirement, making it non-compliant regardless of meeting other conditions like OS version. In Microsoft Intune, compliance policies evaluate each setting independently; a single non-compliant setting results in an overall non-compliant status.

Answer

Compliant, because the OS version is within the allowed range.

Answer

Compliant, because the policy includes a grace period for firewall.

Answer

Non-compliant, because the OS version is not within the allowed range.

Question 9

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

Accepted Answer

The users are not members of the Azure AD group assigned to the required app.. In Microsoft Intune, app deployment is based on Microsoft Entra ID group assignments. Even if a device is compliant and has recently checked in, the required app will not install unless the user or device is a member of the Microsoft Entra ID group that the app is assigned to. Intune evaluates group membership at each check-in to determine which apps should be pushed, so missing group membership is the most likely cause when compliance and connectivity are verified.

Answer

The devices are not connected to a Wi-Fi network configured in Intune.

Answer

The devices are not compliant with the compliance policy.

Answer

The enrollment restrictions are blocking the devices from receiving apps.

Question 10

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

Accepted Answer

Assign a Windows 10/11 feature update policy.. A Windows 10/11 feature update policy in Microsoft Intune is specifically designed to manage the upgrade of Windows 10 devices to Windows 11. This policy uses Windows Update for Business to deliver the feature update (e.g., Windows 11 23H2) and automatically applies it to devices that meet the hardware requirements, ensuring a controlled upgrade process.

Answer

Assign a driver update policy.

Answer

Assign a quality update policy.

Answer

Assign an update ring for Windows 10.

Question 11

You need to remotely wipe a lost corporate-owned iOS device enrolled in Microsoft Intune. The device is currently offline. What will happen when the device comes online?

Accepted Answer

The device will receive the wipe command the next time it checks in with Intune.. When a remote wipe command is issued for an offline iOS device enrolled in Microsoft Intune, the command is stored in the Microsoft Intune service. The device will receive and execute the wipe command the next time it checks in with the Intune service, regardless of whether it is supervised or not. This check-in occurs periodically (typically every 8 hours) or when the device is powered on and connected to the internet.

Answer

The device must be unenrolled first and then wiped.

Answer

The device will be wiped immediately after a grace period of 24 hours.

Answer

The wipe command will be queued only if the device is supervised.

Question 12

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting even though the policy is assigned. What should you check first?

Accepted Answer

Confirm that the device has a compatible TPM chip and that it is enabled.. BitLocker requires a compatible TPM (Trusted Platform Module) chip, version 1.2 or 2.0, that is enabled and activated in the BIOS/UEFI. If the TPM is missing, disabled, or not initialized, the BitLocker policy will apply but encryption will fail silently or remain pending. This is the most common root cause for devices not encrypting despite policy assignment.

Answer

Verify that Secure Boot is disabled in BIOS.

Answer

Ensure devices are marked as compliant in Intune.

Answer

Check if the BitLocker policy is using the Settings catalog.

Question 13

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

Accepted Answer

passwordMinimumLength. The compliance policy requires a minimum password length, and the device's 6-character password does not meet that requirement, making it non-compliant. The passwordMinimumLength setting directly controls the minimum number of characters a password must have, so a password shorter than the configured value triggers non-compliance.

Answer

requireCodeIntegrity

Answer

requireDeviceEncryption

Answer

requireSecureBoot

Question 14

You need to deploy a Windows 10 feature update to a pilot group. Which TWO steps are required in Microsoft Intune?

Accepted Answer

Create a feature update policy for Windows 10.. Option A is correct because in Microsoft Intune, deploying a Windows 10 feature update requires creating a Windows 10 feature update policy (under Software updates > Windows 10 feature updates), which specifies the target Windows version (e.g., Windows 10 21H2) and rollout settings. Option C is correct because a policy has no effect until it is assigned to a group; you must assign the feature update policy to an Microsoft Entra ID device group containing the pilot devices so those devices receive the update. Option B is incorrect because driver update policies manage hardware driver updates via Windows Update for Business, not OS feature updates. Option D is incorrect because update rings control quality (monthly cumulative) updates and deferral/servicing settings, not feature update deployment. Option E is incorrect because compliance policies only evaluate device conditions (e.g., BitLocker, OS version) and do not deliver feature updates.

Answer

Create a driver update policy for Windows 10.

Answer

Create an update ring for Windows 10.

Answer

Create a compliance policy for Windows 10.

Question 15

Refer to the exhibit. You run this Microsoft Graph PowerShell command to retrieve managed devices. The output shows a device with a lastSyncDateTime of 5 days ago. What does this indicate?

Accepted Answer

The device has not communicated with Intune for 5 days.. The `lastSyncDateTime` property in Microsoft Graph for Intune-managed devices indicates the most recent time the device successfully checked in with the Intune service. A value of 5 days ago means the device has not communicated with Intune for 5 days, which could be due to network issues, device inactivity, or configuration problems. This does not inherently mean the device is non-compliant or unenrolled—it simply reflects the last successful sync.

Answer

The device was enrolled 5 days ago.

Answer

The device is non-compliant.

Answer

The device is unenrolled.