MD-102 Manage and maintain devices Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. You have configured the compliance policy shown above. A user reports that their Windows 11 device is compliant with all settings except the threat level. The device has no threat protection agent installed. What will happen when the user tries to access corporate resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access is blocked immediately.. The compliance policy requires a minimum threat level, which cannot be evaluated because the device has no threat protection agent installed. In Microsoft Intune, when a required compliance setting cannot be assessed (e.g., no agent), the device is treated as non-compliant, and access is blocked immediately. There is no grace period for missing required agents, and conditional access enforces the block at the time of the access request.

Answer

Access is granted but the user receives a warning notification.

Answer

Access is blocked only after a 24-hour grace period.

Answer

Access is granted because the device meets all other compliance requirements.

Question 2

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

Accepted Answer

The devices have exceeded the grace period and should be blocked from accessing resources.. The complianceGracePeriodExpirationDateTime represents the deadline by which a device must become compliant after initially being marked noncompliant. When this timestamp is in the past, it means the grace period has expired, and the device should be blocked from accessing corporate resources as per the conditional access policy. This is a standard behavior in Microsoft Intune for managing noncompliant devices.

Answer

The compliance policy has been removed from these devices.

Answer

The devices are still within the grace period and can access resources.

Answer

The devices were recently remediated and are now compliant.

Question 3

You are the Intune administrator for Contoso Ltd., a company with 5,000 Windows 11 devices and 1,000 iOS devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint for threat detection. You need to implement a solution that ensures devices are compliant before they can access corporate resources. You have the following requirements: 1. Windows devices must have Defender for Endpoint running and report a threat level of 'low' or better. 2. iOS devices must have a PIN of at least 6 characters and be jailbreak-detected as 'not jailbroken'. 3. If a device becomes noncompliant, it should be blocked immediately with no grace period. 4. Noncompliant devices should receive a notification to the user. You create compliance policies for Windows and iOS. You also create a conditional access policy in Microsoft Entra ID to require compliant devices. After deploying, you find that some Windows devices that are missing Defender for Endpoint are still able to access email. What should you do to resolve this issue?

Accepted Answer

Enable the 'Require Defender for Endpoint' setting in the Windows compliance policy.. The Windows compliance policy must explicitly have the 'Require Defender for Endpoint' setting enabled to enforce that the Defender for Endpoint sensor is present and active on the device. Without this setting, the compliance policy only checks the threat level reported by Defender for Endpoint but does not require the sensor to be installed or running. Enabling this setting ensures that devices missing the Defender for Endpoint sensor are marked as noncompliant, which then triggers the conditional access policy to block access to corporate resources like email.

Answer

Configure a notification to users when their device is noncompliant.

Answer

Modify the conditional access policy to require a compliant device and a specific client app.

Answer

Set the required threat level to 'medium' in the Windows compliance policy.

Question 4

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

Accepted Answer

Restart the Microsoft Intune Management Extension service on the device.. The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Answer

Unenroll and re-enroll the device.

Answer

Verify that the device is compliant with BitLocker encryption requirements.

Answer

Check the device's compliance policy assignment.

Question 5

You are designing a Windows Update for Business deployment for a hybrid environment with 5,000 devices. You need to ensure that critical security updates are deployed within 48 hours while allowing feature updates to be delayed up to 60 days. Which policy configuration should you use?

Accepted Answer

Configure a 'Quality update deadline' of 2 days and a 'Feature update deadline' of 60 days.. Windows Update for Business uses 'deadline' policies to enforce when updates must be installed, not deferral periods. A 'Quality update deadline' of 2 days ensures critical security updates are installed within 48 hours, while a 'Feature update deadline' of 60 days allows feature updates to be delayed up to 60 days. Deferral periods only postpone when an update is offered, not when it must be installed, making deadlines the appropriate mechanism for enforcing installation timelines.

Answer

Use a 'Quality update deferral period' of 48 hours and a 'Feature update deferral period' of 60 days in a Windows 10 update ring.

Answer

Set the 'Update notification level' to '2 - Disable all notifications' and configure active hours.

Answer

Configure a 'Quality update deferral period' of 2 days and a 'Feature update deferral period' of 60 days.

Question 6

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

Accepted Answer

Set 'Allow application store' to 'Block' for non-admin users.. The 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Answer

Enable 'Private store only' in Microsoft Store for Business settings.

Answer

Disable 'Automatic app updates' in the device restriction policy.

Answer

Configure 'Require a password for app purchases' to 'Yes'.

Question 7

A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?

Accepted Answer

Device compliance policy.. Device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level. Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.

Answer

Device configuration policy (settings catalog).

Answer

Conditional Access policy.

Answer

App protection policy.

Question 8

You have a Windows 11 device that is co-managed with Configuration Manager and Microsoft Intune. After migrating the Windows Update workload to Intune, users report that they can still manually check for updates in Windows Settings and install optional driver and firmware updates that are not signed by Microsoft. You need to prevent users from installing these optional updates. Which setting should you configure in Intune?

Accepted Answer

Set 'Allow non-Microsoft signed updates' to 'Block'.. Setting 'Allow non-Microsoft signed updates' to 'Block' directly prevents users from installing the optional driver and firmware updates that are not signed by Microsoft, which are precisely the updates described in the scenario. Option A changes notification behavior, Option B defers quality updates, and Option D redirects to WSUS, none of which block optional updates.

Answer

Set 'Configure Automatic Updates' to '2 - Notify for download and notify for install'.

Answer

Set 'Defer quality updates' to '30 days'.

Answer

Set 'Specify intranet Microsoft update service location' to point to WSUS.

Question 9

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

Accepted Answer

Remove work profile. The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Answer

Wipe

Answer

Retire

Answer

Delete

Question 10

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

Accepted Answer

The user is blocked by a Conditional Access policy due to sign-in risk.. The user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Azure AD Identity Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Answer

The app protection policy is misconfigured.

Answer

The device model is blocked by a Conditional Access policy.

Answer

The device is not compliant with the compliance policy.

Question 11

You are implementing Windows Autopilot for a new fleet of devices. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and is enrolled in Intune. Which configuration is required?

Accepted Answer

Create an Autopilot deployment profile assigned to the devices.. An Autopilot deployment profile specifies the out-of-box experience (OOBE) settings, including the option to automatically join the device to Microsoft Entra ID and enroll it in Intune. Without a deployment profile assigned to the device, Autopilot will not enforce these behaviors during OOBE.

Answer

Upload corporate identifiers for each device.

Answer

Configure the Enrollment Status Page in Intune.

Answer

Create a dynamic device group in Microsoft Entra ID.

Question 12

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

Accepted Answer

.intunewin. The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Answer

.msi

Answer

.appx

Answer

.exe

Question 13

Which TWO actions can you perform using the Microsoft Intune admin center to manage a Windows device that is enrolled in Intune?

Accepted Answer

Restart the device. The Microsoft Intune admin center provides a 'Restart' remote action that triggers a reboot on a managed Windows device. This action is useful for applying pending updates or troubleshooting without requiring end-user interaction, and it leverages the Intune management extension to execute the restart command.

Answer

Format the hard disk

Answer

Install a printer driver

Answer

Change BIOS settings

Question 14

Which THREE components are required to deploy a Win32 app via Microsoft Intune?

Accepted Answer

Detection rule. A detection rule is required because Intune needs a method to verify whether the Win32 app is already installed on the device. Without a detection rule, Intune cannot determine if the installation succeeded or if the app needs to be reinstalled. The detection rule can be based on a file, registry key, or custom script, and it is mandatory for any Win32 app deployment.

Answer

PowerShell script for post-installation

Answer

Dependency on another app

Question 15

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Accepted Answer

Device compliance policy. Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

Windows update ring