MD-102 Manage and maintain devices Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned Windows 10 devices are allowed to access Microsoft 365 services. You have configured a conditional access policy to require compliant devices. What else must you do to identify corporate-owned devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add corporate device identifiers (e.g., serial numbers) in Intune.. Corporate device identifiers, such as serial numbers or IMEI numbers, are the specific mechanism in Microsoft Intune used to mark a device as corporate-owned. While a conditional access policy requiring compliant devices ensures only compliant devices can access Microsoft 365, it does not distinguish between corporate and personal devices. By uploading corporate identifiers, Intune automatically sets the ownership type to 'Corporate' upon enrollment, which can then be used in conditional access policies to restrict access to only those devices.

Answer

Configure a device compliance policy to require corporate ownership.

Answer

Set enrollment restrictions to block personally owned devices.

Answer

Deploy an app protection policy to block personal devices.

Question 2

You need to retire a device in Microsoft Intune. What is the effect of retiring a device?

Accepted Answer

The device is unenrolled, and corporate data and apps are removed. Personal data is preserved.. Retiring a device in Microsoft Intune performs a selective wipe that removes only corporate-managed data and apps while preserving the user's personal data. The device is also unenrolled from Intune management, meaning it no longer receives policy or compliance enforcement. This is distinct from a full wipe, which resets the entire device to factory settings.

Answer

The device is factory reset to its original settings.

Answer

The device remains enrolled but can no longer access corporate resources.

Answer

The device is deleted from Azure AD and Intune.

Question 3

An organization uses Microsoft Intune to manage Windows devices. They want to ensure that only devices with a TPM 2.0 chip can access corporate email. Which policy should be configured?

Accepted Answer

Device compliance policy with a condition for TPM 2.0, combined with a conditional access policy. A device compliance policy can evaluate whether a device has TPM 2.0 (via the TPM specification version check), and when combined with a Conditional Access policy, it can block access to corporate email for non-compliant devices. This is the standard Microsoft approach for enforcing hardware-based security requirements for cloud app access.

Answer

Device enrollment restriction to require TPM 2.0

Answer

Device configuration profile to enable TPM 2.0

Answer

App protection policy to require TPM 2.0

Question 4

A company uses Microsoft Intune to manage macOS devices. They need to deploy a custom plist configuration file to set security settings. Which policy type should they use?

Accepted Answer

Device configuration profile (custom). A custom device configuration profile in Microsoft Intune allows administrators to deploy plist files to macOS devices, enabling the configuration of settings not covered by built-in templates. This is the correct policy type for deploying a custom plist file because it directly supports uploading and assigning property list files to enforce specific security configurations.

Answer

App protection policy

Answer

Device compliance policy

Answer

Device cleanup rule

Question 5

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

Accepted Answer

Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker. Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Answer

Device configuration profile to enable BitLocker

Answer

Device compliance policy with a noncompliance action to mark device as non-compliant

Answer

PowerShell script deployment with assignment to all devices

Question 6

A company uses Microsoft Intune to manage devices. They need to report on which devices have a specific Windows update installed. Which reporting method should be used?

Accepted Answer

Use the Microsoft Intune admin center to view the Windows Update for Business report. The Windows Update for Business report in the Microsoft Intune admin center provides a dedicated view of update compliance, including which devices have installed specific Windows updates. This report aggregates data from the Windows Update service and displays it per device, making it the correct method for identifying devices with a particular update installed.

Answer

Use Microsoft 365 Lighthouse

Answer

Use the Device compliance report in Intune

Answer

Use Microsoft Defender for Endpoint's advanced hunting

Question 7

An organization uses Microsoft Intune to manage Windows devices. They need to configure a policy to enforce disk encryption on devices. Which TWO of the following are valid encryption options?

Accepted Answer

BitLocker. BitLocker (A) is correct because it is Microsoft's full-volume disk encryption feature for Windows and is the primary encryption method configured through Intune disk encryption policies. Device encryption (C) is also correct because it is a Windows feature (available on supported devices, often with Modern Standby and a Microsoft account) that Intune can enforce via the same disk encryption policy profile. EFS (B) is not a valid answer here because it encrypts individual files and folders on NTFS volumes rather than enforcing full disk encryption. FileVault (D) is incorrect because it is Apple's macOS disk encryption technology, not a Windows encryption option. APFS encryption (E) is incorrect because APFS is an Apple file system and its encryption applies to macOS/iOS devices, not Windows devices managed by Intune.

Answer

Encrypting File System (EFS)

Answer

FileVault

Answer

APFS encryption

Question 8

Refer to the exhibit. A Microsoft Graph PowerShell cmdlet retrieves devices. What is the purpose of this query?

Accepted Answer

To find Windows devices that have not synced since before January 1, 2025. The query uses Get-MgDevice with a filter on approximateLastSignInDateTime being less than 2025-01-01T00:00:00Z. This filter retrieves devices whose last approximate sign-in occurred before January 1, 2025, indicating they have not synced since that date. The -and operator with deviceId -ne $null ensures only actual devices (not null device IDs) are returned. Option D correctly identifies this as finding devices that have not synced since before January 1, 2025.

Answer

To find Windows devices that are compliant

Answer

To find Windows devices with an operating system version earlier than 2025

Answer

To find Windows devices enrolled before January 1, 2025

Question 9

A company uses Microsoft Intune to manage macOS devices. A security audit requires that all macOS devices must have FileVault encryption enabled. Compliance policy reports show that 90% of devices are compliant, but 10% are non-compliant. You review the non-compliant devices and find that FileVault is enabled on them. What is the most likely cause of the non-compliance?

Accepted Answer

The recovery key is not escrowed to Intune.. The most likely cause is that the recovery key is not escrowed to Intune. Even though FileVault is enabled on the device, Intune's compliance policy checks for the presence of the FileVault recovery key in its escrow database. If the key is missing, the device is marked non-compliant because Intune cannot verify full management and recovery capability, which is a key security requirement.

Answer

FileVault is not actually enabled on those devices.

Answer

The devices are not supervised.

Answer

The compliance policy is not assigned to those devices.

Question 10

You need to deploy a line-of-business (LOB) iOS app to company-owned devices using Microsoft Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

iOS/iPadOS LOB app.. An iOS/iPadOS LOB app deployment in Intune is specifically designed for line-of-business apps that are signed with an enterprise certificate and distributed internally. This method allows you to upload the .ipa file directly to Intune and deploy it to company-owned devices without requiring the Apple App Store or a Volume Purchase Program.

Answer

Managed Browser app.

Answer

iOS/iPadOS store app.

Answer

Volume Purchase Program (VPP) app.

Question 11

A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?

Accepted Answer

Review the Intune management extension logs on the device.. The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.

Answer

Verify the device compliance policy.

Answer

Check the Company Portal app version.

Answer

Reassign the app to the user.

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?

Accepted Answer

Require device to be marked as compliant.. To ensure only compliant devices access Exchange Online, the Conditional Access policy must include the grant control 'Require device to be marked as compliant.' This control checks the device's compliance state in Intune and blocks access if the device is non-compliant, directly enforcing the requirement. It is the precise setting for compliance-based access.

Answer

Require multi-factor authentication.

Answer

Require app protection policy.

Answer

Require device to be enrolled in Intune.

Question 13

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

Accepted Answer

Wipe.. The Wipe action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost corporate-owned iOS device to ensure sensitive data is completely erased and the device cannot be accessed. Retire only removes managed apps and policies but leaves personal data intact, which is insufficient for a lost device scenario.

Answer

Retire.

Answer

Delete.

Answer

Reset.

Question 14

You manage Windows 10 devices with Microsoft Intune. Users report that after a recent Windows update, some devices fail to enroll in mobile device management (MDM). You verify that the devices are domain-joined and can reach the internet. Which configuration should you check first?

Accepted Answer

Check that the MDM enrollment URL (https://enrollment.manage.microsoft.com) is reachable and not blocked by a proxy.. The most common cause of MDM enrollment failure after a Windows update is a change in proxy or firewall settings that blocks the MDM enrollment URL. Since the devices can reach the internet generally but fail specifically during enrollment, verifying that `https://enrollment.manage.microsoft.com` is reachable and not blocked by a proxy is the logical first troubleshooting step. This URL is required for the device to communicate with the Intune MDM service during the enrollment process.

Answer

Confirm that the user is assigned a Microsoft Entra ID P1 license.

Answer

Verify that the BitLocker recovery key is backed up to Microsoft Entra ID.

Answer

Ensure the Windows Defender Firewall allows inbound RPC traffic.

Question 15

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

Accepted Answer

A device compliance policy with a required passcode length of 6.. A device compliance policy in Microsoft Intune evaluates whether devices meet specific security requirements, such as a minimum passcode length. By creating a compliance policy with a required passcode length of 6, Intune marks any iOS device with a shorter passcode as noncompliant. This noncompliant status can then be used by a conditional access policy to block access to corporate email, achieving the stated goal.

Answer

A device configuration profile with a passcode payload.

Answer

An app protection policy for Microsoft Outlook.

Answer

A conditional access policy requiring compliant devices.