MD-102 Manage and maintain devices Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

Accepted Answer

Use the 'Update Immediately' setting in the Windows Update for Business policy.. Option D is correct because the 'Update Immediately' setting forces the device to check for and install updates without delay. Option A is wrong because the deadline is already set to 1 day; increasing it would allow more delay. Option B is wrong because restarting the device does not force update installation. Option C is wrong because the issue is not with the update ring assignment; the policy is already applied.

Answer

Ask users to restart their devices.

Answer

Reassign the update ring to a broader device group.

Answer

Increase the 'Quality update deadline' to 3 days.

Question 2

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

Accepted Answer

Remote lock. Option A is correct because 'Remote lock' locks the device and allows a custom message to be displayed. Option B is wrong because 'Wipe' performs a factory reset, which would erase all data and prevent the message from being shown. Option C is wrong because 'Retire' removes company data only, does not lock the device. Option D is wrong because 'Reset passcode' changes the passcode but does not display a custom message.

Answer

Reset passcode

Answer

Wipe

Answer

Retire

Question 3

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. Users report that after a recent update, their devices are stuck at the login screen and cannot access corporate resources. You suspect a configuration conflict. Which action should you take first to restore device functionality without affecting other settings?

Answer

Create a new device configuration profile that overrides the conflicting settings.

Answer

Reset the devices remotely using Intune.

Answer

Perform a selective wipe on the affected devices.

Question 4

Your organization is implementing a zero-trust security model using Microsoft Intune. Devices must be compliant before accessing corporate resources. You need to deploy compliance policies for Windows 10 devices that require BitLocker encryption and a minimum OS version. Which two policy settings should you configure? (Choose two.)

Accepted Answer

Minimum OS version.. Option A is correct because the 'Minimum OS version' setting in a Windows 10 compliance policy ensures that devices must be running at least a specified build number (e.g., 10.0.19041 for Windows 10 20H1). This directly enforces the zero-trust requirement that only devices with a supported, up-to-date OS can access corporate resources, reducing exposure to known vulnerabilities. Option D is correct because the 'Require encryption of data storage on device' setting mandates BitLocker encryption on the system drive, which is a core data protection control in a zero-trust model.

Answer

Require device health attestation.

Answer

Require firewall (Windows Defender Firewall).

Answer

Maximum OS version.

Question 5

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Accepted Answer

Number of failed attempts before wipe.. Option A is correct because the 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Answer

Maximum passcode age (days).

Answer

Allow simple passcode.

Question 6

Refer to the exhibit. You have an Intune configuration that includes a compliance policy and a device configuration policy for Windows 10 devices. You deploy both policies to a group of devices. After deployment, some devices are marked as non-compliant even though they have BitLocker enabled and Windows Defender Antivirus running. Which setting is most likely causing the conflict?

Accepted Answer

The compliance policy requires password, but the device configuration policy does not configure any password settings, leading to non-compliance.. Option D is correct because the compliance policy requires encryption (bitLocker) but the device configuration policy sets 'requireStartupPin' to false, and the compliance policy does not require a startup PIN. However, the compliance policy requires a password with minimum length 6. The device configuration policy does not set a password policy, so the password requirement from compliance may not be met if the device does not have a local password set. But the most direct conflict is that the compliance policy requires encryption (which might require a startup PIN on some devices) while the device configuration policy explicitly disables the startup PIN requirement, potentially causing the device to not meet the encryption requirement if the device's BitLocker configuration is not fully compliant. However, the exhibit does not show a password configuration policy; the compliance policy requires password, but there is no device configuration policy setting password. Thus, the device may be non-compliant because it lacks a password. Option A is wrong because Defender is not the issue. Option B is wrong because there is no device health attestation requirement. Option C is wrong because cloud block level does not affect compliance. The correct answer is that the device configuration policy does not set a password policy, so the compliance password requirement may not be met. But the options are limited: the best answer is D, as the missing password configuration leads to non-compliance.

Answer

The compliance policy requires encryption, but the device configuration policy does not enforce BitLocker startup PIN, causing compliance failure.

Answer

The device configuration policy sets scanParameter to 'fullscan', which may interfere with compliance checks.

Answer

The compliance policy requires Defender, but the device configuration policy sets cloudBlockLevel to 'high', which may conflict with some devices.

Question 7

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Microsoft Intune to manage its Windows 10 devices. The company recently experienced a ransomware attack that encrypted local files on several devices. To mitigate future attacks, management wants to ensure that all devices have real-time protection enabled in Microsoft Defender Antivirus and that Controlled Folder Access is turned on. You need to configure these settings via Intune. You decide to create a device configuration profile for Windows 10. What is the most efficient way to deploy these settings to all existing and future devices?

Accepted Answer

Create a device configuration profile and assign it to a device group that includes all devices.. Option A is correct because a device configuration profile in Intune can include Microsoft Defender Antivirus settings (such as real-time protection and Controlled Folder Access) and is assigned to a device group. This ensures that both existing and future devices that join the group automatically receive the settings, providing a scalable and efficient deployment method without requiring user interaction or additional scripts.

Answer

Use PowerShell scripts deployed via Intune to enable the settings on each device.

Answer

Create a device configuration profile and assign it to a user group that includes all users.

Answer

Create a compliance policy that requires these settings and assign it to all devices.

Question 8

Your organization uses Microsoft Intune to manage Windows 11 devices. You have a requirement to ensure that all devices have BitLocker Drive Encryption enabled with a TPM protector and a recovery key escrowed to Azure AD. Additionally, you need to configure a policy that prevents users from changing the BitLocker settings. You create a device configuration profile using the 'Endpoint Protection' template for Windows 10 and later. After deploying the policy to a test group, you notice that BitLocker is not enabled on some devices. The devices meet the hardware requirements and are Azure AD joined. What is the most likely reason for the failure, and how should you resolve it?

Accepted Answer

The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.. Option C is correct because the 'Endpoint Protection' template for Windows 10 and later requires explicit configuration of the 'Enable full disk encryption' setting and the encryption method (e.g., XTS-AES 128-bit) under the 'Windows Encryption' section. Without these settings, the policy does not trigger BitLocker to start encryption on the device, even if other settings like TPM protector and recovery key escrow are configured. The devices are Azure AD joined and meet hardware requirements, so the missing encryption enablement is the most likely cause.

Answer

Devices are not hybrid Azure AD joined; convert them to hybrid join for BitLocker policy to apply.

Answer

The policy does not specify a recovery key escrow location; configure it to escrow to Azure AD.

Answer

Devices are not co-managed with Configuration Manager; enable co-management to apply BitLocker policy.

Question 9

You are an Intune administrator for a large enterprise that uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) for threat protection. You need to ensure that all Windows 10 devices are properly onboarded to Defender for Endpoint and that security settings are enforced via Intune. You have created a device configuration profile that includes the 'Microsoft Defender for Endpoint' settings, but some devices are not appearing in the Defender for Endpoint portal. You verify that the devices are Intune managed and enrolled. What should you do to ensure proper onboarding?

Accepted Answer

Deploy the Microsoft Defender for Endpoint onboarding package (WindowsDefenderATPOnboardingPackage.zip) via Intune using a PowerShell script or a device configuration profile.. Option B is correct because onboarding to Defender for Endpoint requires a specific deployment package (a .zip file containing the onboarding script) that must be deployed via Intune using a PowerShell script or a device configuration profile with the 'Microsoft Defender for Endpoint' template. However, the most common missing step is deploying the onboarding package. Option A is incorrect because compliance policy does not onboard devices. Option C is incorrect because the devices are already Intune managed. Option D is incorrect because Microsoft Entra ID registration is not the issue.

Answer

Ensure that the devices are co-managed with Configuration Manager.

Answer

Create a compliance policy that requires Defender for Endpoint to be active.

Answer

Register the devices in Microsoft Entra ID (Azure AD) as hybrid joined.

Question 10

Your organization uses Microsoft Intune to manage iOS and Android devices. You need to ensure that corporate data on these devices is protected. Specifically, you want to prevent users from copying corporate data from managed apps to personal apps. You also want to ensure that when a device is lost or stolen, the corporate data can be selectively wiped without affecting personal data. Which Intune feature should you use to achieve these requirements?

Accepted Answer

App Protection Policies (MAM).. Option A is correct because App Protection Policies (MAM) provide data protection settings such as preventing copy/paste between managed and unmanaged apps, and allow selective wipe of corporate data. Option B is incorrect because device compliance policies focus on device-level settings, not app-level data protection. Option C is incorrect because device configuration profiles configure device settings, not app data protection. Option D is incorrect because conditional access policies control access based on compliance, but do not directly prevent copy/paste or provide selective wipe at the app level.

Answer

Device Compliance Policies.

Answer

Conditional Access Policies.

Answer

Device Configuration Profiles.

Question 11

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

Accepted Answer

Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.. Option D is correct because deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Answer

Modify the existing Windows Update for Business policy to set the deferral period to 0 days.

Answer

Create a compliance policy that requires the update to be installed and assign it to all devices.

Answer

Use Configuration Manager to push the update via on-premises WSUS.

Question 12

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

Accepted Answer

Create an App Protection Policy (MAM) that restricts the transfer of corporate data to other apps and a Device Configuration Profile that sets the default mail app to Outlook.. Option C is correct because an App Protection Policy can block the native Mail app from opening corporate data, and a Device Configuration Profile can set the default mail app to Outlook. Option A is incorrect because a compliance policy alone does not block the native Mail app. Option B is incorrect because conditional access can block native Mail app from accessing Exchange Online, but it does not set Outlook as default. Option D is incorrect because device enrollment restrictions do not control app usage.

Answer

Create a device compliance policy that requires the device to have Outlook installed.

Answer

Use device enrollment restrictions to block devices that have the native Mail app installed.

Answer

Create a conditional access policy for Exchange Online that blocks the native Mail app and allows only Outlook.

Question 13

You are an Intune administrator for a company that has recently deployed Windows 11 devices. Management wants to ensure that all devices are running the latest feature update (Windows 11 23H2) within 60 days of release. You need to configure a Windows Update for Business policy in Intune to achieve this goal. Which settings should you configure?

Accepted Answer

Set the feature update deferral period to 60 days and assign the policy to all devices.. Option A is correct because setting the feature update deferral period to 60 days in a Windows Update for Business policy ensures that devices will wait up to 60 days after Microsoft releases a feature update (e.g., Windows 11 23H2) before installing it. This meets the requirement of having all devices running the latest feature update within 60 days of release, as the deferral period defines the maximum delay from the release date. Assigning the policy to all devices ensures blanket coverage across the Windows 11 fleet.

Answer

Set the feature update deferral period to 60 days and pause updates for 30 days.

Answer

Set the feature update deadline to 60 days and assign the policy to a device group.

Answer

Set the feature update deferral period to 0 days and assign to all users.

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company-specific application (a .pkg file) to all macOS devices. The application requires a specific configuration file that must be placed in the /Library/Application Support/ directory. You also need to ensure that the application is installed silently without user interaction. How should you configure the deployment in Intune?

Accepted Answer

Add the .pkg file as a macOS line-of-business app in Intune, specify installation arguments for silent install, and include a script to copy the configuration file post-install.. Option A is correct because Intune supports deploying macOS line-of-business apps (.pkg) with installation arguments for silent installation, and you can include a script to copy the configuration file. Option B is incorrect because the volume purchase program (VPP) is for purchasing apps, not custom deployment. Option C is incorrect because a device configuration profile cannot install .pkg apps. Option D is incorrect because shell scripts can install apps but are less integrated than the LOB app deployment.

Answer

Use a shell script in Intune to download and install the .pkg file from a secure URL.

Answer

Create a device configuration profile for macOS that includes the app installation settings.

Answer

Use Apple Volume Purchase Program (VPP) to distribute the app as a managed app.

Question 15

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

Accepted Answer

Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.. Option B is correct because Android Enterprise devices with work profile use file-based encryption by default, which is considered compliant with Intune's encryption requirement. However, if devices are still non-compliant, you may need to check the compliance policy settings for Android Enterprise. The most likely fix is to configure the compliance policy to 'Require encryption of data storage on device' which is already done. But if devices are still non-compliant, you might need to update the policy to include the specific encryption type. Option A is incorrect because you cannot change the encryption type via Intune. Option C is incorrect because device configuration profiles cannot change encryption type. Option D is incorrect because work profile is already enabled.

Answer

Enable the work profile on the devices via a device configuration profile.

Answer

Change the device encryption method to full-disk encryption using a device configuration profile.

Answer

Create a device configuration profile that enforces encryption on the work profile.