MD-102 Manage and maintain devices Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device has not synced recently; the compliance policy may require a more recent check-in.. The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant. Option A correctly identifies this as the most likely cause.

Answer

The device is company-owned, which is noncompliant by default.

Answer

The device is a userless device and cannot be compliant.

Answer

The device's operating system version is not supported.

Question 2

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.. Conditional Access policies in Microsoft Entra ID can evaluate device compliance status from Intune to grant or block access to corporate resources like Exchange Online. When a device is marked non-compliant (e.g., missing BitLocker, outdated OS, jailbroken/rooted), the Conditional Access policy blocks access and can display a notification. Option A is incorrect because device enrollment restrictions only control whether a device can enroll in Intune or join Azure AD; they do not enforce access after enrollment. Option B is incorrect because device configuration policies apply settings but do not enforce access control. Option C is incorrect because app protection policies protect data within apps but rely on device compliance for access decisions.

Answer

Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

Answer

Create a device configuration policy that blocks access to corporate resources.

Answer

Create an app protection policy in Intune to block access to apps.

Question 3

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

Accepted Answer

Use the 'Update Immediately' setting in the Windows Update for Business policy.. The 'Update Immediately' setting in the Windows Update for Business policy forces devices to check for and install updates immediately, overriding the configured deadline. Option A is incorrect because restarting alone does not trigger installation of pending updates. Option B is incorrect because reassigning the update ring does not affect the urgency of already applied policies. Option D is incorrect because increasing the deadline would allow more delay, not cause immediate installation.

Answer

Ask users to restart their devices.

Answer

Reassign the update ring to a broader device group.

Answer

Increase the 'Quality update deadline' to 3 days.

Question 4

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

Accepted Answer

Remote lock. 'Remote lock' locks the device and allows a custom message to be displayed. Option B is wrong because 'Reset passcode' changes the passcode but does not display a custom message. Option C is wrong because 'Wipe' performs a factory reset, which erases all data and prevents the message from being shown. Option D is wrong because 'Retire' removes company data only, does not lock the device.

Answer

Reset passcode

Answer

Wipe

Answer

Retire

Question 5

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. Users report that after a recent update, their devices are stuck at the login screen and cannot access corporate resources. You suspect a configuration conflict. Which action should you take first to restore device functionality without affecting other settings?

Accepted Answer

Use the Test and remediate feature to apply a temporary configuration to a subset of devices.. The correct first action is to use the 'Test and remediate' feature in Intune, which allows you to apply a temporary configuration to a test group of devices to identify and resolve conflicts without affecting the broader device population. This approach isolates the issue, preserves existing settings, and provides a controlled rollback if needed, aligning with best practices for troubleshooting configuration conflicts in Intune-managed Windows devices.

Answer

Create a new device configuration profile that overrides the conflicting settings.

Answer

Reset the devices remotely using Intune.

Answer

Perform a selective wipe on the affected devices.

Question 6

Your organization is implementing a zero-trust security model using Microsoft Intune. Devices must be compliant before accessing corporate resources. You need to deploy compliance policies for Windows 10 devices that require BitLocker encryption and a minimum OS version. Which two policy settings should you configure? (Choose two.)

Accepted Answer

Minimum OS version.. The 'Minimum OS version' setting in a Windows 10 compliance policy ensures that devices must be running at least a specified build number (e.g., 10.0.19041 for Windows 10 20H1). This directly enforces the zero-trust requirement that only devices with a supported, up-to-date OS can access corporate resources, reducing exposure to known vulnerabilities. Option D is correct because the 'Require encryption of data storage on device' setting mandates BitLocker encryption on the system drive, which is a core data protection control in a zero-trust model.

Answer

Require device health attestation.

Answer

Require firewall (Windows Defender Firewall).

Answer

Maximum OS version.

Question 7

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Accepted Answer

Number of failed attempts before wipe.. The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Answer

Maximum passcode age (days).

Answer

Allow simple passcode.

Question 8

Refer to the exhibit. You have an Intune configuration that includes a compliance policy and a device configuration policy for Windows 10 devices. You deploy both policies to a group of devices. After deployment, some devices are marked as non-compliant even though they have BitLocker enabled and Windows Defender Antivirus running. Which setting is most likely causing the conflict?

Accepted Answer

The compliance policy requires password, but the device configuration policy does not configure any password settings, leading to non-compliance.. The compliance policy requires a password, but the device configuration policy does not configure any password settings. In Intune, compliance policies evaluate device settings independently of configuration policies; if a compliance policy mandates a password and the device lacks one (because the configuration policy doesn't enforce it), the device will be marked non-compliant. BitLocker and Defender being enabled do not satisfy a password requirement, so the conflict is the missing password configuration.

Answer

The compliance policy requires encryption, but the device configuration policy does not enforce BitLocker startup PIN, causing compliance failure.

Answer

The device configuration policy sets scanParameter to 'fullscan', which may interfere with compliance checks.

Answer

The compliance policy requires Defender, but the device configuration policy sets cloudBlockLevel to 'high', which may conflict with some devices.

Question 9

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Microsoft Intune to manage its Windows 10 devices. The company recently experienced a ransomware attack that encrypted local files on several devices. To mitigate future attacks, management wants to ensure that all devices have real-time protection enabled in Microsoft Defender Antivirus and that Controlled Folder Access is turned on. You need to configure these settings via Intune. You decide to create a device configuration profile for Windows 10. What is the most efficient way to deploy these settings to all existing and future devices?

Accepted Answer

Create a device configuration profile and assign it to a device group that includes all devices.. A device configuration profile in Intune can include Microsoft Defender Antivirus settings (such as real-time protection and Controlled Folder Access) and is assigned to a device group. This ensures that both existing and future devices that join the group automatically receive the settings, providing a scalable and efficient deployment method without requiring user interaction or additional scripts.

Answer

Use PowerShell scripts deployed via Intune to enable the settings on each device.

Answer

Create a device configuration profile and assign it to a user group that includes all users.

Answer

Create a compliance policy that requires these settings and assign it to all devices.

Question 10

Your organization uses Microsoft Intune to manage Windows 11 devices. You have a requirement to ensure that all devices have BitLocker Drive Encryption enabled with a TPM protector and a recovery key escrowed to Azure AD. Additionally, you need to configure a policy that prevents users from changing the BitLocker settings. You create a device configuration profile using the 'Endpoint Protection' template for Windows 10 and later. After deploying the policy to a test group, you notice that BitLocker is not enabled on some devices. The devices meet the hardware requirements and are Azure AD joined. What is the most likely reason for the failure, and how should you resolve it?

Accepted Answer

The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.. The 'Endpoint Protection' template for Windows 10 and later requires explicit configuration of the 'Enable full disk encryption' setting and the encryption method (e.g., XTS-AES 128-bit) under the 'Windows Encryption' section. Without these settings, the policy does not trigger BitLocker to start encryption on the device, even if other settings like TPM protector and recovery key escrow are configured. The devices are Azure AD joined and meet hardware requirements, so the missing encryption enablement is the most likely cause.

Answer

Devices are not hybrid Azure AD joined; convert them to hybrid join for BitLocker policy to apply.

Answer

The policy does not specify a recovery key escrow location; configure it to escrow to Azure AD.

Answer

Devices are not co-managed with Configuration Manager; enable co-management to apply BitLocker policy.

Question 11

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

Accepted Answer

Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.. Deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Answer

Modify the existing Windows Update for Business policy to set the deferral period to 0 days.

Answer

Create a compliance policy that requires the update to be installed and assign it to all devices.

Answer

Use Configuration Manager to push the update via on-premises WSUS.

Question 12

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

Accepted Answer

Create an App Protection Policy (MAM) that restricts the transfer of corporate data to other apps and a Device Configuration Profile that sets the default mail app to Outlook.. An App Protection Policy (MAM) can restrict corporate data access to only managed apps like Outlook, preventing the native Mail app from opening corporate data. Additionally, a Device Configuration Profile can set Outlook as the default mail app on iOS/iPadOS devices, effectively blocking the native Mail app from handling corporate email. Option B is incorrect because a device compliance policy requiring Outlook installation does not prevent the native Mail app from accessing data. Option C is incorrect because device enrollment restrictions are for initial enrollment, not controlling app usage. Option D is incorrect because a conditional access policy can block the native Mail app from Exchange Online but does not set Outlook as the default mail app.

Answer

Create a device compliance policy that requires the device to have Outlook installed.

Answer

Use device enrollment restrictions to block devices that have the native Mail app installed.

Answer

Create a conditional access policy for Exchange Online that blocks the native Mail app and allows only Outlook.

Question 13

You are an Intune administrator for a company that has recently deployed Windows 11 devices. Management wants to ensure that all devices are running the latest feature update (Windows 11 23H2) within 60 days of release. You need to configure a Windows Update for Business policy in Intune to achieve this goal. Which settings should you configure?

Accepted Answer

Set the feature update deferral period to 60 days and assign the policy to all devices.. Setting the feature update deferral period to 60 days in a Windows Update for Business policy ensures that devices will wait up to 60 days after Microsoft releases a feature update (e.g., Windows 11 23H2) before installing it. This meets the requirement of having all devices running the latest feature update within 60 days of release, as the deferral period defines the maximum delay from the release date. Assigning the policy to all devices ensures blanket coverage across the Windows 11 fleet.

Answer

Set the feature update deferral period to 60 days and pause updates for 30 days.

Answer

Set the feature update deadline to 60 days and assign the policy to a device group.

Answer

Set the feature update deferral period to 0 days and assign to all users.

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company-specific application (a .pkg file) to all macOS devices. The application requires a specific configuration file that must be placed in the /Library/Application Support/ directory. You also need to ensure that the application is installed silently without user interaction. How should you configure the deployment in Intune?

Accepted Answer

Add the .pkg file as a macOS line-of-business app in Intune, specify installation arguments for silent install, and include a script to copy the configuration file post-install.. Intune's macOS line-of-business (LOB) app deployment supports .pkg files and allows you to specify installation arguments (e.g., `-silent` or `--acceptLicense`) for silent installation. To place the configuration file in /Library/Application Support/, you must use a post-install script because Intune does not natively copy files to specific directories during LOB app deployment. This combination ensures the app is installed silently and configured correctly.

Answer

Use a shell script in Intune to download and install the .pkg file from a secure URL.

Answer

Create a device configuration profile for macOS that includes the app installation settings.

Answer

Use Apple Volume Purchase Program (VPP) to distribute the app as a managed app.

Question 15

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

Accepted Answer

Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.. The issue is likely a misconfiguration of the compliance policy assignment or evaluation. Android Enterprise work profile devices use file-based encryption by default, which Intune considers compliant. If devices are marked non-compliant despite encryption being enabled, you should verify that the compliance policy is correctly assigned to the target groups and re-evaluate the policy. Option A is incorrect because the work profile is already enabled on the device. Option B is incorrect because Intune cannot change the encryption method on Android devices; encryption type is device-specific. Option D is incorrect because device configuration profiles cannot enforce encryption on the work profile; encryption is managed by the device OS.

Answer

Enable the work profile on the devices via a device configuration profile.

Answer

Change the device encryption method to full-disk encryption using a device configuration profile.

Answer

Create a device configuration profile that enforces encryption on the work profile.