MD-102 Manage and maintain devices Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a custom Line-of-Business (LOB) app that is signed with a certificate not trusted by the devices. The app must be available to users in the Company Portal. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upload the app as a LOB app in Intune and assign it to the target group.. Intune natively supports deploying signed Line-of-Business (LOB) apps directly to managed Windows devices, even if the signing certificate is not trusted by the devices. Intune handles the app delivery through the Company Portal, and the app will install as long as the device is enrolled and the app is assigned to the target group. The certificate trust issue is irrelevant for LOB app deployment via Intune because Intune does not validate the certificate chain for LOB apps; it only requires the app to be signed.

Answer

Upload the app to Microsoft Store for Business and assign it as offline.

Answer

Enable side-loading of apps on the target devices using Group Policy.

Answer

Convert the app to a .appx package and sign it with a trusted certificate.

Question 2

You need to ensure that Windows 10 devices in your organization receive the latest quality updates within 7 days of release. You configure a Windows Update for Business policy in Intune with a deferral period of 7 days. After two weeks, some devices have not installed the updates. What is the most likely reason?

Accepted Answer

Devices have not synced with Intune to receive the updated policy.. Windows Update for Business policies in Intune are not applied in real time; devices must check in with the Intune service to receive the updated policy. The default sync interval for Intune-managed Windows 10 devices is approximately 8 hours, and if a device has not synced since the policy was configured, it will not yet have the new deferral settings. This explains why some devices have not installed the updates even after two weeks, as they may have missed the sync window or have a longer check-in cycle.

Answer

The devices are configured to receive updates from WSUS instead of Windows Update.

Answer

The deferral period is too short; Microsoft recommends 14 days.

Answer

The policy is configured to apply only to devices in a specific Azure AD group.

Question 3

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

Accepted Answer

The root CA certificate required to validate the RADIUS server certificate is not installed on the device.. The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Answer

The user's password has expired.

Answer

The Wi-Fi profile is not assigned to the user's device.

Answer

The device's Wi-Fi adapter driver is outdated.

Question 4

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a custom Line-of-Business (LOB) app that is signed with a certificate not trusted by the devices. The app must be available to users in the Company Portal. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the user has logged in and acknowledged the FileVault prompt.. FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Answer

Ensure that a compliance policy is also assigned requiring encryption.

Answer

Ensure the devices are supervised.

Answer

Verify that the profile is assigned to the correct device group.

Question 5

You need to implement a solution that automatically wipes a company-owned Windows 10 device when it has not connected to Intune for 30 days. Which Intune feature should you configure?

Accepted Answer

Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.. A compliance policy can include a rule for 'Maximum days since last check-in' that marks the device non-compliant if it hasn’t connected for 30 days. You then configure a non-compliance action to retire the device, which triggers a wipe. Option A is wrong because a PowerShell script cannot reliably execute on a device that hasn’t connected to Intune for 30 days—it requires connectivity to run. Option C is wrong because device cleanup rules only remove stale device records from Intune, they do not trigger a wipe on the device. Option D is wrong because configuration profiles set settings but do not enforce check-in frequency or trigger wipe actions.

Answer

A PowerShell script that runs on the device to self-destruct after 30 days.

Answer

Device cleanup rules to automatically delete devices after 30 days.

Answer

Device configuration profile with a setting to require periodic check-in.

Question 6

A user reports that after resetting their Windows 10 device, they cannot re-enroll it in Intune. The device appears as 'Pending' in the admin center. What is the most likely reason?

Accepted Answer

The device has a stale record in Intune that needs to be deleted.. When a Windows 10 device is reset, its existing Intune enrollment record becomes stale. The device attempts to re-enroll but the old record causes a conflict, leaving the device in a 'Pending' state in the admin center. Deleting the stale device record from Intune allows the enrollment to complete successfully.

Answer

The user is trying to enroll with a different Azure AD account.

Answer

The MDM authority is not set to Intune.

Answer

The user does not have an Intune license assigned.

Question 7

Which TWO actions can you take to improve the performance of Microsoft Intune management for Windows devices that are geographically distributed and have limited bandwidth?

Accepted Answer

Enable Delivery Optimization to use peer-to-peer sharing within the same network.. Options C and D are correct. Enabling Delivery Optimization (C) allows Windows devices to download updates from other devices on the same network using peer-to-peer, reducing internet bandwidth usage. Configuring Windows Update for Business to use 'Download only' mode (D) ensures that updates are downloaded only once from Microsoft and then shared via Delivery Optimization, further reducing bandwidth consumption. Option A is incorrect because deploying a Configuration Manager site server at each location adds infrastructure complexity and does not directly improve performance for Intune-managed devices; Peer Cache is not a native Intune feature. Option B is incorrect because increasing sync intervals increases network traffic, worsening bandwidth issues. Option E is incorrect because disabling real-time scanning compromises security without any significant bandwidth benefit.

Answer

Deploy a Configuration Manager site server at each location to act as a peer cache.

Answer

Increase the frequency of device sync intervals to ensure policies are applied quickly.

Answer

Disable Windows Defender real-time scanning on devices.

Question 8

Which THREE conditions must be met for a Windows 10 device to be able to use Windows Autopilot self-deploying mode?

Accepted Answer

The device must be Azure AD joined.. Azure AD join is required for self-deploying mode because this mode provisions a device for shared or kiosk scenarios without user interaction. The device must be joined to Azure AD to establish a device identity and allow policy application before any user signs in, which is a core requirement for the zero-touch provisioning flow.

Answer

The device must be Hybrid Azure AD joined.

Answer

A user must be assigned to the device in Autopilot.

Question 9

Which TWO methods can you use to deploy Microsoft 365 Apps to Windows 10 devices managed by Intune?

Accepted Answer

Use the Microsoft 365 Apps (Windows) app type in Intune.. The 'Microsoft 365 Apps (Windows)' app type in Intune is a built-in deployment method specifically designed to install Office 365 ProPlus (now Microsoft 365 Apps) on managed Windows 10 devices. It allows you to select the installation channel, language, and update settings directly from the Intune console without needing external tools.

Answer

Use the Office Deployment Tool wrapped as a Win32 app.

Answer

Use Group Policy to assign Office installation.

Answer

Deploy the Microsoft Store version of Office.

Question 10

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running OS version 10.0.22621.100. The device has a password set, firewall active, and Defender enabled. However, the device is marked as non-compliant. What is the most likely reason?

Accepted Answer

The OS version exceeds the maximum allowed version specified in the policy.. The device OS version 10.0.22621.100 exceeds the maximum OS version specified in the policy (10.0.22621.0). In Microsoft Intune compliance policies, the 'Maximum OS version' setting marks a device as non-compliant if the device's OS build number is greater than the specified value, even if all other conditions are met. This is a common configuration to prevent devices from running untested or incompatible OS builds.

Answer

The password length is exactly 8 characters, but the policy requires more than 8.

Answer

Microsoft Defender is not at the required version 4.18.2207.7.

Answer

The device does not have a password set.

Question 11

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

Accepted Answer

The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.. The compliance policy includes a rule for 'Maximum days since last check-in', which checks the `lastSyncDateTime` property. Devices that have not synced within the configured threshold (e.g., 30 days) are marked as noncompliant. This is a common Intune compliance setting for Windows devices to ensure they regularly communicate with the service.

Answer

The devices failed to enroll properly.

Answer

The devices are running a non-Windows operating system.

Answer

The devices have names that do not match the naming convention.

Question 12

Refer to the exhibit. You apply this device configuration profile to a group of Windows 10 devices. Users report that they receive update notifications outside of active hours. Which setting should you modify to suppress notifications during active hours?

Accepted Answer

Set updateNotificationLevel to 'turnOffAllNotifications'.. The setting updateNotificationLevel controls whether Windows Update displays notifications to users. Setting it to 'turnOffAllNotifications' suppresses all update notifications, including those that appear outside of active hours. This is the correct configuration to prevent users from seeing update notifications during active hours.

Answer

Modify activeHoursStart and activeHoursEnd to cover the full day.

Answer

Set cloudBlockLevel to 'normal'.

Answer

Set detectionFrequency to a higher value.

Question 13

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a custom Line-of-Business (LOB) app that is signed with a certificate not trusted by the devices. The app must be available to users in the Company Portal. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the compliance policy is assigned to the correct Windows version.. The correct first step is to verify that the compliance policy is assigned to the correct Windows version. After a Windows update, the OS version may change, and if the policy targets a specific version that no longer matches, devices may stop receiving it. Option B is incorrect because connectivity issues would affect all Intune communication, not just compliance policy receipt. Option C is incorrect because group membership does not directly affect policy delivery to already-enrolled devices. Option D is incorrect because re-enrollment is unnecessary and disruptive; the issue is likely a policy targeting mismatch.

Answer

Check if the devices can connect to the Intune service.

Answer

Ensure the users are members of the correct Azure AD group.

Answer

Re-enroll the devices in Intune.

Question 14

A company uses Microsoft Intune to manage iOS devices. They need to ensure that corporate data on these devices is protected if a device is lost or stolen. The solution must allow users to continue using personal apps and data after a selective wipe. What should they configure?

Accepted Answer

Initiate a selective wipe from the Intune console.. A selective wipe from the Intune console removes only corporate data (e.g., managed apps, email profiles, VPN configurations) while preserving personal apps and data on the iOS device. This meets the requirement of protecting corporate data on a lost or stolen device without affecting the user's personal content. Intune uses the iOS Management Profile and the built-in selective wipe capability that targets only the MDM-managed corporate partition.

Answer

Configure a full wipe action in a compliance policy.

Answer

Use Remote Lock from the Intune console.

Answer

Create a device compliance policy that marks the device as noncompliant.

Question 15

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

Accepted Answer

Upload the script as a PowerShell script in Intune and assign it to the device group.. Intune's 'PowerShell scripts' feature allows you to upload and assign scripts that run under the system context during device enrollment, specifically targeting devices in a group. This is the only native Intune method that executes scripts in the system context at enrollment time without additional configuration.

Answer

Deploy the script as a proactive remediation.

Answer

Use a device compliance policy to trigger the script.

Answer

Create a custom configuration profile to run the script.