MD-102 Manage and maintain devices Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are no longer receiving compliance policies. You verify that the devices are enrolled and show as active in Intune. What should you check first?

Accepted Answer

Verify that the compliance policy is assigned to the correct Windows version.. Option B is correct because the compliance policy may not have been updated to target the new Windows version after the update. Option A is wrong because connectivity issues would affect all policies, not just compliance. Option C is wrong because if the device is enrolled and active, the enrollment record is intact. Option D is wrong because compliance policies are not tied to user group membership in this scenario.

Answer

Check if the devices can connect to the Intune service.

Answer

Ensure the users are members of the correct Azure AD group.

Answer

Re-enroll the devices in Intune.

Question 2

A company uses Microsoft Intune to manage iOS devices. They need to ensure that corporate data on these devices is protected if a device is lost or stolen. The solution must allow users to continue using personal apps and data after a selective wipe. What should they configure?

Accepted Answer

Initiate a selective wipe from the Intune console.. Option A is correct because a selective wipe from the Intune console removes only corporate data (e.g., managed apps, email profiles, VPN configurations) while preserving personal apps and data on the iOS device. This meets the requirement of protecting corporate data on a lost or stolen device without affecting the user's personal content. Intune uses the iOS Management Profile and the built-in selective wipe capability that targets only the MDM-managed corporate partition.

Answer

Configure a full wipe action in a compliance policy.

Answer

Use Remote Lock from the Intune console.

Answer

Create a device compliance policy that marks the device as noncompliant.

Question 3

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

Accepted Answer

Upload the script as a PowerShell script in Intune and assign it to the device group.. Option D is correct because Intune's 'PowerShell scripts' feature allows you to upload and assign scripts that run under the system context during device enrollment, specifically targeting devices in a group. This is the only native Intune method that executes scripts in the system context at enrollment time without additional configuration.

Answer

Deploy the script as a proactive remediation.

Answer

Use a device compliance policy to trigger the script.

Answer

Create a custom configuration profile to run the script.

Question 4

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 5

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

Accepted Answer

Verify that the devices can communicate with an on-premises domain controller.. In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Answer

Check the certificate profile assigned to the devices.

Answer

Ensure the devices have a VPN connection to the corporate network.

Answer

Review the conditional access policies for the users.

Question 6

You need to enforce encryption on Windows 10 devices managed by Intune. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile. Endpoint Protection profiles in Intune include the 'Windows Encryption' settings category, which allows you to enforce BitLocker Drive Encryption on Windows 10 devices. This profile directly manages encryption policies such as requiring BitLocker on OS and fixed drives, configuring encryption methods (e.g., XTS-AES 128-bit), and setting recovery password options. It is the correct policy type for enforcing encryption because it specifically targets security settings like device encryption and BitLocker.

Answer

Device compliance policy

Answer

Windows Update for Business policy

Answer

Device configuration profile (settings catalog)

Question 7

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that only approved corporate apps can be installed on work profiles. What should you configure?

Accepted Answer

App configuration policy for managed Google Play. To restrict app installation on Android Enterprise work profiles to only approved corporate apps, you must configure an app configuration policy for managed Google Play. This policy enforces a list of required and allowed apps, preventing users from installing unapproved apps from the Play Store on the work profile. Device compliance and conditional access policies control access to resources, not app installation, while device restrictions lack the granularity to enforce app whitelisting on managed Google Play.

Answer

Device compliance policy to block noncompliant devices

Answer

Device restrictions configuration profile

Answer

Conditional access policy to require approved apps

Question 8

A user has an iOS device enrolled in Intune. The device is lost, and you need to immediately prevent unauthorized access to corporate data. The device contains both corporate and personal data. Which action should you take?

Accepted Answer

Use Remote Lock to lock the device. Remote Lock immediately locks the iOS device, preventing unauthorized access to both corporate and personal data without altering the device's content. This is the correct first step to secure data while preserving the ability to recover the device later, as it does not remove any data or accounts.

Answer

Disable the user's account in Microsoft Entra ID

Answer

Initiate a selective wipe

Answer

Initiate a full wipe

Question 9

Your organization is planning to deploy Windows 10 updates using Windows Update for Business. You need to ensure that critical security updates are installed within 7 days of release. Which configuration should you use?

Accepted Answer

Configure a deferral period of 7 days for quality updates. To ensure critical security updates are installed within 7 days of release using Windows Update for Business, you configure a deadline for quality updates. A deadline forces the device to install the update by a specified number of days after the update is published, regardless of any deferral period. Setting the deadline to 7 days ensures that the update is installed within that timeframe, meeting the requirement.

Answer

Create a feature update policy for Windows 10

Answer

Set a deadline for quality updates to 7 days

Answer

Pause quality updates for 7 days

Question 10

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the user context on a schedule. Which TWO methods can you use? (Choose two.)

Accepted Answer

Proactive remediation in Microsoft Intune. Proactive remediations in Microsoft Intune allow you to run PowerShell scripts in the user context on a schedule, making option B correct. They are designed for detection and remediation of common support issues, supporting both user and system context execution with configurable schedules.

Answer

Device compliance policy with a custom script

Answer

Line-of-business app deployment package

Answer

PowerShell script deployment from the Intune console

Question 11

Which THREE are valid device management actions in Microsoft Intune? (Choose three.)

Accepted Answer

Wipe. Wipe is a valid Intune device action that restores a device to factory default settings, removing all data and corporate resources. It is typically used for devices that are lost, stolen, or being repurposed, and it can be applied to both corporate-owned and personally-owned devices enrolled in Intune.

Answer

Delete

Answer

Reboot

Question 12

You are troubleshooting an Intune-managed Windows 10 device that is not receiving a required application. Which THREE steps should you take to diagnose the issue? (Choose three.)

Accepted Answer

Ensure the device has network connectivity. Option A is correct because network connectivity is a prerequisite for Intune-managed devices to communicate with the Microsoft Intune service. Without connectivity, the device cannot check in, download app policies, or retrieve application payloads. You should verify the device can reach endpoints like *.manage.microsoft.com and that the Windows Push Notification Services (WNS) channel is open.

Answer

Verify the device is compliant with compliance policies

Answer

Perform a factory reset on the device

Question 13

Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

Accepted Answer

The device OS version exceeds the maximum allowed version.. The compliance policy JSON specifies a maximum OS version of 10.0.22621.1555, but the device is running build 22621.1, which is lower than the maximum. However, the device is showing as noncompliant because the policy enforces a maximum OS version, and the device's OS version (22621.1) is actually below the minimum allowed version (which is not explicitly set but implied by the policy's version range logic). In Intune compliance policies, when a maximum OS version is specified, devices with an OS version greater than that maximum are marked noncompliant. Since the device's build 22621.1 is less than the maximum 22621.1555, the noncompliance must be due to the OS version being below the minimum allowed version (which is not shown in the exhibit but is a common configuration). The most likely reason is that the device OS version exceeds the maximum allowed version, as the policy's maximum version is set to 10.0.22621.1555 and the device's version 22621.1 is actually lower, but the policy may also have a minimum version requirement that the device does not meet. Given the options, the correct answer is C because the device's OS version (22621.1) is below the minimum version that is implicitly enforced by the policy's maximum version setting, causing noncompliance.

Answer

The device does not have BitLocker encryption enabled.

Answer

The device does not have a password set.

Answer

The password type is not set to alphanumeric.

Question 14

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

Accepted Answer

Sync-IntuneDevice -DeviceId .... The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Answer

Start-DeviceSync -DeviceName PC-001

Answer

Invoke-IntuneDeviceAction -DeviceId ... -Action Sync

Answer

Update-IntuneDevice -DeviceId ...

Question 15

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

Accepted Answer

Update the expirationDateTime property of the token.. The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Answer

Modify the tokenType to a different type.

Answer

Create a new bulk enrollment token with a later expiration date.

Answer

Re-create the token with the same name but later expiration.