MD-102 Manage and maintain devices Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that only approved corporate apps can be installed on work profiles. What should you configure?

Accepted Answer

App configuration policy for managed Google Play. To restrict app installation on Android Enterprise work profiles to only approved corporate apps, you must configure an app configuration policy for managed Google Play. This policy enforces a list of required and allowed apps, preventing users from installing unapproved apps from the Play Store on the work profile. Device compliance and conditional access policies control access to resources, not app installation, while device restrictions lack the granularity to enforce app whitelisting on managed Google Play.

Answer

Device compliance policy to block noncompliant devices

Answer

Device restrictions configuration profile

Answer

Conditional access policy to require approved apps

Question 2

A user has an iOS device enrolled in Intune. The device is lost, and you need to immediately prevent unauthorized access to corporate data. The device contains both corporate and personal data. Which action should you take?

Accepted Answer

Use Remote Lock to lock the device. Remote Lock immediately locks the iOS device, preventing unauthorized access to both corporate and personal data without altering the device's content. This is the correct first step to secure data while preserving the ability to recover the device later, as it does not remove any data or accounts.

Answer

Disable the user's account in Microsoft Entra ID

Answer

Initiate a selective wipe

Answer

Initiate a full wipe

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the user context on a schedule. Which TWO methods can you use? (Choose two.)

Accepted Answer

Proactive remediation in Microsoft Intune. Option B (Proactive remediation in Microsoft Intune) is correct because it allows you to upload a PowerShell script that runs on a defined schedule, and you can configure it to run in the user context by setting the 'Run this script using the logged-on credentials' option to Yes. Option C (Configuration profile with a scheduled task) is correct because a Windows 10 custom configuration profile can deploy an OMA-URI or custom XML that creates a scheduled task, and the task can be configured to run under the logged-on user's context on a recurring schedule. Option A is incorrect because device compliance policies only evaluate conditions and report compliance; they do not execute PowerShell scripts. Option D is incorrect because line-of-business app deployment packages are used to install applications, not to schedule PowerShell script execution in the user context. Option E is incorrect because the Intune console's PowerShell script deployment (Windows 10 scripts) runs scripts once during device or user provisioning and does not provide a built-in recurring schedule.

Answer

Device compliance policy with a custom script

Answer

Line-of-business app deployment package

Answer

PowerShell script deployment from the Intune console

Question 4

Which THREE are valid device management actions in Microsoft Intune? (Choose three.)

Accepted Answer

Wipe. Wipe (A) is a valid Intune device action that performs a factory reset, removing all data and settings from the device, and is used for lost, stolen, or repurposed devices. Retire (C) is also valid: it removes company data, management profiles, and the Intune enrollment while leaving the user's personal data intact, ideal for BYOD scenarios. Sync (D) is a valid action that forces the device to check in with the Intune service immediately so it receives pending policies, apps, and commands rather than waiting for the normal check-in interval. Delete (B) is not a device management action in Intune—it removes the device record from the console without performing any remote action on the device itself. Reboot (E) is not offered as a standard Intune device action; while restart can be triggered via scripts or other means, it is not one of the built-in management actions listed alongside Wipe, Retire, and Sync.

Answer

Delete

Answer

Reboot

Question 5

Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

Accepted Answer

The device OS version exceeds the maximum allowed version.. The compliance policy sets a maximum OS version. The device's OS version (10.0.22621.1) is higher than the maximum allowed version specified in the policy, causing the device to be marked as noncompliant. Therefore, option C is correct.

Answer

The device does not have BitLocker encryption enabled.

Answer

The device does not have a password set.

Answer

The password type is not set to alphanumeric.

Question 6

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

Accepted Answer

Sync-IntuneDevice -DeviceId .... The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Answer

Start-DeviceSync -DeviceName PC-001

Answer

Invoke-IntuneDeviceAction -DeviceId ... -Action Sync

Answer

Update-IntuneDevice -DeviceId ...

Question 7

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

Accepted Answer

Update the expirationDateTime property of the token.. The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Answer

Modify the tokenType to a different type.

Answer

Create a new bulk enrollment token with a later expiration date.

Answer

Re-create the token with the same name but later expiration.

Question 8

A user reports that their Windows 11 device is not receiving Microsoft 365 Apps updates from Intune. You verify the device is enrolled and compliant. The device has a Microsoft 365 Apps update policy assigned. What is the most likely cause?

Accepted Answer

The device is in a low-power state and not checking in for updates. The most likely cause is that the device is in a low-power state (e.g., sleep or hibernation) and not checking in for updates. Intune relies on the Microsoft 365 Apps update service, which uses a scheduled task that runs only when the device is awake and connected. If the device is in a low-power state, it cannot execute the update check, even though it is enrolled and compliant.

Answer

The Microsoft 365 Apps update channel is not configured in the policy

Answer

The device is not connected to the internet

Answer

The device has an older version of Office installed that does not support Intune management

Question 9

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

Accepted Answer

The app is assigned to users, not devices. When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy. The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Answer

The device is low on storage

Answer

The app is available but not required

Answer

The device has offline files enabled

Question 10

You need to ensure that all Windows 10 devices automatically install critical security updates from Windows Update as soon as they are released. Which Windows Update for Business policy setting should you configure?

Accepted Answer

Set 'Quality update deferral period' to 0 days. Setting the 'Quality update deferral period' to 0 days ensures that critical security updates (classified as quality updates in Windows Update for Business) are installed immediately upon release, with no deferral. This policy directly controls the delay before installation, and a value of 0 means updates are applied as soon as they are available from Microsoft.

Answer

Set 'Update notification level' to 'Display notification'

Answer

Configure active hours to allow automatic updates

Answer

Enable 'Pause feature updates'

Question 11

Your organization uses Microsoft Intune to manage iOS devices. You need to prevent users from removing the Intune Company Portal app from their devices. Which setting should you configure?

Accepted Answer

Block app removal in device restrictions. In Microsoft Intune, the 'Block app removal' setting within iOS device restrictions prevents users from uninstalling apps, including the Intune Company Portal. This is the correct control to stop users from removing the Company Portal app from supervised iOS devices. It is configured under Devices > Configuration profiles > Device restrictions for iOS/iPadOS.

Answer

Block screen capture

Answer

Require PIN for app store purchases

Answer

Block jailbroken devices

Question 12

Which THREE prerequisites are required to enable Windows Autopilot for existing devices?

Accepted Answer

The device must be running Windows 10 or Windows 11 Pro, Enterprise, or Education edition. Option B is correct because Windows Autopilot for existing devices requires the target device to run Windows 10 or Windows 11 Pro, Enterprise, or Education edition, since these are the SKUs that support the Autopilot deployment profiles and the associated Intune management capabilities. Option D is correct because the device must have internet connectivity during the out-of-box experience (OOBE) so it can contact the Autopilot service, download the deployment profile, and enroll into Intune. Option E is correct because the device must be registered in Intune using its hardware hash, which is how Autopilot identifies the device and associates it with the correct deployment profile. Option A is not required because Autopilot for existing devices is designed to work with devices that may be domain-joined, Microsoft Entra ID-joined, or in a workgroup, and the process can reconfigure them; on-premises AD domain join is not a prerequisite. Option C is not required because although TPM 2.0 is needed for certain features like Windows Hello for Business and some Autopilot scenarios, it is not a strict prerequisite for enabling Autopilot for existing devices.

Answer

The device must be domain-joined to an on-premises Active Directory

Answer

The device must have a TPM 2.0 chip

Question 13

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned devices with work profile. Option A, Android Enterprise corporate-owned devices with work profile, is correct because it is a supported Intune enrollment method for company-owned Android devices where a managed work profile separates corporate data from personal use. Option B, Android Enterprise personally-owned devices with work profile, is also correct because it lets employees enroll their own Android devices while Intune manages only the work profile, keeping personal data private. Option C, Android Device Administrator, is not one of the two correct answers here because it is a legacy management method that Google is deprecating and is not the intended Android Enterprise enrollment path. Option D, Apple Business Manager, is incorrect because it is an Apple automated device enrollment service, not an Android Intune enrollment method. Option E, Windows Autopilot, is incorrect because it is a Windows device provisioning technology, not an Android enrollment method.

Answer

Android Device Administrator

Answer

Apple Business Manager

Answer

Windows Autopilot

Question 14

Refer to the exhibit. You have the following compliance policy assigned to a Windows 10 device running version 10.0.22000.0. The device has a password of 8 characters and is encrypted. What is the compliance status of the device?

Accepted Answer

Compliant. The device is compliant because it meets all the requirements of the compliance policy shown in the exhibit. The policy requires a minimum OS version of 10.0.19041.0, a password of at least 6 characters, and encryption. The device runs Windows 10 version 10.0.22000.0 (which is greater than 10.0.19041.0), has an 8-character password (exceeding the 6-character minimum), and is encrypted. Therefore, all conditions are satisfied, making option C correct.

Answer

Noncompliant due to password length

Answer

Noncompliant due to encryption

Answer

Noncompliant due to OS version

Question 15

Refer to the exhibit. You see the following Intune device properties for a Windows device. The device is noncompliant and the grace period expires on 2025-02-20. Today is 2025-02-15. The compliance policy requires a minimum OS version of 10.0.19041 but the device is on 10.0.18363. What will happen if the device does not become compliant before the grace period expires?

Accepted Answer

The device will be retired after the grace period expires. When a noncompliant device's grace period expires, Intune enforces the compliance policy by retiring the device. Retirement removes the device from Intune management and revokes access to corporate resources, but it does not immediately block access or force an OS update. The grace period allows a window for remediation; after expiration, the device is marked for retirement.

Answer

The device will automatically update to the required OS version

Answer

The device will be blocked from accessing corporate resources

Answer

The device will be retired immediately