MD-102 Manage and maintain devices Practice Test 20 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a custom app that is not available in the Google Play Store. Which app deployment method should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the app as a line-of-business (LOB) app and upload the APK file.. Line-of-business (LOB) apps in Intune allow administrators to upload and deploy custom APK files to Android Enterprise devices. Option A is incorrect because Managed Google Play apps must be published to the Play Store. Option B is incorrect because deploying a web link is not an app deployment method; it only provides a link to download the APK manually. Option D is incorrect because iOS LOB app deployment is specific to iOS devices and is not applicable to Android.

Answer

Add the app as a Managed Google Play app.

Answer

Deploy the app as a web link to the APK file.

Answer

Use the iOS LOB app deployment method.

Question 2

You manage devices with Microsoft Intune. You need to ensure that only devices with a specific BIOS serial number can enroll. What should you configure?

Accepted Answer

Enrollment restrictions that block devices by hardware identifier.. Intune's enrollment restrictions allow you to block or allow devices based on hardware identifiers such as the BIOS serial number. By adding the specific BIOS serial numbers to the blocked hardware identifiers list, you can effectively prevent any device that does not match the allowed serials from enrolling. This is the only built-in mechanism in Intune that directly controls enrollment eligibility based on hardware characteristics.

Answer

A device category with a dynamic group based on BIOS serial.

Answer

A device compliance policy that checks BIOS serial number.

Answer

A Conditional Access policy that requires a compliant device.

Question 3

Your organization uses Windows Autopilot for device provisioning. Users report that after initial setup, devices are not automatically enrolled in Microsoft Intune. What should you verify?

Accepted Answer

That the devices are registered in Windows Autopilot with a valid hardware hash.. Windows Autopilot requires devices to be registered in the Autopilot service with a valid hardware hash (or other unique identifier like PKID or serial number) so that the service can match the device during OOBE and trigger the enrollment process into Intune. Without a valid hardware hash, the device will not be recognized by Autopilot and will proceed through standard OOBE without automatic Intune enrollment.

Answer

That a device configuration profile is assigned to the devices.

Answer

That a Conditional Access policy is in place requiring Intune enrollment.

Answer

That a device compliance policy is assigned to the Autopilot devices.

Question 4

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

Accepted Answer

In the Intune portal, select the devices and click 'Sync'.. The Intune 'Sync' action sends a direct MDM policy refresh command to the device via the Microsoft Intune service. This triggers the device's enrollment client to immediately check in with the MDM server, download the latest policies, and apply them without waiting for the next scheduled sync interval. Since the devices are online and have connectivity, this remote sync forces an immediate policy refresh.

Answer

Ask users to restart their devices.

Answer

Ask users to run Windows Update.

Answer

Adjust the MDM sync interval in Intune.

Question 5

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only users in the Sales department can enroll their devices. What should you configure?

Accepted Answer

Enrollment restrictions that allow only users in the Sales group.. Enrollment restrictions in Intune let you control which users or groups are allowed to enroll devices, so restricting enrollment to the Sales group directly satisfies the requirement. This is the purpose-built control for limiting enrollment by user or group, platform, or device type.

Answer

An Intune role-based access control (RBAC) role for Sales users.

Answer

A device configuration profile assigned to Sales users.

Answer

A Conditional Access policy that requires device compliance.

Question 6

Which TWO actions can you perform in Microsoft Intune to remediate a noncompliant Windows device that has been marked as noncompliant due to missing antivirus? (Choose two.)

Accepted Answer

Deploy a proactive remediation script to detect and install antivirus.. Option B is correct because proactive remediations in Intune pair a detection script with a remediation script that runs on the device, so you can detect missing antivirus and automatically install it to bring the device back into compliance. Option D is correct because running a PowerShell script from Intune (via a platform script or device script) lets you execute installation commands for the missing antivirus directly on the Windows device. Option A is not a remediation action; a sync only forces the device to check in and re-evaluate policy/compliance, which does not install antivirus. Option C merely notifies the user and relies on manual action, so it does not remediate the device automatically. Option E is a Conditional Access policy that blocks access rather than fixing the noncompliance, so it is not a remediation action.

Answer

Send a sync command to the device to re-evaluate compliance.

Answer

Send a notification to the user to install antivirus via Windows Security.

Answer

Create a Conditional Access policy to block the device until fixed.

Question 7

Which THREE conditions can be used to create a dynamic device group in Microsoft Entra ID for Intune management? (Choose three.)

Accepted Answer

Enrollment profile name (e.g., 'Autopilot Profile'). Option A is correct because dynamic device groups in Microsoft Entra ID support the device property enrollmentProfileName, which matches the Autopilot enrollment profile name such as 'Autopilot Profile', allowing devices to be grouped by how they were provisioned. Option D is correct because the deviceModel attribute is a supported device property that can be used in a dynamic membership rule, so a rule like device.deviceModel -eq "Surface Pro 7" will correctly populate the group. Option E is correct because operatingSystemVersion is also a valid device property for dynamic device membership rules, enabling grouping by OS build such as Windows 11 22H2. Option B is not valid because last sign-in time is a user attribute (signInActivity), not a device property available for dynamic device group rules. Option C is not valid because installed application versions are not exposed as Microsoft Entra ID device attributes; app inventory data lives in Intune and cannot be used directly in an Entra dynamic device membership rule.

Answer

Last sign-in time of the user

Answer

Installed application version

Question 8

Which TWO are valid methods to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune? (Choose two.)

Accepted Answer

Package the Office Deployment Tool as a Win32 app.. Option B is correct because packaging the Office Deployment Tool (ODT) as a Win32 app in Intune lets you supply a custom configuration.xml, so setup.exe can download and install Microsoft 365 Apps with your chosen channel, architecture, and apps. Option D is correct because Intune provides a built-in Microsoft 365 Apps (Office) app type for Windows 10 and later, where you select the update channel, version, architecture, and which Office apps to install directly from the console. Option A is wrong because the iOS Microsoft 365 Apps deployment method targets mobile devices, not Windows devices. Option C is wrong because Microsoft 365 Apps is not distributed as a single MSI for Intune deployment; it uses Click-to-Run via the ODT or the built-in app type. Option E is wrong because a web link to the Office 365 portal only opens a webpage and does not install the apps on the device.

Answer

Use the iOS Microsoft 365 Apps deployment method.

Answer

Upload an MSI file for Microsoft 365 Apps.

Answer

Add a web link to the Office 365 portal.

Question 9

Refer to the exhibit. The JSON snippet shows a device compliance policy for Windows 10. You assign this policy to a device group. Some devices report as noncompliant even though they have BitLocker enabled and meet password requirements. What is the most likely cause?

Accepted Answer

The devices are not enrolled in Microsoft Defender for Endpoint.. The deviceThreatProtectionEnabled setting requires devices to be enrolled in Microsoft Defender for Endpoint to report threat levels. Without this enrollment, the compliance policy cannot evaluate the threat status, causing devices to be marked as noncompliant even if BitLocker and password policies are satisfied.

Answer

The deviceThreatProtectionEnabled setting should be false.

Answer

The password minimum length is too short.

Answer

The storageRequireEncryption setting conflicts with BitLocker.

Question 10

Refer to the exhibit. You run the PowerShell cmdlet in Microsoft Graph to list managed Windows devices. The output shows that several devices have a complianceState of 'noncompliant' but lastSyncDateTime is recent. What is the most likely reason for noncompliance?

Accepted Answer

The devices do not meet the assigned compliance policies.. A device's complianceState is determined by evaluating its configuration against assigned compliance policies. Even if lastSyncDateTime is recent, the device will be marked 'noncompliant' if it fails any of the policy checks (e.g., missing required updates, encryption not enabled, or a required antivirus solution not running). The sync timestamp only indicates when the device last communicated with Intune, not whether it meets policy requirements.

Answer

The devices are running a non-Windows OS.

Answer

The devices have not synced recently.

Answer

The admin lacks permissions to view compliance details.

Question 11

Refer to the exhibit. The JSON snippet shows a Windows Update for Business policy assigned to a device group. Users report that quality updates are installed 7 days after release. Which setting controls this behavior?

Accepted Answer

qualityUpdateDeferralPeriodInDays. The setting `qualityUpdateDeferralPeriodInDays` controls how long quality updates (security fixes) are deferred after release. A value of 7 means updates are installed 7 days post-release, matching the user report. This is a Windows Update for Business policy configured via CSP (Policy CSP - Update).

Answer

featureUpdateDeferralPeriodInDays

Answer

businessReadyUpdatesOnly

Answer

automaticUpdateMode

Question 12

You need to remotely wipe a lost corporate-owned iOS device that is managed by Intune. Which action should you use?

Accepted Answer

Wipe. The 'Wipe' action in Microsoft Intune performs a factory reset on a corporate-owned iOS device, removing all data and settings to protect sensitive information. This is the appropriate action for a lost device because it restores the device to its out-of-box state, ensuring no corporate data remains accessible.

Answer

Reset

Answer

Delete

Answer

Retire

Question 13

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

Accepted Answer

Add as a macOS line-of-business app.. The recommended method to deploy a .pkg app to macOS devices managed by Microsoft Intune is to add it as a macOS line-of-business (LOB) app. This app type is specifically designed for deploying macOS installer packages (.pkg) and requires the file to be uploaded directly to Intune, which then pushes the installation to enrolled devices using the Intune management agent for macOS.

Answer

Add as a Windows line-of-business app.

Answer

Add as a macOS web app.

Answer

Add as a Microsoft Store app.

Question 14

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 15

Which THREE actions can you perform on a managed device from the Microsoft Intune admin center?

Accepted Answer

Change the primary user. The Microsoft Intune admin center supports several remote actions on managed devices. Changing the primary user (A), Restart (C), and Sync (D) are all valid remote actions. Options B (Change the enrolled user) and E (Change the device name) are not available remotely.

Answer

Change the enrolled user

Answer

Change the device name