MD-102 Manage and maintain devices Practice Test 21 — 15 Questions

Question 1

Which TWO are valid methods to enroll Windows devices in Microsoft Intune?

Accepted Answer

Manual enrollment using work or school account. Option B (Manual enrollment using work or school account) is correct because on a Windows 10/11 device a user can go to Settings > Accounts > Access work or school > Connect and sign in with their Microsoft Entra ID work or school account, which triggers automatic MDM enrollment into Intune via the built-in Windows MDM client. Option C (Windows Autopilot) is correct because Autopilot uses a device hash registered in Intune so that during OOBE the device is automatically Microsoft Entra ID joined (or Hybrid Microsoft Entra ID joined) and enrolled in Intune without manual user configuration. Option A (Apple Business Manager) is wrong for this scenario because ABM is Apple's automated device enrollment service for iOS/iPadOS and macOS devices, not Windows. Option D (Android Enterprise) is wrong because it is Google's management framework for Android devices and has no role in enrolling Windows. Option E (Microsoft Entra ID Join) is not a standalone enrollment method; Microsoft Entra ID Join is the identity state that must be combined with an MDM enrollment mechanism (such as manual work/school account connection or Autopilot) to actually register the device in Intune.

Answer

Apple Business Manager

Answer

Android Enterprise

Answer

Azure AD Join

Question 2

Refer to the exhibit. You are reviewing a Windows 10 compliance policy JSON. What is the purpose of the 'osMinimumVersion' setting?

Accepted Answer

It defines the minimum OS build version that the device must have to be compliant.. The 'osMinimumVersion' setting in a Windows 10 compliance policy specifies the minimum OS build version (e.g., 10.0.19041) that a device must have to be considered compliant. If the device's OS build version is lower than this value, Intune marks it as non-compliant, which can trigger conditional access blocks or remediation actions. This setting does not initiate an update; it only evaluates the current version against the defined threshold.

Answer

It sets the Windows Update for Business ring to that version.

Answer

It requires the device to be on a specific feature update.

Answer

It forces the device to update to that version.

Question 3

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Accepted Answer

The ComplianceState reflects the last sync; the device may have changed compliance since.. The ComplianceState property in Microsoft Intune reflects the compliance status at the time of the last device check-in. If a device has not synced for 7 days, the stored ComplianceState is stale and may no longer represent the actual compliance posture. The device could have become non-compliant since its last sync due to policy changes, missing updates, or configuration drift, but Intune will not update the state until the next successful sync.

Answer

The device is compliant but not syncing because it is turned off.

Answer

The device is no longer enrolled but shows compliant due to a reporting delay.

Answer

The compliance policy was removed after the last sync.

Question 4

Refer to the exhibit. You are reviewing a Windows 10 update ring configuration JSON. What does the 'automaticUpdateBehavior' setting control?

Accepted Answer

Whether updates are installed automatically and if the user can control reboot timing. The 'automaticUpdateBehavior' setting in a Windows 10 update ring configuration JSON controls whether updates are downloaded and installed automatically, and whether the user can control reboot timing. When set to 'autoInstallAndRebootWithNoUserControl', updates install automatically and reboots occur without user interaction; when set to 'autoInstallAndRebootWithUserControl', the user can schedule or postpone reboots. This directly matches option C, as it governs both automatic installation and reboot control.

Answer

The level of update notifications

Answer

How long to defer feature updates

Answer

The branch readiness level

Question 5

You are designing a Windows 11 update strategy for a fleet of 500 devices managed by Intune. The organization requires that critical security updates be applied within 7 days, but feature updates can be delayed up to 60 days. Which Update Rings configuration should you use?

Accepted Answer

Create an Update Ring with quality update deferral of 7 days and feature update deferral of 60 days. Update Rings in Intune allow you to independently configure deferral periods for quality updates (security fixes) and feature updates. Setting quality update deferral to 7 days ensures critical security patches are applied within the required window, while feature update deferral of 60 days delays non-security feature updates as needed, all managed via cloud-based Windows Update for Business policies.

Answer

Assign a Quality Update policy with deferral of 7 days

Answer

Configure Windows Update for Business via Group Policy on-premises

Answer

Assign a Feature Update policy with deferral of 60 days

Question 6

You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?

Accepted Answer

OS version is above the maximum allowed. The compliance policy in the exhibit specifies a maximum OS version of 10.0.22621.1000, but the Windows 11 device is running build 10.0.22621.1500, which is above that maximum. Intune compares the device's OS version against the configured maximum OS version setting; if the device's version exceeds the maximum, it is marked as noncompliant. This setting is used to prevent devices with newer, potentially untested builds from accessing corporate resources.

Answer

Password minimum length is not met

Answer

Device threat protection level is below medium

Answer

TPM is not present

Question 7

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a specific firewall rule. However, the profile fails to apply on a subset of devices. The Intune console shows 'Conflict' status. What is the most likely cause?

Accepted Answer

Another profile with overlapping settings is assigned. The 'Conflict' status in Microsoft Intune indicates that two or more configuration profiles are attempting to apply different values to the same setting on the device. Since the question specifies a custom firewall rule, the most likely cause is that another profile (e.g., a built-in or custom profile) is also configuring firewall settings, creating a conflict. Intune cannot resolve overlapping settings, so it marks the profile as 'Conflict' and does not apply it.

Answer

The user does not have a macOS license

Answer

The macOS version is not supported by the profile

Answer

The device is not connected to the internet

Question 8

You manage Windows 10 devices with Intune. You need to collect diagnostic logs from a remote device that is experiencing application crashes. Which Intune feature should you use?

Accepted Answer

Collect diagnostics. The 'Collect diagnostics' feature in Intune allows you to remotely gather diagnostic logs from Windows 10 devices without user interaction. This is the correct tool for troubleshooting application crashes because it collects system logs, event logs, and crash dumps directly from the device via the Intune management channel, enabling analysis of the failure.

Answer

Company Portal app

Answer

Autopilot Reset

Answer

Windows Update for Business

Question 9

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows 11 devices remotely? (Choose two.)

Accepted Answer

Collect diagnostics. Option A (Collect diagnostics) is correct because the Intune admin center provides a remote action on Windows 11 devices that gathers diagnostic logs from the device and uploads them to Intune for troubleshooting. Option C (Restart the device) is correct because Intune offers a remote restart action that sends a command to the Windows 11 device to reboot it without requiring physical access. The other options are not remote device actions: deploying a line-of-business app, creating a VPN profile, and assigning a compliance policy are configuration or policy management tasks performed on the Intune service, not direct remote actions executed against a specific enrolled device.

Answer

Deploy a line-of-business app

Answer

Create a VPN profile

Answer

Assign a compliance policy

Question 10

You apply the custom policy shown in the exhibit to a Windows 11 device. Users report that they cannot use Bluetooth devices (e.g., mouse, keyboard) after the policy applies. Which setting in the policy is causing this issue?

Accepted Answer

allowBluetooth set to false. The `allowBluetooth` setting set to `false` explicitly disables the Bluetooth radio on the device, preventing any Bluetooth peripherals (mouse, keyboard, etc.) from pairing or connecting. This is a common policy in Windows CSP (Policy CSP – Bluetooth/AllowBluetooth) that controls the Bluetooth stack at the OS level, and setting it to false blocks all Bluetooth functionality.

Answer

allowStorageCard set to false

Answer

allowCopyPaste set to false

Answer

allowCamera set to false

Question 11

You need to deploy a custom Windows 11 feature update to a pilot group of 50 devices before rolling out to the entire organization. The devices are managed by Intune and are in a 'Pilot' Azure AD group. What is the best approach?

Accepted Answer

Create a feature update profile for Windows 11 and assign to the pilot group. Intune's feature update profiles are specifically designed to deploy Windows 11 feature updates to targeted Microsoft Entra ID groups, such as the 'Pilot' group. This approach allows you to control the exact feature update version (e.g., Windows 11 23H2) and assign it only to the pilot devices, enabling a controlled rollout before expanding to the entire organization.

Answer

Configure a Windows Update for Business deferral policy for all devices

Answer

Create a custom configuration profile with update settings

Answer

Use Group Policy to configure Windows Update settings for the pilot group

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

Accepted Answer

Device compliance policies.. A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.

Answer

No additional configuration is needed.

Answer

Device configuration policies.

Answer

App protection policies.

Question 13

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Accepted Answer

Run a detection script to identify issues.. Proactive remediations in Microsoft Intune are built on a two-part script package, so option A is correct: each remediation includes a detection script that runs first to identify whether a problem exists on the Windows device. Option D is also correct because, when the detection script reports a non-compliant state, the paired remediation script executes to fix the identified issue. Option C is correct as well, since proactive remediations are assigned to device groups and run on a configurable schedule (for example, daily or hourly) rather than only once. Option B is not part of proactive remediations, as Intune does not send email alerts as a built-in remediation action; reporting is surfaced through Intune reports and Endpoint Analytics. Option E is incorrect because proactive remediations do not change device compliance state — compliance is governed separately by compliance policies, and remediation scripts only detect and fix issues.

Answer

Send email alerts when issues are detected.

Answer

Mark devices as non-compliant if remediation fails.

Question 14

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

Accepted Answer

bitLockerDisableWarningForOtherDiskEncryption set to false. Setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Answer

bitLockerEncryptionMethod set to aes256

Answer

passwordRequired set to true

Answer

bitLockerDisableWarningForOtherDiskEncryption set to true

Question 15

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

Accepted Answer

Enable the TPM in the device's BIOS settings.. The device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Answer

Replace the device's motherboard.

Answer

Assign a grace period for the device.

Answer

Remove the tpmRequired setting from the compliance policy.