MD-102 Manage and maintain devices Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a device compliance policy that uses Defender for Endpoint risk level, then use Conditional Access.. It combines a device compliance policy that evaluates the Defender for Endpoint risk level with a Conditional Access policy that blocks access when the device is noncompliant. This is the only supported method to automatically block corporate resource access based on real-time risk assessment from Defender for Endpoint.

Answer

Configure a device compliance policy with 'Require Defender for Endpoint' setting.

Answer

Configure a device configuration policy to block access based on risk.

Answer

Configure an app protection policy to block access based on device risk.

Question 2

A company is planning to use Windows Autopilot to deploy new devices. They want to ensure that devices are automatically enrolled in Microsoft Intune when a user signs in with their Microsoft Entra ID credentials. Which configuration is required?

Accepted Answer

Configure MDM auto-enrollment in Microsoft Intune admin center.. Configuring MDM auto-enrollment in Microsoft Entra ID (under Mobility > MDM) is the required step to automatically enroll devices in Intune when users sign in with their Microsoft Entra ID credentials during Windows Autopilot. Option A (Enrollment Status Page) only affects the end-user experience during enrollment, it does not trigger enrollment. Option B (compliance policy) enforces compliance after enrollment, not enrollment itself. Option C (device enrollment restrictions) controls which platforms can enroll, not automatic enrollment.

Answer

Configure an Enrollment Status Page (ESP) profile in Intune.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Enforce enrollment'.

Answer

Set device enrollment restrictions to allow all device platforms.

Question 3

Your organization wants to use Windows Autopilot for user-driven deployment. Users should be able to self-deploy their devices by signing in with their corporate credentials. Which Autopilot deployment mode should you use?

Accepted Answer

User-driven (Azure AD join). User-driven (Microsoft Entra ID join) deployment mode is correct because it allows users to self-deploy their devices by signing in with their corporate credentials during the out-of-box experience (OOBE). This mode joins the device to Microsoft Entra ID and enrolls it in Microsoft Intune, enabling the user to complete the setup without IT intervention.

Answer

Pre-provisioned deployment

Answer

Hybrid Azure AD join

Answer

Self-deploying (Azure AD join)

Question 4

Which THREE conditions must be met for a Windows 10 device to be co-managed with Microsoft Intune and Microsoft Configuration Manager? (Choose three.)

Accepted Answer

The device must be enrolled in Microsoft Intune.. Option A is correct because co-management requires the device to be enrolled in Microsoft Intune, which provides the MDM channel and enables the Intune workload authority alongside Configuration Manager. Option B is correct because the Configuration Manager client must be installed on the device so that the Configuration Manager channel and its workloads can function. Option C is correct because the device must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined to establish the identity and authentication needed for Intune enrollment and co-management. Option D is not required because hybrid Microsoft Entra ID join is only one of the acceptable identity states; Microsoft Entra ID join alone also satisfies the requirement. Option E is not required because the Intune Management Extension is only needed for specific workloads such as PowerShell scripts and Win32 apps, not as a baseline condition for co-management.

Answer

The device must be hybrid Azure AD joined.

Answer

The device must have the Intune Management Extension installed.

Question 5

Refer to the exhibit. You are reviewing a Win32 app configuration in Microsoft Intune. The app is not installing on some Windows 10 devices. Which is the most likely reason?

Accepted Answer

The devices have an OS version lower than 10.0.19041.. The exhibit shows the 'Minimum OS version' requirement set to 10.0.19041 (Windows 10 version 20H1/2004). Devices with an OS build lower than this threshold will fail to install the Win32 app, as Intune enforces this requirement before executing the installation command. This is a common configuration issue when deploying apps to a mixed-OS environment.

Answer

The install command line is missing the /silent switch.

Answer

The detection rule path is incorrect.

Answer

The install experience is set to system, but should be user.

Question 6

A company uses Microsoft Intune to manage Windows 11 devices. Users report that the Company Portal app is not showing required applications. You verify that the devices show as 'Compliant' in Microsoft Intune. Which configuration should you check first?

Accepted Answer

Check the application assignments in Intune.. The most common reason required applications are not visible in Company Portal is that the applications have not been assigned to the user or device group. Even if a device is compliant, Intune will only display applications that are assigned with an 'Available' intent to the user or device. Checking application assignments first directly addresses the symptom without assuming other configurations are misconfigured.

Answer

Check the Microsoft Entra ID (Azure AD) configuration for the device.

Answer

Check the Windows Update for Business ring assignments.

Answer

Check the device compliance policy settings.

Question 7

You are troubleshooting an iPhone that cannot enroll in Microsoft Intune. The user receives an error stating 'This device is already enrolled in another MDM.' What is the most likely cause?

Accepted Answer

The device is already enrolled in Apple Business Manager or another MDM.. The error 'This device is already enrolled in another MDM' indicates that the iPhone has an existing MDM profile that conflicts with Intune enrollment. This typically occurs when the device is already enrolled in Apple Business Manager (ABM) or another MDM solution, as iOS enforces a single MDM enrollment per device. Intune cannot overwrite an existing MDM profile without first removing it.

Answer

The device has a VPN configuration installed.

Answer

The device is not running the latest iOS version.

Answer

The user's license is expired.

Question 8

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

Accepted Answer

The devices are not connected to the internet.. Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Answer

The hardware hashes are invalid.

Answer

The devices are not running Windows 11 Pro or Enterprise.

Answer

The user does not have an Intune license.

Question 9

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

Accepted Answer

The current OS version on the device.. The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Answer

The user's license status.

Answer

The compliance policy is assigned to the device.

Answer

The device is connected to the internet.

Question 10

Which TWO Windows Update for Business policies can you configure using Microsoft Intune?

Accepted Answer

Feature update version targeting. Microsoft Intune allows you to configure a 'Feature update version targeting' policy, which specifies a target feature update version (e.g., Windows 11 23H2) for devices. Option B is correct because you can configure a 'Quality update deferral period' within an update ring policy to delay quality updates. Option C is incorrect because, although a driver update deferral period can be configured in an update ring policy, it is not a separate Windows Update for Business policy type; the question expects the two distinct policy types: Feature update version targeting and Quality update deferral period. Option D is incorrect because Windows Defender definition update schedule is not a Windows Update for Business policy; it is managed via Microsoft Defender for Endpoint or other settings. Option E is incorrect because Microsoft 365 Apps update channel is not a Windows Update for Business policy; it is configured separately for Office applications.

Answer

Driver update deferral period

Answer

Windows Defender definition update schedule

Answer

Microsoft 365 Apps update channel

Question 11

Which THREE are valid Windows Autopilot deployment scenarios?

Accepted Answer

Self-deploying. Self-deploying (A) is a valid Windows Autopilot scenario in which the device is provisioned with no user interaction, using a device-targeted profile and TPM attestation, ideal for kiosks and shared devices. User-driven (C) is valid because it lets the end user sign in with their Microsoft Entra ID credentials during OOBE, after which the Autopilot profile applies device and user settings. White glove (E) is valid as the pre-provisioning scenario where a partner or IT technician runs the provisioning process so the device reaches the user ready for a fast, final sign-in. App-driven (B) and Policy-driven (D) are not Autopilot deployment scenarios; Autopilot modes are defined by user interaction and pre-provisioning, not by app or policy triggers.

Answer

App-driven

Answer

Policy-driven

Question 12

You have a Windows 10 device running OS version 10.0.19043.1234. The device is compliant with all settings except password requirements. The device does not have a password set. What is the compliance status?

Accepted Answer

Noncompliant because passwordRequired is true and no password set.. The device is noncompliant due to the passwordRequired policy setting being set to true while no password is configured on the device. In Microsoft Intune, compliance policies evaluate each setting independently; if a required setting like passwordRequired is not met, the device is marked noncompliant regardless of other compliant settings. The OS version 10.0.19043.1234 is within a supported range, and storage encryption is not evaluated unless explicitly required by a policy, so only the missing password triggers noncompliance.

Answer

Noncompliant because storage encryption is not enabled.

Answer

Noncompliant because OS version is not within range.

Answer

Compliant

Question 13

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

Accepted Answer

The policy has not been applied to the device yet.. If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Answer

Real-time scanning is set to monitorAllFiles, but the file was an archive.

Answer

The scan type is set to quick, which does not scan downloaded files.

Answer

The cloud block level is set to high, which may block unknown files, but known files might be missed.

Question 14

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Accepted Answer

Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.. Option A is correct because Intune policies are assigned to Microsoft Entra ID groups, so if the device (or its user) is not a member of the group targeted by the security policy, the policy will never be delivered and the device will remain non-compliant. Option D is correct because Intune is a cloud-based MDM service; the device must have an active internet connection and be able to reach Intune endpoints (e.g., *.manage.microsoft.com over TCP 443) for policy sync, check-in, and compliance evaluation to occur. Option B is not relevant because Microsoft 365 licensing affects access to services like Exchange and Office, not Intune policy delivery or compliance state. Option C is not appropriate because resetting enrollment state via the Company Portal is a drastic remediation that removes management and would not fix a group-targeting or connectivity issue. Option E is incorrect because gpupdate /force applies on-premises Active Directory Group Policy, not Intune MDM policies, and Invoke-Command targets PowerShell remoting rather than Intune policy sync.

Answer

Reissue the user's Microsoft 365 license from the admin center.

Answer

Reset the device's enrollment state via the Company Portal.

Answer

Run Invoke-Command to remotely execute gpupdate /force.

Question 15

Refer to the exhibit. You run this PowerShell command using the Microsoft Graph PowerShell SDK. What is the primary purpose of this command?

Accepted Answer

To retrieve a list of all Windows managed devices with their compliance status.. The PowerShell command uses `Get-MgDeviceManagementManagedDevice` with a filter for `operatingSystem eq 'Windows'` and selects properties including `complianceState`. This retrieves all Windows managed devices and their compliance status, making option D correct. The command does not filter by compliance state, so it returns both compliant and non-compliant devices, and it does not enforce any compliance action.

Answer

To list only non-compliant Windows devices.

Answer

To retrieve all managed devices regardless of operating system.

Answer

To enforce compliance on Windows devices.