MD-102 Manage and maintain devices Practice Test 25 — 15 Questions

Question 1

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.. The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates. Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Answer

Change the update ring policy deadline to 7 days to ensure devices have enough time.

Answer

Create a new feature update policy for KB5001234 and assign it to all devices.

Answer

Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.

Question 2

You are a Microsoft Intune administrator for Tailwind Traders. The company has enrolled Windows 11 devices. You need to configure BitLocker encryption on all devices using Intune. You have created an endpoint security policy for BitLocker and assigned it to the correct group. After 24 hours, some devices still show as not encrypted. You verify that the devices are compliant with the policy's prerequisites. What should you do to force the policy to apply?

Accepted Answer

Remotely sync the devices from the Intune console to refresh policy.. When a BitLocker endpoint security policy is assigned but devices have not applied it, forcing a remote sync from the Intune console triggers the device to check in and apply pending policies, including BitLocker encryption.

Answer

Use Group Policy Editor to configure BitLocker locally on each device.

Answer

Check if the devices have TPM version 2.0.

Answer

Re-create the BitLocker policy with a different name.

Question 3

You manage Windows 11 devices with Microsoft Intune. A critical line-of-business app must be installed on all devices in the Finance department, but the app's installer requires administrator privileges and the users do not have local admin rights. You need to deploy the app silently without user interaction and ensure it installs even if no user is signed in. What should you do?

Accepted Answer

Deploy the app as a Windows app (Win32) with install context set to System and detection rules configured.. The app requires administrator privileges and must install silently regardless of user sign-in. Only a Win32 app deployment with the install context set to System runs the installer with local system rights and supports installation without a signed-in user. Detection rules are also required to verify successful installation.

Answer

Deploy the app as a Windows app (Win32) with install context set to User.

Answer

Deploy the app as a Microsoft Store app (new) from Intune.

Answer

Deploy the app as a Microsoft 365 Apps (Windows 10 and later) app from Intune.

Question 4

Your company uses Microsoft Intune to manage Windows 11 devices. A security policy requires that devices automatically receive quality updates as soon as they are available, with a deadline of 2 days after release and automatic restart outside active hours. You create a Windows update ring in Intune. Which setting should you configure to meet the deadline requirement?

Accepted Answer

Set 'Update deadline' to 2 days and configure 'Grace period' as needed.. A Windows update ring in Intune includes an 'Update deadline' setting that forces installation and restart after a specified number of days. Setting it to 2 days ensures quality updates are installed and the device restarts within two days of release, meeting the security policy. Other settings like active hours or auto restart do not enforce the deadline.

Answer

Set 'Restart checks' to 'Allow' and configure 'Auto restart' to 'Always'.

Answer

Set 'Automatic update behavior' to 'Auto install and restart at maintenance time'.

Answer

Set 'Active hours start' and 'Active hours end' to define the restart window.

Question 5

You manage devices enrolled in Microsoft Intune. You need to configure a device compliance policy for Windows 11 devices that requires BitLocker to be enabled and Secure Boot to be enabled. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Require Secure Boot to be enabled on the device. To enforce BitLocker and Secure Boot, the compliance policy must include the 'Require BitLocker' and 'Require Secure Boot to be enabled on the device' settings. These directly evaluate the encryption and firmware security states. Other settings like TPM or code integrity are related but do not confirm that BitLocker and Secure Boot are active.

Answer

Require Trusted Platform Module (TPM)

Answer

Require a minimum OS version

Answer

Require code integrity

Question 6

You manage 500 Windows 11 devices enrolled in Microsoft Intune. A security policy requires that a specific registry value be set on all devices, and you must be able to report which devices have the value applied and remediate any that do not. You need to implement this with the least administrative effort. What should you create?

Accepted Answer

A proactive remediation script in Intune. Proactive remediation scripts are designed to detect and automatically fix issues on Windows devices, and they surface per-device results in Intune. A platform script can set a value but cannot detect or remediate drift, and a custom compliance policy reports but does not remediate. A custom OMA-URI profile can set the value but provides no detection or remediation reporting.

Answer

A PowerShell script deployed as a platform script assigned to all devices

Answer

A configuration profile with a custom OMA-URI setting

Answer

A custom compliance policy with a discovery script

Question 7

You are an administrator for a Microsoft Intune environment. You need to remotely wipe a lost Windows 11 device to prevent access to corporate data. The device is enrolled in Intune and is currently online. Which action should you perform from the Intune admin center?

Accepted Answer

Wipe the device. For a lost or stolen device, the Wipe action in Intune initiates a factory reset, erasing all data. This protects corporate information. Retire only removes corporate data, and Delete only removes the Intune record. Reset is not a valid action. The device must be online to receive the wipe command.

Answer

Reset the device

Answer

Retire the device

Answer

Delete the device

Question 8

You manage a fleet of Windows 11 devices with Microsoft Intune. Users report that the Windows Update ring assigned to them installs quality updates but never installs the required feature update to Windows 11 version 23H2. You confirm the devices are active, check-in is successful, and the ring is assigned to the correct Microsoft Entra group. You need to ensure the feature update installs automatically without user interaction. What should you configure?

Accepted Answer

Create a Feature updates for Windows 10 and later policy targeting Windows 11 version 23H2 and assign it to the device group.. Feature updates require a dedicated Feature updates for Windows 10 and later policy in Intune that specifies the target Windows version and is assigned to the intended devices. Windows Update rings manage quality update behavior and deferrals but do not select which feature update version a device receives. Creating and assigning the feature update policy ensures devices automatically upgrade to Windows 11 version 23H2 without user action.

Answer

Configure a Windows Update for Business delivery optimization policy to enable peer-to-peer content sharing.

Answer

Add the devices to a Microsoft Entra dynamic device group that filters on operatingSystemVersion and assign the update ring to that group.

Answer

Increase the feature update deferral period in the existing Windows Update ring to zero days.

Question 9

You use Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy to require that devices have a specific minimum OS version and that BitLocker is enabled. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Minimum OS version. To enforce a minimum OS version and BitLocker, you configure the Minimum OS version setting and the Require BitLocker setting in the Windows compliance policy. These settings directly map to the requirements. Secure Boot, code integrity, and antivirus are separate security controls that do not address the specific needs of the scenario.

Answer

Require antivirus

Answer

Require Secure Boot

Answer

Require code integrity

Question 10

You are the endpoint administrator for a company using Microsoft Intune. The IT director asks you to generate a report that shows which Windows devices have not installed the latest security update in the past 14 days. What should you use?

Accepted Answer

Microsoft Intune Reports > Windows updates > Windows quality updates report.. The Windows quality updates report in Intune provides detailed per-device status for monthly security and quality updates. It allows administrators to see which devices have not installed specific updates within a given timeframe, making it the correct tool for identifying devices missing recent security patches.

Answer

Microsoft Intune Reports > Windows updates > Feature updates report.

Answer

Microsoft Intune Devices > Monitor > Noncompliant devices report.

Answer

Microsoft Intune Endpoint security > Windows updates report.

Question 11

You manage a fleet of Windows 10 devices enrolled in Microsoft Intune. Users report that their devices are not receiving newly assigned compliance policies. You need to force the devices to check in with Intune immediately. What should you do from the Intune admin center?

Accepted Answer

Select each device and choose 'Sync' to initiate a device check-in.. The Sync action in the Intune admin center sends a remote check-in request to the device, prompting it to contact the Intune service and apply any pending policies. This is the standard, efficient way to force policy retrieval without user intervention or disruptive re-enrollment.

Answer

Remove and re-enroll each device in Intune.

Answer

Run the 'gpupdate /force' command on each device.

Answer

Restart the Intune Management Extension service on each device.

Question 12

You manage a fleet of Windows 11 devices with Microsoft Intune. The security team requires that any device that has not checked in with Intune for more than 30 days is automatically retired so its resources are released and its compliance state is removed. You need to configure this behavior with the least administrative effort. What should you do?

Accepted Answer

Create a device cleanup rule in the Intune tenant settings and set the inactivity threshold to 30 days.. Intune's built-in device cleanup rule is designed exactly for this scenario: it automatically retires devices that have not checked in for a configured number of days. Setting the threshold to 30 days satisfies the security team's requirement without custom scripting, dynamic groups, or conditional access workarounds. It is the native, lowest-effort lifecycle management feature.

Answer

Configure an Autopilot deployment profile with a 30-day enrollment timeout and enable automatic device deletion.

Answer

Create a dynamic device group based on the last check-in date and apply a retire action using a scheduled PowerShell script.

Answer

Assign a compliance policy that marks devices as noncompliant after 30 days of inactivity, and configure conditional access to block them.

Question 13

You administer Microsoft Intune for a company with Windows 11 devices joined to Microsoft Entra ID. A security requirement states that if a device is found noncompliant, it must lose access to Microsoft 365 services within 15 minutes, and the device must be marked noncompliant automatically when a required antivirus signature is out of date. You need to implement this with the least administrative effort. What should you do?

Accepted Answer

Create a compliance policy with an antivirus requirement, set the compliance status validity period to 15 minutes, and create a Conditional Access policy that requires compliant devices for Microsoft 365.. Compliance policies in Intune define the conditions a device must meet, and Conditional Access policies enforce those conditions for access to cloud apps. Setting the compliance status validity period to 15 minutes ensures Microsoft Entra ID quickly reflects a noncompliant state after antivirus signatures become stale. Together, these configurations automatically mark the device noncompliant and block Microsoft 365 access within the required time frame.

Answer

Create a device configuration profile that disables access to Microsoft 365 when antivirus signatures are stale, and assign it to all users.

Answer

Create a compliance policy with an antivirus requirement and a device health attestation setting, then assign it to all users without a Conditional Access policy.

Answer

Create a Conditional Access policy that requires multifactor authentication for all users and set a sign-in frequency of 15 minutes.

Question 14

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. A security policy requires that devices be automatically marked as noncompliant if they have not checked in with Intune for more than 30 days. You need to configure this behavior with the least administrative effort. What should you do?

Accepted Answer

Create a device compliance policy with the 'Device is inactive for a period of time' setting configured to 30 days.. The built-in compliance policy setting for device inactivity allows you to specify a number of days after which a device with no check-in is marked noncompliant. This is a native Intune feature that requires only configuring the compliance policy, with no custom scripting or additional services. Conditional access can then act on the noncompliant state, but the marking itself must come from the compliance policy. Therefore, the compliance policy with the inactivity rule is the correct and least-effort solution.

Answer

Configure a device configuration profile with a custom OMA-URI that sets an inactivity timeout.

Answer

Create a conditional access policy that blocks access for devices not checked in for 30 days.

Answer

Use an Intune PowerShell script to query devices and mark them noncompliant if they have not checked in for 30 days.

Question 15

You manage a group of Windows 11 devices enrolled in Microsoft Intune. You need to ensure that Windows Update for Business policies are applied to these devices to control when feature updates are installed. What should you configure?

Accepted Answer

A Windows 10 and later update ring.. Windows Update rings in Intune are the primary way to configure Windows Update for Business settings, including feature update deferrals, quality update deferrals, and active hours. Assigning an update ring to the device group ensures that these policies are applied. Feature update policies are used to target specific versions, but they do not provide the full set of Windows Update for Business controls. Quality update policies are for expedited updates, and configuration profiles are not the recommended method for update management.

Answer

A device configuration profile with the Windows Update settings.

Answer

A quality update policy.

Answer

A feature update policy.