MD-102 Manage and maintain devices Practice Test 26 — 15 Questions

Question 1

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. You need to ensure that when a device is reported as lost or stolen, you can remotely wipe the device and prevent access to corporate data. Which action should you perform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Wipe the device. The wipe action remotely resets the device to factory settings, removing all data and preventing access. This is the correct choice for lost or stolen devices because it ensures corporate data is not accessible. Retire, reset, and Fresh Start do not provide the same immediate data protection and remote wipe capability for lost devices.

Answer

Fresh Start the device

Answer

Reset the device

Answer

Retire the device

Question 2

You manage a group of iOS devices enrolled in Microsoft Intune. Users report that they are unable to receive email on their devices after you deployed a new configuration profile. You need to identify the cause quickly. What should you use?

Accepted Answer

Intune configuration profile assignment status. The configuration profile assignment status in Intune provides per-device deployment details, including success or failure and error messages. This helps quickly identify if the email profile was not applied correctly or if there was a conflict, directly addressing the user's inability to receive email.

Answer

Intune device compliance report

Answer

Azure AD sign-in logs

Answer

Intune audit logs

Question 3

You administer Microsoft Intune for a company with 500 Windows 11 devices. The security team requires that when a device is reported lost or stolen, you can remotely erase corporate data without affecting the user's personal files on devices enrolled as personally owned. Which action should you perform in the Intune admin center?

Accepted Answer

Run a Selective wipe (Retire) on the device.. The Retire action performs a selective wipe that removes only organizational data and the management profile from a device. On personally owned devices enrolled in Intune, this preserves the user's personal files while removing corporate email, apps, and policies. Full wipe, Fresh Start, and Autopilot Reset all remove user data and are intended for corporate-owned devices, so they do not meet the requirement.

Answer

Run an Autopilot Reset on the device.

Answer

Run a Fresh Start on the device.

Answer

Run a Full wipe on the device.

Question 4

You manage devices with Microsoft Intune. You need to ensure that only devices that meet specific compliance requirements can access Microsoft 365 services. You create a compliance policy and assign it to a group of users. What should you do next to enforce the policy?

Accepted Answer

Create a conditional access policy that requires compliant devices. To enforce compliance for access to Microsoft 365 services, you must create a Conditional Access policy that requires devices to be compliant. The compliance policy alone only evaluates and reports compliance status; it does not block access. Assigning to devices or enabling a setting does not enforce access control. Conditional Access is the correct enforcement tool.

Answer

Enable device compliance in the Microsoft Intune admin center

Answer

Configure a device configuration profile with a compliance setting

Answer

Assign the compliance policy to the devices

Question 5

You manage 500 Windows 11 devices with Microsoft Intune. Several devices are shared by multiple employees across shifts at a manufacturing plant. You need to configure a policy that automatically removes local user profiles that have not been used for 60 days to conserve disk space, while preserving profiles of users who sign in regularly. What should you configure?

Accepted Answer

An Intune settings catalog policy or custom OMA-URI using the SharedPC CSP with 'InactiveThreshold' set to 60 days.. Shared devices accumulate local profiles over time, and Intune addresses this through the SharedPC CSP, which supports an InactiveThreshold value expressed in days. Configuring this through the settings catalog or a custom OMA-URI deletes dormant profiles automatically while leaving frequently used profiles intact. General device restrictions, compliance policies, and session timeouts do not perform profile cleanup, so they fail to reclaim the disk space consumed by unused accounts.

Answer

A compliance policy that marks devices as noncompliant after 60 days of profile inactivity.

Answer

A device restrictions configuration profile with the 'Inactivity timeout' setting configured to 60 days.

Answer

A Windows 10/11 device restrictions profile with 'Delete inactive user profiles' set to 60 days.

Question 6

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is retired, all corporate data is removed but the user's personal files remain intact. The devices are enrolled as personal devices with work profiles. What should you do?

Accepted Answer

Use the 'Retire' action in Intune.. For personal devices enrolled with work profiles, the Retire action is designed to remove only corporate data and management profiles, leaving personal files untouched. This is the correct way to deprovision a personal device without affecting the user's personal data. A factory reset or Wipe would delete everything, which is not desired.

Answer

Use the 'Wipe' action in Intune.

Answer

Remove the device from the Azure AD group.

Answer

Perform a factory reset on the device.

Question 7

You manage Windows 11 devices with Microsoft Intune. Several devices are failing to check in and receive policy. You review the device list and see the devices are enrolled but show a compliance state of 'Not evaluated'. You need to force the devices to immediately check in with the Intune service from the local device. What should you do?

Accepted Answer

In Settings, navigate to Accounts > Access work or school, select the work account, and click Info > Sync.. Forcing a manual sync from the device is the quickest way to make an enrolled Windows device check in with Intune. Using the Settings app under Access work or school triggers the MDM enrollment client to contact the service immediately, refreshing policies and compliance status. This resolves the 'Not evaluated' state because the device re-evaluates its configuration against assigned compliance policies and reports back.

Answer

Restart the Microsoft Intune Management Extension service.

Answer

Run the command: deviceenroller.exe /c /z /o

Answer

Run the command: dsregcmd /status

Question 8

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant, users receive a notification email with instructions to remediate the issue. The email must be sent only to the primary user of the device. What should you configure?

Accepted Answer

A compliance policy with the 'Send email to users' action enabled and the 'Send email to primary user' option selected.. Compliance policies in Intune include actions that can send email notifications to users when a device is noncompliant. Configuring the action to send to the primary user ensures the email reaches the correct recipient with remediation instructions, directly fulfilling the requirement.

Answer

An Endpoint security policy with the 'Noncompliance email' setting configured.

Answer

A conditional access policy that blocks access and sends an email to the user.

Answer

A device configuration profile with the 'Compliance notification' setting enabled.

Question 9

Your company uses Microsoft Intune to manage Windows 11 devices. You need to ensure that when a device is marked as noncompliant, it loses access to Microsoft 365 services within 15 minutes, without affecting compliant devices. You have already created a compliance policy and assigned it to all users. What should you configure next?

Accepted Answer

A conditional access policy in Microsoft Entra ID that requires compliant devices and set the grant control to 'Require device to be marked as compliant'.. Conditional access in Microsoft Entra ID enforces access controls based on conditions such as device compliance. By creating a policy that requires compliant devices for Microsoft 365 apps, noncompliant devices are blocked from accessing those services. This integrates with Intune compliance policies, which evaluate and report device state. The other options do not provide real-time access blocking based on compliance.

Answer

A device compliance policy in Intune with an action for noncompliance that marks the device as noncompliant immediately.

Answer

A configuration profile in Intune that sets the device to block access to Microsoft 365 services when noncompliant.

Answer

A Microsoft Defender for Endpoint device group in Intune with an automated task to restrict access.

Question 10

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a user reports a lost device, you can remotely lock it and display a custom message on the lock screen. The solution must not erase any data. What should you do?

Accepted Answer

Use the Remote lock action and configure a custom lock screen message.. To remotely lock a lost Windows device and display a custom message without erasing data, use the Remote lock action in Intune. Additionally, configure a custom lock screen message through a device configuration profile. This secures the device and provides contact information, all without data loss.

Answer

Use the Fresh Start action.

Answer

Perform a full wipe.

Answer

Perform a selective wipe.

Question 11

You are the endpoint administrator for a company that uses Microsoft Intune. You need to ensure that when a Windows 11 device is retired or wiped, the device record is automatically removed from Intune after 30 days. Which action should you take?

Accepted Answer

Configure a device cleanup rule in the Intune tenant settings.. The device cleanup rule in Intune tenant settings automatically deletes devices that have not checked in for a specified number of days. Setting it to 30 days removes records for retired or wiped devices that no longer communicate. Dynamic groups, compliance policies, and Entra ID retention policies do not delete Intune device records, so they cannot fulfill this requirement.

Answer

Assign a compliance policy that marks devices as noncompliant after 30 days.

Answer

Create a dynamic device group based on the enrollment date.

Answer

Enable automatic enrollment for all users and set a retention policy in Microsoft Entra ID.

Question 12

You manage Windows 10 and Windows 11 devices with Microsoft Intune. You need to configure a Windows Update ring to defer quality updates by 7 days and feature updates by 60 days. Which two settings should you configure in the update ring? (Choose two.)

Accepted Answer

Quality update deferral period (days). In a Windows Update ring, you can configure separate deferral periods for quality updates and feature updates. Setting the quality update deferral to 7 days and the feature update deferral to 60 days ensures that monthly security updates are delayed by a week and feature updates by two months, exactly matching the requirements.

Answer

Update/quality update deadline (days)

Answer

Automatic update behavior - Auto install at maintenance time

Answer

Windows Update for Business configuration - Servicing channel

Question 13

You manage Windows 11 devices with Microsoft Intune. Users report that when they attempt to enroll a personal device, enrollment fails with error 80180014. You need to ensure that only corporate-owned devices can enroll. What should you configure?

Accepted Answer

Enrollment restrictions in Intune with a device platform restriction blocking personally owned Windows devices.. Enrollment restrictions in Intune are designed to control which devices can enroll based on platform, version, and ownership. By blocking personally owned Windows devices, you ensure that only corporate-owned devices can enroll. This directly resolves the error and enforces the requirement. Other options control post-enrollment compliance or access, not the enrollment process itself.

Answer

Device compliance policy requiring BitLocker and Secure Boot.

Answer

Conditional Access policy requiring compliant devices for all cloud apps.

Answer

Windows Autopilot deployment profile assigned to all users.

Question 14

You manage iOS/iPadOS devices with Microsoft Intune. You need to ensure that when a device is lost or stolen, its corporate data can be remotely wiped while leaving personal data intact. The devices are enrolled as user enrollment (personal devices). What should you do?

Accepted Answer

Issue a selective wipe from the Intune console for the device.. For user-enrolled iOS/iPadOS devices, selective wipe is the correct action to remove corporate data while preserving personal data. It targets only managed apps, profiles, and corporate data. Full wipe would erase personal content, retiring does not actively wipe, and conditional access only blocks access without removing data.

Answer

Retire the device from Intune and then delete the device record.

Answer

Issue a full wipe from the Intune console for the device.

Answer

Configure a conditional access policy to block the device from accessing corporate resources.

Question 15

You are an endpoint administrator for a company that uses Microsoft Intune. You need to create a report that shows which devices have not checked in to Intune for more than 30 days. What should you use?

Accepted Answer

Intune devices with stale check-in report. Intune provides a specific report called 'Devices with stale check-in' that identifies devices that have not communicated with the service for a defined period. This report can be filtered to show devices with check-in times older than 30 days, making it the correct tool for the task.

Answer

Intune device inventory report

Answer

Microsoft Entra sign-in logs

Answer

Intune device compliance report