MD-102 Manage and maintain devices Practice Test 27 — 15 Questions

Question 1

Your company uses Microsoft Intune to manage Windows 10 and Windows 11 devices. A security team requires that all devices run a specific antivirus signature version before users can access Microsoft 365 resources. You have already created a compliance policy that requires Microsoft Defender Antivirus to be enabled. You now need to add a rule that evaluates the antivirus signature version. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a custom compliance setting to the compliance policy that uses a PowerShell discovery script returning the signature version and a JSON file that validates it.. Intune compliance policies include built-in rules for Defender Antivirus status, but they do not natively expose a rule for a specific signature version. Custom compliance settings close that gap: a PowerShell discovery script reads the current signature version from the device, and a JSON file defines the acceptable values. The resulting compliance state is then honored by conditional access, ensuring only devices with current signatures reach Microsoft 365.

Answer

Create a device configuration profile that sets the Defender signature update interval to every hour and assign it to all devices.

Answer

Configure a Windows Defender Application Control policy that blocks access to Microsoft 365 when the signature is older than the required version.

Answer

Add a compliance policy rule that requires the device to be at or below a specific OS build version and rely on that as a proxy for signature currency.

Question 2

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to ensure that devices automatically receive quality updates and feature updates according to a schedule you define, with the ability to pause updates. What should you configure?

Accepted Answer

Windows Update rings in Intune.. Windows Update rings in Intune are specifically designed to manage and schedule Windows updates, including quality and feature updates. They provide settings for deferral, deadlines, active hours, and the ability to pause updates. This directly addresses the requirement to schedule updates and allow pausing. Other options do not offer the same level of update control.

Answer

Compliance policies for Windows 10 devices.

Answer

Endpoint security policies for update management.

Answer

Device configuration profiles for Windows Update for Business.

Question 3

You manage a hybrid Azure AD joined environment with Microsoft Intune. You need to configure a Windows 10 device to receive Windows updates from Intune instead of from on-premises WSUS. The device is currently configured to use WSUS via Group Policy. Which TWO actions should you perform? (Choose two.)

Accepted Answer

Remove the WSUS Group Policy settings from the device.. To transition from WSUS to Intune update management, you must remove the WSUS Group Policy settings that direct the device to the on-premises server, and then enroll the device in Intune and assign a Windows Update ring. These two actions ensure that Intune policies take precedence and manage update delivery.

Answer

Deploy a PowerShell script to modify the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU to point to Intune.

Answer

Enable the 'Microsoft Update' option in the Windows Update settings on each device.

Answer

Configure a conditional access policy to block WSUS traffic.

Question 4

You are deploying a Windows 11 device using Windows Autopilot. The device is enrolled in Microsoft Intune and assigned a device group. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and enrolls in Intune without user interaction. Which Autopilot deployment mode should you configure?

Accepted Answer

Self-deploying mode. Self-deploying mode in Windows Autopilot enables a device to join Microsoft Entra ID and enroll in Intune automatically during OOBE, without any user interaction. It is the correct choice when zero-touch provisioning is required and no user credentials are available.

Answer

Autopilot reset

Answer

User-driven mode

Answer

Pre-provisioning mode (White glove)

Question 5

You manage Windows 10 devices with Microsoft Intune. You need to ensure that when a device is marked as noncompliant, the user receives a notification email, and the device is automatically retired after 30 days. The solution must minimize administrative effort. What should you configure?

Accepted Answer

A compliance policy with actions for non-compliance: send email to user at 0 days, and retire device at 30 days.. Compliance policies are the correct tool to automate actions based on noncompliance. You can configure an action to send an email to the user immediately when the device becomes noncompliant, and another action to retire the device after 30 days. This requires only one policy and minimal administrative effort.

Answer

A Windows Update ring with a deadline of 30 days and an automatic retirement action.

Answer

A device configuration profile with a custom OMA-URI to send email and retire the device after 30 days.

Answer

An Intune device cleanup rule that retires devices after 30 days of inactivity and sends an email.

Question 6

You manage a fleet of Windows 11 devices with Microsoft Intune. You need to ensure that when a device is compromised, it can be remotely wiped even if the user is not connected to the corporate network. The devices are Azure AD joined and enrolled in Intune. What should you configure?

Accepted Answer

Ensure the device has an active internet connection and use the 'Wipe' action in Intune.. Intune's Wipe action is designed for remote device wipe. When initiated, the command is queued and delivered to the device over the internet through the Intune service. The device must have an active internet connection to receive the command, but it does not need to be on the corporate network. This makes it effective for compromised devices that are off-site.

Answer

Configure a conditional access policy that requires compliant devices.

Answer

Deploy a PowerShell script that triggers a factory reset when a specific file is created.

Answer

Enable Windows Defender Application Guard.

Question 7

You are deploying a Windows 11 device using Windows Autopilot. The device fails to enroll in Intune and you see the error 'The device is not registered in Autopilot'. You have verified that the device hardware hash is uploaded. What is the most likely cause?

Accepted Answer

The device hardware hash is associated with a different tenant.. The error 'The device is not registered in Autopilot' indicates that the device's hardware hash is not present in the Autopilot service for your tenant. A common cause is that the hash was uploaded to a different Microsoft Entra tenant, perhaps by the OEM or a previous owner. Verifying and re-uploading the hash to the correct tenant resolves the issue. Other causes like internet connectivity or profile assignment do not produce this specific error.

Answer

The device is not running a supported version of Windows 11.

Answer

The device is not connected to the internet during OOBE.

Answer

The Autopilot deployment profile is not assigned to the device.

Question 8

You manage Windows 11 devices with Microsoft Intune. A security requirement states that when a device is marked as noncompliant, it must lose access to Microsoft 365 services within 15 minutes, but the device must not be wiped. You create a compliance policy and a conditional access policy. Which setting should you configure in the compliance policy to meet the time requirement?

Accepted Answer

Set the 'Mark device noncompliant' schedule to 15 minutes.. The 'Mark device noncompliant' schedule is the compliance policy setting that controls how quickly a failed compliance check transitions the device to a noncompliant state. Once noncompliant, the conditional access policy evaluates the device state and blocks access to Microsoft 365 services. The other options either apply to different policy types or perform destructive actions that violate the no-wipe requirement.

Answer

Create an app protection policy with a 15-minute recheck interval.

Answer

Set the compliance policy action for noncompliance to 'Retire the device' after 15 minutes.

Answer

Configure a device restriction policy with a 15-minute grace period.

Question 9

You use Microsoft Intune to manage Windows 11 devices. A device named LAPTOP-01 is not receiving a newly assigned device configuration profile. You verify the profile is assigned to a group that contains LAPTOP-01. You need to force the device to check in with Intune and apply the policy immediately. Which action should you perform from the Intune admin center?

Accepted Answer

Select the device and choose 'Sync'.. The 'Sync' action in the Intune admin center is designed to initiate an immediate device check-in with the Intune service. This prompts the device to retrieve and apply any pending policies, including newly assigned configuration profiles. Other actions like collecting diagnostics, remote lock, or restart do not directly trigger a policy sync and are not the correct approach for this requirement.

Answer

Restart the device from the Intune admin center.

Answer

Select the device and choose 'Remote lock'.

Answer

Select the device and choose 'Collect diagnostics'.

Question 10

You manage a set of Windows 11 devices enrolled in Microsoft Intune. Users report that they can no longer sign in with their Microsoft Entra ID credentials after you deployed a new compliance policy. The devices show as compliant in Intune, but the sign-in fails with an error about device not meeting requirements. You need to ensure that users can sign in. What should you do?

Accepted Answer

Review the conditional access policy that requires compliant devices and ensure the device is included.. The sign-in error indicates a conditional access block despite Intune reporting compliance. Conditional access evaluates device compliance at authentication time, and if the device is not included in the policy or not properly registered, access is denied. Reviewing the conditional access policy to ensure the device is targeted and meets requirements resolves the issue. Other actions do not address the authentication flow.

Answer

Restart the Intune Management Extension service on the affected devices.

Answer

Assign the compliance policy to the device group instead of the user group.

Answer

Modify the compliance policy to mark the devices as compliant manually.

Question 11

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to ensure that when a device is retired, the primary user's corporate data is removed but the device remains enrolled and managed. Which action should you take in the Intune admin center?

Accepted Answer

Use Selective wipe.. Selective wipe is the action that removes corporate data from a device while preserving personal data and keeping the device enrolled in Intune. Wipe and reset remove all data and unenroll the device, while retire removes corporate data but also unenrolls the device. Only selective wipe satisfies both conditions of removing corporate data and maintaining enrollment.

Answer

Wipe the device.

Answer

Retire the device.

Answer

Reset the device.

Question 12

You manage devices with Microsoft Intune. You need to ensure that when a device is marked as non-compliant, users receive a notification and the device is blocked from accessing corporate email. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires compliant devices for Exchange Online.. To notify users and block email access for non-compliant devices, you need a compliance policy with actions for non-compliance to send notifications, and a Conditional Access policy that requires compliant devices for Exchange Online. The compliance policy detects non-compliance and triggers notifications, while Conditional Access enforces the block. Together, they meet both requirements.

Answer

Set up an enrollment restriction to block non-compliant devices.

Answer

Configure an app protection policy for Outlook mobile.

Answer

Deploy a device configuration profile that disables email access.

Question 13

You manage Windows 10 devices with Microsoft Intune. You need to ensure that devices receive a specific Windows quality update as soon as possible, bypassing any deferral settings. What should you configure?

Accepted Answer

Expedite the update using the Expedite update feature in Intune.. The Expedite update feature in Intune is specifically designed to deploy a specific quality update to devices immediately, bypassing deferrals and deadlines. It ensures the update is installed as soon as possible. Other options either do not target a specific update or do not guarantee immediate installation. Therefore, expediting the update is the correct action.

Answer

Modify the update ring to set quality update deferral to 0 days.

Answer

Use a PowerShell script to manually install the update on each device.

Answer

Create a new update ring with no deferrals and assign it to the devices.

Question 14

You manage a hybrid environment with Microsoft Intune and Microsoft Configuration Manager. You need to ensure that devices co-managed for Windows Update policies use Intune as the authoritative source for update deployments, while Configuration Manager continues to manage software updates. Which workload slider should you move to Intune?

Accepted Answer

Windows Update policies. The Windows Update policies workload in co-management determines whether Intune or Configuration Manager manages Windows Update for Business settings. Moving this slider to Intune ensures Intune controls update rings and deployment, while Configuration Manager can still manage software updates if that workload remains on-premises.

Answer

Endpoint Protection

Answer

Resource access policies

Answer

Compliance policies

Question 15

You are a Microsoft 365 Endpoint Administrator. You need to remotely wipe a lost Windows 11 device that is enrolled in Microsoft Intune. The device is currently offline. What happens when you initiate a wipe action from the Intune admin center?

Accepted Answer

The wipe command is queued and will execute the next time the device checks in with Intune.. Intune queues remote actions for devices that are offline. When the device next connects to the Intune service, it receives the pending wipe command and executes it. This ensures that lost or stolen devices can be wiped even if they are currently disconnected. The other options incorrectly suggest immediate failure, expiration, or push notification delivery to offline devices. The correct behavior is to queue the command until the device checks in.

Answer

The wipe command is sent via push notification and will execute even if the device is offline.

Answer

The wipe fails immediately because the device is offline, and you must retry once it is online.

Answer

The device is marked as wiped in Intune immediately, but the actual wipe occurs only if the device comes online within 24 hours.