MD-102 Manage and maintain devices Practice Test 28 — 15 Questions

Question 1

You manage Windows 11 devices in Microsoft Intune. A compliance policy named 'Win11-Compliance' is assigned to all users. You need to prevent users whose devices are not compliant with 'Win11-Compliance' from accessing Microsoft 365 apps, but you want to allow a 30-minute grace period before access is blocked. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that requires compliant devices, and set the 'Grant' control to 'Require device to be marked as compliant'. Then, in the compliance policy, set the 'Action for noncompliance' to 'Mark device noncompliant' after 30 minutes.. To allow a grace period before blocking access, you must delay the device being marked noncompliant. Conditional Access itself does not provide a grace period. By configuring the compliance policy to mark the device noncompliant after 30 minutes, the device remains compliant during that time, and Conditional Access continues to allow access. After the delay, the device becomes noncompliant and access is blocked.

Answer

Create a Conditional Access policy that requires compliant devices, and set the 'Grant' control to 'Require device to be marked as compliant' with a 30-minute session lifetime.

Answer

Create a Conditional Access policy that requires compliant devices, and configure the 'Grant' control to 'Require device to be marked as compliant' with a 30-minute grace period.

Answer

In the compliance policy, set 'Mark device noncompliant' to 30 minutes and assign the policy to all users.

Question 2

You manage Windows 10 and Windows 11 devices with Microsoft Intune. You need to configure a compliance policy that marks devices as noncompliant if they do not have a specific minimum OS version and if they have not checked in with Intune within the last 7 days. Which TWO settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Last check-in time. The compliance policy settings for Minimum OS version and Last check-in time directly enforce the two requirements. Minimum OS version ensures devices meet the specified build, while Last check-in time flags devices that have not communicated with Intune within 7 days. Together, they define the compliance state as required.

Answer

Encryption of data storage on device

Answer

Device health attestation

Answer

Antivirus and antispyware status

Question 3

You manage 1,200 Windows 11 devices with Microsoft Intune. The security team reports that several devices have stopped checking in and may be compromised. You need to identify devices that have not contacted the service recently and then take action. Which TWO actions should you perform? (Choose two.)

Accepted Answer

In the Intune console, review the Devices > All devices list and sort or filter by the Last check-in column.. Identifying devices that have stopped checking in requires data on the last contact time. The Intune console's All devices view exposes a Last check-in column that can be sorted or filtered, and Microsoft Graph's managedDevices entity exposes lastSyncDateTime, which can be queried directly or through the Intune Data Warehouse. Provisioning state, enrollment date filtering, and compliance marking do not surface last check-in information, so they cannot reliably identify the stale devices.

Answer

Run a PowerShell script that imports the Intune module and calls Get-IntuneManagedDevice to list devices by enrollment date.

Answer

Create a dynamic device group that includes devices based on the deviceManagement.approvisioningState property.

Answer

Configure a compliance policy with the 'Unable to check in' rule set to 30 days and a noncompliance action of 'Mark device noncompliant'.

Question 4

You are responsible for managing Windows 10 devices with Microsoft Intune. You need to deploy a new line-of-business (LOB) app to a group of devices. The app requires a script to run after installation to configure settings. What should you use to deploy the app and ensure the script runs?

Accepted Answer

Add the app as a Win32 app and include the script in the install command.. Win32 apps in Intune support custom install commands, allowing you to run additional scripts after the main installer. By appending the script execution to the install command, you ensure it runs immediately after installation. This is a common method for configuring LOB apps that require post-installation steps. Other options like requirement or detection rules are not designed for executing configuration scripts.

Answer

Add the app as a Win32 app and include the script as a detection rule.

Answer

Add the app as a Microsoft Store app and use a PowerShell script to configure settings.

Answer

Add the app as a Win32 app and include the script as a requirement rule.

Question 5

You manage a fleet of Windows 10 devices enrolled in Microsoft Intune. You need to ensure that devices receive quality updates with a maximum deferral of 7 days. What should you configure?

Accepted Answer

Windows Update rings in Intune.. Windows Update rings in Intune are specifically designed to manage update deferrals for quality and feature updates. By configuring a quality update deferral of 7 days, you ensure devices receive updates after that period. Other options either do not support deferral settings or are not the correct tool for Intune-managed devices.

Answer

Device compliance policy with a setting for update deferral.

Answer

Endpoint security policy for Windows Update.

Answer

Windows Update for Business configuration in Group Policy.

Question 6

You manage Windows 11 devices with Microsoft Intune. After a Windows quality update is deployed to a pilot ring, several devices report installation failures in the Update reports. You need to identify the exact error code returned by the update installation on a specific device without accessing the device directly. What should you do?

Accepted Answer

In the Microsoft Intune admin center, open the device's Windows Update for Business reports and view the 'Update installation failures' report.. Windows Update for Business reports in Microsoft Intune include detailed update installation data, including failure codes and reasons. These reports are accessible from the Intune admin center and provide per-device information without requiring direct device access. The other options either report unrelated data or require additional infrastructure that does not surface update error codes.

Answer

From the Intune admin center, select the device and review the device compliance policy status.

Answer

In Microsoft Intune, review the device's discovered apps report to identify the update failure.

Answer

Use Microsoft Endpoint Configuration Manager to create a device collection and run a hardware inventory cycle.

Question 7

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. Users report that when they attempt to enroll a personally owned Windows device, enrollment is blocked. You need to allow only corporate-owned devices to enroll while still permitting personally owned devices to access email through a browser. What should you configure?

Accepted Answer

Create a device enrollment restriction that blocks personally owned Windows devices and allow corporate-owned devices.. Enrollment restrictions in Intune are the mechanism for controlling whether personally owned devices can enroll for a given platform. By blocking personal Windows ownership while allowing corporate ownership, only corporate devices enroll. Because browser-based email access is controlled separately through conditional access, personal devices can still reach email in a browser without being enrolled.

Answer

Configure an Autopilot deployment profile that targets only corporate devices.

Answer

Configure a conditional access policy that requires compliant devices for all cloud apps.

Answer

Create a device compliance policy that requires BitLocker and mark personal devices as noncompliant.

Question 8

You use Microsoft Intune to manage Windows 11 devices. You configure a Windows Update ring policy to defer quality updates by 7 days and feature updates by 60 days. A critical security update is released that must be installed immediately on all devices, bypassing the deferral. What should you configure?

Accepted Answer

Use expedited updates in Microsoft Intune to deploy the specific security update to all devices.. Expedited updates in Microsoft Intune are specifically designed to deploy a particular Windows quality update immediately, overriding deferrals and other update ring settings. This is the correct approach for critical security updates that cannot wait. Other methods either do not bypass deferrals or affect all updates rather than the specific one.

Answer

Deploy a PowerShell script that runs the Windows Update client to install all available updates.

Answer

Create a new Windows Update ring policy with a deadline of 0 days and assign it to all devices.

Answer

Modify the existing Windows Update ring policy to set the quality update deferral to 0 days.

Question 9

A help desk technician reports that a Windows 11 device enrolled in Microsoft Intune has not received a newly assigned configuration profile. The device shows as compliant in the admin center. You need to force the device to check in with Intune immediately. What should you do?

Accepted Answer

From the device overview in the Intune admin center, select Sync to trigger a check-in. The Sync action in the Intune admin center sends a remote check-in request to the device, causing it to contact the service and apply any pending policies or profiles. It is the correct, non-destructive way to force an immediate check-in when a device appears healthy but has not yet received a newly assigned configuration. Other device actions such as Retire or Fresh Start are destructive and unrelated to policy refresh.

Answer

From the device overview, select Retire to remove corporate data and force a re-enrollment

Answer

From the device overview, select Collect diagnostics to gather logs and force a policy refresh

Answer

From the device overview, select Fresh Start to reset the device and reapply all policies

Question 10

You manage Windows 11 devices with Microsoft Intune. A line-of-business application must be deployed to a specific group of devices. The application installer requires administrative privileges and must run in the system context. You need to ensure the app installs silently without user interaction. What should you create?

Accepted Answer

A Win32 app with the install command configured to run with system privileges and a detection rule based on a file version.. Win32 apps in Intune are the appropriate deployment type for custom line-of-business installers that require administrative rights and system context. The Intune Management Extension runs the install command as SYSTEM, and detection rules determine whether the app is present. This provides silent installation, verification, and uninstall support that a platform script would not deliver.

Answer

An Office app deployment using the Microsoft 365 Apps configuration.

Answer

A Microsoft Store app (new) assigned as required to the device group.

Answer

A PowerShell platform script that runs once per device and invokes the installer.

Question 11

You manage macOS devices enrolled in Microsoft Intune using the Intune Company Portal app. Users report that the Company Portal app does not detect newly assigned required apps and shows an outdated compliance status. You need to ensure the Company Portal refreshes device state on demand. What should you do?

Accepted Answer

Instruct users to open Company Portal, select Devices, choose the device, and select Check status to force a sync. The macOS Company Portal app includes a Check status option that forces the device to check in with Intune, refreshing compliance and app assignment data. This is the correct self-service method for users to resolve stale Company Portal information without administrator intervention. Other actions such as re-authentication, admin-initiated sync, or re-enrollment either do not trigger a check-in or are unnecessarily disruptive.

Answer

From the Intune admin center, select the device and choose Sync to push a check-in to the macOS device

Answer

Delete the device record in Intune and have the user re-enroll the macOS device to refresh state

Answer

Instruct users to sign out of and back into the Company Portal app to refresh the device state

Question 12

You manage devices in Microsoft Intune. You need to generate a report that shows which devices have not checked in with Intune for more than 30 days. What should you use?

Accepted Answer

Devices without recent check-in report. The 'Devices without recent check-in' report in Intune is designed to list devices that have not communicated with the service within a specified period. It allows you to filter by number of days, making it the correct tool to identify devices inactive for more than 30 days.

Answer

Device compliance report

Answer

Windows Update report

Answer

Device configuration report

Question 13

You manage a fleet of Windows 11 devices enrolled in Microsoft Intune. You need to configure a remediation to automatically restart the Windows Update service (wuauserv) if it stops. You create a proactive remediation script package. Which two components must you provide in the script package? (Choose two.)

Accepted Answer

A detection script that checks whether the Windows Update service is running. A proactive remediation script package in Intune consists of two scripts: a detection script and a remediation script. The detection script identifies whether the Windows Update service is running; if it is not, it signals non-compliance. The remediation script then starts the service. Together, they automate the detection and correction of the issue, ensuring the service is restarted without manual intervention.

Answer

A PowerShell script that runs only once at device enrollment

Answer

A requirement rule that checks the service status before installation

Answer

A compliance policy that marks the device noncompliant if the service is stopped

Question 14

Your company uses Microsoft Intune to manage Windows 11 devices. An administrator needs to remotely restart a specific device that is currently online to apply pending updates. Which action should the administrator use in the Intune admin center?

Accepted Answer

Restart. The Restart action is designed specifically to remotely reboot a managed device so that pending updates requiring a restart can complete. Retire, Wipe, and Fresh Start are all destructive or unenrollment actions that remove data or management and are not appropriate when the goal is simply to reboot an online device.

Answer

Wipe

Answer

Fresh Start

Answer

Retire

Question 15

You manage devices in Microsoft Intune. You need to ensure that a specific set of Windows 10 devices automatically receive new configuration profiles as soon as they are assigned. The devices are already enrolled and are members of an Microsoft Entra ID group. What should you do?

Accepted Answer

Assign the configuration profile to the Microsoft Entra ID group.. Assigning the configuration profile to the existing Microsoft Entra ID group that contains the devices is the most direct and effective method. Intune will deploy the profile to all devices in the group automatically. Other options either target users, use categories that are not for assignment, or introduce unnecessary complexity.

Answer

Create a device category and assign the profile to that category.

Answer

Assign the configuration profile to the user who owns the devices.

Answer

Use a dynamic device group based on device name and assign the profile to it.