MD-102 Manage and maintain devices Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

Accepted Answer

Compliance policy. A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Answer

Device configuration policy

Answer

Windows Update for Business policy

Answer

Device health attestation policy

Question 2

A user reports that their Windows 11 device is not receiving Microsoft 365 Apps updates from Intune. You verify the device is enrolled and compliant. The device has a Microsoft 365 Apps update policy assigned. What is the most likely cause?

Accepted Answer

The device is in a low-power state and not checking in for updates. The most likely cause is that the device is in a low-power state (e.g., sleep or hibernation) and not checking in for updates. Intune relies on the Microsoft 365 Apps update service, which uses a scheduled task that runs only when the device is awake and connected. If the device is in a low-power state, it cannot execute the update check, even though it is enrolled and compliant.

Answer

The Microsoft 365 Apps update channel is not configured in the policy

Answer

The device is not connected to the internet

Answer

The device has an older version of Office installed that does not support Intune management

Question 3

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

Accepted Answer

Hybrid Azure AD join. Hybrid Azure AD join is the correct approach because it allows devices that are joined to on-premises Active Directory to also register with Microsoft Entra ID, enabling Intune management while maintaining access to on-premises resources via Kerberos/NTLM authentication. This configuration synchronizes the device object from AD to Entra ID using Azure AD Connect, creating a device identity that can be managed by Intune and can authenticate against both cloud and on-premises services without requiring a VPN.

Answer

Entra ID registered with on-premises domain join

Answer

Windows Autopilot self-deploying mode

Answer

Entra ID joined with VPN to on-premises

Question 4

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

Accepted Answer

PowerShell scripts (Devices > Scripts). PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Answer

Proactive remediations

Answer

Compliance policy

Answer

Device configuration profile

Question 5

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

Accepted Answer

Endpoint security > Disk encryption policy. To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Answer

Compliance policy for Windows 10

Answer

Windows Update for Business policy

Answer

Device configuration profile for Windows 10

Question 6

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

Accepted Answer

The app is assigned to users, not devices. When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy. The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Answer

The device is low on storage

Answer

The app is available but not required

Answer

The device has offline files enabled

Question 7

You need to ensure that all Windows 10 devices automatically install critical security updates from Windows Update as soon as they are released. Which Windows Update for Business policy setting should you configure?

Accepted Answer

Set 'Quality update deferral period' to 0 days. Option A is correct because the 'Defer feature updates' setting can be set to 0 days, but for quality updates, use 'Quality update deferral period' set to 0. However, for immediate installation, 'Automatic update behavior' set to 'Auto install and restart' is key. Option A is the best answer. Option B is wrong because active hours are for scheduling restarts, not immediate installation. Option C is wrong because pause features delay updates. Option D is wrong because it is not a specific setting name.

Answer

Set 'Update notification level' to 'Display notification'

Answer

Configure active hours to allow automatic updates

Answer

Enable 'Pause feature updates'

Question 8

Your organization uses Microsoft Intune to manage iOS devices. You need to prevent users from removing the Intune Company Portal app from their devices. Which setting should you configure?

Accepted Answer

Block app removal in device restrictions. Option B is correct because blocking app removal prevents users from uninstalling the Company Portal. Option A is wrong because blocking jailbreak detection does not prevent app removal. Option C is wrong because blocking screen capture is unrelated. Option D is wrong because requiring PIN is unrelated.

Answer

Block screen capture

Answer

Require PIN for app store purchases

Answer

Block jailbroken devices

Question 9

You are planning a Windows 11 deployment for 500 new devices using Windows Autopilot. The devices will be shipped directly to users from the manufacturer. You need to ensure that the devices are automatically enrolled in Intune and joined to Microsoft Entra ID. What should you do?

Accepted Answer

Register the device hashes in Intune and assign an Autopilot deployment profile. Option A is correct because Windows Autopilot uses device hashes (hardware IDs) to identify devices in Intune. By registering these hashes and assigning an Autopilot deployment profile, the devices are automatically enrolled in Intune and joined to Microsoft Entra ID during the out-of-box experience (OOBE), without requiring manual intervention or additional infrastructure.

Answer

Pre-install the Intune Management Extension on each device

Answer

Configure a provisioning package and include it with the shipment

Answer

Create a hybrid Azure AD join configuration in Intune

Question 10

Which TWO actions can you perform using Microsoft Intune to manage Windows 10 devices?

Accepted Answer

Remotely wipe a device. Option B is correct because Microsoft Intune supports a remote wipe action that can be triggered from the Intune console to reset a Windows 10 device to factory settings or selectively remove corporate data. This is a core device management capability used for data protection when a device is lost or stolen, leveraging the Windows 10 reset functionality via the Intune management channel.

Answer

Create local user accounts on the device

Answer

Configure DHCP settings

Answer

Add the device to an Active Directory group

Question 11

Which THREE prerequisites are required to enable Windows Autopilot for existing devices?

Accepted Answer

The device must be running Windows 10 or Windows 11 Pro, Enterprise, or Education edition. Options A, C, and D are correct. Autopilot requires Windows 10/11 Pro/Enterprise/Edu, the device to be registered in Intune, and internet connectivity. Option B is wrong because a TPM is not strictly required for Autopilot (except for self-deploying mode). Option E is wrong because an on-premises DC is not needed for pure cloud Autopilot.

Answer

The device must be domain-joined to an on-premises Active Directory

Answer

The device must have a TPM 2.0 chip

Question 12

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned devices with work profile. Options B and D are correct. Android Enterprise corporate-owned devices with work profile and Android Enterprise personally-owned devices with work profile are standard enrollment methods. Option A is wrong because Apple Business Manager is for iOS. Option C is wrong because Windows Autopilot is for Windows. Option E is wrong because Android Device Administrator is deprecated.

Answer

Android Device Administrator

Answer

Apple Business Manager

Answer

Windows Autopilot

Question 13

Refer to the exhibit. You have the following compliance policy assigned to a Windows 10 device running version 10.0.22000.0. The device has a password of 8 characters and is encrypted. What is the compliance status of the device?

Accepted Answer

Compliant. Option B is correct because the device OS version (10.0.22000.0) is within the minimum (10.0.19041.0) and maximum (10.0.22621.0) versions, password is 8 characters (min 6), and encryption is enabled. Option A is wrong because all conditions are met. Option C is wrong because OS version is within range. Option D is wrong because password meets requirements.

Answer

Noncompliant due to password length

Answer

Noncompliant due to encryption

Answer

Noncompliant due to OS version

Question 14

Refer to the exhibit. You see the following Intune device properties for a Windows device. The device is noncompliant and the grace period expires on 2025-02-20. Today is 2025-02-15. The compliance policy requires a minimum OS version of 10.0.19041 but the device is on 10.0.18363. What will happen if the device does not become compliant before the grace period expires?

Accepted Answer

The device will be retired after the grace period expires. Option D is correct because when a noncompliant device's grace period expires, Intune enforces the compliance policy by retiring the device. Retirement removes the device from Intune management and revokes access to corporate resources, but it does not immediately block access or force an OS update. The grace period allows a window for remediation; after expiration, the device is marked for retirement.

Answer

The device will automatically update to the required OS version

Answer

The device will be blocked from accessing corporate resources

Answer

The device will be retired immediately

Question 15

Refer to the exhibit. You manage a Windows 11 device that is marked as compliant and has OS version 10.0.22621.0. You need to upgrade the device to Windows 11 version 23H2. Which Intune feature should you use?

Accepted Answer

Windows feature update profile. A Windows feature update profile is the correct Intune feature to upgrade a Windows 11 device from one version to another (e.g., from 10.0.22621.0 to 23H2). Feature update profiles deploy new OS builds that enable feature-level changes, whereas quality updates deliver only security and cumulative fixes. This profile targets the specific version upgrade required for the device.

Answer

Windows quality update profile

Answer

Driver update policy

Answer

Compliance policy