MD-102 Manage and maintain devices Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 2

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

Accepted Answer

Verify that the devices can communicate with an on-premises domain controller.. In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Answer

Check the certificate profile assigned to the devices.

Answer

Ensure the devices have a VPN connection to the corporate network.

Answer

Review the conditional access policies for the users.

Question 3

You need to enforce encryption on Windows 10 devices managed by Intune. Which policy type should you configure?

Accepted Answer

Endpoint Protection profile. Endpoint Protection profiles in Intune include the 'Windows Encryption' settings category, which allows you to enforce BitLocker Drive Encryption on Windows 10 devices. This profile directly manages encryption policies such as requiring BitLocker on OS and fixed drives, configuring encryption methods (e.g., XTS-AES 128-bit), and setting recovery password options. It is the correct policy type for enforcing encryption because it specifically targets security settings like device encryption and BitLocker.

Answer

Device compliance policy

Answer

Windows Update for Business policy

Answer

Device configuration profile (settings catalog)

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that only approved corporate apps can be installed on work profiles. What should you configure?

Accepted Answer

App configuration policy for managed Google Play. To restrict app installation on Android Enterprise work profiles to only approved corporate apps, you must configure an app configuration policy for managed Google Play. This policy enforces a list of required and allowed apps, preventing users from installing unapproved apps from the Play Store on the work profile. Device compliance and conditional access policies control access to resources, not app installation, while device restrictions lack the granularity to enforce app whitelisting on managed Google Play.

Answer

Device compliance policy to block noncompliant devices

Answer

Device restrictions configuration profile

Answer

Conditional access policy to require approved apps

Question 5

A user has an iOS device enrolled in Intune. The device is lost, and you need to immediately prevent unauthorized access to corporate data. The device contains both corporate and personal data. Which action should you take?

Accepted Answer

Use Remote Lock to lock the device. Remote Lock immediately locks the iOS device, preventing unauthorized access to both corporate and personal data without altering the device's content. This is the correct first step to secure data while preserving the ability to recover the device later, as it does not remove any data or accounts.

Answer

Disable the user's account in Microsoft Entra ID

Answer

Initiate a selective wipe

Answer

Initiate a full wipe

Question 6

Your organization is planning to deploy Windows 10 updates using Windows Update for Business. You need to ensure that critical security updates are installed within 7 days of release. Which configuration should you use?

Accepted Answer

Set a deadline for quality updates to 7 days. To ensure critical security updates are installed within 7 days of release, set a deadline for quality updates to 7 days. A deadline specifies the maximum number of days after the update is offered that the device has to install it. This enforces installation within the desired timeframe. A deferral period delays when the update is offered, which would not guarantee installation within 7 days.

Answer

Create a feature update policy for Windows 10

Answer

Configure a deferral period of 7 days for quality updates

Answer

Pause quality updates for 7 days

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the user context on a schedule. Which TWO methods can you use? (Choose two.)

Accepted Answer

Proactive remediation in Microsoft Intune. Proactive remediations in Microsoft Intune allow you to run PowerShell scripts in the user context on a schedule, making option B correct. They are designed for detection and remediation of common support issues, supporting both user and system context execution with configurable schedules.

Answer

Device compliance policy with a custom script

Answer

Line-of-business app deployment package

Answer

PowerShell script deployment from the Intune console

Question 8

Which THREE are valid device management actions in Microsoft Intune? (Choose three.)

Accepted Answer

Wipe. Wipe is a valid Intune device action that restores a device to factory default settings, removing all data and corporate resources. It is typically used for devices that are lost, stolen, or being repurposed, and it can be applied to both corporate-owned and personally-owned devices enrolled in Intune.

Answer

Delete

Answer

Reboot

Question 9

You are troubleshooting an Intune-managed Windows 10 device that is not receiving a required application. Which THREE steps should you take to diagnose the issue? (Choose three.)

Accepted Answer

Ensure the device has network connectivity. Network connectivity is a prerequisite for Intune-managed devices to communicate with the Microsoft Intune service. Without connectivity, the device cannot check in, download app policies, or retrieve application payloads. You should verify the device can reach endpoints like *.manage.microsoft.com and that the Windows Push Notification Services (WNS) channel is open.

Answer

Verify the device is compliant with compliance policies

Answer

Perform a factory reset on the device

Question 10

Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

Accepted Answer

The device OS version exceeds the maximum allowed version.. The compliance policy sets a maximum OS version. The device's OS version (10.0.22621.1) is higher than the maximum allowed version specified in the policy, causing the device to be marked as noncompliant. Therefore, option C is correct.

Answer

The device does not have BitLocker encryption enabled.

Answer

The device does not have a password set.

Answer

The password type is not set to alphanumeric.

Question 11

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

Accepted Answer

Sync-IntuneDevice -DeviceId .... The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Answer

Start-DeviceSync -DeviceName PC-001

Answer

Invoke-IntuneDeviceAction -DeviceId ... -Action Sync

Answer

Update-IntuneDevice -DeviceId ...

Question 12

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

Accepted Answer

Update the expirationDateTime property of the token.. The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Answer

Modify the tokenType to a different type.

Answer

Create a new bulk enrollment token with a later expiration date.

Answer

Re-create the token with the same name but later expiration.

Question 13

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

Accepted Answer

Compliance policy. A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Answer

Device configuration policy

Answer

Windows Update for Business policy

Answer

Device health attestation policy

Question 14

A user reports that their Windows 11 device is not receiving Microsoft 365 Apps updates from Intune. You verify the device is enrolled and compliant. The device has a Microsoft 365 Apps update policy assigned. What is the most likely cause?

Accepted Answer

The device is in a low-power state and not checking in for updates. The most likely cause is that the device is in a low-power state (e.g., sleep or hibernation) and not checking in for updates. Intune relies on the Microsoft 365 Apps update service, which uses a scheduled task that runs only when the device is awake and connected. If the device is in a low-power state, it cannot execute the update check, even though it is enrolled and compliant.

Answer

The Microsoft 365 Apps update channel is not configured in the policy

Answer

The device is not connected to the internet

Answer

The device has an older version of Office installed that does not support Intune management

Question 15

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

Accepted Answer

Hybrid Azure AD join. Hybrid Azure AD join is the correct approach because it allows devices that are joined to on-premises Active Directory to also register with Microsoft Entra ID, enabling Intune management while maintaining access to on-premises resources via Kerberos/NTLM authentication. This configuration synchronizes the device object from AD to Entra ID using Azure AD Connect, creating a device identity that can be managed by Intune and can authenticate against both cloud and on-premises services without requiring a VPN.

Answer

Entra ID registered with on-premises domain join

Answer

Windows Autopilot self-deploying mode

Answer

Entra ID joined with VPN to on-premises