MD-102 Manage and maintain devices Practice Test 4 — 15 Questions

Question 1

A user reports that their Windows 11 device cannot connect to the corporate Wi-Fi network. In Intune, the device shows a status of 'Pending' for the Wi-Fi configuration profile. The profile is assigned to a group that includes the user. What is the most likely cause of the issue?

Accepted Answer

The device has not checked in to Intune within the last 8 hours.. The 'Pending' status in Intune for a Wi-Fi configuration profile indicates that the policy has been assigned but not yet applied to the device. This typically occurs when the device has not performed a recent check-in with the Intune service. By default, devices check in every 8 hours, so if the device has not checked in within that window, the profile remains in a 'Pending' state until the next successful sync.

Answer

The device does not have the required root certificate installed.

Answer

The Wi-Fi profile is not assigned to the user's group.

Answer

The Wi-Fi profile requires user affinity and the device is shared.

Question 2

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

Accepted Answer

Update Deadline for Quality Updates (days). The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Answer

Grace Period for Restarts (days)

Answer

Defer Quality Updates (days)

Answer

Active Hours

Question 3

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only approved corporate apps can be installed on these devices. Which restriction profile setting should you configure?

Accepted Answer

Require app store password. Option C is correct because 'Require app store password' ensures that the user must provide the Apple ID password to purchase or download apps. Option A is incorrect; while it prevents installing apps from unknown sources, iOS already blocks that. Option B is incorrect because it manages app data, not installation. Option D is incorrect because it manages automatic app downloads.

Answer

Allow app installation from App Store only

Answer

Allow managed apps to unmanaged accounts

Answer

Allow automatic app downloads

Question 4

You are troubleshooting a Windows 10 device that shows as 'Noncompliant' in Intune despite having all required compliance policies applied. The device is domain-joined and configured with hybrid Azure AD join. What is the most likely cause?

Accepted Answer

The device's health attestation certificate has expired.. A device that is hybrid Azure AD joined and domain-joined but shows as 'Noncompliant' in Intune, despite having all required compliance policies applied, is most likely failing compliance due to an expired health attestation certificate. Intune uses Windows Health Attestation Service (HAS) to verify device integrity; if the attestation certificate has expired, the device cannot prove its health status, causing it to be marked noncompliant even when policies are correctly assigned.

Answer

The Intune Management Extension is not installed.

Answer

The device is not registered in Microsoft Entra ID.

Answer

The device is not enrolled in Intune.

Question 5

You need to retire a corporate-owned iOS device that is no longer in use. The device is enrolled in Intune with user affinity. Which action should you perform?

Accepted Answer

Retire the device from Intune.. Option C is correct because the 'Retire' action in Intune removes the managed app data and policies from the device while preserving the user's personal data, which is appropriate for a corporate-owned device with user affinity that is no longer in use. Retiring also removes the device from Intune management and revokes the company portal access, ensuring compliance without unnecessary data loss.

Answer

Disable the device in Intune.

Answer

Wipe the device from Intune.

Answer

Delete the device from Microsoft Entra ID.

Question 6

Your organization requires that all Windows 11 devices encrypt their drives with BitLocker. You have configured a BitLocker policy in Intune, but some devices show as 'Not evaluated' for the encryption status. What is the most likely reason?

Accepted Answer

The devices do not have a TPM chip.. Option B is correct because BitLocker requires a TPM chip to function; devices without TPM cannot evaluate the policy. Option A is incorrect because the policy is assigned. Option C is incorrect because Secure Boot is not required for BitLocker. Option D is incorrect because BitLocker can be configured via Intune without a GPO.

Answer

The policy is not assigned to the correct group.

Answer

The devices have a conflicting Group Policy.

Answer

Secure Boot is disabled on the devices.

Question 7

You are using Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a preference for a third-party app. Which method should you use?

Accepted Answer

Upload a property list (.plist) file.. Option C is correct because custom configuration profiles on macOS use property list (.plist) files. Option A is incorrect; XML is not directly used for macOS profiles. Option B is incorrect; JSON is used for Windows, not macOS. Option D is incorrect; DMG is a disk image format, not a configuration format.

Answer

Upload an XML file with the preference settings.

Answer

Upload a DMG file containing the preferences.

Answer

Upload a JSON file with the preference settings.

Question 8

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

Accepted Answer

Check the device's last check-in time with Intune.. Option A is correct because the most common issue is that the email profile has not been applied due to a pending check-in. Option B is incorrect because the device is compliant. Option C is incorrect because the user has a license. Option D is incorrect because the device is enrolled.

Answer

Verify that the device meets the compliance policy for Android.

Answer

Confirm that the user has an Exchange Online license.

Answer

Ensure the device is enrolled in Intune.

Question 9

You have configured a Windows 10 update ring with a deadline of 3 days for quality updates. However, some devices are not installing updates within the deadline. What should you verify?

Accepted Answer

The devices are set to defer quality updates in Windows Update settings.. Option D is correct because if devices are not meeting the deadline, they may be set to defer updates, which overrides the deadline. Option A is incorrect because the update ring is assigned. Option B is incorrect because the issue is not about missing feature updates. Option C is incorrect because the Intune Management Extension does not manage Windows updates.

Answer

The devices have a feature update policy that conflicts.

Answer

The Intune Management Extension is installed.

Answer

The update ring is assigned to the correct Azure AD group.

Question 10

You have assigned the above compliance policy to all Windows 10 devices. A user's device shows as noncompliant with a reason of 'TPM not found'. What should you do to resolve the issue?

Accepted Answer

Create a new compliance policy without the TPM requirement and assign it to devices without TPM.. Option B is correct because the policy requires TPM (tpmEnabled: true), but the device does not have a TPM. The best action is to create a separate policy for devices without TPM and exclude them from the current policy. Option A is incorrect because the setting is required by security policy. Option C is incorrect because the policy is already assigned. Option D is incorrect because changing the complexity requirement does not address TPM.

Answer

Disable the TPM requirement in the policy.

Answer

Assign the policy to a different group that excludes those devices.

Answer

Change the password complexity requirement to 'none'.

Question 11

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

Accepted Answer

The OMA-URI path is incorrect for an ADMX-backed policy.. Option D is correct because the OMA-URI path for an ADMX-backed policy must follow the exact format: `./Device/Vendor/MSFT/Policy/Config/ADMX_/`. If the path is incorrect—for example, missing the `ADMX_` prefix or using a wrong category name—the policy will fail to apply on Windows 10 devices. Custom configuration policies do support ADMX-backed policies, but the URI must precisely match the ADMX administrative template structure.

Answer

The value must be an integer, not a string.

Answer

The OMA-URI targets the user, not the device.

Answer

Custom configuration policies are not supported on Windows 10.

Question 12

The above PowerShell cmdlet returns the following output:

DeviceName: LAPTOP001
LastSyncDateTime: 2025-03-15T08:30:00Z
ComplianceState: noncompliant
ManagementState: managed
OSVersion: 10.0.19044.1288

The device last synced 3 days ago. What is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced in over 24 hours.. The device last synced 3 days ago, and the output shows ComplianceState: noncompliant. In Microsoft Intune, a device that has not checked in for more than 24 hours is automatically marked as noncompliant because the compliance policies cannot be evaluated without a recent sync. The LastSyncDateTime of 2025-03-15T08:30:00Z confirms the device has not synced within the required 24-hour window, making C the correct answer.

Answer

The device is running an outdated OS version.

Answer

The device has been retired or wiped.

Answer

The device has no compliance policy assigned.

Question 13

You need to ensure that corporate data on lost or stolen iOS devices is protected. Which TWO actions should you configure in Intune?

Accepted Answer

Configure a device passcode policy.. Option A and Option D are correct because remote wipe and passcode reset are standard data protection measures for lost devices. Option B is incorrect because selective wipe only removes corporate data, not the device. Option C is incorrect because device retire removes management but does not protect data immediately. Option E is incorrect because device inventory is not a protective action.

Answer

Enable device inventory reporting.

Answer

Perform a selective wipe to remove corporate data only.

Answer

Retire the device from Intune.

Question 14

You are planning the deployment of Windows 11 using Intune. Which THREE components are required to perform an in-place upgrade from Windows 10?

Accepted Answer

A valid Windows 11 product key.. Option A, Option C, and Option D are correct. A Windows 11 feature update profile is needed to deploy the upgrade. A valid product key for Windows 11 is required. Hardware requirements (TPM 2.0, 4GB RAM, etc.) must be met. Option B is incorrect because a Group Policy is not required; Intune can manage the upgrade. Option E is incorrect because the Intune Management Extension is not required for feature updates.

Answer

A Group Policy to enable Windows Update for Business.

Answer

The Intune Management Extension installed on the device.

Question 15

You need to configure conditional access for managed devices accessing Exchange Online. Which THREE conditions can be used?

Accepted Answer

Device platform (e.g., iOS, Android).. Option A, Option B, and Option E are correct. Conditional access can use device compliance, device platform (e.g., iOS, Android), and device risk from Microsoft Defender XDR. Option C is incorrect because user location is a condition but not device-specific; it is based on IP address. Option D is incorrect because app protection policies are not a condition in conditional access; they are separate policies.

Answer

App protection policy status.

Answer

User location based on IP address.