MD-102 Manage and maintain devices Practice Test 4 — 15 Questions

Question 1

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

Accepted Answer

PowerShell scripts (Devices > Scripts). PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Answer

Proactive remediations

Answer

Compliance policy

Answer

Device configuration profile

Question 2

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

Accepted Answer

Endpoint security > Disk encryption policy. To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Answer

Compliance policy for Windows 10

Answer

Windows Update for Business policy

Answer

Device configuration profile for Windows 10

Question 3

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

Accepted Answer

The app is assigned to users, not devices. When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy. The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Answer

The device is low on storage

Answer

The app is available but not required

Answer

The device has offline files enabled

Question 4

You need to ensure that all Windows 10 devices automatically install critical security updates from Windows Update as soon as they are released. Which Windows Update for Business policy setting should you configure?

Accepted Answer

Set 'Quality update deferral period' to 0 days. Setting the 'Quality update deferral period' to 0 days ensures that critical security updates (classified as quality updates in Windows Update for Business) are installed immediately upon release, with no deferral. This policy directly controls the delay before installation, and a value of 0 means updates are applied as soon as they are available from Microsoft.

Answer

Set 'Update notification level' to 'Display notification'

Answer

Configure active hours to allow automatic updates

Answer

Enable 'Pause feature updates'

Question 5

Your organization uses Microsoft Intune to manage iOS devices. You need to prevent users from removing the Intune Company Portal app from their devices. Which setting should you configure?

Accepted Answer

Block app removal in device restrictions. The 'Block app removal' setting in iOS device restrictions prevents users from uninstalling the Company Portal app, ensuring it remains on the device for management. Option B is incorrect because blocking screen capture does not affect app removal. Option C is incorrect because requiring a PIN for app store purchases is unrelated to app removal. Option D is incorrect because blocking jailbroken devices addresses security risks, not app removal.

Answer

Block screen capture

Answer

Require PIN for app store purchases

Answer

Block jailbroken devices

Question 6

You are planning a Windows 11 deployment for 500 new devices using Windows Autopilot. The devices will be shipped directly to users from the manufacturer. You need to ensure that the devices are automatically enrolled in Intune and joined to Microsoft Entra ID. What should you do?

Accepted Answer

Register the device hashes in Intune and assign an Autopilot deployment profile. Windows Autopilot uses device hashes (hardware IDs) to identify devices in Intune. By registering these hashes and assigning an Autopilot deployment profile, the devices are automatically enrolled in Intune and joined to Microsoft Entra ID during the out-of-box experience (OOBE), without requiring manual intervention or additional infrastructure.

Answer

Pre-install the Intune Management Extension on each device

Answer

Configure a provisioning package and include it with the shipment

Answer

Create a hybrid Azure AD join configuration in Intune

Question 7

Which TWO actions can you perform using Microsoft Intune to manage Windows 10 devices?

Accepted Answer

Remotely wipe a device. Microsoft Intune supports a remote wipe action that can be triggered from the Intune console to reset a Windows 10 device to factory settings or selectively remove corporate data. This is a core device management capability used for data protection when a device is lost or stolen, leveraging the Windows 10 reset functionality via the Intune management channel.

Answer

Create local user accounts on the device

Answer

Configure DHCP settings

Answer

Add the device to an Active Directory group

Question 8

Which THREE prerequisites are required to enable Windows Autopilot for existing devices?

Accepted Answer

The device must be running Windows 10 or Windows 11 Pro, Enterprise, or Education edition. Windows Autopilot requires a supported edition of Windows 10 or Windows 11 (Pro, Enterprise, or Education) to access the necessary cloud-based provisioning and enrollment features. Home editions lack the required MDM enrollment capabilities and policy support, making them incompatible with Autopilot deployment.

Answer

The device must be domain-joined to an on-premises Active Directory

Answer

The device must have a TPM 2.0 chip

Question 9

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned devices with work profile. Android Enterprise corporate-owned devices with work profile is a valid enrollment method in Microsoft Intune that allows IT to manage a work profile on company-owned devices while keeping the personal space separate. This method uses the Android Enterprise platform to enforce corporate policies without requiring full device management, leveraging the work profile container for security and compliance.

Answer

Android Device Administrator

Answer

Apple Business Manager

Answer

Windows Autopilot

Question 10

Refer to the exhibit. You have the following compliance policy assigned to a Windows 10 device running version 10.0.22000.0. The device has a password of 8 characters and is encrypted. What is the compliance status of the device?

Accepted Answer

Compliant. The device is running Windows 10 version 10.0.22000.0, which is between the minimum (10.0.19041.0) and maximum (10.0.22621.0) allowed. The password length is 8 characters, which meets the minimum requirement of 6. The device is encrypted. Therefore, all compliance policy conditions are satisfied, making the device Compliant. Option C is correct. Options A, B, and D are incorrect because password length meets the requirement, encryption is enabled, and OS version is within the allowed range.

Answer

Noncompliant due to password length

Answer

Noncompliant due to encryption

Answer

Noncompliant due to OS version

Question 11

Refer to the exhibit. You see the following Intune device properties for a Windows device. The device is noncompliant and the grace period expires on 2025-02-20. Today is 2025-02-15. The compliance policy requires a minimum OS version of 10.0.19041 but the device is on 10.0.18363. What will happen if the device does not become compliant before the grace period expires?

Accepted Answer

The device will be retired after the grace period expires. When a noncompliant device's grace period expires, Intune enforces the compliance policy by retiring the device. Retirement removes the device from Intune management and revokes access to corporate resources, but it does not immediately block access or force an OS update. The grace period allows a window for remediation; after expiration, the device is marked for retirement.

Answer

The device will automatically update to the required OS version

Answer

The device will be blocked from accessing corporate resources

Answer

The device will be retired immediately

Question 12

Refer to the exhibit. You manage a Windows 11 device that is marked as compliant and has OS version 10.0.22621.0. You need to upgrade the device to Windows 11 version 23H2. Which Intune feature should you use?

Accepted Answer

Windows feature update profile. A Windows feature update profile is the correct Intune feature to upgrade a Windows 11 device from one version to another (e.g., from 10.0.22621.0 to 23H2). Feature update profiles deploy new OS builds that enable feature-level changes, whereas quality updates deliver only security and cumulative fixes. This profile targets the specific version upgrade required for the device.

Answer

Windows quality update profile

Answer

Driver update policy

Answer

Compliance policy

Question 13

A user reports that their Windows 11 device cannot connect to the corporate Wi-Fi network. In Intune, the device shows a status of 'Pending' for the Wi-Fi configuration profile. The profile is assigned to a group that includes the user. What is the most likely cause of the issue?

Accepted Answer

The device has not checked in to Intune within the last 8 hours.. The 'Pending' status in Intune for a Wi-Fi configuration profile indicates that the policy has been assigned but not yet applied to the device. This typically occurs when the device has not performed a recent check-in with the Intune service. By default, devices check in every 8 hours, so if the device has not checked in within that window, the profile remains in a 'Pending' state until the next successful sync.

Answer

The device does not have the required root certificate installed.

Answer

The Wi-Fi profile is not assigned to the user's group.

Answer

The Wi-Fi profile requires user affinity and the device is shared.

Question 14

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

Accepted Answer

Update Deadline for Quality Updates (days). The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Answer

Grace Period for Restarts (days)

Answer

Defer Quality Updates (days)

Answer

Active Hours

Question 15

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only approved corporate apps can be installed on these devices. Which restriction profile setting should you configure?

Accepted Answer

Allow app installation from App Store only. Configuring 'Allow app installation from App Store only' to 'No' effectively blocks the App Store, preventing users from installing any apps from the store. Only apps deployed via Intune (managed apps) can then be installed, ensuring only approved corporate apps are on the devices. Option B is incorrect because requiring a password for App Store transactions does not block the installation of unapproved apps if the user has the password. Options C and D are unrelated to app installation restrictions.

Answer

Require app store password

Answer

Allow managed apps to unmanaged accounts

Answer

Allow automatic app downloads