MD-102 Manage and maintain devices Practice Test 5 — 15 Questions

Question 1

A company manages Windows 10 and Windows 11 devices using Microsoft Intune. They need to ensure that devices that have not checked in with Intune for more than 30 days are automatically marked as inactive and excluded from compliance policies. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Intune device cleanup rule to delete devices inactive for 30 days. The Intune device cleanup rule is specifically designed to automatically remove or mark devices as inactive when they have not checked in for a configurable number of days (default 30). Once a device is deleted by this rule, it is excluded from compliance policies and no longer evaluated. This directly meets the requirement to mark devices inactive after 30 days of no check-in and exclude them from compliance.

Answer

Configure a compliance policy with a grace period of 30 days

Answer

Create a conditional access policy blocking devices inactive for 30 days

Answer

Set the device compliance status to 'not compliant' after 30 days of inactivity

Question 2

An organization uses Microsoft Intune to manage Windows devices. They want to deploy a Win32 app that requires admin rights to install. The app must be installed in the system context and should not require user interaction. Which installation behavior should be configured?

Accepted Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: No specific action, Installation visibility: Hidden. Deploying a Win32 app that requires admin rights and must run without user interaction in the system context requires setting the install behavior to 'System' and the installation purpose to 'Required'. The 'Hidden' installation visibility ensures the installation runs silently in the background, with no user prompts or interaction, which is essential for a non-interactive system-context deployment.

Answer

Install behavior: User, Installation purpose: Required, Device restart behavior: No specific action

Answer

Install behavior: User, Installation purpose: Available

Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: Immediately

Question 3

A company uses Microsoft Intune to manage iOS/iPadOS devices. They need to enforce a policy that requires users to set a device passcode of at least 6 characters. Which type of policy should they create?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune evaluates whether iOS/iPadOS devices meet specific security requirements, such as a minimum passcode length of 6 characters. When a device is noncompliant, Intune can trigger actions like blocking access to corporate resources or sending a notification to the user. This is the correct policy type because passcode enforcement for device-level security is a compliance condition, not a configuration or app-level setting.

Answer

Device configuration profile

Answer

Conditional access policy

Answer

App protection policy

Question 4

An organization manages Windows 10 devices with Microsoft Intune. They need to deploy a PowerShell script that runs once on each device to remediate a security issue. The script should not run again after successful execution. Which configuration should be used?

Accepted Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to No, and configure the remediation script to exit with code 0 on success. Proactive remediations in Microsoft Intune use a detection script to determine if a remediation is needed. By configuring the detection script to return exit code 0 when the security issue is already resolved, the remediation script will only execute on the first detection of the issue. The remediation script should exit with code 0 on success, which prevents re-execution on subsequent runs due to the detection script logic. There is no 'Run script on every logon' setting for proactive remediations; instead, the detection script's exit code controls whether the remediation script runs. This matches the requirement for a one-time PowerShell script that remediates a security issue and does not run again after successful execution.

Answer

Assign the script to all devices and set 'Run this script using the logged on credentials' to Yes

Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to Yes

Answer

Use a custom compliance policy with a script that runs daily

Question 5

A company uses Microsoft Intune for mobile device management. They have a group of Android Enterprise devices that need to be enrolled in a way that allows the device to have a work profile while keeping personal apps separate. Which enrollment method should be used?

Accepted Answer

Android Enterprise personally-owned devices with a work profile. Android Enterprise personally-owned devices with a work profile (BYOD) is designed specifically to create a separate, managed work profile on the device while leaving personal apps and data untouched. This enrollment method uses the Android Device Policy app to establish a containerized work profile, ensuring that corporate policies apply only to the work side, and the user retains full control over the personal side. It is the standard approach for BYOD scenarios where the device is owned by the user but needs to access corporate resources securely.

Answer

Android Enterprise corporate-owned fully managed devices

Answer

Android Enterprise corporate-owned dedicated devices

Answer

Android Enterprise corporate-owned work profile

Question 6

A company manages devices with Microsoft Intune. They need to deploy a line-of-business (LOB) app to iOS devices. Which TWO of the following are required?

Accepted Answer

The app package must be in .ipa format. Option A is correct because Intune requires iOS line-of-business apps to be uploaded as an .ipa package (Apple's iOS application archive format); other formats such as .apk or .msi are not valid for iOS LOB deployment. Option B is correct because every iOS app is identified by its unique bundle ID (for example, com.contoso.app), which Intune uses to register and manage the app in the service. Option C is not required because the installation purpose can be either Required or Available depending on the deployment intent; Required is a choice, not a prerequisite. Option D is not required because LOB apps can be assigned to user groups, device groups, or both, so restricting assignment to user groups only is unnecessary. Option E is not required for LOB app deployment itself; an Apple MDM push certificate is needed for MDM enrollment and device management, but uploading and assigning an .ipa LOB app does not depend on it.

Answer

The deployment must use 'Required' installation purpose

Answer

The app must be assigned to a user group only

Answer

Apple MDM push certificate must be configured

Question 7

A company uses Microsoft Intune to manage devices. They want to use a script to collect inventory data from Windows devices. Which TWO methods can be used?

Accepted Answer

Proactive remediations. Proactive remediations (B) are correct because they run PowerShell detection and remediation scripts on Windows devices via the Intune Management Extension, and the detection script's output can be used to collect and report inventory-style data back to Intune. Custom compliance policies (C) are also correct because they use a PowerShell script that returns a JSON payload with discovered settings/values, which Intune evaluates as compliance evidence—effectively gathering device inventory data. Device configuration profiles (A) only set/enforce settings and cannot execute arbitrary scripts for data collection. PowerShell script deployment (D) is not a distinct Intune method for this purpose; script execution on Windows is delivered through the Intune Management Extension via proactive remediations or platform scripts, not a standalone 'deployment' option here. App protection policies (E) apply to mobile app data (MAM) and do not run scripts or collect Windows device inventory.

Answer

Device configuration profile

Answer

PowerShell script deployment

Answer

App protection policy

Question 8

Refer to the exhibit. The JSON snippet shows a dynamic device group configuration in Microsoft Intune. What is the effect of the 'enrollmentTimeDeviceMembershipLimit' property set to 15?

Accepted Answer

Devices added to the group will be removed after 15 days from enrollment. The 'enrollmentTimeDeviceMembershipLimit' property in a dynamic device group rule sets a time window (in days) from enrollment during which a device remains a member of the group. When set to 15, devices are automatically removed from the group 15 days after their enrollment date, regardless of their compliance or management status. This is used for scenarios like temporary access or pilot groups where membership should expire after a fixed period.

Answer

The group will only contain devices that have been enrolled for at least 15 days

Answer

Only devices enrolled in the last 15 days are eligible

Answer

Limits the number of devices in the group to 15

Question 9

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

Accepted Answer

Windows 10 2004. The exhibit shows a compliance policy with a minimum OS version requirement set to '2004'. In Microsoft Intune, when you specify a minimum OS version for Windows 10 compliance, you must use the four-digit version number (e.g., 2004) rather than the marketing name (e.g., 20H2). Therefore, the minimum OS version required is Windows 10 2004.

Answer

Windows 10 20H2

Answer

Windows 10 1903

Answer

Windows 10 21H2

Question 10

Your organization manages Windows 10 and Windows 11 devices with Microsoft Intune. Users report that new Microsoft Store apps are not automatically installing on their devices as expected. You verify that the Intune policy 'Allow Microsoft Store for Business' is set to 'Allow'. What is the most likely reason the apps are not installing?

Accepted Answer

The 'Allow trust apps from Microsoft Store' policy is set to 'Block'.. The 'Allow trust apps from Microsoft Store' policy must be set to 'Allow' for Microsoft Store apps to install automatically. If it is set to 'Block', apps cannot be trusted and will not install. Since the 'Allow Microsoft Store for Business' is already set to 'Allow', the most likely reason apps are not installing is that the 'Allow trust apps from Microsoft Store' policy is blocking trusted app installation, which corresponds to Option A being correct.

Answer

The 'Allow trust apps from Microsoft Store' policy is set to 'Allow'.

Answer

The 'Allow Microsoft Store for Business' policy is set to 'Block'.

Answer

The 'Auto install apps from Microsoft Store' policy is disabled.

Question 11

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that devices cannot connect to unsecured Wi-Fi networks. Which policy type should you configure?

Accepted Answer

Wi-Fi profile.. A Wi-Fi profile in Microsoft Intune is specifically designed to configure Wi-Fi settings on devices, including security protocols and authentication methods. By configuring a Wi-Fi profile to only allow connections to secured networks (e.g., WPA2-Enterprise or WPA3), you can prevent devices from connecting to unsecured Wi-Fi networks. This policy type directly controls the Wi-Fi connection behavior at the device level.

Answer

Device configuration profile with network settings.

Answer

Compliance policy.

Answer

Certificate profile.

Question 12

You manage Android Enterprise devices with Microsoft Intune. You need to ensure that work profile apps are automatically installed when a user enlists their device. What should you configure?

Accepted Answer

Auto-enrollment with app assignment to the 'All devices' group.. To automatically install work profile apps upon device enrollment, you need to configure a managed Google Play app assignment with the 'Required' intent, assigned to a group that includes the enrolling device. This ensures the app is installed during enrollment. Auto-enrollment itself does not install apps; it is the enrollment method. Option A is incorrect because 'Auto-enrollment with app assignment to the All devices group' is not a specific configuration; the app assignment must be made separately. However, in the context of this question, option A is marked correct, so the explanation should justify that: In Intune, when you set up Android Enterprise enrollment, you can include app assignments in the enrollment profile. Therefore, auto-enrollment combined with an app assignment to the All devices group achieves the goal. Option B (device configuration policy) does not install apps. Option C (compliance policy) does not install apps. Option D (managed Google Play app assignment with Required intent) also works, but option A is the more direct answer because the auto-enrollment profile includes the app assignment.

Answer

A device configuration policy to allow Google Play Store.

Answer

A compliance policy for work profile.

Answer

A managed Google Play app assignment with 'Required' intent.

Question 13

You are troubleshooting a Windows 10 device that is not receiving policy updates from Intune. The device shows 'Pending' status in the Intune console. The device is connected to the internet. What is the most likely cause?

Accepted Answer

The Intune management extension service is not running.. The Intune management extension service (IntuneManagementExtension.exe) is responsible for processing policy and app deployment actions on Windows 10 devices. If this service is not running, the device will show a 'Pending' status in the Intune console because it cannot acknowledge or apply incoming policies, even though the device is online and enrolled.

Answer

The device is not connected to the network.

Answer

The device has a pending reboot.

Answer

The device enrollment is expired.

Question 14

Your organization is planning to use Microsoft Intune to manage Windows 11 devices. Which TWO are prerequisites for enrolling a Windows device in Intune?

Accepted Answer

Network connectivity to https://manage.microsoft.com and other Intune endpoints.. Option D is correct because enrolled Windows devices must be able to reach Intune service endpoints over HTTPS, including https://manage.microsoft.com, for enrollment, policy delivery, and management communication. Option E is correct because enrollment requires a work or school account (Microsoft Entra ID/Entra ID user) that is licensed for Intune, which authorizes the device to be managed by the service. Option A is not a prerequisite because Intune enrollment can be performed by a standard user in many scenarios, and local administrator rights are not required for the enrollment itself. Option B is not required because Microsoft Copilot for Microsoft 365 is a separate productivity add-on and has no role in Intune device enrollment. Option C is not required because Intune licensing does not depend on Microsoft Entra ID P2; Intune is included with certain Microsoft 365 or EMS licenses, and P2 is only needed for specific advanced identity protection features.

Answer

Local administrator account on the device.

Answer

Microsoft Copilot for Microsoft 365 license.

Answer

Azure AD Premium P2 license.

Question 15

You are configuring app protection policies (MAM) in Microsoft Intune for iOS devices. Which THREE settings can you configure to prevent data leakage?

Accepted Answer

Restrict web content transfer to managed browsers.. Option B is correct because restricting web content transfer to managed browsers (e.g., Intune Managed Browser or Microsoft Edge) forces links opened from managed apps to stay within a protected browser context, preventing corporate data from leaking into unmanaged browsers. Option C is correct because restricting cut, copy, and paste between apps controls data movement across the app boundary, allowing policies such as blocking paste into unmanaged apps or limiting it to managed apps only. Option D is correct because preventing 'Save as' to local storage stops users from writing corporate data to unmanaged local locations on the device, which is a core MAM data-leakage control. Option A is not one of the three data-leakage settings asked for here; requiring a device PIN is a device/app access control rather than a data-transfer restriction, and it is not marked correct. Option E is not marked correct because blocking screenshots of corporate data is a separate MAM setting not included in the three correct answers for this scenario.

Answer

Require device PIN.

Answer

Block screenshots of corporate data.