MD-102 Manage and maintain devices Practice Test 5 — 15 Questions

Question 1

You are troubleshooting a Windows 10 device that shows as 'Noncompliant' in Intune despite having all required compliance policies applied. The device is domain-joined and configured with hybrid Azure AD join. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device's health attestation certificate has expired.. A device that is hybrid Azure AD joined and domain-joined but shows as 'Noncompliant' in Intune, despite having all required compliance policies applied, is most likely failing compliance due to an expired health attestation certificate. Intune uses Windows Health Attestation Service (HAS) to verify device integrity; if the attestation certificate has expired, the device cannot prove its health status, causing it to be marked noncompliant even when policies are correctly assigned.

Answer

The Intune Management Extension is not installed.

Answer

The device is not registered in Microsoft Entra ID.

Answer

The device is not enrolled in Intune.

Question 2

You need to retire a corporate-owned iOS device that is no longer in use. The device is enrolled in Intune with user affinity. Which action should you perform?

Accepted Answer

Retire the device from Intune.. The 'Retire' action in Intune removes the managed app data and policies from the device while preserving the user's personal data, which is appropriate for a corporate-owned device with user affinity that is no longer in use. Retiring also removes the device from Intune management and revokes the company portal access, ensuring compliance without unnecessary data loss.

Answer

Disable the device in Intune.

Answer

Wipe the device from Intune.

Answer

Delete the device from Microsoft Entra ID.

Question 3

Your organization requires that all Windows 11 devices encrypt their drives with BitLocker. You have configured a BitLocker policy in Intune, but some devices show as 'Not evaluated' for the encryption status. What is the most likely reason?

Accepted Answer

The devices do not have a TPM chip.. The 'Not evaluated' status in Intune indicates that the device has not yet checked in or the policy has not been applied, but the most common root cause for BitLocker policy evaluation failure is the absence of a TPM chip. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 for its default encryption method, and without it, the policy cannot be assessed, resulting in a 'Not evaluated' state rather than a compliance failure.

Answer

The policy is not assigned to the correct group.

Answer

The devices have a conflicting Group Policy.

Answer

Secure Boot is disabled on the devices.

Question 4

You are using Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a preference for a third-party app. Which method should you use?

Accepted Answer

Upload a property list (.plist) file.. Intune for macOS uses property list (.plist) files to deploy custom configuration profiles for app preferences. The .plist format is the native macOS mechanism for storing application settings, and Intune's custom profile type directly accepts a valid .plist file to apply these settings via MDM. This method ensures the preferences are correctly parsed and enforced on managed macOS devices.

Answer

Upload an XML file with the preference settings.

Answer

Upload a DMG file containing the preferences.

Answer

Upload a JSON file with the preference settings.

Question 5

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

Accepted Answer

Check the device's last check-in time with Intune.. The device is already compliant and enrolled, and the email profile is assigned, so the most likely issue is that the device has not recently checked in with Intune to receive the latest policy or profile. Checking the last check-in time is the first troubleshooting step because Intune relies on periodic device check-ins to push configuration profiles, including email profiles. If the device hasn't checked in recently, it won't have the email profile applied, even if it's compliant and enrolled.

Answer

Verify that the device meets the compliance policy for Android.

Answer

Confirm that the user has an Exchange Online license.

Answer

Ensure the device is enrolled in Intune.

Question 6

You have configured a Windows 10 update ring with a deadline of 3 days for quality updates. However, some devices are not installing updates within the deadline. What should you verify?

Accepted Answer

The devices are set to defer quality updates in Windows Update settings.. If devices are configured to defer quality updates in their local Windows Update settings, they will ignore the deadline specified in the update ring policy. The update ring deadline enforces installation timing, but deferral settings can override that by delaying the download or installation beyond the deadline. You must verify that no local or Group Policy deferral is active, as Intune's update ring policy does not automatically clear existing deferral configurations.

Answer

The devices have a feature update policy that conflicts.

Answer

The Intune Management Extension is installed.

Answer

The update ring is assigned to the correct Azure AD group.

Question 7

You have assigned the above compliance policy to all Windows 10 devices. A user's device shows as noncompliant with a reason of 'TPM not found'. What should you do to resolve the issue?

Accepted Answer

Create a new compliance policy without the TPM requirement and assign it to devices without TPM.. The device lacks TPM hardware, so the compliance policy requirement for TPM cannot be met. The appropriate solution is to create a separate compliance policy without the TPM requirement and assign it to devices that do not have TPM, ensuring those devices can still be compliant without compromising security requirements for TPM-capable devices.

Answer

Disable the TPM requirement in the policy.

Answer

Assign the policy to a different group that excludes those devices.

Answer

Change the password complexity requirement to 'none'.

Question 8

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

Accepted Answer

The OMA-URI path is incorrect for an ADMX-backed policy.. The OMA-URI path for an ADMX-backed policy must follow the exact format: `./Device/Vendor/MSFT/Policy/Config/ADMX_/`. If the path is incorrect—for example, missing the `ADMX_` prefix or using a wrong category name—the policy will fail to apply on Windows 10 devices. Custom configuration policies do support ADMX-backed policies, but the URI must precisely match the ADMX administrative template structure.

Answer

The value must be an integer, not a string.

Answer

The OMA-URI targets the user, not the device.

Answer

Custom configuration policies are not supported on Windows 10.

Question 9

The above PowerShell cmdlet returns the following output:

DeviceName: LAPTOP001
LastSyncDateTime: 2025-03-15T08:30:00Z
ComplianceState: noncompliant
ManagementState: managed
OSVersion: 10.0.19044.1288

The device last synced 3 days ago. What is the most likely reason for the noncompliant status?

Accepted Answer

The device has not synced in over 24 hours.. The device last synced 3 days ago, and the output shows ComplianceState: noncompliant. In Microsoft Intune, a device that has not checked in for more than 24 hours is automatically marked as noncompliant because the compliance policies cannot be evaluated without a recent sync. The LastSyncDateTime of 2025-03-15T08:30:00Z confirms the device has not synced within the required 24-hour window, making C the correct answer.

Answer

The device is running an outdated OS version.

Answer

The device has been retired or wiped.

Answer

The device has no compliance policy assigned.

Question 10

You need to ensure that corporate data on lost or stolen iOS devices is protected. Which TWO actions should you configure in Intune?

Accepted Answer

Configure a device passcode policy.. (Configure a device passcode policy) is correct because requiring a passcode protects data on lost or stolen devices by preventing unauthorized access. Option E (Enable remote wipe on the device) is correct because remote wipe can erase all data on a lost or stolen iOS device, ensuring corporate data is not compromised. Option A is incorrect because device inventory reporting is a management feature, not a protective action. Option C is incorrect because selective wipe (retire) removes corporate data but does not protect the device itself. Option D is incorrect because retiring the device removes management but does not immediately protect data.

Answer

Enable device inventory reporting.

Answer

Perform a selective wipe to remove corporate data only.

Answer

Retire the device from Intune.

Question 11

You are planning the deployment of Windows 11 using Intune. Which TWO components are required to perform an in-place upgrade from Windows 10?

Accepted Answer

A Windows 11 feature update profile in Intune.. To perform an in-place upgrade from Windows 10 to Windows 11 using Intune, you need two core components: a Windows 11 feature update profile in Intune to trigger the upgrade, and hardware that meets Windows 11 system requirements for compatibility. Although the question asks for three components, only two of the listed options are correct. A valid product key is not needed because the digital license carries forward. The Intune Management Extension is not used for feature updates, and Group Policy for Windows Update for Business is not required when using Intune's built-in update management. The third component is not applicable in this context.

Answer

A Group Policy to enable Windows Update for Business.

Answer

A valid Windows 11 product key.

Answer

The Intune Management Extension installed on the device.

Question 12

You need to configure conditional access for managed devices accessing Exchange Online. Which THREE conditions can be used?

Accepted Answer

Device platform (e.g., iOS, Android).. Conditional Access for managed devices can target specific device platforms (e.g., iOS, Android, Windows) to enforce policies like requiring a compliant device. This allows administrators to restrict access based on the operating system, which is a fundamental condition in Conditional Access policies for Exchange Online.

Answer

App protection policy status.

Answer

User location based on IP address.

Question 13

You are troubleshooting a Windows 11 device that fails to install a required Win32 app deployed via Intune. Which THREE logs or locations should you review?

Accepted Answer

Intune Management Extension logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs. The Intune Management Extension (IME) is the agent responsible for processing Win32 app deployments on Windows 11 devices. Its logs, located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs, provide detailed information about the download, detection, and installation phases of Win32 apps, making them the primary source for troubleshooting installation failures.

Answer

Windows Update log (C:\Windows\WindowsUpdate.log)

Answer

Windows Registry under HKLM\Software\Microsoft\Intune

Question 14

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the corporate Wi-Fi profile no longer connects automatically. You verify the profile is still assigned and the device shows 'Not compliant' in Intune. What should you check first?

Accepted Answer

Review the device's compliance policy status and resolve any non-compliance.. The device shows 'Not compliant' in Intune, which directly prevents the Wi-Fi profile from applying or connecting automatically. Intune enforces compliance before allowing configuration profiles to take effect; resolving the non-compliance will restore automatic connectivity. This is the most direct and likely cause given the scenario.

Answer

Re-enroll the device in Intune.

Answer

Create a new Wi-Fi profile and assign it.

Answer

Verify the device's certificate for the Wi-Fi profile is still valid.

Question 15

A company uses Microsoft Intune to manage iOS devices. They want to ensure that only devices with a passcode of at least 6 characters and without jailbreak can access corporate email. Which policy type should they configure?

Accepted Answer

Device compliance policy. Device compliance policies in Microsoft Intune evaluate device-level security settings such as jailbreak status and passcode length. By configuring a compliance policy that requires a passcode of at least 6 characters and detects jailbroken devices, Intune can mark non-compliant devices and, when combined with Conditional Access, block access to corporate email. This is the correct policy type because it directly assesses the device's security posture rather than app-level or configuration settings.

Answer

Conditional Access policy

Answer

App protection policy

Answer

Device configuration policy