MD-102 Manage and maintain devices Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Accepted Answer

Non-compliant, because the firewall is disabled.. The policy requires activeFirewallRequired to be true. Since the firewall is disabled, the device is non-compliant. Even though other requirements are met, non-compliance in one area makes the device non-compliant. Option A is incorrect because the policy does not have a grace period. Option B is incorrect because the device is non-compliant. Option D is incorrect because the policy is applicable.

Answer

Non-compliant, because the OS version is not within the allowed range.

Answer

Compliant, because the policy includes a grace period for firewall.

Answer

Compliant, because the OS version is within the allowed range.

Question 2

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

Accepted Answer

The users are not members of the Azure AD group assigned to the required app.. Option A is correct because if users are not members of the Azure AD group targeted for the app, the app will not be required. Option B is wrong because compliance does not affect app assignment targeting. Option C is wrong because Wi-Fi profiles are not required for app installation. Option D is wrong because enrollment restrictions block enrollment, not app installation.

Answer

The devices are not connected to a Wi-Fi network configured in Intune.

Answer

The devices are not compliant with the compliance policy.

Answer

The enrollment restrictions are blocking the devices from receiving apps.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to deploy a PowerShell script that runs every time a user logs in to a Windows 10 device. The script must run with administrative privileges. Which deployment approach should you use?

Accepted Answer

Use Intune PowerShell scripts targeting the user, with a scheduled task triggered by logon.. Option D is correct because Microsoft Intune supports PowerShell scripts running in the user context on login, and using a scheduled task triggered by logon can run with elevated privileges. Option A is wrong because Proactive remediations run on a schedule, not on logon. Option B is wrong because a Win32 app can be set to run once, not on every logon. Option C is wrong because custom compliance policies evaluate compliance, not run scripts on login.

Answer

Package the script as a Win32 app and assign it as required.

Answer

Deploy the script as a proactive remediation in Intune.

Answer

Use a custom compliance policy to run the script.

Question 4

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

Accepted Answer

Assign a Windows 10/11 feature update policy.. Option A is correct because the Windows 10/11 feature update policy in Intune is designed to upgrade devices to a later version, including Windows 11. Option B is wrong because update rings control update deferral, not feature upgrades. Option C is wrong because quality updates are cumulative security updates, not feature upgrades. Option D is wrong because drivers are separate.

Answer

Assign a driver update policy.

Answer

Assign a quality update policy.

Answer

Assign an update ring for Windows 10.

Question 5

Refer to the exhibit. You create a custom configuration profile in Intune for Windows 10 devices. The profile is assigned to a test device, but the telemetry setting is not applied. The device is managed and compliant. What is the most likely reason?

Accepted Answer

The AllowTelemetry policy value must be an integer, not a string, or the device needs a Windows 10 version that supports this setting.. Option C is correct because the AllowTelemetry policy requires a value of 0 to disable telemetry, but the OMA-URI string must match the expected data type; the value '0' as a string may not be accepted, or the device may require a specific version. Option A is wrong because the custom profile overwrites, it doesn't conflict with built-in policies. Option B is wrong because the device is compliant. Option D is wrong because the OMA-URI path is correct.

Answer

The device is not compliant with the baseline policy.

Answer

The OMA-URI path for AllowTelemetry is incorrect.

Answer

The custom profile conflicts with a built-in policy that sets telemetry to full.

Question 6

You need to remotely wipe a lost corporate-owned iOS device enrolled in Microsoft Intune. The device is currently offline. What will happen when the device comes online?

Accepted Answer

The device will receive the wipe command the next time it checks in with Intune.. Option B is correct because the wipe command is stored in the Intune service and sent when the device checks in. Option A is wrong because Intune does not wait for a grace period. Option C is wrong because the device does not need to be unenrolled first. Option D is wrong because the wipe is not queued only for supervised devices.

Answer

The device must be unenrolled first and then wiped.

Answer

The device will be wiped immediately after a grace period of 24 hours.

Answer

The wipe command will be queued only if the device is supervised.

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting even though the policy is assigned. What should you check first?

Accepted Answer

Confirm that the device has a compatible TPM chip and that it is enabled.. Option D is correct because BitLocker requires a compatible TPM; if TPM is not present or not initialized, encryption may fail. Option A is wrong because the policy does not require disabling Secure Boot. Option B is wrong because BitLocker policies are available in the Settings catalog. Option C is wrong because device compliance does not affect BitLocker enforcement.

Answer

Verify that Secure Boot is disabled in BIOS.

Answer

Ensure devices are marked as compliant in Intune.

Answer

Check if the BitLocker policy is using the Settings catalog.

Question 8

Users report that after updating to Windows 11, their devices are no longer receiving policy updates from Intune. The devices appear as active and compliant in the Intune console. What is the most likely cause?

Accepted Answer

The Intune management extension is outdated and needs to be updated.. Option D is correct because Windows 11 requires the Intune management extension to be updated; an outdated extension may not process policies correctly. Option A is wrong because Windows 11 is supported. Option B is wrong because the devices are compliant. Option C is wrong because MDM authority is per tenant, not per device.

Answer

The devices lost compliance after the upgrade.

Answer

The MDM authority changed to Configuration Manager.

Answer

Windows 11 is not supported by Microsoft Intune.

Question 9

You need to block users from enrolling personal Android devices in Microsoft Intune. Which enrollment restriction should you configure?

Accepted Answer

Set the 'Block personally owned devices' restriction for Android.. Option B is correct because the 'Block personally owned devices' restriction prevents personal devices from enrolling. Option A is wrong because that restricts device platform, not ownership. Option C is wrong because device type restrictions are for platform, not ownership. Option D is wrong because compliance policies do not block enrollment.

Answer

Set the 'Block Android' platform restriction.

Answer

Set the 'Block Android Enterprise' device type restriction.

Answer

Configure a device compliance policy to mark personal devices as non-compliant.

Question 10

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

Accepted Answer

passwordMinimumLength. Option D is correct because the policy requires a minimum password length of 8, but the device has 6. Option A is wrong because the device may have encryption. Option B is wrong because Secure Boot may be enabled. Option C is wrong because code integrity may be enabled.

Answer

requireCodeIntegrity

Answer

requireDeviceEncryption

Answer

requireSecureBoot

Question 11

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices. Which TWO conditions must be met?

Accepted Answer

The iOS devices must have the distribution profile installed.. Options B and D are correct. The app must be signed with an Enterprise Developer certificate (B), and the iOS devices must have the distribution profile installed (D). Option A is wrong because the app file is an .ipa, not .appx. Option C is wrong because the app must be uploaded to Intune, not distributed via MDM. Option E is wrong because the app must be assigned to users or devices.

Answer

The app must be packaged as an .appx file.

Answer

The app must be assigned to devices only, not users.

Answer

The app must be distributed via the Apple App Store.

Question 12

You need to configure a Microsoft Intune policy to ensure that only devices with a minimum OS version can access corporate email. Which THREE policy types can enforce this requirement?

Accepted Answer

Device compliance policy. Options A, C, and D are correct. A: Device compliance policy can mark devices as non-compliant if OS version is below minimum. C: Conditional access policy can block access based on device state. D: App protection policy can require minimum app version, which maps to OS version in some contexts. Option B is wrong because configuration profiles do not enforce access. Option E is wrong because enrollment restrictions block enrollment, not access after enrollment.

Answer

Enrollment restrictions

Answer

Device configuration profile

Question 13

You need to deploy a Windows 10 feature update to a pilot group. Which TWO steps are required in Microsoft Intune?

Accepted Answer

Create a feature update policy for Windows 10.. Options B and E are correct. B: Create a feature update profile targeting Windows 10 version 22H2. E: Assign the profile to the pilot device group. Option A is wrong because update rings are for quality updates. Option C is wrong because compliance policies are not for updates. Option D is wrong because driver updates are separate.

Answer

Create a driver update policy for Windows 10.

Answer

Create an update ring for Windows 10.

Answer

Create a compliance policy for Windows 10.

Question 14

Refer to the exhibit. You run this Microsoft Graph PowerShell command to retrieve managed devices. The output shows a device with a lastSyncDateTime of 5 days ago. What does this indicate?

Accepted Answer

The device has not communicated with Intune for 5 days.. Option B is correct because lastSyncDateTime indicates when the device last communicated with Intune; 5 days ago means the device has not checked in for 5 days. Option A is wrong because complianceState is a separate property. Option C is wrong because enrollment date is in the past. Option D is wrong because the device is still enrolled.

Answer

The device was enrolled 5 days ago.

Answer

The device is non-compliant.

Answer

The device is unenrolled.

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned Windows 10 devices are allowed to access Microsoft 365 services. You have configured a conditional access policy to require compliant devices. What else must you do to identify corporate-owned devices?

Accepted Answer

Add corporate device identifiers (e.g., serial numbers) in Intune.. Option A is correct because you need to add corporate device identifiers (e.g., serial numbers) in Intune so that devices can be marked as corporate-owned. Option B is wrong because app protection policies manage data within apps, not device ownership. Option C is wrong because compliance policies do not set ownership. Option D is wrong because enrollment restrictions block personal devices but do not mark devices as corporate.

Answer

Configure a device compliance policy to require corporate ownership.

Answer

Set enrollment restrictions to block personally owned devices.

Answer

Deploy an app protection policy to block personal devices.

MD-102 Manage and maintain devices Practice Test 6 — 15 Questions

Exhibit

MD-102 Manage and maintain devices Practice Test 6 — 15 Questions

Exhibit