MD-102 Manage and maintain devices Practice Test 6 — 15 Questions

Question 1

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs every time a device boots, before the user logs on. The script is signed. What is the correct deployment approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the script as a PowerShell script in Intune, configured to run in system context at device startup.. Intune's PowerShell script deployment supports running scripts in the system context at device startup, which executes before user logon. This meets the requirement for a signed script that runs every boot, leveraging the 'Run this script using the logged on credentials' option unchecked and 'Run script in 64-bit PowerShell Host' as needed.

Answer

Use a proactive remediation script set to run at device startup.

Answer

Package the script as a Win32 app and deploy it with installation behavior set to 'System'.

Answer

Add the script as a device configuration profile (OMA-URI).

Question 2

Your organization uses Microsoft Intune for device management. A user reports that their Android device is not receiving a required app that is assigned as 'Required' for all users. The device shows as 'Compliant' in Intune. What is the most likely cause?

Accepted Answer

The app is not supported on the device's Android version.. The device is compliant and enrolled, and the user has the Company Portal app (required for Android enrollment). The most likely reason the required app is not installing is that the app is not supported on the device's Android version. Intune will skip installation if the minimum OS version requirement defined in the app assignment is not met, even if the device is otherwise compliant.

Answer

The device is marked non-compliant.

Answer

The user has not installed the Company Portal app.

Answer

The device is not enrolled in Intune.

Question 3

A company uses Microsoft Intune to manage macOS devices. They need to enforce FileVault encryption on all Macs. What should they configure?

Accepted Answer

A device configuration profile with FileVault settings.. FileVault encryption on macOS is enforced through a device configuration profile in Microsoft Intune. Specifically, you create a settings catalog or a custom profile that includes the FileVault settings under the 'System Preferences' > 'Security & Privacy' category, which allows you to require FileVault and escrow the recovery key to Intune. This is the native Intune method for managing macOS disk encryption, as endpoint security policies for disk encryption are designed for Windows BitLocker, not macOS.

Answer

An endpoint security policy for disk encryption.

Answer

A device compliance policy that requires FileVault.

Answer

An app protection policy.

Question 4

You are troubleshooting a Windows 11 device that fails to install an Intune-managed update. The device has been offline for two weeks. After reconnecting, the update does not install. In the Intune console, the update shows 'Failed to install' with error code 0x800f0831. What is the most likely cause?

Accepted Answer

The device's Windows component store is corrupted due to missing prerequisites.. Error code 0x800f0831 indicates that the Windows component store (CBS) is corrupted because a required servicing stack or prerequisite update is missing. When a device has been offline for two weeks, it may lack the necessary baseline updates that the current update depends on, causing the installation to fail even after reconnecting to the network.

Answer

The device does not have internet connectivity.

Answer

The device does not have enough disk space.

Answer

The update is superseded and no longer applicable.

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with TPM 2.0 and Secure Boot enabled can access Microsoft 365 resources. What is the best approach?

Accepted Answer

Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.. Device compliance policies in Microsoft Intune can evaluate hardware attributes like TPM version and Secure Boot status. When combined with a Conditional Access policy that blocks non-compliant devices, this enforces the security requirements before granting access to Microsoft 365 resources. This two-step approach ensures only devices meeting the hardware security baseline can authenticate.

Answer

Create an app protection policy targeting Microsoft 365 apps.

Answer

Create a device configuration policy to enable TPM and Secure Boot.

Answer

Create a Conditional Access policy requiring TPM and Secure Boot.

Question 6

A user's iOS device is enrolled in Microsoft Intune. The user reports that they cannot install the Company Portal app from the App Store. What is the most likely reason?

Accepted Answer

The App Store is disabled by a device restriction policy.. A device restriction policy in Microsoft Intune can block access to the App Store on iOS devices. When the App Store is disabled via a configuration profile, users cannot install or update any apps from the App Store, including the Company Portal app. This is a common policy setting used by organizations to control app installation sources.

Answer

The user does not have an Apple ID.

Answer

The device is not enrolled in Intune.

Answer

The device is not supervised.

Question 7

You manage a hybrid Azure AD joined Windows 10 device with Intune. The device is showing as 'Pending' enrollment. You have verified that the user has an Intune license and the device is synced with Azure AD Connect. What is the most likely issue?

Accepted Answer

The Group Policy for automatic Intune enrollment is not applied to the device.. When a hybrid Azure AD joined device shows 'Pending' enrollment in Intune, the most common cause is that the Group Policy setting 'Automatically enroll devices to Microsoft Intune' has not been applied to the device. This policy triggers the automatic MDM enrollment via the device's scheduled task during user sign-in. Without this policy, the device remains in a pending state even if the user has a license and the device object is synced.

Answer

The user is not the primary user of the device.

Answer

The device is not co-managed with Configuration Manager.

Answer

Azure AD Connect has not synced the device object.

Question 8

Which TWO actions can you perform to reduce the amount of time it takes for a Windows 10 device to receive a new policy from Microsoft Intune?

Accepted Answer

Manually trigger a sync from the device's Settings > Accounts > Access work or school.. Manually triggering a sync from Settings > Accounts > Access work or school forces the device to immediately check in with Microsoft Intune, bypassing the default polling interval. This action initiates an immediate policy retrieval and application cycle, reducing the wait time for new policies to be received.

Answer

Increase the policy refresh interval in the device configuration profile.

Answer

Restart the device.

Answer

Change the device's DNS to point to a local Intune server.

Question 9

Which THREE factors should you consider when planning the deployment of Windows 10 feature updates using Intune?

Accepted Answer

Devices must have sufficient disk space to download the update.. Windows 10 feature updates require sufficient free disk space (typically 20–32 GB depending on the version) to download and stage the update files. If a device lacks adequate space, the update will fail or be blocked by Intune's update readiness checks, which evaluate disk space before initiating the deployment.

Answer

The version of Windows 10 determines which update rings are available.

Answer

The feature update compatibility report is only available for Windows 11.

Question 10

Which TWO methods can you use to enroll a Windows 10 device in Microsoft Intune?

Accepted Answer

Sign in to Settings > Accounts > Access work or school and connect.. Enrolling a Windows 10 device via Settings > Accounts > Access work or school and clicking 'Connect' initiates a device enrollment that registers the device with Azure AD and automatically enrolls it in Intune (if auto-enrollment is configured via GPO or MDM discovery). This method uses the MDM enrollment protocol over the Enrollment REST service, requiring only a work or school account.

Answer

Navigate to the Intune enrollment URL in a browser.

Answer

Use the Company Portal website to enroll.

Answer

Enroll from the Microsoft 365 admin center.

Question 11

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Accepted Answer

Non-compliant, because the firewall is disabled.. The compliance policy requires the firewall to be enabled. Since the device has a disabled firewall, it fails that specific requirement, making it non-compliant regardless of meeting other conditions like OS version. In Microsoft Intune, compliance policies evaluate each setting independently; a single non-compliant setting results in an overall non-compliant status.

Answer

Compliant, because the OS version is within the allowed range.

Answer

Compliant, because the policy includes a grace period for firewall.

Answer

Non-compliant, because the OS version is not within the allowed range.

Question 12

Refer to the exhibit. You apply this device configuration profile to a Windows 10 device. A user downloads a file that is classified as potentially unwanted application (PUA). What action will Defender take?

Accepted Answer

Block the file from being downloaded.. The device configuration profile shown in the exhibit sets the 'PUAProtection' policy to 'Enabled' with the 'Block' option selected. When a user attempts to download a file classified as a potentially unwanted application (PUA), Microsoft Defender for Endpoint enforces this policy by blocking the download entirely, preventing the file from being written to disk. Option D is correct because the explicit 'Block' setting overrides any other behavior, ensuring the PUA is not allowed to execute or persist on the device.

Answer

Audit the detection and allow the download.

Answer

Send the file to the cloud for analysis.

Answer

Automatically clean the file.

Question 13

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Accepted Answer

Non-compliant, because the firewall is disabled.. The device is non-compliant because the compliance policy explicitly requires the firewall to be enabled. Even though the OS version (10.0.19044) falls within the allowed range of 10.0.17763 to 10.0.19045, the firewall requirement is a separate condition that must be met. In Microsoft Intune, if any required setting is not satisfied and no grace period is configured for that setting, the device is marked non-compliant immediately.

Answer

Non-compliant, because the OS version is not within the allowed range.

Answer

Compliant, because the policy includes a grace period for firewall.

Answer

Compliant, because the OS version is within the allowed range.

Question 14

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

Accepted Answer

The users are not members of the Azure AD group assigned to the required app.. In Microsoft Intune, app deployment is based on Azure AD group assignments. Even if a device is compliant and has recently checked in, the required app will not install unless the user or device is a member of the Azure AD group that the app is assigned to. Intune evaluates group membership at each check-in to determine which apps should be pushed, so missing group membership is the most likely cause when compliance and connectivity are verified.

Answer

The devices are not connected to a Wi-Fi network configured in Intune.

Answer

The devices are not compliant with the compliance policy.

Answer

The enrollment restrictions are blocking the devices from receiving apps.

Question 15

Your organization uses Microsoft Intune to manage devices. You need to deploy a PowerShell script that runs every time a user logs in to a Windows 10 device. The script must run with administrative privileges. Which deployment approach should you use?

Accepted Answer

Use Intune PowerShell scripts targeting the user, with a scheduled task triggered by logon.. Intune PowerShell scripts can be deployed to users and configured to run as the logged-on user. To run with administrative privileges and on every logon, a scheduled task triggered by logon can be created that runs the script with elevated rights. Option A is incorrect because deploying a PowerShell script as a Win32 app typically runs once per assigned device, not on every user logon. Option B is incorrect because proactive remediations run on a schedule (e.g., daily) and can detect/fix issues but are not triggered by user logon events. Option D is incorrect because custom compliance policies evaluate device settings for compliance and do not execute scripts on login.

Answer

Package the script as a Win32 app and assign it as required.

Answer

Deploy the script as a proactive remediation in Intune.

Answer

Use a custom compliance policy to run the script.