MD-102 Manage and maintain devices Practice Test 7 — 15 Questions

Question 1

You are troubleshooting a user's Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is managed by Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The certificate is issued by your internal CA. The device shows 'No internet access' though it connects. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The root CA certificate is not deployed to the device. The device connects to the Wi-Fi network but shows 'No internet access,' indicating the SSID and connectivity are functional. With SCEP certificate authentication, the client must trust the issuing CA's root certificate to validate the server-side certificate during the EAP-TLS handshake. If the root CA certificate is not deployed to the device via Intune, the certificate chain cannot be verified, causing the connection to fail at the authentication layer even though the Wi-Fi association succeeds.

Answer

The SSID in the profile is incorrect

Answer

The user does not have an Intune license

Answer

The Wi-Fi profile is not assigned to the device

Question 2

You need to ensure that all iOS devices enrolled in Intune automatically install required apps (e.g., Microsoft Outlook, Teams) during enrollment. Which enrollment profile setting should you configure?

Accepted Answer

Install required apps during enrollment. The 'Install required apps during enrollment' setting in an iOS enrollment profile directs Intune to push mandatory apps (like Outlook and Teams) to the device as part of the Automated Device Enrollment (ADE) process. This leverages the Device Enrollment Program (DEP) workflow to install apps before the user gains full access, ensuring compliance with corporate policies from the outset.

Answer

Apple Volume Purchase Program token

Answer

Company Portal branding

Answer

Device type restriction

Question 3

A user reports that their Android Enterprise work profile device is not receiving email from the corporate Exchange Online account. The device is enrolled in Intune and shows as compliant. The Outlook app is installed but cannot connect. What should you check first?

Accepted Answer

Email profile configuration in Intune. For Android Enterprise work profile devices, email access to Exchange Online via Outlook depends on an Intune email profile configuration (or app configuration policy) that supplies the correct server, account, and authentication settings. Since the device is already compliant and enrolled, the most likely gap is that the email profile was never assigned or is misconfigured. Checking the email profile configuration first isolates whether the mailbox settings are being delivered to the device.

Answer

App protection policy settings

Answer

Device compliance policy settings

Answer

Intune license assignment

Question 4

Which THREE conditions must be met for a Windows device to be able to enroll in Microsoft Intune using Microsoft Entra ID join? (Choose three.)

Accepted Answer

The device must be running Windows 10 or later. Option A is correct because Intune's Microsoft Entra ID join enrollment requires the device to run Windows 10 or later (Windows 10/11 Pro, Enterprise, or Education), as older Windows versions cannot perform the Entra join and MDM auto-enrollment flow. Option B is correct because the device must reach Microsoft Entra ID and Intune endpoints over the internet (HTTPS/443) to perform the join, obtain the PRT, and complete MDM enrollment; without connectivity the process cannot complete. Option C is correct because the enrolling user must have an Intune license (e.g., via Microsoft 365 E3/E5 or an Intune standalone subscription) assigned so that the automatic MDM enrollment is authorized and the device receives policy. Option D is not required: TPM 2.0 is a prerequisite for features like Windows Hello for Business or BitLocker with certain settings, but not for Entra ID join enrollment itself. Option E is not required: an on-premises Active Directory domain join is a separate identity model (hybrid Entra join), whereas this scenario is a pure Microsoft Entra ID join.

Answer

The device must have a TPM 2.0 chip

Answer

The device must be joined to an on-premises Active Directory domain

Question 5

Which TWO of the following are valid remote assistance tools for Windows devices managed by Microsoft Intune? (Choose two.)

Accepted Answer

Quick Assist. Quick Assist (C) is a valid remote assistance tool for Intune-managed Windows devices because it is built into Windows 10/11 and can be launched by the end user to share their screen with a helper, and Intune can deploy it as a Store app or make it available via the Company Portal. TeamViewer (E) is also valid because Microsoft Intune offers a first-party TeamViewer integration that lets IT admins initiate remote assistance sessions directly from the Intune admin center for enrolled Windows devices. WinRM (A) is a management protocol for running commands and scripts (e.g., PowerShell remoting over HTTP/5985 or HTTPS/5986), not an interactive remote assistance tool. Remote Desktop (B) provides full remote control of a device but is a remote desktop/remote session technology rather than the remote assistance capability referenced for Intune-managed endpoints in this context. Skype (D) is a communication application and is not a supported Intune remote assistance tool.

Answer

Windows Remote Management (WinRM)

Answer

Remote Desktop

Answer

Skype

Question 6

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

Accepted Answer

Screen timeout exceeds the policy setting. The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Answer

Device threat protection level is not set to high

Answer

Storage encryption is not enabled

Answer

OS version is above the maximum allowed

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

Accepted Answer

Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.. The Start layout for Windows 10 devices managed by Intune is configured under Device restrictions, not Administrative Templates. The 'Start layout' setting in Device restrictions allows you to upload an XML file that defines the Start menu layout, which can be applied to restore the missing layout after a software update.

Answer

Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

Answer

Create a configuration profile for Windows 11 using 'Start layout' setting.

Answer

Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

Question 8

Your company has iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot remove the Microsoft Intune Company Portal app from their devices. What should you configure?

Accepted Answer

Configure a Required app assignment with removal prevention.. Configuring a Required app assignment with removal prevention in Microsoft Intune ensures that the Company Portal app is installed as a required app and users cannot uninstall it. This setting is specifically designed to prevent removal of managed apps on iOS/iPadOS devices enrolled in Intune, leveraging the MDM channel to enforce the policy.

Answer

Configure an App Configuration policy for Company Portal.

Answer

Configure an App Protection policy for Company Portal.

Answer

Configure a Device Compliance policy to require Company Portal installation.

Question 9

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs in the user context to configure user settings. What type of script should you use?

Accepted Answer

A PowerShell script deployed via Intune Management Extension.. The Intune Management Extension (IME) is the component that handles PowerShell script execution on Windows 10 devices managed by Intune. When you deploy a PowerShell script via Intune, it is automatically executed by the IME, and you can choose to run it in the user context (as the logged-on user) or the system context. This is the correct mechanism for deploying a user-context PowerShell script to configure user settings.

Answer

A platform script for Windows.

Answer

A discovery script.

Answer

A remediation script.

Question 10

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

Accepted Answer

The administrative template does not configure the update channel; you must use the Office Deployment Tool.. When you configure the update channel for Microsoft 365 Apps via an Intune administrative template (ADMX), the setting is applied as a Group Policy preference but does not actually trigger the update mechanism. Microsoft 365 Apps updates require the Office Deployment Tool (ODT) or the Office CDN to deliver the correct channel bits. The administrative template only sets the registry key for the channel; without the ODT or a corresponding update policy, devices remain on their current channel and do not receive new updates.

Answer

Devices are not configured for Windows Update for Business.

Answer

Devices need to be in the Semi-Annual Channel (Targeted) to receive updates.

Answer

The Semi-Annual Enterprise Channel is not supported for Microsoft 365 Apps.

Question 11

Which TWO settings can you configure in a Microsoft Intune device compliance policy for Android Enterprise devices?

Accepted Answer

Require a password to unlock the device. Option B is correct because Intune compliance policies for Android Enterprise include a Device Health/system security setting that requires a password to unlock mobile devices, letting you enforce password presence and strength. Option C is correct because compliance policies expose a Device Properties rule for Minimum OS version, allowing you to require a minimum Android version (for example, Android 10 or later) for the device to be marked compliant. Option A is not a standalone compliance setting for Android Enterprise; encryption is enforced by the platform and reported via device health rather than configured as a discrete compliance rule. Option D is wrong because disabling the camera is a device configuration (restriction) setting, not a compliance policy setting. Option E is wrong because compliance policies enforce a minimum OS version, not a maximum OS version.

Answer

Encryption

Answer

Disable camera

Answer

Maximum OS version

Question 12

Which TWO methods can you use to enroll macOS devices in Microsoft Intune?

Accepted Answer

User-initiated enrollment via Company Portal. Option C (User-initiated enrollment via Company Portal) is correct because macOS users can manually enroll their own devices by signing in to the Intune Company Portal app or web portal, which triggers the MDM enrollment profile installation. Option E (Automated Device Enrollment, ADE) is correct because ADE, formerly known as the Device Enrollment Program (DEP), lets organizations automatically enroll corporate-owned macOS devices purchased through Apple or an authorized reseller, with zero-touch setup during the Out-of-Box Experience. Option A (Google Zero Touch Enrollment) is incorrect because it is an Android-specific zero-touch enrollment mechanism and has no support for macOS. Option B (Windows Autopilot) is incorrect because it is a Windows-only provisioning technology for enrolling Windows devices. Option D (Apple Configurator) is incorrect because, while it can prepare and supervise iOS/iPadOS devices and install profiles, it is not one of the two Intune-supported macOS enrollment methods in this question (macOS enrollment is done via Company Portal or ADE).

Answer

Google Zero Touch Enrollment

Answer

Windows Autopilot

Answer

Apple Configurator

Question 13

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

Accepted Answer

uninstallPrevious: true. The `uninstallPrevious` setting in the Microsoft Edge Intune deployment profile forces the removal of any existing version of Edge (e.g., Beta, Dev, or older Stable) before the new version is installed. This ensures a clean installation and prevents conflicts, which is critical when deploying Edge as a required app via Intune for Windows devices.

Answer

appVersion: 96.0.1054.62

Answer

channel: Stable

Answer

intent: required

Question 14

Your company uses Microsoft Intune to manage Windows 10 devices. You need to ensure that all devices have Windows Defender Antivirus real-time protection enabled. What should you configure?

Accepted Answer

Create a device configuration policy for Windows Defender Antivirus and enable Real-time protection.. A device configuration policy is the most direct method to enforce Windows Defender Antivirus real-time protection, using the Defender CSP to set 'AllowRealtimeMonitoring'. While the Endpoint security node provides a dedicated Antivirus policy, device configuration policies are the straightforward administrative path for granular settings like real-time protection. A compliance policy only checks for antivirus but does not enforce the setting. Administrative Templates can also configure this via GPO-style settings, but they are less direct for this specific requirement in Intune. Therefore, Option B is the best single answer.

Answer

Create a device compliance policy requiring antivirus.

Answer

Use Administrative Templates to configure Windows Defender Antivirus.

Answer

Use the Endpoint security node to configure Antivirus policies.

Question 15

Which THREE features are available in Microsoft Intune's Windows Autopilot for existing devices?

Accepted Answer

Collect hardware hash from the existing device.. Windows Autopilot for existing devices requires capturing the device's hardware hash so it can be registered as an Autopilot device, which is exactly what option A describes. Option B is correct because the standard workflow uses a provisioning package (created with Windows Configuration Designer) delivered via USB drive to run the Autopilot configuration on the existing PC. Option C is correct because the process resets the device (via the provisioning package triggering a wipe/redeploy) and re-enrolls it through Autopilot into Intune. Option D is not a supported feature: hardware hash collection and Autopilot registration are not fully automatic without user or admin action (the hash must be captured and uploaded, e.g., via the provisioning package or manual collection). Option E is incorrect because Autopilot, including Autopilot for existing devices, applies to Windows devices, not macOS.

Answer

Automatically convert the device to an Autopilot device without user interaction.

Answer

Apply Autopilot profiles to macOS devices.