MD-102 Manage and maintain devices Practice Test 7 — 15 Questions

Question 1

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

Accepted Answer

Assign a Windows 10/11 feature update policy.. A Windows 10/11 feature update policy in Microsoft Intune is specifically designed to manage the upgrade of Windows 10 devices to Windows 11. This policy uses Windows Update for Business to deliver the feature update (e.g., Windows 11 23H2) and automatically applies it to devices that meet the hardware requirements, ensuring a controlled upgrade process.

Answer

Assign a driver update policy.

Answer

Assign a quality update policy.

Answer

Assign an update ring for Windows 10.

Question 2

Refer to the exhibit. You create a custom configuration profile in Intune for Windows 10 devices. The profile is assigned to a test device, but the telemetry setting is not applied. The device is managed and compliant. What is the most likely reason?

Accepted Answer

The AllowTelemetry policy value must be an integer, not a string, or the device needs a Windows 10 version that supports this setting.. The AllowTelemetry setting in a custom OMA-URI profile requires the value to be an integer (0–3) and the device must be running Windows 10 version 1703 or later. If the value is entered as a string (e.g., "2" instead of 2), Intune will not apply the policy, and the device will silently ignore the configuration. Additionally, older Windows 10 builds do not support this OMA-URI path and will fail to process it.

Answer

The device is not compliant with the baseline policy.

Answer

The OMA-URI path for AllowTelemetry is incorrect.

Answer

The custom profile conflicts with a built-in policy that sets telemetry to full.

Question 3

You need to remotely wipe a lost corporate-owned iOS device enrolled in Microsoft Intune. The device is currently offline. What will happen when the device comes online?

Accepted Answer

The device will receive the wipe command the next time it checks in with Intune.. When a remote wipe command is issued for an offline iOS device enrolled in Microsoft Intune, the command is stored in the Microsoft Intune service. The device will receive and execute the wipe command the next time it checks in with the Intune service, regardless of whether it is supervised or not. This check-in occurs periodically (typically every 8 hours) or when the device is powered on and connected to the internet.

Answer

The device must be unenrolled first and then wiped.

Answer

The device will be wiped immediately after a grace period of 24 hours.

Answer

The wipe command will be queued only if the device is supervised.

Question 4

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting even though the policy is assigned. What should you check first?

Accepted Answer

Confirm that the device has a compatible TPM chip and that it is enabled.. BitLocker requires a compatible TPM (Trusted Platform Module) chip, version 1.2 or 2.0, that is enabled and activated in the BIOS/UEFI. If the TPM is missing, disabled, or not initialized, the BitLocker policy will apply but encryption will fail silently or remain pending. This is the most common root cause for devices not encrypting despite policy assignment.

Answer

Verify that Secure Boot is disabled in BIOS.

Answer

Ensure devices are marked as compliant in Intune.

Answer

Check if the BitLocker policy is using the Settings catalog.

Question 5

Users report that after updating to Windows 11, their devices are no longer receiving policy updates from Intune. The devices appear as active and compliant in the Intune console. What is the most likely cause?

Accepted Answer

The Intune management extension is outdated and needs to be updated.. The Intune management extension is responsible for deploying PowerShell scripts, Win32 apps, and custom compliance policies. After a Windows 11 upgrade, the extension may become outdated or fail to re-register, causing a break in the policy retrieval loop even though the device appears active and compliant. This is a known behavior where the extension’s version mismatch prevents it from processing new policy assignments.

Answer

The devices lost compliance after the upgrade.

Answer

The MDM authority changed to Configuration Manager.

Answer

Windows 11 is not supported by Microsoft Intune.

Question 6

You need to block users from enrolling personal Android devices in Microsoft Intune. Which enrollment restriction should you configure?

Accepted Answer

Set the 'Block personally owned devices' restriction for Android.. The 'Block personally owned devices' restriction in Intune prevents users from enrolling personal (BYOD) Android devices. Option B is incorrect because the 'Block Android' platform restriction blocks all Android devices regardless of ownership, not just personal ones. Option C is incorrect because 'Block Android Enterprise' restricts Android Enterprise enrollment, not personally owned devices. Option D is incorrect because device compliance policies evaluate devices after enrollment, they do not block enrollment itself.

Answer

Set the 'Block Android' platform restriction.

Answer

Set the 'Block Android Enterprise' device type restriction.

Answer

Configure a device compliance policy to mark personal devices as non-compliant.

Question 7

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

Accepted Answer

passwordMinimumLength. The compliance policy requires a minimum password length, and the device's 6-character password does not meet that requirement, making it non-compliant. The passwordMinimumLength setting directly controls the minimum number of characters a password must have, so a password shorter than the configured value triggers non-compliance.

Answer

requireCodeIntegrity

Answer

requireDeviceEncryption

Answer

requireSecureBoot

Question 8

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices. Which TWO conditions must be met?

Accepted Answer

The iOS devices must have the distribution profile installed.. IOS devices require a distribution profile (provisioning profile) to trust and install line-of-business (LOB) apps that are not distributed through the Apple App Store. The distribution profile contains the app ID, device IDs (if not using user enrollment), and the enterprise certificate, enabling the device to validate and run the app. Without this profile, the app will fail to install or launch due to code signing validation failures enforced by iOS.

Answer

The app must be packaged as an .appx file.

Answer

The app must be assigned to devices only, not users.

Answer

The app must be distributed via the Apple App Store.

Question 9

You need to configure a Microsoft Intune policy to ensure that only devices with a minimum OS version can access corporate email. Which THREE policy types can enforce this requirement?

Accepted Answer

Device compliance policy. Device compliance policy (A) is correct because it allows you to define rules such as a minimum OS version requirement. When a device is marked as non-compliant due to an outdated OS, you can combine this with a Conditional Access policy to block access to corporate email. This is the primary mechanism for OS version enforcement on managed devices.

Answer

Enrollment restrictions

Answer

Device configuration profile

Question 10

You need to deploy a Windows 10 feature update to a pilot group. Which TWO steps are required in Microsoft Intune?

Accepted Answer

Create a feature update policy for Windows 10.. A is correct because a feature update policy in Microsoft Intune is the specific policy type designed to control which Windows 10 feature update version (e.g., 22H2) is offered to devices. This policy allows you to defer or approve updates for pilot groups, ensuring controlled rollout before broad deployment.

Answer

Create a driver update policy for Windows 10.

Answer

Create an update ring for Windows 10.

Answer

Create a compliance policy for Windows 10.

Question 11

Refer to the exhibit. You run this Microsoft Graph PowerShell command to retrieve managed devices. The output shows a device with a lastSyncDateTime of 5 days ago. What does this indicate?

Accepted Answer

The device has not communicated with Intune for 5 days.. The `lastSyncDateTime` property in Microsoft Graph for Intune-managed devices indicates the most recent time the device successfully checked in with the Intune service. A value of 5 days ago means the device has not communicated with Intune for 5 days, which could be due to network issues, device inactivity, or configuration problems. This does not inherently mean the device is non-compliant or unenrolled—it simply reflects the last successful sync.

Answer

The device was enrolled 5 days ago.

Answer

The device is non-compliant.

Answer

The device is unenrolled.

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned Windows 10 devices are allowed to access Microsoft 365 services. You have configured a conditional access policy to require compliant devices. What else must you do to identify corporate-owned devices?

Accepted Answer

Add corporate device identifiers (e.g., serial numbers) in Intune.. Corporate device identifiers, such as serial numbers or IMEI numbers, are the specific mechanism in Microsoft Intune used to mark a device as corporate-owned. While a conditional access policy requiring compliant devices ensures only compliant devices can access Microsoft 365, it does not distinguish between corporate and personal devices. By uploading corporate identifiers, Intune automatically sets the ownership type to 'Corporate' upon enrollment, which can then be used in conditional access policies to restrict access to only those devices.

Answer

Configure a device compliance policy to require corporate ownership.

Answer

Set enrollment restrictions to block personally owned devices.

Answer

Deploy an app protection policy to block personal devices.

Question 13

You need to retire a device in Microsoft Intune. What is the effect of retiring a device?

Accepted Answer

The device is unenrolled, and corporate data and apps are removed. Personal data is preserved.. Retiring a device in Microsoft Intune performs a selective wipe that removes only corporate-managed data and apps while preserving the user's personal data. The device is also unenrolled from Intune management, meaning it no longer receives policy or compliance enforcement. This is distinct from a full wipe, which resets the entire device to factory settings.

Answer

The device is factory reset to its original settings.

Answer

The device remains enrolled but can no longer access corporate resources.

Answer

The device is deleted from Azure AD and Intune.

Question 14

A company manages Windows 10 and Windows 11 devices using Microsoft Intune. They need to ensure that devices that have not checked in with Intune for more than 30 days are automatically marked as inactive and excluded from compliance policies. Which configuration should be used?

Accepted Answer

Configure the Intune device cleanup rule to delete devices inactive for 30 days. The Intune device cleanup rule is specifically designed to automatically remove or mark devices as inactive when they have not checked in for a configurable number of days (default 30). Once a device is deleted by this rule, it is excluded from compliance policies and no longer evaluated. This directly meets the requirement to mark devices inactive after 30 days of no check-in and exclude them from compliance.

Answer

Configure a compliance policy with a grace period of 30 days

Answer

Create a conditional access policy blocking devices inactive for 30 days

Answer

Set the device compliance status to 'not compliant' after 30 days of inactivity

Question 15

An organization uses Microsoft Intune to manage Windows devices. They want to deploy a Win32 app that requires admin rights to install. The app must be installed in the system context and should not require user interaction. Which installation behavior should be configured?

Accepted Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: No specific action, Installation visibility: Hidden. Deploying a Win32 app that requires admin rights and must run without user interaction in the system context requires setting the install behavior to 'System' and the installation purpose to 'Required'. The 'Hidden' installation visibility ensures the installation runs silently in the background, with no user prompts or interaction, which is essential for a non-interactive system-context deployment.

Answer

Install behavior: User, Installation purpose: Required, Device restart behavior: No specific action

Answer

Install behavior: User, Installation purpose: Available

Answer

Install behavior: System, Installation purpose: Required, Device restart behavior: Immediately