MD-102 Manage and maintain devices Practice Test 8 — 15 Questions

Question 1

Which TWO settings can be configured in a Microsoft Intune device compliance policy for iOS/iPadOS?

Accepted Answer

Require a password. Option C is correct because an Intune iOS/iPadOS compliance policy includes a System Security section where you configure a password requirement, such as requiring a password to unlock the device, along with password length, complexity, and expiration rules. Option D is correct because the Device Health section of an iOS/iPadOS compliance policy lets you set a Minimum OS version (for example, 16.0) to flag devices running older, unsupported iOS/iPadOS builds as noncompliant. Option A is not a compliance policy setting; restricting app installation to the App Store only is handled through app protection policies, device restriction configuration profiles, or App Store app type settings, not compliance rules. Option B is not available for iOS/iPadOS compliance policies because blocking USB devices is a hardware/device restriction capability (and is not a compliance setting for Apple platforms). Option E is not a configurable compliance setting for iOS/iPadOS; jailbroken/rooted device detection is enforced automatically by Intune as a built-in compliance check rather than a setting you configure.

Answer

Allow app installation from App Store only

Answer

Block USB devices

Answer

Jailbroken devices

Question 2

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. The user has confirmed that the device is enrolled and connected to the internet. Which is the most likely cause?

Accepted Answer

The Intune Management Extension is not installed or not running.. The Intune Management Extension (IME) is the component responsible for processing and applying compliance policies on Windows devices. If the IME is not installed or not running, the device cannot evaluate compliance policies, resulting in a 'Not evaluated' status in the Intune admin center, even though the device is enrolled and connected to the internet.

Answer

The device is not enrolled in Microsoft Intune.

Answer

The device has a Device Lock policy applied that blocks evaluation.

Answer

The user does not have a Microsoft 365 E3 license assigned.

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs during the device provisioning process, before the user signs in. The script should be assigned to a device group containing all Autopilot devices. Which method should you use?

Accepted Answer

Use a device context PowerShell script in Intune and assign it to the device group.. A device context PowerShell script in Intune runs in the system context before the user signs in, making it ideal for provisioning tasks on Autopilot devices. Assigning it to a device group ensures the script executes on the target devices regardless of which user signs in, aligning with the requirement for pre-user-sign-in execution.

Answer

Add the script as a Windows 10 platform script in Intune.

Answer

Assign the script to a user group containing the users.

Answer

Deploy the script as a device configuration profile.

Question 4

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage endpoint security. You need to ensure that all Windows 10 devices are onboarded to Defender for Endpoint via Microsoft Intune. Which policy type should you use?

Accepted Answer

Endpoint detection and response policy. To onboard Windows 10 devices to Microsoft Defender for Endpoint via Intune, you must use an Endpoint detection and response (EDR) policy. This policy type deploys the required onboarding configuration package (a .cmd script or .xml file) that registers the device with the Defender for Endpoint service, enabling sensor data collection and threat detection. Antivirus, Firewall, and Windows Security experience policies manage separate security features but do not handle the initial onboarding process.

Answer

Antivirus policy

Answer

Firewall policy

Answer

Windows Security experience policy

Question 5

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. The app requires installation in the system context. Which deployment method should you use?

Accepted Answer

Win32 app. Win32 apps in Microsoft Intune support installation in the system context via the 'Install behavior' setting, and they can be deployed using a custom installation script that handles certificate trust issues (e.g., by installing the signing certificate first or using a silent install switch). This method also allows the app to run with elevated privileges, which is required for system-context installation, and does not depend on the device trusting the app's signing certificate at deployment time.

Answer

Microsoft Store for Business app

Answer

Microsoft Intune LOB app (msi/appx)

Answer

Web link

Question 6

A user's mobile device is lost. You need to remotely wipe the device using Microsoft Intune. What is the correct sequence of actions?

Accepted Answer

In the Microsoft Intune admin center, select the device and choose Retire/Wipe.. The Retire/Wipe action in the Microsoft Intune admin center is the direct, administrator-initiated method to remotely wipe a lost device. This action sends a wipe command to the device via the Intune service, which the device's management agent (Company Portal or MDM agent) processes to perform a factory reset, removing all corporate and personal data.

Answer

Ask the user to reset the device from the Company Portal app.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Remote wipe'.

Answer

Remove the device from Microsoft Entra ID and it will automatically wipe.

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a minimum OS version can access corporate email via Microsoft Outlook for iOS. Which policy type should you configure?

Accepted Answer

App protection policy (MAM). App Protection Policies (MAM) allow you to target specific apps like Microsoft Outlook for iOS with conditional launch settings, including minimum OS version requirements. This policy applies at the app layer without requiring device enrollment, making it ideal for controlling access to corporate data in Outlook on iOS devices based on OS version.

Answer

Device configuration policy

Answer

Conditional Access policy

Answer

Device compliance policy

Question 8

You are troubleshooting a Windows 10 device that is not receiving Intune policies. The device is enrolled and shows as 'Active' in the Intune admin center. You run the Get-MgDeviceManagementManagedDevice cmdlet and the device's managementAgent is 'mdm'. Which of the following is the most likely cause of the issue?

Accepted Answer

The device's last sync time is more than 24 hours ago.. The device's last sync time being more than 24 hours ago indicates that the device has not checked in with Intune within the required interval. Intune policies are delivered during a sync cycle, and if the device hasn't synced recently, it will not receive new or updated policies. The managementAgent being 'mdm' confirms the device is MDM-managed, so the sync interval is critical for policy delivery.

Answer

The device is co-managed and the workload is set to Configuration Manager.

Answer

The device's enrollment certificate has expired.

Answer

The device is retired from Intune.

Question 9

Which TWO actions can you perform using Microsoft Intune to manage devices that are not compliant? (Choose two.)

Accepted Answer

Send a push notification to the user.. Option D is correct because Intune compliance policies support actions that send a push notification to the user (and optionally to additional recipients) when a device is marked noncompliant, alerting them to remediate the issue. Option E is correct because when a device fails a compliance policy, Intune automatically marks the device as noncompliant in the Intune admin center, which is the foundational state that drives all other compliance actions. Option A is not a built-in Intune compliance action; while you can configure email notifications to recipients including managers via notification templates, the standard compliance action is to email the user, not specifically the manager as an automated action. Option B is incorrect because remote wipe is a device action available for lost/stolen or retired devices, not a standard noncompliance remediation action. Option C is incorrect because blocking access to corporate resources is achieved through Conditional Access policies in Entra ID, not as a direct Intune compliance action.

Answer

Automatically send an email to the user's manager.

Answer

Remotely wipe the device.

Answer

Block access to corporate resources.

Question 10

Which TWO of the following are device configuration settings you can manage with Microsoft Intune? (Choose two.)

Accepted Answer

Device restrictions (e.g., camera, Bluetooth). Device restrictions (B) are a core Intune device configuration profile type that lets administrators control hardware and feature availability on enrolled devices, such as disabling the camera, Bluetooth, or screen capture, which is exactly what this option describes. Lock screen settings (D) are also managed through Intune device configuration profiles, where you can enforce things like custom lock screen images, timeout values, and password/PIN requirements on Windows, Android, and iOS/iPadOS devices. The other options belong to different Intune workload areas rather than device configuration: application settings for Microsoft 365 Apps (A) are handled through app configuration policies or the Microsoft 365 Apps app suite settings, Wi-Fi profiles (C) are delivered via Intune network/Wi-Fi profiles (a separate profile category from device configuration), and email profiles for Exchange Online (E) are deployed through Intune email profiles, not device configuration settings.

Answer

Application settings for Microsoft 365 Apps

Answer

Wi-Fi profiles

Answer

Email profiles for Exchange Online

Question 11

Refer to the exhibit. You are reviewing a JSON policy for Windows 10 compliance. Which of the following is required by this policy?

Accepted Answer

A TPM chip present and enabled. The JSON policy includes the setting 'requireTPM' with a value of 'true', which mandates that a Trusted Platform Module (TPM) chip must be present and enabled on the device to be compliant. TPM provides hardware-level security for cryptographic operations and is a key requirement for features like BitLocker, but the policy itself specifically enforces TPM presence, not encryption status.

Answer

Secure Boot disabled

Answer

BitLocker drive encryption enabled

Answer

A password of at least 8 characters

Question 12

Refer to the exhibit. You run a PowerShell cmdlet to get managed devices and see the output above. The device is noncompliant. What is the most likely reason?

Accepted Answer

The device has not synced recently.. The device is noncompliant because it has not synced recently. In Microsoft Intune, devices must regularly check in to report their compliance status; if a device fails to sync within the configured grace period (typically 30 days by default), it is marked as noncompliant. The PowerShell output shows the device is enrolled and managed, but the last sync time is missing or outdated, triggering the noncompliant state.

Answer

The device is not enrolled.

Answer

The device name is too long.

Answer

The OS version is not supported.

Question 13

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

Accepted Answer

Assign the device to a different update ring with a 0-day deferral.. The device is assigned to an update ring that defers updates by 30 days, which is why it is not receiving the latest security updates despite being compliant. To immediately receive the latest updates, you must assign the device to a different update ring with a 0-day deferral, as update rings in Microsoft Intune control the deferral period for Windows Update for Business. Changing the ring triggers the device to check for updates based on the new policy, ensuring immediate availability of security updates.

Answer

Change the compliance policy to require immediate updates.

Answer

Run Windows Update manually on the device.

Answer

Re-enroll the device in Intune.

Question 14

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy a custom configuration profile to configure Wi-Fi settings for corporate devices. Which method should you use?

Accepted Answer

Use a custom configuration profile in Intune.. Intune's custom configuration profile allows you to deploy Apple Configurator–generated .mobileconfig files or custom XML/PLIST settings that are not available in the built-in Wi-Fi policy. This is the only method in Intune that supports arbitrary key-value pairs for iOS Wi-Fi configurations, such as EAP-TLS with specific certificate requirements or advanced proxy settings.

Answer

Use a Microsoft Entra ID (Azure AD) device configuration policy.

Answer

Use a PowerShell script to apply the settings.

Answer

Use a Microsoft Defender for Endpoint security policy.

Question 15

You need to ensure that Windows 10 devices automatically receive Microsoft 365 Apps updates from the Internet when not connected to the corporate network. Which update channel should you configure?

Accepted Answer

Current Channel. The Current Channel is the correct choice because it provides the most frequent updates for Microsoft 365 Apps, and it is the only channel that supports automatic updates from the Internet (via the Office Content Delivery Network) when devices are not connected to the corporate network. This channel is designed for devices that need the latest features and security updates without relying on on-premises update infrastructure.

Answer

Monthly Enterprise Channel

Answer

Office Insider

Answer

Semi-Annual Channel