MD-102 Manage and maintain devices Practice Test 8 — 15 Questions

Question 1

A company uses Microsoft Intune to manage iOS/iPadOS devices. They need to enforce a policy that requires users to set a device passcode of at least 6 characters. Which type of policy should they create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune evaluates whether iOS/iPadOS devices meet specific security requirements, such as a minimum passcode length of 6 characters. When a device is noncompliant, Intune can trigger actions like blocking access to corporate resources or sending a notification to the user. This is the correct policy type because passcode enforcement for device-level security is a compliance condition, not a configuration or app-level setting.

Answer

Device configuration profile

Answer

Conditional access policy

Answer

App protection policy

Question 2

A company uses Microsoft Intune for mobile device management. They have a group of Android Enterprise devices that need to be enrolled in a way that allows the device to have a work profile while keeping personal apps separate. Which enrollment method should be used?

Accepted Answer

Android Enterprise personally-owned devices with a work profile. Android Enterprise personally-owned devices with a work profile (BYOD) is designed specifically to create a separate, managed work profile on the device while leaving personal apps and data untouched. This enrollment method uses the Android Device Policy app to establish a containerized work profile, ensuring that corporate policies apply only to the work side, and the user retains full control over the personal side. It is the standard approach for BYOD scenarios where the device is owned by the user but needs to access corporate resources securely.

Answer

Android Enterprise corporate-owned fully managed devices

Answer

Android Enterprise corporate-owned dedicated devices

Answer

Android Enterprise corporate-owned work profile

Question 3

An organization uses Microsoft Intune to manage Windows devices. They want to ensure that only devices with a TPM 2.0 chip can access corporate email. Which policy should be configured?

Accepted Answer

Device compliance policy with a condition for TPM 2.0, combined with a conditional access policy. A device compliance policy can evaluate whether a device has TPM 2.0 (via the TPM specification version check), and when combined with a Conditional Access policy, it can block access to corporate email for non-compliant devices. This is the standard Microsoft approach for enforcing hardware-based security requirements for cloud app access.

Answer

Device enrollment restriction to require TPM 2.0

Answer

Device configuration profile to enable TPM 2.0

Answer

App protection policy to require TPM 2.0

Question 4

A company uses Microsoft Intune to manage macOS devices. They need to deploy a custom plist configuration file to set security settings. Which policy type should they use?

Accepted Answer

Device configuration profile (custom). A custom device configuration profile in Microsoft Intune allows administrators to deploy plist files to macOS devices, enabling the configuration of settings not covered by built-in templates. This is the correct policy type for deploying a custom plist file because it directly supports uploading and assigning property list files to enforce specific security configurations.

Answer

App protection policy

Answer

Device compliance policy

Answer

Device cleanup rule

Question 5

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

Accepted Answer

Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker. Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Answer

Device configuration profile to enable BitLocker

Answer

Device compliance policy with a noncompliance action to mark device as non-compliant

Answer

PowerShell script deployment with assignment to all devices

Question 6

A company uses Microsoft Intune to manage devices. They need to report on which devices have a specific Windows update installed. Which reporting method should be used?

Accepted Answer

Use the Microsoft Intune admin center to view the Windows Update for Business report. The Windows Update for Business report in the Microsoft Intune admin center provides a dedicated view of update compliance, including which devices have installed specific Windows updates. This report aggregates data from the Windows Update service and displays it per device, making it the correct method for identifying devices with a particular update installed.

Answer

Use Microsoft 365 Lighthouse

Answer

Use the Device compliance report in Intune

Answer

Use Microsoft Defender for Endpoint's advanced hunting

Question 7

A company manages devices with Microsoft Intune. They need to deploy a line-of-business (LOB) app to iOS devices. Which TWO of the following are required?

Accepted Answer

The app package must be in .ipa format. IOS line-of-business (LOB) apps must be packaged in the .ipa format, which is the standard iOS app package that Intune can deploy directly to devices. Intune uses the .ipa file to install the app on supervised or unsupervised iOS devices via the MDM channel, and the app must be signed with an Apple Developer Enterprise certificate or a distribution certificate.

Answer

The deployment must use 'Required' installation purpose

Answer

The app must be assigned to a user group only

Answer

Apple MDM push certificate must be configured

Question 8

An organization uses Microsoft Intune to manage Windows devices. They need to configure a policy to enforce disk encryption on devices. Which TWO of the following are valid encryption options?

Accepted Answer

BitLocker. BitLocker is a full-disk encryption feature built into Windows Pro and Enterprise editions, and it can be managed via Microsoft Intune using the 'Endpoint Protection' profile under the 'Windows Encryption' category. Device encryption is available on Windows devices that support InstantGo (modern standby) and is enabled by default on many devices. In contrast, FileVault is a macOS-specific encryption feature and is not applicable to Windows devices. Encrypting File System (EFS) provides file-level encryption, not full-disk encryption. APFS encryption is also macOS-specific. Therefore, only BitLocker (A) and Device encryption (C) are valid encryption options for Windows devices managed by Intune.

Answer

Encrypting File System (EFS)

Answer

FileVault

Answer

APFS encryption

Question 9

A company uses Microsoft Intune to manage devices. They want to use a script to collect inventory data from Windows devices. Which TWO methods can be used?

Accepted Answer

Proactive remediations. Proactive remediations (B) are correct because they allow you to run PowerShell scripts on a schedule to detect and remediate issues, and the detection script can output custom inventory data that is collected and reported in Intune. Custom compliance policies (C) are correct because they can execute a PowerShell script to evaluate compliance settings, and the script's output (e.g., registry values, file versions) can be used to gather inventory data as part of the compliance check.

Answer

Device configuration profile

Answer

PowerShell script deployment

Answer

App protection policy

Question 10

Refer to the exhibit. The JSON snippet shows a dynamic device group configuration in Microsoft Intune. What is the effect of the 'enrollmentTimeDeviceMembershipLimit' property set to 15?

Accepted Answer

Devices added to the group will be removed after 15 days from enrollment. The 'enrollmentTimeDeviceMembershipLimit' property in a dynamic device group rule sets a time window (in days) from enrollment during which a device remains a member of the group. When set to 15, devices are automatically removed from the group 15 days after their enrollment date, regardless of their compliance or management status. This is used for scenarios like temporary access or pilot groups where membership should expire after a fixed period.

Answer

The group will only contain devices that have been enrolled for at least 15 days

Answer

Only devices enrolled in the last 15 days are eligible

Answer

Limits the number of devices in the group to 15

Question 11

Refer to the exhibit. A Microsoft Graph PowerShell cmdlet retrieves devices. What is the purpose of this query?

Accepted Answer

To find Windows devices that have not synced since before January 1, 2025. The query uses Get-MgDevice with a filter on approximateLastSignInDateTime being less than 2025-01-01T00:00:00Z. This filter retrieves devices whose last approximate sign-in occurred before January 1, 2025, indicating they have not synced since that date. The -and operator with deviceId -ne $null ensures only actual devices (not null device IDs) are returned. Option D correctly identifies this as finding devices that have not synced since before January 1, 2025.

Answer

To find Windows devices that are compliant

Answer

To find Windows devices with an operating system version earlier than 2025

Answer

To find Windows devices enrolled before January 1, 2025

Question 12

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

Accepted Answer

Windows 10 2004. The exhibit shows a compliance policy with a minimum OS version requirement set to '2004'. In Microsoft Intune, when you specify a minimum OS version for Windows 10 compliance, you must use the four-digit version number (e.g., 2004) rather than the marketing name (e.g., 20H2). Therefore, the minimum OS version required is Windows 10 2004.

Answer

Windows 10 20H2

Answer

Windows 10 1903

Answer

Windows 10 21H2

Question 13

A company uses Microsoft Intune to manage iOS/iPadOS devices. They need to enforce a policy that requires users to set a device passcode of at least 6 characters. Which type of policy should they create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The recovery key is not escrowed to Intune.. The most likely cause is that the recovery key is not escrowed to Intune. Even though FileVault is enabled on the device, Intune's compliance policy checks for the presence of the FileVault recovery key in its escrow database. If the key is missing, the device is marked non-compliant because Intune cannot verify full management and recovery capability, which is a key security requirement.

Answer

FileVault is not actually enabled on those devices.

Answer

The devices are not supervised.

Answer

The compliance policy is not assigned to those devices.

Question 14

You need to deploy a line-of-business (LOB) iOS app to company-owned devices using Microsoft Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

iOS/iPadOS LOB app.. An iOS/iPadOS LOB app deployment in Intune is specifically designed for line-of-business apps that are signed with an enterprise certificate and distributed internally. This method allows you to upload the .ipa file directly to Intune and deploy it to company-owned devices without requiring the Apple App Store or a Volume Purchase Program.

Answer

Managed Browser app.

Answer

iOS/iPadOS store app.

Answer

Volume Purchase Program (VPP) app.

Question 15

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that devices cannot connect to unsecured Wi-Fi networks. Which policy type should you configure?

Accepted Answer

Wi-Fi profile.. A Wi-Fi profile in Microsoft Intune is specifically designed to configure Wi-Fi settings on devices, including security protocols and authentication methods. By configuring a Wi-Fi profile to only allow connections to secured networks (e.g., WPA2-Enterprise or WPA3), you can prevent devices from connecting to unsecured Wi-Fi networks. This policy type directly controls the Wi-Fi connection behavior at the device level.

Answer

Device configuration profile with network settings.

Answer

Compliance policy.

Answer

Certificate profile.