MD-102 Manage and maintain devices Practice Test 9 — 15 Questions

Question 1

A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Intune management extension logs on the device.. The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.

Answer

Verify the device compliance policy.

Answer

Check the Company Portal app version.

Answer

Reassign the app to the user.

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?

Accepted Answer

Require device to be marked as compliant.. Conditional access in Microsoft Entra ID includes the grant control 'Require device to be marked as compliant,' which ensures that only devices meeting compliance policies can access corporate Exchange Online email. Option A is correct because this setting directly enforces compliance. Option B (Require multi-factor authentication) is separate—it adds identity verification but does not check device compliance. Option C (Require app protection policy) applies to mobile app management, not device-level access. Option D (Require device to be enrolled in Intune) ensures enrollment but does not guarantee compliance; a device could be non-compliant even if enrolled. Therefore, only the compliance requirement meets the goal.

Answer

Require multi-factor authentication.

Answer

Require app protection policy.

Answer

Require device to be enrolled in Intune.

Question 3

You are troubleshooting a Windows 10 device that is not receiving policy updates from Intune. The device shows 'Pending' status in the Intune console. The device is connected to the internet. What is the most likely cause?

Accepted Answer

The Intune management extension service is not running.. The Intune management extension service (IntuneManagementExtension.exe) is responsible for processing policy and app deployment actions on Windows 10 devices. If this service is not running, the device will show a 'Pending' status in the Intune console because it cannot acknowledge or apply incoming policies, even though the device is online and enrolled.

Answer

The device is not connected to the network.

Answer

The device has a pending reboot.

Answer

The device enrollment is expired.

Question 4

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

Accepted Answer

Wipe.. The Wipe action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost corporate-owned iOS device to ensure sensitive data is completely erased and the device cannot be accessed. Retire only removes managed apps and policies but leaves personal data intact, which is insufficient for a lost device scenario.

Answer

Retire.

Answer

Delete.

Answer

Reset.

Question 5

Your organization is planning to use Microsoft Intune to manage Windows 11 devices. Which TWO are prerequisites for enrolling a Windows device in Intune?

Accepted Answer

Network connectivity to https://manage.microsoft.com and other Intune endpoints.. Network connectivity to https://manage.microsoft.com and other Intune endpoints is essential for device enrollment. Without this connectivity, the device cannot communicate with the Intune service to complete registration, policy retrieval, or management tasks. This requirement applies to all enrollment methods, including automatic enrollment via Azure AD join and manual enrollment via the Company Portal.

Answer

Local administrator account on the device.

Answer

Microsoft Copilot for Microsoft 365 license.

Answer

Azure AD Premium P2 license.

Question 6

You are configuring app protection policies (MAM) in Microsoft Intune for iOS devices. Which THREE settings can you configure to prevent data leakage?

Accepted Answer

Restrict web content transfer to managed browsers.. Restricting web content transfer to managed browsers ensures that corporate data opened via web links can only be viewed in browsers that support Intune MAM policies (e.g., Microsoft Edge). This prevents data from being opened in unmanaged browsers where app protection policies cannot enforce data leakage controls, such as preventing copy/paste or requiring encryption.

Answer

Require device PIN.

Answer

Block screenshots of corporate data.

Question 7

You need to deploy Microsoft Defender for Endpoint to Windows 10 devices using Microsoft Intune. Which TWO methods can you use to deploy the Microsoft Defender for Endpoint client?

Accepted Answer

As a line-of-business (LOB) app in Intune.. You can deploy the Microsoft Defender for Endpoint client as a line-of-business (LOB) app in Intune by uploading the Windows Defender ATP client installation file (e.g., WindowsDefenderATPOnboardingPackage.zip) and targeting it to Windows 10 devices. Option D is correct because you can use a device configuration profile with the 'Microsoft Defender for Endpoint' Configuration Service Provider (CSP) to configure and deploy the client settings, such as onboarding and policy enforcement, directly via Intune.

Answer

Using Group Policy connected to Intune.

Answer

From the Microsoft Store for Business.

Answer

Via Microsoft Configuration Manager.

Question 8

Refer to the exhibit. The JSON shows a device queried from Microsoft Graph. The device shows as compliant, but the user reports that they are unable to access corporate resources. The conditional access policy requires device compliance. What is a likely reason for the access issue?

Accepted Answer

The device has not synced recently, so the compliance state may be outdated.. The device's compliance state is determined at the time of the last check-in with Microsoft Intune. If the device has not synced recently, the compliance state shown in Microsoft Graph may be stale, and the Conditional Access policy will evaluate the last known state. Even though the device was compliant at last check-in, changes in device health, configuration, or user context since then could cause access to be denied until a fresh compliance evaluation occurs.

Answer

The device compliance state is actually non-compliant.

Answer

The device is managed by MAM instead of MDM.

Answer

The device enrollment date is too recent.

Question 9

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. A device is marked as non-compliant even though it has a password of length 8, firewall enabled, and Defender enabled. What is the most likely cause?

Accepted Answer

The device does not lock after inactivity.. The compliance policy JSON includes a setting for 'requireDeviceLock' or similar inactivity lock enforcement. Even though the device has a password of length 8, firewall enabled, and Defender enabled, if the device does not lock after a period of inactivity, it violates the policy. The policy likely specifies a maximum inactivity timeout (e.g., 5 minutes) and a grace period; failure to meet this requirement results in non-compliance regardless of other settings.

Answer

Microsoft Defender is not running.

Answer

The device firewall is not active.

Answer

The device password is not complex enough.

Question 10

Refer to the exhibit. The ARM template snippet attempts to deploy a Windows 10 Security Baseline policy in Intune. The deployment fails. What is the most likely reason?

Accepted Answer

Intune configuration policies cannot be deployed via ARM templates.. Intune does not support deploying Windows 10 Security Baseline policies via ARM templates because ARM templates are designed for Azure resource management (e.g., Azure VMs, storage accounts) and cannot directly manage Intune workloads. Intune policies, including Security Baselines, must be configured through Microsoft Graph API, PowerShell, or the Intune portal, not through Azure Resource Manager.

Answer

The apiVersion is not supported.

Answer

The templateId is incorrect.

Answer

The setting value is invalid.

Question 11

You manage Windows 10 devices with Microsoft Intune. Users report that after a recent Windows update, some devices fail to enroll in mobile device management (MDM). You verify that the devices are domain-joined and can reach the internet. Which configuration should you check first?

Accepted Answer

Check that the MDM enrollment URL (https://enrollment.manage.microsoft.com) is reachable and not blocked by a proxy.. The most common cause of MDM enrollment failure after a Windows update is a change in proxy or firewall settings that blocks the MDM enrollment URL. Since the devices can reach the internet generally but fail specifically during enrollment, verifying that `https://enrollment.manage.microsoft.com` is reachable and not blocked by a proxy is the logical first troubleshooting step. This URL is required for the device to communicate with the Intune MDM service during the enrollment process.

Answer

Confirm that the user is assigned a Microsoft Entra ID P1 license.

Answer

Verify that the BitLocker recovery key is backed up to Microsoft Entra ID.

Answer

Ensure the Windows Defender Firewall allows inbound RPC traffic.

Question 12

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

Accepted Answer

A device compliance policy with a required passcode length of 6.. A device compliance policy in Microsoft Intune evaluates whether devices meet specific security requirements, such as a minimum passcode length. By creating a compliance policy with a required passcode length of 6, Intune marks any iOS device with a shorter passcode as noncompliant. This noncompliant status can then be used by a conditional access policy to block access to corporate email, achieving the stated goal.

Answer

A device configuration profile with a passcode payload.

Answer

An app protection policy for Microsoft Outlook.

Answer

A conditional access policy requiring compliant devices.

Question 13

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a custom app that is not available in the Google Play Store. Which app deployment method should you use?

Accepted Answer

Add the app as a line-of-business (LOB) app and upload the APK file.. Line-of-business (LOB) apps in Intune allow administrators to upload and deploy custom APK files to Android Enterprise devices. Option A is incorrect because Managed Google Play apps must be published to the Play Store. Option B is incorrect because deploying a web link is not an app deployment method; it only provides a link to download the APK manually. Option D is incorrect because iOS LOB app deployment is specific to iOS devices and is not applicable to Android.

Answer

Add the app as a Managed Google Play app.

Answer

Deploy the app as a web link to the APK file.

Answer

Use the iOS LOB app deployment method.

Question 14

You manage devices with Microsoft Intune. You need to ensure that only devices with a specific BIOS serial number can enroll. What should you configure?

Accepted Answer

Enrollment restrictions that block devices by hardware identifier.. Intune's enrollment restrictions allow you to block or allow devices based on hardware identifiers such as the BIOS serial number. By adding the specific BIOS serial numbers to the blocked hardware identifiers list, you can effectively prevent any device that does not match the allowed serials from enrolling. This is the only built-in mechanism in Intune that directly controls enrollment eligibility based on hardware characteristics.

Answer

A device category with a dynamic group based on BIOS serial.

Answer

A device compliance policy that checks BIOS serial number.

Answer

A Conditional Access policy that requires a compliant device.

Question 15

Your organization uses Windows Autopilot for device provisioning. Users report that after initial setup, devices are not automatically enrolled in Microsoft Intune. What should you verify?

Accepted Answer

That the devices are registered in Windows Autopilot with a valid hardware hash.. Windows Autopilot requires devices to be registered in the Autopilot service with a valid hardware hash (or other unique identifier like PKID or serial number) so that the service can match the device during OOBE and trigger the enrollment process into Intune. Without a valid hardware hash, the device will not be recognized by Autopilot and will proceed through standard OOBE without automatic Intune enrollment.

Answer

That a device configuration profile is assigned to the devices.

Answer

That a Conditional Access policy is in place requiring Intune enrollment.

Answer

That a device compliance policy is assigned to the Autopilot devices.