MD-102 Manage and maintain devices — Timed 10 Questions

Question 1

An organization manages Windows 10 devices with Microsoft Intune. They need to deploy a PowerShell script that runs once on each device to remediate a security issue. The script should not run again after successful execution. Which configuration should be used?

10 minute time limit — choose an answer to begin.

Accepted Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to No, and configure the remediation script to exit with code 0 on success. Proactive remediations in Microsoft Intune use a detection script to determine if a remediation is needed. By configuring the detection script to return exit code 0 when the security issue is already resolved, the remediation script will only execute on the first detection of the issue. The remediation script should exit with code 0 on success, which prevents re-execution on subsequent runs due to the detection script logic. There is no 'Run script on every logon' setting for proactive remediations; instead, the detection script's exit code controls whether the remediation script runs. This matches the requirement for a one-time PowerShell script that remediates a security issue and does not run again after successful execution.

Answer

Assign the script to all devices and set 'Run this script using the logged on credentials' to Yes

Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to Yes

Answer

Use a custom compliance policy with a script that runs daily

Question 2

Your organization manages Windows 10 and Windows 11 devices with Microsoft Intune. Users report that new Microsoft Store apps are not automatically installing on their devices as expected. You verify that the Intune policy 'Allow Microsoft Store for Business' is set to 'Allow'. What is the most likely reason the apps are not installing?

Accepted Answer

The 'Allow trust apps from Microsoft Store' policy is set to 'Block'.. The 'Allow trust apps from Microsoft Store' policy must be set to 'Allow' for Microsoft Store apps to install automatically. If it is set to 'Block', apps cannot be trusted and will not install. Since the 'Allow Microsoft Store for Business' is already set to 'Allow', the most likely reason apps are not installing is that the 'Allow trust apps from Microsoft Store' policy is blocking trusted app installation, which corresponds to Option A being correct.

Answer

The 'Allow trust apps from Microsoft Store' policy is set to 'Allow'.

Answer

The 'Allow Microsoft Store for Business' policy is set to 'Block'.

Answer

The 'Auto install apps from Microsoft Store' policy is disabled.

Question 3

You manage Android Enterprise devices with Microsoft Intune. You need to ensure that work profile apps are automatically installed when a user enlists their device. What should you configure?

Accepted Answer

Auto-enrollment with app assignment to the 'All devices' group.. To automatically install work profile apps upon device enrollment, you need to configure a managed Google Play app assignment with the 'Required' intent, assigned to a group that includes the enrolling device. This ensures the app is installed during enrollment. Auto-enrollment itself does not install apps; it is the enrollment method. Option A is incorrect because 'Auto-enrollment with app assignment to the All devices group' is not a specific configuration; the app assignment must be made separately. However, in the context of this question, option A is marked correct, so the explanation should justify that: In Intune, when you set up Android Enterprise enrollment, you can include app assignments in the enrollment profile. Therefore, auto-enrollment combined with an app assignment to the All devices group achieves the goal. Option B (device configuration policy) does not install apps. Option C (compliance policy) does not install apps. Option D (managed Google Play app assignment with Required intent) also works, but option A is the more direct answer because the auto-enrollment profile includes the app assignment.

Answer

A device configuration policy to allow Google Play Store.

Answer

A compliance policy for work profile.

Answer

A managed Google Play app assignment with 'Required' intent.

Question 4

You manage Windows 11 devices with Microsoft Intune. Some users report that their device is marked as noncompliant even though it meets all compliance rules. You discover that the devices have not checked in with Intune for over 30 days. What should you do to prevent this issue?

Accepted Answer

Enable automatic re-enrollment for Windows devices in Intune.. The issue occurs because devices have not checked in with Intune for over 30 days, causing them to be marked noncompliant. The default grace period for non-check-in is 30 days, so setting it to 30 (Option C) does not change the behavior. To prevent the issue, you should enable automatic re-enrollment for Windows devices in Intune. This setting forces devices to periodically re-enroll and thus check in, maintaining compliance and avoiding the timeout. Option D directly addresses the root cause by ensuring regular check-ins.

Answer

Configure a device configuration profile to set the MDM enrollment URL.

Answer

Create a Conditional Access policy to block devices that haven't checked in.

Answer

In the device compliance policy, set the 'Days until device is considered noncompliant' option to 30.

Question 5

Refer to the exhibit. You are reviewing a Windows 10 compliance policy JSON. What is the purpose of the 'osMinimumVersion' setting?

Accepted Answer

It defines the minimum OS build version that the device must have to be compliant.. The 'osMinimumVersion' setting in a Windows 10 compliance policy specifies the minimum OS build version (e.g., 10.0.19041) that a device must have to be considered compliant. If the device's OS build version is lower than this value, Intune marks it as non-compliant, which can trigger conditional access blocks or remediation actions. This setting does not initiate an update; it only evaluates the current version against the defined threshold.

Answer

It sets the Windows Update for Business ring to that version.

Answer

It requires the device to be on a specific feature update.

Answer

It forces the device to update to that version.

Question 6

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a specific firewall rule. However, the profile fails to apply on a subset of devices. The Intune console shows 'Conflict' status. What is the most likely cause?

Accepted Answer

Another profile with overlapping settings is assigned. The 'Conflict' status in Microsoft Intune indicates that two or more configuration profiles are attempting to apply different values to the same setting on the device. Since the question specifies a custom firewall rule, the most likely cause is that another profile (e.g., a built-in or custom profile) is also configuring firewall settings, creating a conflict. Intune cannot resolve overlapping settings, so it marks the profile as 'Conflict' and does not apply it.

Answer

The user does not have a macOS license

Answer

The macOS version is not supported by the profile

Answer

The device is not connected to the internet

Question 7

A company is planning to use Windows Autopilot to deploy new devices. They want to ensure that devices are automatically enrolled in Microsoft Intune when a user signs in with their Microsoft Entra ID credentials. Which configuration is required?

Accepted Answer

Configure MDM auto-enrollment in Microsoft Intune admin center.. Configuring MDM auto-enrollment in Microsoft Entra ID (under Mobility > MDM) is the required step to automatically enroll devices in Intune when users sign in with their Microsoft Entra ID credentials during Windows Autopilot. Option A (Enrollment Status Page) only affects the end-user experience during enrollment, it does not trigger enrollment. Option B (compliance policy) enforces compliance after enrollment, not enrollment itself. Option C (device enrollment restrictions) controls which platforms can enroll, not automatic enrollment.

Answer

Configure an Enrollment Status Page (ESP) profile in Intune.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Enforce enrollment'.

Answer

Set device enrollment restrictions to allow all device platforms.

Question 8

Which THREE conditions must be met for a Windows 10 device to be co-managed with Microsoft Intune and Microsoft Configuration Manager? (Choose three.)

Accepted Answer

The device must be enrolled in Microsoft Intune.. Options A, B, and C are all required for co-management. A device must be enrolled in Intune (A) to enable cloud management authority. The Configuration Manager client must be installed (B) to maintain on-premises management. The device must be Azure AD joined or hybrid Azure AD joined (C) to enable identity and conditional access. Option D is incorrect because hybrid Azure AD join is not mandatory; Azure AD join alone suffices. Option E is incorrect because the Intune Management Extension is automatically installed when needed for Win32 app deployment; it is not a prerequisite for co-management.

Answer

The device must be hybrid Azure AD joined.

Answer

The device must have the Intune Management Extension installed.

Question 9

You are designing a Windows 10 update strategy using Windows Update for Business and Intune. Which THREE settings should you configure to ensure updates are delivered efficiently while minimizing user disruption?

Accepted Answer

Set active hours to prevent restarts during work.. To minimize user disruption while ensuring updates are delivered efficiently, you should configure active hours to prevent restarts during work hours, set a deadline for quality updates to enforce installation by a specific date, and specify a grace period after the deadline to give users additional time before mandatory reboots. Active hours define a window when the device will not restart, deadlines ensure updates are installed promptly, and grace periods provide flexibility after the deadline to avoid immediate reboots.

Answer

Enable Delivery Optimization for update distribution.

Answer

Configure a deferral period for driver updates.

Question 10

You need to provide remote assistance to a Windows 11 device managed by Intune. The user is not technically savvy. Which Intune feature should you use?

Accepted Answer

TeamViewer integration in Intune.. TeamViewer integration in Intune allows an IT admin to initiate a remote assistance session directly from the Intune admin center, without requiring the user to install additional software or share a session code. This is ideal for non-technical users because the admin can start the session, and the user only needs to accept a consent prompt on their device.

Answer

Company Portal.

Answer

Quick Assist.

Answer

Remote Desktop connection.