MD-102 Manage, maintain, and protect devices — 10 Questions

Question 1

A company deploys Windows 10 Enterprise devices managed by Microsoft Intune. Users report that after a recent Windows update, the Start menu layout is reset to default on some devices. The company uses a custom Start menu layout XML policy. How should the administrator ensure the custom layout is reapplied automatically after feature updates?

Accepted Answer

Configure the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar to point to the XML file.. Option C is correct because the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar in a Group Policy Object (GPO) or Intune Administrative Template profile is designed to persistently enforce a custom Start layout XML. When a Windows feature update resets the Start menu to default, this policy automatically reapplies the custom layout at next user logon or policy refresh, ensuring consistency without manual intervention.

Answer

Use a Feature Update policy in Intune to set the 'Start layout XML' setting.

Answer

Deploy a provisioning package with the custom layout to all devices via Intune.

Answer

Reapply the Start layout policy manually after each feature update.

Question 2

A company uses Microsoft Intune to manage Windows 10 devices. They have a compliance policy that requires BitLocker to be enabled. Some devices are marked as non-compliant even though BitLocker appears to be on. The administrator runs 'manage-bde -status' on a non-compliant device and sees that the protection status is 'Protection Off'. What is the most likely cause?

Accepted Answer

The BitLocker key protectors are missing or have been removed.. The compliance policy requires BitLocker to be enabled, but 'manage-bde -status' shows 'Protection Off'. This indicates that while the drive is encrypted, BitLocker is not actively protecting the data because the key protectors (such as the TPM protector) are missing or have been removed. Intune checks the protection status, not just encryption state, so when protectors are absent, the device is marked non-compliant.

Answer

The TPM is not initialized.

Answer

The device has a recovery password protector but no TPM protector.

Answer

The device uses a different encryption method (e.g., XTS-AES 256 vs AES 128).

Question 3

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

Accepted Answer

Select the device and choose 'Wipe'.. The 'Wipe' action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost or stolen device to prevent unauthorized access to company data. The 'Retire' action only removes managed app data and policies but leaves personal data intact, which is insufficient for a security breach scenario.

Answer

Select the device and choose 'Retire'.

Answer

Select the device and choose 'Reset'.

Answer

Select the device and choose 'Delete'.

Question 4

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Accepted Answer

The script references a file path that does not exist on the failing devices.. Option B is correct because the script likely references a file that is not present. Option A is wrong because execution policy can be bypassed by Intune. Option C is wrong because admin rights are granted. Option D is wrong because script timeout would give a different error.

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 5

A company uses Microsoft Intune to manage iOS devices. They want to enforce a policy that requires a passcode of at least 6 characters and auto-lock after 5 minutes. Which configuration profile type should they use?

Accepted Answer

Device restrictions profile.. A Device restrictions profile is the correct configuration profile type because it contains the security settings for iOS devices, including passcode requirements (minimum length, complexity) and device lock timeouts (auto-lock after minutes). This profile type enforces device-level security policies directly managed by Intune, making it the appropriate choice for requiring a 6-character passcode and 5-minute auto-lock.

Answer

Wi-Fi profile.

Answer

VPN profile.

Answer

Email profile.

Question 6

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is packaged as an .msi file. Which TWO steps are required to deploy this app via Intune?

Accepted Answer

Assign the app to a group of users or devices.. Option C is correct because after preparing the Win32 app, you must assign it to a group of users or devices in Intune to trigger deployment. Without assignment, the app is uploaded but not installed on any target. This step is mandatory for any Intune-managed app deployment.

Answer

Upload the .msi file directly as a Microsoft Store for Business app.

Answer

Install the app on a file server and configure a shortcut.

Answer

Create a PowerShell script to install the app silently.

Question 7

A company uses Microsoft Intune to manage devices. They have a Windows 10 device that is non-compliant due to missing required updates. The administrator reviews the device and sees the update status shows 'Pending restart'. Which THREE actions should the administrator take to resolve the compliance issue?

Accepted Answer

Check the Update Rings policy for deferral settings.. Option A is correct because Update Rings policy deferral settings can delay the installation of required updates, causing the device to show a 'Pending restart' status without actually applying the updates. By checking and adjusting these deferral settings, the administrator can ensure updates are installed promptly, resolving the non-compliance issue.

Answer

Wait for the automatic restart from the compliance policy.

Answer

Re-enroll the device in Intune.

Question 8

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are stuck in a reboot loop. The administrator needs to identify devices affected by the issue. Which report in the Microsoft Intune admin center should the administrator use?

Accepted Answer

Windows Update report. The Windows Update report in the Microsoft Intune admin center provides detailed information about Windows 10 update deployments, including devices that are stuck in a reboot loop after an update. This report shows update status, errors, and pending reboots, allowing the administrator to identify affected devices and take remediation actions.

Answer

Update compliance report

Answer

Device compliance report

Answer

Device inventory report

Question 9

An organization uses Configuration Manager to deploy software updates to Windows 10 devices. The administrator wants to ensure that devices receive updates from the local distribution point rather than the cloud. Which boundary group option should be configured?

Accepted Answer

Prefer distribution points over cloud sources. Option A is correct because the 'Prefer distribution points over cloud sources' boundary group option ensures that clients will attempt to download software updates from a local distribution point before falling back to a cloud-based source. This setting directly controls client behavior to prioritize on-premises distribution points, which aligns with the administrator's goal of keeping traffic local and avoiding cloud egress.

Answer

Enable peer caching

Answer

Use cloud distribution points only

Answer

Fallback to cloud sources

Question 10

A company manages 500 Windows 11 devices with Microsoft Intune. They use BitLocker encryption with automatic encryption enabled. Several devices report that encryption did not start. The administrator reviews the devices and finds that they are not compliant with the BitLocker policy. What is the most likely cause?

Accepted Answer

Devices do not have a Trusted Platform Module (TPM) chip. BitLocker automatic encryption requires a compatible TPM chip to securely store encryption keys and validate system integrity. Without a TPM, BitLocker cannot start the encryption process automatically, leading to non-compliance with the policy. The other options do not directly prevent encryption from starting.

Answer

Devices do not have a secure boot enabled

Answer

Devices are not Azure AD joined

Answer

BitLocker startup key is not saved to Azure AD