MD-102 Manage, maintain, and protect devices — 20 Questions

Question 1

A company deploys Windows 10 Enterprise devices managed by Microsoft Intune. Users report that after a recent Windows update, the Start menu layout is reset to default on some devices. The company uses a custom Start menu layout XML policy. How should the administrator ensure the custom layout is reapplied automatically after feature updates?

Accepted Answer

Configure the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar to point to the XML file.. Option C is correct because the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar in a Group Policy Object (GPO) or Intune Administrative Template profile is designed to persistently enforce a custom Start layout XML. When a Windows feature update resets the Start menu to default, this policy automatically reapplies the custom layout at next user logon or policy refresh, ensuring consistency without manual intervention.

Answer

Use a Feature Update policy in Intune to set the 'Start layout XML' setting.

Answer

Deploy a provisioning package with the custom layout to all devices via Intune.

Answer

Reapply the Start layout policy manually after each feature update.

Question 2

A company uses Microsoft Intune to manage Windows 10 devices. They have a compliance policy that requires BitLocker to be enabled. Some devices are marked as non-compliant even though BitLocker appears to be on. The administrator runs 'manage-bde -status' on a non-compliant device and sees that the protection status is 'Protection Off'. What is the most likely cause?

Accepted Answer

The BitLocker key protectors are missing or have been removed.. The compliance policy requires BitLocker to be enabled, but 'manage-bde -status' shows 'Protection Off'. This indicates that while the drive is encrypted, BitLocker is not actively protecting the data because the key protectors (such as the TPM protector) are missing or have been removed. Intune checks the protection status, not just encryption state, so when protectors are absent, the device is marked non-compliant.

Answer

The TPM is not initialized.

Answer

The device has a recovery password protector but no TPM protector.

Answer

The device uses a different encryption method (e.g., XTS-AES 256 vs AES 128).

Question 3

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

Accepted Answer

Select the device and choose 'Wipe'.. The 'Wipe' action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost or stolen device to prevent unauthorized access to company data. The 'Retire' action only removes managed app data and policies but leaves personal data intact, which is insufficient for a security breach scenario.

Answer

Select the device and choose 'Retire'.

Answer

Select the device and choose 'Reset'.

Answer

Select the device and choose 'Delete'.

Question 4

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Accepted Answer

The script references a file path that does not exist on the failing devices.. Option B is correct because the script likely references a file that is not present. Option A is wrong because execution policy can be bypassed by Intune. Option C is wrong because admin rights are granted. Option D is wrong because script timeout would give a different error.

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 5

A company uses Microsoft Intune to manage iOS devices. They want to enforce a policy that requires a passcode of at least 6 characters and auto-lock after 5 minutes. Which configuration profile type should they use?

Accepted Answer

Device restrictions profile.. A Device restrictions profile is the correct configuration profile type because it contains the security settings for iOS devices, including passcode requirements (minimum length, complexity) and device lock timeouts (auto-lock after minutes). This profile type enforces device-level security policies directly managed by Intune, making it the appropriate choice for requiring a 6-character passcode and 5-minute auto-lock.

Answer

Wi-Fi profile.

Answer

VPN profile.

Answer

Email profile.

Question 6

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is packaged as an .msi file. Which TWO steps are required to deploy this app via Intune?

Accepted Answer

Assign the app to a group of users or devices.. Option C is correct because after preparing the Win32 app, you must assign it to a group of users or devices in Intune to trigger deployment. Without assignment, the app is uploaded but not installed on any target. This step is mandatory for any Intune-managed app deployment.

Answer

Upload the .msi file directly as a Microsoft Store for Business app.

Answer

Install the app on a file server and configure a shortcut.

Answer

Create a PowerShell script to install the app silently.

Question 7

A company uses Microsoft Intune to manage devices. They have a Windows 10 device that is non-compliant due to missing required updates. The administrator reviews the device and sees the update status shows 'Pending restart'. Which THREE actions should the administrator take to resolve the compliance issue?

Accepted Answer

Check the Update Rings policy for deferral settings.. Option A is correct because Update Rings policy deferral settings can delay the installation of required updates, causing the device to show a 'Pending restart' status without actually applying the updates. By checking and adjusting these deferral settings, the administrator can ensure updates are installed promptly, resolving the non-compliance issue.

Answer

Wait for the automatic restart from the compliance policy.

Answer

Re-enroll the device in Intune.

Question 8

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are stuck in a reboot loop. The administrator needs to identify devices affected by the issue. Which report in the Microsoft Intune admin center should the administrator use?

Accepted Answer

Windows Update report. The Windows Update report in the Microsoft Intune admin center provides detailed information about Windows 10 update deployments, including devices that are stuck in a reboot loop after an update. This report shows update status, errors, and pending reboots, allowing the administrator to identify affected devices and take remediation actions.

Answer

Update compliance report

Answer

Device compliance report

Answer

Device inventory report

Question 9

An organization uses Configuration Manager to deploy software updates to Windows 10 devices. The administrator wants to ensure that devices receive updates from the local distribution point rather than the cloud. Which boundary group option should be configured?

Accepted Answer

Prefer distribution points over cloud sources. Option A is correct because the 'Prefer distribution points over cloud sources' boundary group option ensures that clients will attempt to download software updates from a local distribution point before falling back to a cloud-based source. This setting directly controls client behavior to prioritize on-premises distribution points, which aligns with the administrator's goal of keeping traffic local and avoiding cloud egress.

Answer

Enable peer caching

Answer

Use cloud distribution points only

Answer

Fallback to cloud sources

Question 10

A company manages 500 Windows 11 devices with Microsoft Intune. They use BitLocker encryption with automatic encryption enabled. Several devices report that encryption did not start. The administrator reviews the devices and finds that they are not compliant with the BitLocker policy. What is the most likely cause?

Accepted Answer

Devices do not have a Trusted Platform Module (TPM) chip. BitLocker automatic encryption requires a compatible TPM chip to securely store encryption keys and validate system integrity. Without a TPM, BitLocker cannot start the encryption process automatically, leading to non-compliance with the policy. The other options do not directly prevent encryption from starting.

Answer

Devices do not have a secure boot enabled

Answer

Devices are not Azure AD joined

Answer

BitLocker startup key is not saved to Azure AD

Question 11

An administrator uses Configuration Manager to manage Windows 10 devices. The administrator wants to deploy a custom Windows application as an Application model deployment type. The application requires a reboot. Which deployment purpose should the administrator use to allow users to control the installation timing?

Accepted Answer

Available. The Available deployment purpose allows users to see the application in Software Center and choose when to install it, including scheduling the required reboot at their convenience. This gives users control over installation timing, which is the stated requirement. Required and Mandatory deployments force installation according to a schedule, removing user choice.

Answer

Mandatory

Answer

Pre-deploy

Answer

Required

Question 12

A company uses Microsoft Intune to manage iOS devices. The administrator configures a device compliance policy that requires a minimum OS version of 15.0. Users report that devices running iOS 14.8 are marked non-compliant even after updating to iOS 15.0. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune after the update. The most likely cause is that the device has not checked in with Intune after the update. Intune relies on periodic check-ins to evaluate compliance; if the device updated to iOS 15.0 but hasn't completed a check-in, Intune still sees the last reported OS version (14.8) and marks it non-compliant. A forced sync or waiting for the next scheduled check-in resolves this.

Answer

The compliance policy requires a grace period

Answer

The update was not applied successfully

Answer

The compliance policy is not assigned to the correct user group

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. The administrator needs to configure Windows Defender Firewall rules via a device configuration profile. Which TWO settings can be configured?

Accepted Answer

Set default inbound action. Option B is correct because the Windows Defender Firewall device configuration profile in Microsoft Intune includes the 'Default inbound action' setting, which allows administrators to specify whether inbound connections that do not match an explicit rule should be blocked or allowed. This setting is a core firewall behavior control that can be enforced via a device configuration profile (Windows 10 and later) under the 'Endpoint Protection' category.

Answer

Configure notification settings

Answer

Configure log file location

Question 14

An organization uses Configuration Manager to manage Windows 10 devices. The administrator is configuring a phased deployment for a software update. Which THREE conditions can be used to define the phases?

Accepted Answer

Collection membership. Collection membership (A) is correct because Configuration Manager phased deployments allow you to specify a target collection for each phase, such as a collection containing pilot devices for the first phase and a broader collection for subsequent phases. This enables granular control over which devices receive the update at each stage, based on existing collection membership rules.

Answer

Time-based delay between phases

Answer

Device compliance status

Question 15

A company applies the above BitLocker policy to Windows 10 devices via Intune. An administrator discovers that some devices are not encrypting. The administrator checks a device and finds that it has no TPM chip. Which setting in the policy will cause encryption to fail?

Accepted Answer

requireTpm. The 'requireTpm' setting enforces that BitLocker will only start encryption if a Trusted Platform Module (TPM) chip is present on the device. If a device lacks a TPM, this policy setting causes the encryption process to fail outright, as BitLocker cannot meet the mandatory hardware requirement.

Answer

recoveryKeyRotation

Answer

encryptionMethod

Answer

requireStartupPin

Question 16

An administrator runs the above PowerShell command on a Windows 10 device managed by Microsoft Defender for Endpoint. The device is reporting as healthy in the security console. Based on the output, which protection feature is disabled?

Accepted Answer

Real-time protection. The PowerShell command `Get-MpComputerStatus` returns the current status of Microsoft Defender Antivirus. The output shows `AMServiceEnabled : False`, which indicates the antimalware service is disabled, but the critical indicator is `RealTimeProtectionEnabled : False`. Real-time protection monitors file system activity for malware in real time; when disabled, the device may still report as healthy in the Microsoft Defender for Endpoint console if other components (e.g., cloud-delivered protection) are active, but the device is not fully protected against immediate threats.

Answer

IOAV protection

Answer

Antimalware service

Answer

Antivirus

Question 17

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

Accepted Answer

Create an update ring for Windows 10 with a deadline of 7 days.. Option B is correct because update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Answer

Create a compliance policy for Windows 10 update compliance.

Answer

Create a device configuration profile for Windows 10 updates.

Answer

Configure a Windows Update for Business policy in Group Policy.

Question 18

A user reports that their Windows 10 device is not receiving policies from Microsoft Intune. The device shows as 'Not compliant' in the Intune console. You run the Get-MgDeviceManagementManagedDevice cmdlet and see that the device is enrolled and appears in the list. However, the LastSyncTime is 14 days ago. What is the most likely cause?

Accepted Answer

The Intune Management Extension service is not running on the device.. The Intune Management Extension (IME) service is responsible for synchronizing policies, including compliance and configuration policies, from Intune to Windows 10 devices. If the IME service is not running, the device will not receive new policies or sync status, leading to a stale LastSyncTime (14 days ago) and a 'Not compliant' state, even though the device is enrolled and appears in the Get-MgDeviceManagementManagedDevice output.

Answer

The MDM certificate has expired.

Answer

The device is not connected to the internet due to a proxy misconfiguration.

Answer

The device is not enrolled in Intune.

Question 19

You are deploying Microsoft Defender for Endpoint to Windows 10 devices managed by Microsoft Intune. After onboarding, you need to verify that the sensor is running. Which cmdlet should you use on the device?

Accepted Answer

Get-Service -Name Sense. The correct cmdlet is Get-Service -Name Sense because the Microsoft Defender for Endpoint sensor runs as a Windows service named 'Sense' (Microsoft Defender Advanced Threat Protection Service). Checking this service confirms the sensor is installed and running, which is the standard verification step after onboarding devices to Defender for Endpoint.

Answer

Get-Service -Name WinDefend

Answer

Get-DefenderEndpoint

Answer

Get-MpComputerStatus

Question 20

A company uses Microsoft Intune to manage iOS/iPadOS devices. The compliance policy requires a minimum OS version of 15.0. A user reports that their iPad running iOS 14.8 cannot access company email and shows as non-compliant. However, the device is up to date with the latest available OS for that hardware. What should you do to allow the device to access email while maintaining security?

Accepted Answer

Configure a compliance grace period of 30 days on the policy.. Option A is correct because a compliance grace period allows the device to remain non-compliant for a specified duration (e.g., 30 days) without immediately blocking access to company resources. This gives the user time to update the OS if possible, but since the iPad hardware cannot go beyond iOS 14.8, the grace period still permits email access while the device is marked non-compliant, maintaining security by not permanently exempting the device.

Answer

Change the minimum OS version to 14.8 in the policy.

Answer

Delete the compliance policy that requires iOS 15.0.

Answer

Request the user to update the iPad to iOS 15.0.