Courseiva

CCNA Manage and maintain devices Questions

75 of 285 questions · Page 1/4 · Manage and maintain devices · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a minimum OS version can access corporate email via Microsoft Outlook for iOS. Which policy type should you configure?

A.Device configuration policy
B.Conditional Access policy
C.Device compliance policy
D.App protection policy (MAM)
AnswerD

App protection policies can require a minimum OS version for managed apps.

Why this answer

App Protection Policies (MAM) allow you to target specific apps like Microsoft Outlook for iOS with conditional launch settings, including minimum OS version requirements. This policy applies at the app layer without requiring device enrollment, making it ideal for controlling access to corporate data in Outlook on iOS devices based on OS version.

Exam trap

The trap here is that candidates often confuse Device Compliance Policies (Option C) with app-level OS version controls, not realizing that MAM policies can enforce OS version requirements directly on the app without device enrollment.

How to eliminate wrong answers

Option A is wrong because Device Configuration Policies manage device settings (e.g., Wi-Fi, VPN, restrictions) but do not enforce OS version requirements for app-level access. Option B is wrong because Conditional Access policies control access at the authentication layer (e.g., requiring compliant devices) but cannot enforce a minimum OS version specifically for the Outlook app on iOS without device compliance integration. Option C is wrong because Device Compliance Policies evaluate device-level compliance (e.g., OS version, jailbreak status) but require device enrollment and are not app-specific; they would block all access from non-compliant devices, not just Outlook.

Practice this question →
2
MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs at every device startup to map network drives based on the user's security group membership. The script should run in the system context and should not require user interaction. How should you configure the script deployment in Intune?

A.Add the script as a Windows PowerShell script in Intune and assign it to users, so it runs when users log in.
B.Use Proactive remediations in Intune to run the script on a schedule.
C.Add the PowerShell script as a Windows PowerShell script in Intune, set the execution context to 'System', and configure the script to run at device startup.
D.Create a device configuration profile that includes the script as a custom setting.
AnswerC

Intune PowerShell scripts can run in system context and at startup.

Why this answer

Intune allows PowerShell scripts to run in the system context and be configured to run at device startup, fulfilling the requirement. Option A is incorrect because assigning the script to users and running at user logon does not run in the system context and requires user interaction. Option B is incorrect because Proactive remediations run on a schedule or on demand, not at startup.

Option D is incorrect because device configuration profiles cannot execute scripts directly.

Practice this question →
3
MCQhard

Refer to the exhibit. The JSON snippet shows a dynamic device group configuration in Microsoft Intune. What is the effect of the 'enrollmentTimeDeviceMembershipLimit' property set to 15?

A.The group will only contain devices that have been enrolled for at least 15 days
B.Only devices enrolled in the last 15 days are eligible
C.Limits the number of devices in the group to 15
D.Devices added to the group will be removed after 15 days from enrollment
AnswerD

This property sets a time limit for membership after enrollment.

Why this answer

The 'enrollmentTimeDeviceMembershipLimit' property in a dynamic device group rule sets a time window (in days) from enrollment during which a device remains a member of the group. When set to 15, devices are automatically removed from the group 15 days after their enrollment date, regardless of their compliance or management status. This is used for scenarios like temporary access or pilot groups where membership should expire after a fixed period.

Exam trap

The trap here is that candidates confuse 'enrollmentTimeDeviceMembershipLimit' with a device count limit or a recency filter, when it actually defines a fixed membership duration from the enrollment timestamp.

How to eliminate wrong answers

Option A is wrong because the property does not enforce a minimum enrollment duration; it sets a maximum membership window from enrollment, not a requirement that devices be enrolled for at least 15 days. Option B is wrong because it incorrectly suggests only devices enrolled in the last 15 days are eligible, but the property actually removes devices after 15 days from enrollment, not filters by enrollment recency. Option C is wrong because the property controls time-based membership duration, not a device count limit; device count limits are handled by a different property or group type.

Practice this question →
4
MCQeasy

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs in the user context to configure user settings. What type of script should you use?

A.A platform script for Windows.
B.A PowerShell script deployed via Intune Management Extension.
C.A discovery script.
D.A remediation script.
AnswerB

PowerShell scripts can run in user context.

Why this answer

The Intune Management Extension (IME) is the component that handles PowerShell script execution on Windows 10 devices managed by Intune. When you deploy a PowerShell script via Intune, it is automatically executed by the IME, and you can choose to run it in the user context (as the logged-on user) or the system context. This is the correct mechanism for deploying a user-context PowerShell script to configure user settings.

Exam trap

The trap here is that candidates often confuse 'discovery script' or 'remediation script' (which are part of proactive remediations) with the general-purpose PowerShell script deployment feature, leading them to pick a wrong answer when the question simply asks for a script to configure user settings.

How to eliminate wrong answers

Option A is wrong because 'platform script for Windows' is not a recognized Intune script type; Intune uses PowerShell scripts deployed via the IME, not a separate 'platform script' category. Option C is wrong because a discovery script is used in proactive remediations to detect a condition (e.g., a registry key or file state), not to configure user settings. Option D is wrong because a remediation script is also part of proactive remediations and is executed only after a discovery script detects an issue; it is not the primary method for deploying a standalone user-context configuration script.

Practice this question →
5
Multi-Selecteasy

Which TWO of the following are valid remote assistance tools for Windows devices managed by Microsoft Intune? (Choose two.)

Select 2 answers
A.Windows Remote Management (WinRM)
B.Remote Desktop
C.Quick Assist
D.Skype
E.TeamViewer
AnswersC, E

Quick Assist is a Windows built-in tool for remote assistance.

Why this answer

Quick Assist is a built-in Windows tool that allows remote assistance connections and is fully supported for managed devices in Microsoft Intune. It uses Remote Desktop Protocol (RDP) for screen sharing and control, and can be deployed and configured via Intune policies, making it a valid remote assistance option.

Exam trap

The trap here is that candidates often confuse Remote Desktop (full remote access) with remote assistance (attended, consent-based support), leading them to select Remote Desktop instead of Quick Assist or TeamViewer.

Practice this question →
6
Multi-Selectmedium

Which TWO settings can be configured in a Microsoft Intune device compliance policy for iOS/iPadOS?

Select 2 answers
A.Allow app installation from App Store only
B.Block USB devices
C.Require a password
D.Minimum OS version
E.Jailbroken devices
AnswersC, D

This is a compliance setting.

Why this answer

Intune device compliance policies for iOS/iPadOS include a setting to require a password on the device, which can enforce specific password complexity rules such as minimum length, number of complex characters, and lockout behavior. This setting is a core compliance requirement for securing devices that access corporate resources.

Exam trap

The trap here is that candidates often confuse settings available in device compliance policies with those in device configuration profiles, mistakenly thinking restrictions like app store installation or USB blocking are compliance settings, when they are actually managed under configuration profiles.

Practice this question →
7
Multi-Selecthard

You need to configure a Microsoft Intune policy to ensure that only devices with a minimum OS version can access corporate email. Which THREE policy types can enforce this requirement?

Select 3 answers
A.Device compliance policy
B.App protection policy
C.Enrollment restrictions
D.Device configuration profile
E.Conditional access policy
AnswersA, B, E

Compliance policy can require minimum OS version.

Why this answer

Device compliance policy (A) is correct because it allows you to define rules such as a minimum OS version requirement. When a device is marked as non-compliant due to an outdated OS, you can combine this with a Conditional Access policy to block access to corporate email. This is the primary mechanism for OS version enforcement on managed devices.

Exam trap

The trap here is that candidates often think Device configuration profiles can enforce security requirements like OS version, but they only configure settings and do not evaluate or block access based on compliance criteria.

Practice this question →
8
MCQeasy

You need to remotely wipe a lost corporate-owned iOS device that is enrolled in Microsoft Intune. Which action should you perform in the Intune console?

A.Retire.
B.Wipe.
C.Delete.
D.Reset.
AnswerB

Wipe performs a factory reset, suitable for lost devices.

Why this answer

The Wipe action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost corporate-owned iOS device to ensure sensitive data is completely erased and the device cannot be accessed. Retire only removes managed apps and policies but leaves personal data intact, which is insufficient for a lost device scenario.

Exam trap

The trap here is that candidates confuse 'Retire' with 'Wipe', mistakenly thinking Retire is sufficient for a lost device, but Retire only removes management and corporate data without performing a full device reset, leaving personal data and the device usable.

How to eliminate wrong answers

Option A (Retire) is wrong because it only removes managed apps, corporate data, and Intune management, but does not perform a full factory reset, leaving personal data and the device operational. Option C (Delete) is wrong because deleting the device from the Intune console simply removes its enrollment record without initiating any wipe or data removal on the device itself. Option D (Reset) is wrong because Intune does not have a 'Reset' action; the correct term for a full factory reset is 'Wipe', and 'Reset' is not a valid action in the Intune console.

Practice this question →
9
MCQmedium

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage endpoint security. You need to ensure that all Windows 10 devices are onboarded to Defender for Endpoint via Microsoft Intune. Which policy type should you use?

A.Endpoint detection and response policy
B.Antivirus policy
C.Firewall policy
D.Windows Security experience policy
AnswerA

EDR policy is used to onboard devices to Defender for Endpoint.

Why this answer

To onboard Windows 10 devices to Microsoft Defender for Endpoint via Intune, you must use an Endpoint detection and response (EDR) policy. This policy type deploys the required onboarding configuration package (a .cmd script or .xml file) that registers the device with the Defender for Endpoint service, enabling sensor data collection and threat detection. Antivirus, Firewall, and Windows Security experience policies manage separate security features but do not handle the initial onboarding process.

Exam trap

The trap here is that candidates confuse 'onboarding' with 'configuring existing security features,' mistakenly selecting Antivirus policy because they think Defender Antivirus must be enabled first, when in fact onboarding is a distinct prerequisite handled only by the EDR policy.

How to eliminate wrong answers

Option B (Antivirus policy) is wrong because it configures Microsoft Defender Antivirus settings (e.g., real-time protection, cloud-delivered protection) but does not deploy the onboarding package required to connect the device to Defender for Endpoint. Option C (Firewall policy) is wrong because it manages Windows Defender Firewall rules and profiles, which are unrelated to the device registration and sensor activation needed for onboarding. Option D (Windows Security experience policy) is wrong because it customizes the Windows Security app interface (e.g., notifications, tamper protection) but does not include the onboarding configuration that establishes the device's connection to the Defender for Endpoint backend.

Practice this question →
10
MCQhard

You are troubleshooting a Windows 10 device that is not receiving policy updates from Intune. The device shows 'Pending' status in the Intune console. The device is connected to the internet. What is the most likely cause?

A.The device is not connected to the network.
B.The device has a pending reboot.
C.The Intune management extension service is not running.
D.The device enrollment is expired.
AnswerC

The service must be running to receive policies.

Why this answer

The Intune management extension service (IntuneManagementExtension.exe) is responsible for processing policy and app deployment actions on Windows 10 devices. If this service is not running, the device will show a 'Pending' status in the Intune console because it cannot acknowledge or apply incoming policies, even though the device is online and enrolled.

Exam trap

The trap here is that candidates may assume 'Pending' always means a network issue or a pending reboot, but the correct interpretation is that the Intune management extension service must be actively running to process policy updates, and a stopped service is the most common cause of a stuck 'Pending' status.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the device is connected to the internet, so network connectivity is not the issue. Option B is wrong because a pending reboot may delay some actions but does not prevent the Intune management extension from running or receiving policy updates; the 'Pending' status specifically indicates the service is not responding. Option D is wrong because device enrollment in Intune does not expire; enrollment remains valid until the device is manually retired or wiped, so an expired enrollment is not a valid concept in this context.

Practice this question →
11
MCQhard

You are using Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a preference for a third-party app. Which method should you use?

A.Upload an XML file with the preference settings.
B.Upload a DMG file containing the preferences.
C.Upload a property list (.plist) file.
D.Upload a JSON file with the preference settings.
AnswerC

Custom macOS profiles use plist files.

Why this answer

Intune for macOS uses property list (.plist) files to deploy custom configuration profiles for app preferences. The .plist format is the native macOS mechanism for storing application settings, and Intune's custom profile type directly accepts a valid .plist file to apply these settings via MDM. This method ensures the preferences are correctly parsed and enforced on managed macOS devices.

Exam trap

The trap here is that candidates confuse the macOS .plist format with generic XML or JSON, assuming any structured data file works, but Intune strictly requires a .plist file because macOS MDM enforces that format for preference domains.

How to eliminate wrong answers

Option A is wrong because XML files are not a supported format for macOS custom configuration profiles in Intune; while .plist files are XML-based, they must be in the specific .plist format with the correct plist DTD and structure. Option B is wrong because DMG files are disk images used for distributing applications, not for deploying configuration preferences; Intune cannot extract or apply settings from a DMG as a configuration profile. Option D is wrong because JSON files are not natively supported by macOS for system or app preference management; Intune's macOS custom profile only accepts .plist files, not JSON.

Practice this question →
12
Multi-Selecthard

You are troubleshooting a Windows 10 device that is not receiving a required security policy from Intune. The device shows as 'Not compliant' in the Intune console. Which TWO actions should you take to resolve the issue?

Select 2 answers
A.Ensure the device is in the correct Microsoft Entra ID group targeted by the policy.
B.Reissue the user's Microsoft 365 license from the admin center.
C.Reset the device's enrollment state via the Company Portal.
D.Verify that the device has an active internet connection and can reach Intune services.
E.Run Invoke-Command to remotely execute gpupdate /force.
AnswersA, D

Correct. Group assignment is essential for policy delivery.

Why this answer

Intune security policies are assigned to Microsoft Entra ID groups. If the device is not a member of the targeted group, it will not receive the policy, resulting in a 'Not compliant' status. Verifying group membership ensures the policy scope is correctly applied.

Exam trap

The trap here is that candidates often confuse Intune MDM policy delivery with traditional on-premises Group Policy, leading them to select the gpupdate command (Option E) instead of recognizing that Intune relies on OMA-DM sync and network connectivity.

Practice this question →
13
MCQhard

An organization uses Microsoft Intune to manage Windows devices. They want to deploy a Win32 app that requires admin rights to install. The app must be installed in the system context and should not require user interaction. Which installation behavior should be configured?

A.Install behavior: User, Installation purpose: Required, Device restart behavior: No specific action
B.Install behavior: System, Installation purpose: Required, Device restart behavior: No specific action, Installation visibility: Hidden
C.Install behavior: User, Installation purpose: Available
D.Install behavior: System, Installation purpose: Required, Device restart behavior: Immediately
AnswerB

System context ensures admin rights, Hidden prevents user interaction, and Required ensures installation.

Why this answer

Deploying a Win32 app that requires admin rights and must run without user interaction in the system context requires setting the install behavior to 'System' and the installation purpose to 'Required'. The 'Hidden' installation visibility ensures the installation runs silently in the background, with no user prompts or interaction, which is essential for a non-interactive system-context deployment.

Exam trap

The trap here is that candidates often confuse 'Install behavior: User' with the ability to install apps requiring admin rights, not realizing that only the System context can elevate privileges silently without user prompts.

How to eliminate wrong answers

Option A is wrong because 'Install behavior: User' runs the installer in the user context, which lacks the necessary admin rights for an app that requires admin privileges, and 'Installation purpose: Required' with user behavior still prompts the user for elevation. Option C is wrong because 'Install behavior: User' again lacks system context, and 'Installation purpose: Available' allows the user to choose to install, which contradicts the requirement for no user interaction and admin rights. Option D is wrong because 'Device restart behavior: Immediately' forces an immediate reboot after installation, which is not required by the scenario (the requirement is 'no specific action' for restart), and this could disrupt user productivity.

Practice this question →
14
MCQhard

You have configured a Windows 10 update ring with a deadline of 3 days for quality updates. However, some devices are not installing updates within the deadline. What should you verify?

A.The devices are set to defer quality updates in Windows Update settings.
B.The devices have a feature update policy that conflicts.
C.The Intune Management Extension is installed.
D.The update ring is assigned to the correct Azure AD group.
AnswerA

Deferral settings can delay installation beyond the deadline.

Why this answer

If devices are configured to defer quality updates in their local Windows Update settings, they will ignore the deadline specified in the update ring policy. The update ring deadline enforces installation timing, but deferral settings can override that by delaying the download or installation beyond the deadline. You must verify that no local or Group Policy deferral is active, as Intune's update ring policy does not automatically clear existing deferral configurations.

Exam trap

The trap here is that candidates assume the update ring deadline is absolute, but they overlook that local deferral settings can override the deadline by delaying when the update is even offered to the device.

How to eliminate wrong answers

Option B is wrong because a feature update policy does not conflict with quality update deadlines; feature updates and quality updates are managed independently, and a feature update policy would not prevent quality updates from installing within their deadline. Option C is wrong because the Intune Management Extension is not required for Windows Update for Business policies; these policies are delivered via the Windows Update service and do not depend on the Intune Management Extension. Option D is wrong because if the update ring were not assigned to the correct Azure AD group, the devices would not receive the policy at all, rather than receiving it but failing to meet the deadline; the question states the devices are configured with the deadline, so assignment is already correct.

Practice this question →
15
Multi-Selectmedium

Which TWO actions can you perform using Microsoft Intune to manage devices that are not compliant? (Choose two.)

Select 2 answers
A.Automatically send an email to the user's manager.
B.Remotely wipe the device.
C.Block access to corporate resources.
D.Send a push notification to the user.
E.Mark the device as noncompliant in the Intune admin center.
AnswersD, E

Intune can notify users when their device is noncompliant.

Why this answer

Microsoft Intune can send push notifications to noncompliant devices via the Company Portal app, alerting users about compliance issues and required actions. Option E is correct because marking a device as noncompliant in the Intune admin center is a manual action that updates the device's compliance state, which then triggers conditional access policies to block resources. Both actions are available for managing noncompliant devices without requiring user interaction or remote wipe.

Exam trap

The trap here is that candidates confuse the actions available directly in Intune (like sending notifications or marking noncompliant) with the downstream effects of conditional access policies (like blocking access), leading them to incorrectly select 'Block access to corporate resources' as an Intune action rather than a conditional access outcome.

Practice this question →
16
MCQhard

Users report that after updating to Windows 11, their devices are no longer receiving policy updates from Intune. The devices appear as active and compliant in the Intune console. What is the most likely cause?

A.The devices lost compliance after the upgrade.
B.The Intune management extension is outdated and needs to be updated.
C.The MDM authority changed to Configuration Manager.
D.Windows 11 is not supported by Microsoft Intune.
AnswerB

The management extension must be updated to support Windows 11 policies.

Why this answer

The Intune management extension is responsible for deploying PowerShell scripts, Win32 apps, and custom compliance policies. After a Windows 11 upgrade, the extension may become outdated or fail to re-register, causing a break in the policy retrieval loop even though the device appears active and compliant. This is a known behavior where the extension’s version mismatch prevents it from processing new policy assignments.

Exam trap

The trap here is that candidates assume compliance status guarantees policy delivery, but Intune separates compliance evaluation from policy enforcement, and a stale management extension can block policy retrieval while compliance remains intact.

How to eliminate wrong answers

Option A is wrong because the devices are listed as compliant in the Intune console, which directly contradicts a loss of compliance. Option C is wrong because the MDM authority is a tenant-level setting that does not change automatically due to an OS upgrade; if it had changed, the devices would not appear in the Intune console at all. Option D is wrong because Windows 11 is fully supported by Microsoft Intune, with specific minimum build requirements (21H2 or later) that are met by the upgrade.

Practice this question →
17
MCQhard

An organization uses Microsoft Intune for device management. They have a requirement that all Windows devices must have BitLocker enabled. They want to automatically remediate any device that has BitLocker disabled by running a PowerShell script. Which Intune feature should be used?

A.Device configuration profile to enable BitLocker
B.Device compliance policy with a noncompliance action to mark device as non-compliant
C.PowerShell script deployment with assignment to all devices
D.Proactive remediations with a detection script for BitLocker status and a remediation script to enable BitLocker
AnswerD

Proactive remediations can detect and automatically run remediation scripts.

Why this answer

Proactive remediations in Microsoft Intune are specifically designed to detect and automatically fix common configuration drift on managed devices. By using a detection script to check BitLocker status and a remediation script to enable BitLocker, this feature meets the requirement for automatic remediation without user interaction or manual re-mediation.

Exam trap

The trap here is that candidates often confuse Proactive remediations with simple script deployment, not realizing that Proactive remediations provide a detection-then-remediation loop that automatically re-applies the fix when drift is detected, whereas a one-time script deployment does not.

How to eliminate wrong answers

Option A is wrong because a device configuration profile can enable BitLocker on new or compliant devices, but it does not automatically remediate devices that later become non-compliant (e.g., after a user disables BitLocker). Option B is wrong because a device compliance policy with a noncompliance action only marks the device as non-compliant and can trigger conditional access blocks, but it does not run a PowerShell script to re-enable BitLocker. Option C is wrong because PowerShell script deployment runs the script once at assignment or during a scheduled sync, but it lacks the detection-and-remediation loop that Proactive remediations provide; it cannot automatically re-run when BitLocker is disabled again.

Practice this question →
18
MCQmedium

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

A.The devices failed to enroll properly.
B.The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.
C.The devices are running a non-Windows operating system.
D.The devices have names that do not match the naming convention.
AnswerB

A common compliance rule requires devices to sync within a set number of days.

Why this answer

The compliance policy includes a rule for 'Maximum days since last check-in', which checks the `lastSyncDateTime` property. Devices that have not synced within the configured threshold (e.g., 30 days) are marked as noncompliant. This is a common Intune compliance setting for Windows devices to ensure they regularly communicate with the service.

Exam trap

The MD-102 exam often tests the distinction between enrollment failures and compliance violations; the trap here is that candidates may incorrectly attribute noncompliance to enrollment issues rather than recognizing that a valid `lastSyncDateTime` indicates successful enrollment, and the noncompliant state is due to a missed check-in threshold.

How to eliminate wrong answers

Option A is wrong because failed enrollment would prevent the device from appearing in the output at all, or it would show an enrollment failure state, not a compliance state of 'noncompliant' with a valid lastSyncDateTime. Option C is wrong because the PowerShell command specifically retrieves Windows devices (as stated in the question), and non-Windows OS devices would not be returned by this query. Option D is wrong because device naming conventions are not a compliance policy setting in Intune; naming is used for identification and management, not compliance evaluation.

Practice this question →
19
Multi-Selecthard

Which THREE actions are available in Microsoft Intune's proactive remediations for Windows devices?

Select 3 answers
A.Run a detection script to identify issues.
B.Send email alerts when issues are detected.
C.Schedule scripts to run at regular intervals.
D.Run a remediation script to fix issues.
E.Mark devices as non-compliant if remediation fails.
AnswersA, C, D

Detection scripts identify problems.

Why this answer

Proactive remediations in Microsoft Intune are designed to detect and automatically fix common issues on Windows devices without requiring user intervention. Option A is correct because the workflow begins with a detection script that runs on the device to identify specific problems, such as registry misconfigurations or missing files. This script must return an exit code indicating whether an issue exists, which then triggers the remediation script if needed.

Exam trap

The trap here is that candidates often confuse proactive remediations with compliance policies or alerting features, assuming that failed remediation can automatically trigger non-compliance or email notifications, but Intune separates these functions into distinct policies and requires additional configuration for alerts.

Practice this question →
20
MCQeasy

Your organization uses Windows Autopilot for device provisioning. Users report that after initial setup, devices are not automatically enrolled in Microsoft Intune. What should you verify?

A.That a device configuration profile is assigned to the devices.
B.That the devices are registered in Windows Autopilot with a valid hardware hash.
C.That a Conditional Access policy is in place requiring Intune enrollment.
D.That a device compliance policy is assigned to the Autopilot devices.
AnswerB

Autopilot devices must be registered to automatically enroll in Intune.

Why this answer

Windows Autopilot requires devices to be registered in the Autopilot service with a valid hardware hash (or other unique identifier like PKID or serial number) so that the service can match the device during OOBE and trigger the enrollment process into Intune. Without a valid hardware hash, the device will not be recognized by Autopilot and will proceed through standard OOBE without automatic Intune enrollment.

Exam trap

The trap here is that candidates often confuse post-enrollment policies (configuration profiles, compliance, Conditional Access) with the prerequisite registration step, assuming any assigned policy will force enrollment, when in fact the device must first be recognized by Autopilot via a valid hardware hash.

How to eliminate wrong answers

Option A is wrong because a device configuration profile is used to apply settings after enrollment, not to trigger enrollment itself; Autopilot enrollment happens before configuration profiles are applied. Option C is wrong because Conditional Access policies control access to resources after enrollment, they do not initiate or enforce the enrollment process during Autopilot. Option D is wrong because device compliance policies are evaluated after a device is enrolled in Intune, they have no role in the initial enrollment step.

Practice this question →
21
MCQmedium

Your organization requires that all Windows 11 devices encrypt their drives with BitLocker. You have configured a BitLocker policy in Intune, but some devices show as 'Not evaluated' for the encryption status. What is the most likely reason?

A.The devices do not have a TPM chip.
B.The policy is not assigned to the correct group.
C.The devices have a conflicting Group Policy.
D.Secure Boot is disabled on the devices.
AnswerA

TPM is required for BitLocker, and without it the policy cannot be evaluated.

Why this answer

The 'Not evaluated' status in Intune indicates that the device has not yet checked in or the policy has not been applied, but the most common root cause for BitLocker policy evaluation failure is the absence of a TPM chip. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 for its default encryption method, and without it, the policy cannot be assessed, resulting in a 'Not evaluated' state rather than a compliance failure.

Exam trap

The trap here is that candidates often confuse 'Not evaluated' with a compliance failure or policy misassignment, but the key is that 'Not evaluated' specifically indicates the device could not even begin the assessment, often due to missing prerequisites like TPM.

How to eliminate wrong answers

Option B is wrong because if the policy is not assigned to the correct group, the device would typically show as 'Not applicable' or simply not appear in the policy report, not 'Not evaluated'. Option C is wrong because conflicting Group Policy would usually cause a 'Conflict' or 'Error' status, not 'Not evaluated', as Intune can still attempt evaluation and report the conflict. Option D is wrong because Secure Boot being disabled does not prevent BitLocker from evaluating the policy; it may cause a compliance failure or warning, but the policy would still be evaluated and show a status like 'Noncompliant' rather than 'Not evaluated'.

Practice this question →
22
MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate apps are installed automatically on new devices without user interaction. Which enrollment method should you use?

A.Android Enterprise fully managed
B.Android Enterprise dedicated device
C.Android Legacy device administrator
D.Android Enterprise work profile
AnswerA

Fully managed devices allow silent app installation.

Why this answer

Android Enterprise fully managed (A) is the correct enrollment method because it allows IT to enroll corporate-owned devices into Intune with full device control, enabling automatic, silent installation of required corporate apps without any user interaction. This mode uses the Android Enterprise API to push apps via managed Google Play as required or kiosk apps, ensuring they are installed before the device is handed to the user.

Exam trap

The trap here is that candidates often confuse 'fully managed' with 'dedicated device' because both are corporate-owned, but dedicated devices lack user association and cannot automatically install user-specific corporate apps without a user context.

How to eliminate wrong answers

Option B (Android Enterprise dedicated device) is wrong because it is designed for single-purpose or kiosk devices that are not assigned to a specific user, and while it can auto-install apps, it does not support user-based app targeting or user-specific corporate app deployment without a user context. Option C (Android Legacy device administrator) is wrong because it is a deprecated enrollment method that relies on Device Admin API, which does not support automatic app installation via managed Google Play and lacks the modern app management capabilities of Android Enterprise. Option D (Android Enterprise work profile) is wrong because it is intended for BYOD scenarios where a separate work profile is created on a personal device, and while apps can be pushed, they require user consent or interaction during profile setup and are not automatically installed on new devices without user involvement.

Practice this question →
23
MCQhard

Refer to the exhibit. You run this Microsoft Graph PowerShell command to retrieve managed devices. The output shows a device with a lastSyncDateTime of 5 days ago. What does this indicate?

A.The device was enrolled 5 days ago.
B.The device is non-compliant.
C.The device is unenrolled.
D.The device has not communicated with Intune for 5 days.
AnswerD

lastSyncDateTime indicates the last check-in time.

Why this answer

The `lastSyncDateTime` property in Microsoft Graph for Intune-managed devices indicates the most recent time the device successfully checked in with the Intune service. A value of 5 days ago means the device has not communicated with Intune for 5 days, which could be due to network issues, device inactivity, or configuration problems. This does not inherently mean the device is non-compliant or unenrolled—it simply reflects the last successful sync.

Exam trap

The trap here is that candidates often confuse `lastSyncDateTime` with enrollment date or compliance status, leading them to incorrectly assume the device is non-compliant or unenrolled, when in fact it simply indicates the last successful communication with Intune.

How to eliminate wrong answers

Option A is wrong because `lastSyncDateTime` records the last successful sync with Intune, not the enrollment date; enrollment date is tracked by the `enrolledDateTime` property. Option B is wrong because a device can be non-compliant for many reasons (e.g., missing required updates, jailbreak detection) and a stale sync date alone does not determine compliance—compliance is evaluated based on policy conditions, not sync recency. Option C is wrong because an unenrolled device would not appear in the managed devices list at all; the `lastSyncDateTime` field would be absent or the device would be removed from the inventory.

Practice this question →
24
MCQhard

Refer to the exhibit. A Windows 11 device assigned to this update ring is running a released version. What is the immediate behavior after the policy applies?

A.The device will uninstall the current Insider build and revert to the released version.
B.The device will be offered the latest Windows Insider Dev Channel build.
C.The device will defer all updates by 10 days.
D.The device will install the latest released quality update immediately.
AnswerB

Correct. The servicing channel directs the device to Dev Channel builds.

Why this answer

The exhibit shows an update ring policy configured with the 'Windows Insider Program' enabled and the 'Insider Channel' set to 'Dev Channel'. Since the device is currently on a released version, applying this policy will enroll it in the Windows Insider Program and offer the latest Dev Channel build. This is the immediate behavior because the policy triggers a check for the specified Insider build, not a deferral or quality update.

Exam trap

The trap here is that candidates may confuse the 'Deferral' settings with Insider build behavior, assuming deferral periods apply to Insider builds, when in fact enabling the Insider Program overrides deferrals for feature updates and directly offers the specified channel's build.

How to eliminate wrong answers

Option A is wrong because the policy does not uninstall the current build; it enrolls the device in the Insider Program, which offers a new build without reverting the existing OS. Option C is wrong because the policy explicitly enables Insider builds, overriding any deferral settings; deferrals apply to quality updates, not feature updates from Insider channels. Option D is wrong because the policy targets Insider Dev Channel builds, not released quality updates; quality updates are managed separately via deferral periods or other policies.

Practice this question →
25
Multi-Selectmedium

You are troubleshooting a Windows 11 device that fails to install a required Win32 app deployed via Intune. Which THREE logs or locations should you review?

Select 3 answers
A.Windows Update log (C:\Windows\WindowsUpdate.log)
B.Intune Management Extension logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs
C.The IntuneManagementExtension.log file in the agent directory.
D.Windows Registry under HKLM\Software\Microsoft\Intune
E.Windows Event Logs under Applications and Services Logs > Microsoft > Windows > AppLocker
AnswersB, C, E

These logs detail app installation attempts.

Why this answer

The Intune Management Extension (IME) is the agent responsible for processing Win32 app deployments on Windows 11 devices. Its logs, located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs, provide detailed information about the download, detection, and installation phases of Win32 apps, making them the primary source for troubleshooting installation failures.

Exam trap

The trap here is that candidates confuse the Intune Management Extension logs with the Windows Update log, assuming all app installations use the same logging mechanism, but Win32 apps rely solely on the IME agent, not Windows Update.

Practice this question →
26
Multi-Selectmedium

Which TWO actions can you perform using Microsoft Intune to manage Windows 10 devices?

Select 2 answers
A.Create local user accounts on the device
B.Remotely wipe a device
C.Configure DHCP settings
D.Apply BitLocker encryption policies
E.Add the device to an Active Directory group
AnswersB, D

Intune supports remote wipe.

Why this answer

Microsoft Intune supports a remote wipe action that can be triggered from the Intune console to reset a Windows 10 device to factory settings or selectively remove corporate data. This is a core device management capability used for data protection when a device is lost or stolen, leveraging the Windows 10 reset functionality via the Intune management channel.

Exam trap

The trap here is that candidates often confuse Intune's device management capabilities with on-premises Group Policy or Active Directory tasks, leading them to incorrectly select options like creating local users or managing DHCP, which are outside Intune's scope.

Practice this question →
27
MCQeasy

You need to ensure that Windows 10 devices are automatically upgraded to Windows 11 if they meet hardware requirements. Which policy should you configure in Microsoft Intune?

A.Assign a driver update policy.
B.Assign a quality update policy.
C.Assign an update ring for Windows 10.
D.Assign a Windows 10/11 feature update policy.
AnswerD

Feature update policies are used to upgrade Windows 10 to Windows 11.

Why this answer

A Windows 10/11 feature update policy in Microsoft Intune is specifically designed to manage the upgrade of Windows 10 devices to Windows 11. This policy uses Windows Update for Business to deliver the feature update (e.g., Windows 11 23H2) and automatically applies it to devices that meet the hardware requirements, ensuring a controlled upgrade process.

Exam trap

The trap here is that candidates confuse 'update rings' (which control update behavior like deferrals and deadlines) with 'feature update policies' (which actually push the OS version upgrade), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because a driver update policy only manages driver updates, not OS version upgrades; it cannot trigger a Windows 11 feature update. Option B is wrong because a quality update policy handles cumulative security and non-security patches (e.g., monthly updates), not feature updates that change the OS version. Option C is wrong because an update ring for Windows 10 configures deferral and update behavior for Windows 10 updates but does not initiate a feature upgrade to Windows 11; it only controls how existing Windows 10 updates are applied.

Practice this question →
28
MCQeasy

You need to deploy a custom PowerShell script to all Windows 10 devices enrolled in Intune. The script must run under the SYSTEM account. Which Intune feature should you use?

A.Proactive remediations
B.PowerShell scripts (Devices > Scripts)
C.Compliance policy
D.Device configuration profile
AnswerB

PowerShell scripts in Intune can run in the system context.

Why this answer

PowerShell scripts (Devices > Scripts) in Intune allow you to upload and assign custom PowerShell scripts that run under the SYSTEM account on Windows 10 devices. This feature is specifically designed for executing scripts during device enrollment or on a schedule, ensuring the script has elevated privileges without user interaction.

Exam trap

A common misconception is that Proactive remediations can replace custom PowerShell scripts. However, Proactive remediations require both a detection script and a remediation script, and are designed for automatic remediation of specific issues, not for general script deployment. Custom PowerShell scripts (Devices > Scripts) are the correct choice for deploying a standalone script under the SYSTEM account.

How to eliminate wrong answers

Option A is wrong because Proactive remediations are used for detecting and fixing common support issues with built-in detection and remediation scripts, not for deploying custom PowerShell scripts under the SYSTEM account. Option C is wrong because Compliance policies evaluate device settings against defined rules and do not execute scripts. Option D is wrong because Device configuration profiles manage settings via CSPs (Configuration Service Providers) and cannot run arbitrary PowerShell scripts.

Practice this question →
29
MCQeasy

You need to remotely wipe a lost corporate-owned iOS device enrolled in Microsoft Intune. The device is currently offline. What will happen when the device comes online?

A.The device must be unenrolled first and then wiped.
B.The device will be wiped immediately after a grace period of 24 hours.
C.The device will receive the wipe command the next time it checks in with Intune.
D.The wipe command will be queued only if the device is supervised.
AnswerC

Intune stores the command and delivers it on next device check-in.

Why this answer

When a remote wipe command is issued for an offline iOS device enrolled in Microsoft Intune, the command is stored in the Microsoft Intune service. The device will receive and execute the wipe command the next time it checks in with the Intune service, regardless of whether it is supervised or not. This check-in occurs periodically (typically every 8 hours) or when the device is powered on and connected to the internet.

Exam trap

The trap here is that candidates often confuse the offline wipe behavior with a mandatory grace period or think that supervision is required for remote wipe, when in fact Intune queues the command and executes it on the next check-in for any enrolled iOS device.

How to eliminate wrong answers

Option A is wrong because there is no requirement to unenroll the device before a remote wipe; the wipe command itself triggers the removal of management and corporate data. Option B is wrong because there is no built-in 24-hour grace period for offline wipe commands in Intune; the wipe executes immediately upon the next check-in, not after a fixed delay. Option D is wrong because the wipe command is not queued only for supervised devices; both supervised and unsupervised iOS devices can receive and execute a remote wipe command when they come online.

Practice this question →
30
MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to deploy a custom configuration profile to configure Wi-Fi settings for corporate devices. Which method should you use?

A.Use a Microsoft Entra ID (Azure AD) device configuration policy.
B.Use a PowerShell script to apply the settings.
C.Use a custom configuration profile in Intune.
D.Use a Microsoft Defender for Endpoint security policy.
AnswerC

Custom profiles allow deploying settings not available in built-in templates.

Why this answer

Intune's custom configuration profile allows you to deploy Apple Configurator–generated .mobileconfig files or custom XML/PLIST settings that are not available in the built-in Wi-Fi policy. This is the only method in Intune that supports arbitrary key-value pairs for iOS Wi-Fi configurations, such as EAP-TLS with specific certificate requirements or advanced proxy settings.

Exam trap

The trap here is that candidates confuse custom configuration profiles with built-in Wi-Fi policies, not realizing that advanced Wi-Fi settings (e.g., custom EAP types, proxy PAC URLs, or per-connection VPN) require a .mobileconfig file rather than the simple UI-based Wi-Fi policy.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID device configuration policies are used for identity and access management, not for deploying device-level Wi-Fi settings. Option B is wrong because PowerShell scripts cannot run on iOS devices; they are only supported on Windows, macOS, and Linux managed by Intune. Option D is wrong because Microsoft Defender for Endpoint security policies focus on threat protection and vulnerability management, not on configuring network connectivity settings like Wi-Fi profiles.

Practice this question →
31
MCQhard

Refer to the exhibit. You have an Intune configuration that includes a compliance policy and a device configuration policy for Windows 10 devices. You deploy both policies to a group of devices. After deployment, some devices are marked as non-compliant even though they have BitLocker enabled and Windows Defender Antivirus running. Which setting is most likely causing the conflict?

A.The compliance policy requires password, but the device configuration policy does not configure any password settings, leading to non-compliance.
B.The compliance policy requires encryption, but the device configuration policy does not enforce BitLocker startup PIN, causing compliance failure.
C.The device configuration policy sets scanParameter to 'fullscan', which may interfere with compliance checks.
D.The compliance policy requires Defender, but the device configuration policy sets cloudBlockLevel to 'high', which may conflict with some devices.
AnswerA

The compliance policy requires a password, but the device configuration policy does not set a password policy, so devices may not have a compliant password.

Why this answer

The compliance policy requires a password, but the device configuration policy does not configure any password settings. In Intune, compliance policies evaluate device settings independently of configuration policies; if a compliance policy mandates a password and the device lacks one (because the configuration policy doesn't enforce it), the device will be marked non-compliant. BitLocker and Defender being enabled do not satisfy a password requirement, so the conflict is the missing password configuration.

Exam trap

The trap here is that candidates assume enabling BitLocker and Defender automatically satisfies all compliance requirements, but Intune compliance policies evaluate each setting independently, so a missing password configuration will cause non-compliance even if other security features are present.

How to eliminate wrong answers

Option B is wrong because the compliance policy requires encryption, not a BitLocker startup PIN; the device configuration policy not enforcing a startup PIN does not cause compliance failure if BitLocker is enabled and encryption is satisfied. Option C is wrong because the scanParameter setting in a device configuration policy does not interfere with compliance checks; compliance policies evaluate security state, not scan parameters. Option D is wrong because cloudBlockLevel set to 'high' in a device configuration policy does not conflict with a compliance policy requiring Defender; both can coexist without causing non-compliance.

Practice this question →
32
Multi-Selecteasy

You need to deploy Windows updates to a group of devices using Microsoft Intune. Which TWO policies should you configure to ensure updates are applied within a maintenance window?

Select 2 answers
A.Assignment filter
B.Device compliance policy
C.Windows 10 and later update ring
D.Windows 10 and later quality update
E.Windows 10 and later feature update
AnswersC, E

Update rings manage update deferral, deadline, and maintenance windows.

Why this answer

(Windows 10 and later update ring) is correct because update rings in Microsoft Intune allow you to configure a maintenance window by setting the 'Active hours start' and 'Active hours end' values, which define a period during which updates are deferred and applied outside of those hours. This ensures updates are installed only during the specified maintenance window, aligning with the requirement to control update timing.

Exam trap

The trap here is that candidates may confuse 'Windows 10 and later quality update' (a non-existent policy) with the actual quality update settings within an update ring, or assume that a device compliance policy can enforce update timing, when in fact only update rings provide the maintenance window configuration.

Practice this question →
33
MCQhard

Refer to the exhibit. You create a custom configuration profile in Intune for Windows 10 devices. The profile is assigned to a test device, but the telemetry setting is not applied. The device is managed and compliant. What is the most likely reason?

A.The device is not compliant with the baseline policy.
B.The OMA-URI path for AllowTelemetry is incorrect.
C.The AllowTelemetry policy value must be an integer, not a string, or the device needs a Windows 10 version that supports this setting.
D.The custom profile conflicts with a built-in policy that sets telemetry to full.
AnswerC

AllowTelemetry expects an integer (0-3); OMA-URI string type may cause failure. Also, some settings require specific builds.

Why this answer

The AllowTelemetry setting in a custom OMA-URI profile requires the value to be an integer (0–3) and the device must be running Windows 10 version 1703 or later. If the value is entered as a string (e.g., "2" instead of 2), Intune will not apply the policy, and the device will silently ignore the configuration. Additionally, older Windows 10 builds do not support this OMA-URI path and will fail to process it.

Exam trap

The trap here is that candidates assume any OMA-URI value will be accepted regardless of data type, or they overlook the version requirement, leading them to incorrectly blame the OMA-URI path or compliance status instead of the value format or OS version.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as compliant, and compliance status does not prevent a custom profile from applying—non-compliance would block access to resources but not stop policy application. Option B is wrong because the OMA-URI path for AllowTelemetry is correctly specified as ./Device/Vendor/MSFT/Policy/Config/System/AllowTelemetry; an incorrect path would generate a sync error in Intune, not a silent failure. Option D is wrong because built-in policies do not conflict with custom profiles in a way that silently blocks application; conflicts are reported in the device's policy status, and a conflicting built-in policy would still attempt to apply the custom setting, not prevent it from being applied.

Practice this question →
34
MCQeasy

Your company has 500 iOS devices enrolled in Microsoft Intune. The devices are used by sales representatives to access customer data. You need to ensure that if a device is lost or stolen, an administrator can remotely lock the device and display a custom message with a phone number to call. Which remote action should the administrator use?

A.Remote lock
B.Reset passcode
C.Wipe
D.Retire
AnswerA

Correct. Remote lock locks the device and displays a custom message.

Why this answer

'Remote lock' locks the device and allows a custom message to be displayed. Option B is wrong because 'Reset passcode' changes the passcode but does not display a custom message. Option C is wrong because 'Wipe' performs a factory reset, which erases all data and prevents the message from being shown.

Option D is wrong because 'Retire' removes company data only, does not lock the device.

Practice this question →
35
MCQhard

You manage devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. The app requires installation in the system context. Which deployment method should you use?

A.Microsoft Store for Business app
B.Win32 app
C.Microsoft Intune LOB app (msi/appx)
D.Web link
AnswerB

Win32 apps can be unsigned and run in system context.

Why this answer

Win32 apps in Microsoft Intune support installation in the system context via the 'Install behavior' setting, and they can be deployed using a custom installation script that handles certificate trust issues (e.g., by installing the signing certificate first or using a silent install switch). This method also allows the app to run with elevated privileges, which is required for system-context installation, and does not depend on the device trusting the app's signing certificate at deployment time.

Exam trap

The trap here is that candidates often assume 'LOB app' must use the Intune LOB app type (MSI/APPX), but the requirement for system context and untrusted certificate forces the use of the Win32 app type, which provides the flexibility to handle certificate trust via scripting.

How to eliminate wrong answers

Option A is wrong because Microsoft Store for Business apps require the device to trust the Microsoft Store certificate chain and cannot be deployed in the system context; they are per-user installs. Option C is wrong because Intune LOB apps (MSI/APPX) require the app to be signed with a certificate that is already trusted by the device (e.g., via a PKI or pre-installed root), and they do not support custom installation logic to bypass certificate trust issues. Option D is wrong because a web link simply opens a URL in the browser and does not install any software, let alone in the system context.

Practice this question →
36
MCQhard

Refer to the exhibit. You are creating a device filter in Microsoft Intune to target a policy to Windows 10 Pro devices. The filter should only apply to devices running OS build 1904x (20H1 or later). However, some devices with build 1904x and SKU Professional are not receiving the policy. What is the most likely reason?

A.The -startsWith operator does not work for osVersion property.
B.The device must be enrolled via Autopilot for filters to apply.
C.The filter rule syntax is incorrect because of the parentheses.
D.The device.skuFamily property value is case-sensitive and may not match 'Professional'.
AnswerD

Case sensitivity can cause mismatches.

Why this answer

The `device.skuFamily` property in Microsoft Intune is case-sensitive. When creating a device filter rule, the value 'Professional' must exactly match the case of the SKU family string returned by the device. If the actual SKU family is reported as 'Professional' with a different casing (e.g., 'professional' or 'PROFESSIONAL'), the filter will not match, causing the policy not to apply to those devices.

Exam trap

The trap here is that candidates often assume property values in Intune filters are case-insensitive, leading them to overlook the exact casing requirement for `device.skuFamily`, and instead focus on unrelated syntax or enrollment requirements.

How to eliminate wrong answers

Option A is wrong because the `-startsWith` operator is fully supported for the `osVersion` property in Intune device filters, and it is commonly used to match OS build versions like '1904x'. Option B is wrong because device filters in Intune do not require Autopilot enrollment; they work with any enrolled Windows device, regardless of enrollment method. Option C is wrong because parentheses are valid in filter rule syntax for grouping conditions, and the provided syntax does not contain an error related to parentheses.

Practice this question →
37
MCQeasy

A user reports that their Windows 11 device is not receiving security updates. The device is enrolled in Microsoft Intune and shows as compliant. You check the Update Rings policy and see that the device is assigned to a ring that defers updates by 30 days. What should you do to ensure the device gets the latest security updates immediately?

A.Change the compliance policy to require immediate updates.
B.Run Windows Update manually on the device.
C.Re-enroll the device in Intune.
D.Assign the device to a different update ring with a 0-day deferral.
AnswerD

This ensures the device receives updates without delay.

Why this answer

The device is assigned to an update ring that defers updates by 30 days, which is why it is not receiving the latest security updates despite being compliant. To immediately receive the latest updates, you must assign the device to a different update ring with a 0-day deferral, as update rings in Microsoft Intune control the deferral period for Windows Update for Business. Changing the ring triggers the device to check for updates based on the new policy, ensuring immediate availability of security updates.

Exam trap

The trap here is that candidates may think manually running Windows Update or changing compliance policies can override the update ring deferral, but only reassigning to a different ring with a shorter deferral period will actually change the update behavior.

How to eliminate wrong answers

Option A is wrong because compliance policies in Intune do not control update deferral settings; they enforce device health and configuration requirements, not update ring deferral periods. Option B is wrong because manually running Windows Update on the device will still respect the deferral period set by the assigned update ring policy, so it will not bypass the 30-day delay. Option C is wrong because re-enrolling the device in Intune does not change the update ring assignment; the device would still be subject to the same deferral policy unless the ring assignment is explicitly changed.

Practice this question →
38
Multi-Selectmedium

Which TWO settings can you configure in a Microsoft Intune device compliance policy for Android Enterprise devices?

Select 2 answers
A.Encryption
B.Require a password to unlock the device
C.Minimum OS version
D.Disable camera
E.Maximum OS version
AnswersB, C

This is a compliance setting.

Why this answer

Microsoft Intune device compliance policies for Android Enterprise require a password to unlock the device as a configurable setting. This setting enforces a lock screen password, which is a fundamental security requirement for compliance evaluation. It directly controls device access and is a standard compliance check for Android Enterprise work profiles and fully managed devices.

Exam trap

The trap here is that candidates confuse device compliance policies with device configuration profiles, assuming settings like disabling the camera or controlling encryption are part of compliance, when they are actually managed under separate configuration policies.

Practice this question →
39
MCQmedium

Refer to the exhibit. You run the PowerShell cmdlet in Microsoft Graph to list managed Windows devices. The output shows that several devices have a complianceState of 'noncompliant' but lastSyncDateTime is recent. What is the most likely reason for noncompliance?

A.The devices are running a non-Windows OS.
B.The devices have not synced recently.
C.The devices do not meet the assigned compliance policies.
D.The admin lacks permissions to view compliance details.
AnswerC

Noncompliance occurs when devices fail compliance policy rules.

Why this answer

A device's complianceState is determined by evaluating its configuration against assigned compliance policies. Even if lastSyncDateTime is recent, the device will be marked 'noncompliant' if it fails any of the policy checks (e.g., missing required updates, encryption not enabled, or a required antivirus solution not running). The sync timestamp only indicates when the device last communicated with Intune, not whether it meets policy requirements.

Exam trap

The trap here is that candidates assume a recent sync timestamp implies the device is healthy or compliant, when in fact sync and compliance are separate attributes—a device can be fully synced yet persistently noncompliant due to policy violations.

How to eliminate wrong answers

Option A is wrong because the cmdlet specifically queries 'managed Windows devices', so the output only includes Windows devices; a non-Windows OS would not appear in these results. Option B is wrong because the exhibit explicitly shows that lastSyncDateTime is recent, meaning the devices have synced recently; noncompliance is not caused by a lack of sync. Option D is wrong because if the admin lacked permissions to view compliance details, the cmdlet would either fail or return an access-denied error, not show a complianceState of 'noncompliant' for specific devices.

Practice this question →
40
MCQhard

Refer to the exhibit. The JSON shows a device queried from Microsoft Graph. The device shows as compliant, but the user reports that they are unable to access corporate resources. The conditional access policy requires device compliance. What is a likely reason for the access issue?

A.The device has not synced recently, so the compliance state may be outdated.
B.The device compliance state is actually non-compliant.
C.The device is managed by MAM instead of MDM.
D.The device enrollment date is too recent.
AnswerA

Last sync is at 10:30, which might be too old for conditional access.

Why this answer

The device's compliance state is determined at the time of the last check-in with Microsoft Intune. If the device has not synced recently, the compliance state shown in Microsoft Graph may be stale, and the Conditional Access policy will evaluate the last known state. Even though the device was compliant at last check-in, changes in device health, configuration, or user context since then could cause access to be denied until a fresh compliance evaluation occurs.

Exam trap

The trap here is that candidates assume the compliance state in Graph is always current, but Microsoft intentionally tests the concept that compliance is evaluated at sync time and can become stale, leading to a mismatch between the reported state and actual device posture.

How to eliminate wrong answers

Option B is wrong because the exhibit explicitly shows the device as compliant, so the compliance state is not actually non-compliant; the issue is that the state may be outdated. Option C is wrong because MAM (Mobile Application Management) is used for app-level management without device enrollment, but the device is enrolled (as shown by enrollmentType and managementType in the JSON), so it is managed by MDM, not MAM. Option D is wrong because the enrollment date being recent does not inherently cause access issues; Conditional Access policies evaluate compliance state, not enrollment age, and a newly enrolled device can be compliant immediately after its first sync.

Practice this question →
41
MCQhard

You manage devices with Microsoft Intune. You need to ensure that only devices with a specific BIOS serial number can enroll. What should you configure?

A.Enrollment restrictions that block devices by hardware identifier.
B.A device category with a dynamic group based on BIOS serial.
C.A device compliance policy that checks BIOS serial number.
D.A Conditional Access policy that requires a compliant device.
AnswerA

Enrollment restrictions can block devices based on hardware IDs like BIOS serial numbers.

Why this answer

Intune's enrollment restrictions allow you to block or allow devices based on hardware identifiers such as the BIOS serial number. By adding the specific BIOS serial numbers to the blocked hardware identifiers list, you can effectively prevent any device that does not match the allowed serials from enrolling. This is the only built-in mechanism in Intune that directly controls enrollment eligibility based on hardware characteristics.

Exam trap

The trap here is that candidates often confuse post-enrollment controls (compliance policies, Conditional Access) with pre-enrollment controls (enrollment restrictions), leading them to select options that only take effect after the device has already enrolled.

How to eliminate wrong answers

Option B is wrong because device categories and dynamic groups are used for organizational and targeting purposes after enrollment, not to block or allow enrollment itself. Option C is wrong because a device compliance policy checks conditions after enrollment and can mark a device as noncompliant, but it does not prevent the device from enrolling in the first place. Option D is wrong because a Conditional Access policy that requires a compliant device only applies after the device is enrolled and registered in Azure AD; it cannot block the initial enrollment process.

Practice this question →
42
MCQmedium

You need to configure a Windows 10 device to automatically install updates from a specific branch readiness level. Which setting in the Update ring policy should you configure?

A.Automatic update behavior
B.Quality update deferral period
C.Feature update deferral period
D.Branch readiness level
AnswerD

This setting determines the branch for updates.

Why this answer

The Branch readiness level setting in an Update ring policy directly controls which Windows Insider or semi-annual channel (e.g., Preview, Broad) a device receives updates from, determining the specific branch readiness level for automatic updates. This is the correct setting to configure when you need to specify a branch readiness level for automatic installation.

Exam trap

The trap here is that candidates often confuse deferral periods (which only delay updates within a chosen branch) with the Branch readiness level setting, which actually selects the branch itself, leading them to pick Quality or Feature update deferral period instead.

How to eliminate wrong answers

Option A is wrong because Automatic update behavior controls when and how updates are installed (e.g., auto install at maintenance time, notify download), not which branch readiness level is used. Option B is wrong because Quality update deferral period only delays the installation of quality (security) updates by a set number of days, it does not select the branch readiness level. Option C is wrong because Feature update deferral period only delays the installation of feature updates by a set number of days, it does not determine the branch readiness level.

Practice this question →
43
MCQhard

A company uses Microsoft Intune to manage macOS devices. A security audit requires that all macOS devices must have FileVault encryption enabled. Compliance policy reports show that 90% of devices are compliant, but 10% are non-compliant. You review the non-compliant devices and find that FileVault is enabled on them. What is the most likely cause of the non-compliance?

A.FileVault is not actually enabled on those devices.
B.The recovery key is not escrowed to Intune.
C.The devices are not supervised.
D.The compliance policy is not assigned to those devices.
AnswerB

Key escrow is required for compliance.

Why this answer

The most likely cause is that the recovery key is not escrowed to Intune. Even though FileVault is enabled on the device, Intune's compliance policy checks for the presence of the FileVault recovery key in its escrow database. If the key is missing, the device is marked non-compliant because Intune cannot verify full management and recovery capability, which is a key security requirement.

Exam trap

The trap here is that candidates assume enabling FileVault alone satisfies compliance, but Intune requires the recovery key to be escrowed to confirm full manageability and recovery capability.

How to eliminate wrong answers

Option A is wrong because the scenario explicitly states that FileVault is enabled on the non-compliant devices, so the issue is not that encryption is absent. Option C is wrong because macOS devices do not require supervision for FileVault compliance; supervision is an iOS/iPadOS concept and does not apply to macOS in this context. Option D is wrong because if the compliance policy were not assigned, the devices would not appear in compliance reports at all, or would show as 'not evaluated' rather than 'non-compliant'.

Practice this question →
44
MCQhard

You are implementing Windows Autopilot for a new fleet of devices. You need to ensure that during the out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID and is enrolled in Intune. Which configuration is required?

A.Upload corporate identifiers for each device.
B.Configure the Enrollment Status Page in Intune.
C.Create an Autopilot deployment profile assigned to the devices.
D.Create a dynamic device group in Microsoft Entra ID.
AnswerC

The profile defines the OOBE experience, including Entra ID join and Intune enrollment.

Why this answer

An Autopilot deployment profile specifies the out-of-box experience (OOBE) settings, including the option to automatically join the device to Microsoft Entra ID and enroll it in Intune. Without a deployment profile assigned to the device, Autopilot will not enforce these behaviors during OOBE.

Exam trap

The trap here is that candidates often confuse the prerequisite step of registering the device (uploading corporate identifiers) with the configuration step that actually defines the OOBE behavior (the deployment profile), leading them to select Option A instead of C.

How to eliminate wrong answers

Option A is wrong because uploading corporate identifiers (e.g., hardware hashes) registers the device with Autopilot but does not configure the OOBE behavior; it only enables the device to be recognized by the Autopilot service. Option B is wrong because the Enrollment Status Page (ESP) controls the post-enrollment device setup experience (e.g., app and policy installation progress), not the initial join or enrollment actions during OOBE. Option D is wrong because a dynamic device group in Microsoft Entra ID is used for targeting policies or applications after enrollment, not for triggering or configuring the Autopilot OOBE flow.

Practice this question →
45
MCQeasy

Your organization uses Microsoft Intune to manage Windows devices. You need to ensure that only IT administrators can manually install apps from the Microsoft Store. Which setting should you configure in a device restriction policy?

A.Enable 'Private store only' in Microsoft Store for Business settings.
B.Disable 'Automatic app updates' in the device restriction policy.
C.Set 'Allow application store' to 'Block' for non-admin users.
D.Configure 'Require a password for app purchases' to 'Yes'.
AnswerC

Blocking the store prevents non-admins from installing apps manually.

Why this answer

The 'Allow application store' setting in a device restriction policy controls whether users can access the Microsoft Store. Setting it to 'Block' for non-admin users prevents them from manually installing apps, while IT administrators (who have local admin rights) can still install apps via the Store. This setting is enforced through Intune's policy management and applies to Windows devices managed by Microsoft Intune.

Exam trap

The trap here is that candidates often confuse the 'Allow application store' setting with store visibility or purchase controls, thinking that blocking the entire store or requiring a password for purchases achieves the same result, but only the explicit block for non-admin users prevents manual installations.

How to eliminate wrong answers

Option A is wrong because 'Private store only' in Microsoft Store for Business settings restricts the visible catalog to private apps but does not prevent non-admin users from manually installing apps; it only limits which apps they see. Option B is wrong because disabling 'Automatic app updates' controls whether apps update automatically, not whether users can manually install apps from the Store. Option D is wrong because 'Require a password for app purchases' applies to purchase transactions, not to manual installations of free apps or to blocking installation by non-admin users.

Practice this question →
46
MCQmedium

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. The user has confirmed that the device is enrolled and connected to the internet. Which is the most likely cause?

A.The device is not enrolled in Microsoft Intune.
B.The device has a Device Lock policy applied that blocks evaluation.
C.The Intune Management Extension is not installed or not running.
D.The user does not have a Microsoft 365 E3 license assigned.
AnswerC

The Intune Management Extension is needed for compliance evaluation on Windows devices.

Why this answer

The Intune Management Extension (IME) is the component responsible for processing and applying compliance policies on Windows devices. If the IME is not installed or not running, the device cannot evaluate compliance policies, resulting in a 'Not evaluated' status in the Intune admin center, even though the device is enrolled and connected to the internet.

Exam trap

The trap here is that candidates confuse enrollment status with policy evaluation readiness, assuming that if a device is enrolled and online, compliance policies should automatically apply, overlooking the critical role of the Intune Management Extension service.

How to eliminate wrong answers

Option A is wrong because the user confirmed the device is enrolled, and the 'Not evaluated' status specifically indicates enrollment is recognized but policy evaluation has failed. Option B is wrong because a Device Lock policy would prevent access or configuration changes but does not block the compliance evaluation engine from running; the device would still show an evaluation status. Option D is wrong because while a Microsoft 365 E3 license is required for Intune enrollment, the device is already enrolled, so licensing is not the immediate cause of the 'Not evaluated' status.

Practice this question →
47
Multi-Selecteasy

You need to deploy a Windows 10 feature update to a pilot group. Which TWO steps are required in Microsoft Intune?

Select 2 answers
A.Create a feature update policy for Windows 10.
B.Create a driver update policy for Windows 10.
C.Assign the feature update policy to a device group containing pilot devices.
D.Create an update ring for Windows 10.
E.Create a compliance policy for Windows 10.
AnswersA, C

Feature update policy specifies the target version.

Why this answer

A is correct because a feature update policy in Microsoft Intune is the specific policy type designed to control which Windows 10 feature update version (e.g., 22H2) is offered to devices. This policy allows you to defer or approve updates for pilot groups, ensuring controlled rollout before broad deployment.

Exam trap

The trap here is confusing update rings (which control deferral periods and deadlines) with feature update policies (which explicitly set the target version), leading candidates to select 'Create an update ring' instead of the correct feature update policy.

Practice this question →
48
MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with TPM 2.0 and Secure Boot enabled can access Microsoft 365 resources. What is the best approach?

A.Create an app protection policy targeting Microsoft 365 apps.
B.Create a device configuration policy to enable TPM and Secure Boot.
C.Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.
D.Create a Conditional Access policy requiring TPM and Secure Boot.
AnswerC

This combination enforces the requirements and blocks access.

Why this answer

Device compliance policies in Microsoft Intune can evaluate hardware attributes like TPM version and Secure Boot status. When combined with a Conditional Access policy that blocks non-compliant devices, this enforces the security requirements before granting access to Microsoft 365 resources. This two-step approach ensures only devices meeting the hardware security baseline can authenticate.

Exam trap

The trap here is that candidates often think a Conditional Access policy alone can directly check hardware features, but it actually requires a compliance policy to report those attributes first.

How to eliminate wrong answers

Option A is wrong because app protection policies (MAM) manage data protection within apps (e.g., copy/paste restrictions) and do not evaluate device-level hardware features like TPM or Secure Boot. Option B is wrong because device configuration policies are used to configure settings (e.g., enable BitLocker) but cannot enforce access control; they lack the ability to block devices from accessing cloud resources. Option D is wrong because a Conditional Access policy alone cannot evaluate TPM or Secure Boot; it relies on device compliance status, which must be reported by Intune via a compliance policy.

Practice this question →
49
Multi-Selecthard

Which THREE steps are required to deploy a Windows 10 feature update (e.g., version 22H2) to a group of test devices using Intune?

Select 3 answers
A.Create a Windows 10 feature update deployment policy.
B.Ensure the test devices are in a group that targets the feature update.
C.Create a device compliance policy for the target version.
D.Create a Windows 10 update ring with expedited updates.
E.Assign the policy to the test device group.
AnswersA, B, E

A feature update deployment policy is needed.

Why this answer

A Windows 10 feature update deployment policy is the specific Intune policy type designed to deliver feature updates (like version 22H2) to devices. This policy allows you to specify the target version and control the rollout, which is required for deploying feature updates via Intune.

Exam trap

The trap here is confusing update rings (which manage quality updates and deferral settings) with feature update policies (which target specific feature versions), leading candidates to incorrectly select expedited update rings for feature updates.

Practice this question →
50
Multi-Selecthard

Which THREE prerequisites are required to enable Windows Autopilot for existing devices?

Select 3 answers
A.The device must be domain-joined to an on-premises Active Directory
B.The device must be running Windows 10 or Windows 11 Pro, Enterprise, or Education edition
C.The device must have a TPM 2.0 chip
D.The device must have internet connectivity during the out-of-box experience
E.The device must be registered in Intune using its hardware hash
AnswersB, D, E

Autopilot requires these editions.

Why this answer

Windows Autopilot requires a supported edition of Windows 10 or Windows 11 (Pro, Enterprise, or Education) to access the necessary cloud-based provisioning and enrollment features. Home editions lack the required MDM enrollment capabilities and policy support, making them incompatible with Autopilot deployment.

Exam trap

The trap here is that candidates often assume TPM 2.0 is universally required for all Autopilot scenarios, but it is only mandatory for self-deploying mode and pre-provisioning, not for user-driven Autopilot on existing devices.

Practice this question →
51
MCQmedium

You manage Windows 10 devices with Microsoft Intune. Users report that after a recent Windows update, some devices fail to enroll in mobile device management (MDM). You verify that the devices are domain-joined and can reach the internet. Which configuration should you check first?

A.Confirm that the user is assigned a Microsoft Entra ID P1 license.
B.Verify that the BitLocker recovery key is backed up to Microsoft Entra ID.
C.Ensure the Windows Defender Firewall allows inbound RPC traffic.
D.Check that the MDM enrollment URL (https://enrollment.manage.microsoft.com) is reachable and not blocked by a proxy.
AnswerD

The enrollment URL must be reachable for successful MDM enrollment.

Why this answer

The most common cause of MDM enrollment failure after a Windows update is a change in proxy or firewall settings that blocks the MDM enrollment URL. Since the devices can reach the internet generally but fail specifically during enrollment, verifying that `https://enrollment.manage.microsoft.com` is reachable and not blocked by a proxy is the logical first troubleshooting step. This URL is required for the device to communicate with the Intune MDM service during the enrollment process.

Exam trap

The trap here is that candidates often assume a general internet connection means all services are reachable, but MDM enrollment requires specific URLs that may be blocked by a proxy or firewall even when general browsing works.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID P1 licenses are required for features like Conditional Access, but not for basic MDM enrollment; a user needs an Intune license (e.g., Microsoft 365 E3/E5 or standalone Intune) to enroll. Option B is wrong because BitLocker recovery key backup to Microsoft Entra ID is a post-enrollment compliance or recovery feature, not a prerequisite for MDM enrollment. Option C is wrong because inbound RPC traffic is not required for MDM enrollment; the device initiates outbound HTTPS (TCP 443) connections to Intune, and inbound RPC is irrelevant to this process.

Practice this question →
52
MCQhard

Refer to the exhibit. You are reviewing a Win32 app configuration in Microsoft Intune. The app is not installing on some Windows 10 devices. Which is the most likely reason?

A.The devices have an OS version lower than 10.0.19041.
B.The install command line is missing the /silent switch.
C.The detection rule path is incorrect.
D.The install experience is set to system, but should be user.
AnswerA

The requirement rule sets a minimum OS version of 10.0.19041.

Why this answer

The exhibit shows the 'Minimum OS version' requirement set to 10.0.19041 (Windows 10 version 20H1/2004). Devices with an OS build lower than this threshold will fail to install the Win32 app, as Intune enforces this requirement before executing the installation command. This is a common configuration issue when deploying apps to a mixed-OS environment.

Exam trap

The trap here is that candidates often focus on the install command or detection rules as the cause of installation failure, overlooking the explicit OS version requirement that prevents installation from even starting on incompatible devices.

How to eliminate wrong answers

Option B is wrong because the install command line is not missing the /silent switch; the exhibit shows the command includes '--silent' (or a similar silent flag), so the absence of /silent is not the issue. Option C is wrong because the detection rule path being incorrect would cause the app to appear as 'Not Installed' on devices where it actually installed, not prevent installation from starting. Option D is wrong because the install experience set to 'system' is correct for system-wide installations; setting it to 'user' would install per-user and could cause issues, but the exhibit shows 'system' is selected, so this is not the problem.

Practice this question →
53
Multi-Selectmedium

Which THREE are valid Windows Autopilot deployment scenarios?

Select 3 answers
A.Self-deploying
B.App-driven
C.User-driven
D.Policy-driven
E.White glove
AnswersA, C, E

Self-deploying is for shared devices.

Why this answer

Windows Autopilot self-deploying is a valid deployment scenario where a device can be automatically configured without user interaction, using a hardware hash to enroll in Azure AD and Intune. This scenario is ideal for kiosks, digital signage, or shared devices that require zero-touch provisioning.

Exam trap

The trap here is that candidates confuse deployment phases or management concepts (like app or policy deployment) with the three official Autopilot deployment scenarios, which are strictly self-deploying, user-driven, and white glove (pre-provisioning).

Practice this question →
54
Multi-Selecteasy

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows devices? (Choose two)

Select 2 answers
A.Reset a user's password.
B.View hardware inventory of a device.
C.Remotely sync a device with Intune.
D.Manage on-premises Active Directory objects.
E.Assign Microsoft 365 licenses to a user.
AnswersB, C

Inventory is visible in the device properties.

Why this answer

The Microsoft Intune admin center provides a hardware inventory view for managed Windows devices, displaying details such as processor, RAM, disk space, and firmware version. This data is collected via the Intune Management Extension and device inventory reports, enabling administrators to assess device compliance and readiness without requiring on-premises tools.

Exam trap

The trap here is that candidates confuse user management tasks (password reset, license assignment) with device management actions, or assume Intune can manage on-premises AD objects, when Intune's scope is strictly cloud-based device and app management via MDM and MAM.

Practice this question →
55
MCQhard

You manage Windows 10 devices with Microsoft Intune. You need to deploy a PowerShell script that runs every time a device boots, before the user logs on. The script is signed. What is the correct deployment approach?

A.Use a proactive remediation script set to run at device startup.
B.Package the script as a Win32 app and deploy it with installation behavior set to 'System'.
C.Deploy the script as a PowerShell script in Intune, configured to run in system context at device startup.
D.Add the script as a device configuration profile (OMA-URI).
AnswerC

This allows the script to run before user logon in system context.

Why this answer

Intune's PowerShell script deployment supports running scripts in the system context at device startup, which executes before user logon. This meets the requirement for a signed script that runs every boot, leveraging the 'Run this script using the logged on credentials' option unchecked and 'Run script in 64-bit PowerShell Host' as needed.

Exam trap

The trap here is that candidates confuse 'run at device startup' with 'run during app installation' (Option B) or assume proactive remediations (Option A) can be triggered at boot, when in fact only the PowerShell script deployment in Intune supports the exact 'device startup' trigger in system context.

How to eliminate wrong answers

Option A is wrong because proactive remediations are designed for detecting and fixing common issues on existing devices, not for running arbitrary scripts at every boot before logon; they run on a schedule or on demand, not at startup. Option B is wrong because packaging a script as a Win32 app with installation behavior set to 'System' runs the script once during app installation, not every time the device boots. Option D is wrong because device configuration profiles (OMA-URI) are used for configuring device settings via CSPs, not for executing PowerShell scripts.

Practice this question →
56
MCQhard

You manage devices with Microsoft Intune and have enabled co-management with Configuration Manager. You need to ensure that Windows Update policies are managed by Intune for all co-managed Windows 10 devices. Which workload slider should you set in Configuration Manager?

A.Endpoint Protection
B.Windows Update Policies
C.Client Apps
D.Device Configuration
AnswerB

Correct. This workload controls update management.

Why this answer

In a co-management scenario, the workload slider determines which management authority handles specific workloads. Setting the 'Windows Update Policies' slider to 'Intune' directs Windows Update for Business policies to be applied via Intune, overriding Configuration Manager policies for co-managed Windows 10 devices. This ensures that update rings and deferral settings configured in Intune are enforced.

Exam trap

The trap here is that candidates often confuse the 'Windows Update Policies' slider with the 'Endpoint Protection' slider, mistakenly thinking update management is part of security policies, but the slider specifically governs Windows Update for Business policies, not Defender or antivirus updates.

How to eliminate wrong answers

Option A is wrong because the Endpoint Protection workload slider controls antimalware and firewall policies (e.g., Defender for Endpoint), not Windows Update policies. Option C is wrong because the Client Apps workload slider governs the deployment of applications (e.g., MSI, Win32 apps) from Intune or Configuration Manager, not update management. Option D is wrong because the Device Configuration workload slider manages settings like compliance policies and resource access (e.g., VPN, Wi-Fi), not Windows Update policies.

Practice this question →
57
MCQmedium

You manage Windows 10 devices with Microsoft Intune. A user reports that their device is not receiving required compliance policies, and the device status in Intune shows 'Not evaluated' for compliance. You confirm the device is enrolled and able to sync. What should you check first?

A.Verify that the user is assigned an Intune license.
B.Run the 'dsregcmd /status' command to check the device registration status.
C.Check that the device has a TPM chip enabled and Secure Boot turned on.
D.Ensure the compliance policy is assigned to a group that includes the user or device.
AnswerD

The compliance policy must be assigned to a group containing the user or device.

Why this answer

A compliance policy must be assigned to a group containing the user or device for it to be evaluated. Even if the device is enrolled and syncing, without assignment the policy will not apply, resulting in a 'Not evaluated' status in Intune.

Exam trap

The trap here is that candidates confuse 'Not evaluated' with a device health or configuration issue, when it actually points to a missing policy assignment or group membership problem.

How to eliminate wrong answers

Option A is wrong because an Intune license is required for enrollment and sync, which the user already has (device is enrolled and syncing), so licensing is not the cause of 'Not evaluated' status. Option B is wrong because 'dsregcmd /status' checks Azure AD registration and hybrid join status, not compliance policy assignment or evaluation; the device is already enrolled and syncing, indicating registration is fine. Option C is wrong because TPM and Secure Boot are prerequisites for BitLocker or device health attestation, not for compliance policy evaluation; their absence would cause specific compliance failures, not a 'Not evaluated' status.

Practice this question →
58
MCQhard

You are troubleshooting a Windows 11 device that is enrolled in Microsoft Intune. The device shows 'Pending' status for a required app deployment. The app is a line-of-business (LOB) app. The device has been online for the past 24 hours. What is the most likely cause?

A.The device does not have internet connectivity to download the app.
B.The device's certificate for Intune is expired.
C.The Intune management extension is not installed on the device.
D.The device requires a restart to complete previous updates.
AnswerC

LOB apps require the extension, which may be missing.

Why this answer

The Intune management extension is responsible for deploying line-of-business (LOB) apps and PowerShell scripts on Windows devices. If this extension is not installed, the device will show a 'Pending' status for required app deployments because the Intune service cannot initiate the download or installation. Since the device has been online, connectivity is not the issue, and the extension must be present to process the deployment.

Exam trap

The trap here is that candidates often assume a 'Pending' status is always due to network issues or pending reboots, but Microsoft specifically tests the requirement of the Intune management extension for LOB app deployments on Windows devices.

How to eliminate wrong answers

Option A is wrong because the device has been online for the past 24 hours, indicating internet connectivity is available, and a 'Pending' status typically does not result from transient connectivity issues. Option B is wrong because an expired Intune certificate would cause the device to appear as 'Not compliant' or 'Unhealthy' in the Intune console, not a 'Pending' status for a specific app deployment. Option D is wrong because a pending restart would affect the installation of updates, not the initial download or deployment status of an LOB app, and the device would still show the app as 'Pending' only if the management extension were missing.

Practice this question →
59
Multi-Selectmedium

Which THREE actions can you perform on a managed device from the Microsoft Intune admin center?

Select 3 answers
A.Change the primary user
B.Change the enrolled user
C.Restart the device
D.Sync the device
E.Change the device name
AnswersA, C, D

Correct. You can change the primary user of a managed device from the Intune admin center. This updates the user-device association.

Why this answer

The Microsoft Intune admin center supports several remote actions on managed devices. Changing the primary user (A), Restart (C), and Sync (D) are all valid remote actions. Options B (Change the enrolled user) and E (Change the device name) are not available remotely.

Exam trap

Candidates often assume that changing the primary user is not possible, but Intune does support this remote action. The trap is to incorrectly limit remote actions to only Restart and Sync, omitting Change primary user.

Practice this question →
60
MCQeasy

You need to ensure that only compliant devices can access Exchange Online. Which Intune policy should you use?

A.Device compliance policy
B.App protection policy
C.Conditional Access policy
D.Device configuration profile
AnswerC

Conditional Access blocks non-compliant devices.

Why this answer

Conditional Access policies in Microsoft Entra ID (formerly Azure AD) evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By integrating with Intune compliance policies, a Conditional Access policy can block or allow access based on whether the device meets compliance requirements. This is the correct mechanism to enforce access control for compliant devices.

Exam trap

The trap here is that candidates often confuse Device compliance policies (which only assess and report compliance) with Conditional Access policies (which actually enforce access decisions), leading them to select the compliance policy as the enforcement mechanism.

How to eliminate wrong answers

Option A is wrong because a Device compliance policy only marks a device as compliant or non-compliant; it does not enforce access control to Exchange Online on its own. Option B is wrong because App protection policies manage data protection within applications (e.g., preventing copy/paste) and do not evaluate device compliance or control access to Exchange Online at the device level. Option D is wrong because Device configuration profiles apply settings like Wi-Fi or VPN configurations and do not enforce conditional access based on compliance status.

Practice this question →
61
Multi-Selecthard

An organization uses Microsoft Intune to manage Windows devices. They need to configure a policy to enforce disk encryption on devices. Which TWO of the following are valid encryption options?

Select 2 answers
A.BitLocker
B.Encrypting File System (EFS)
C.Device encryption
D.FileVault
E.APFS encryption
AnswersA, C

BitLocker is a full disk encryption feature for Windows.

Why this answer

BitLocker is a full-disk encryption feature built into Windows Pro and Enterprise editions, and it can be managed via Microsoft Intune using the 'Endpoint Protection' profile under the 'Windows Encryption' category. Device encryption is available on Windows devices that support InstantGo (modern standby) and is enabled by default on many devices. In contrast, FileVault is a macOS-specific encryption feature and is not applicable to Windows devices.

Encrypting File System (EFS) provides file-level encryption, not full-disk encryption. APFS encryption is also macOS-specific. Therefore, only BitLocker (A) and Device encryption (C) are valid encryption options for Windows devices managed by Intune.

Exam trap

The trap here is that candidates often confuse file-level encryption (EFS) with full-disk encryption, or mistakenly apply macOS-specific technologies (FileVault, APFS encryption) to Windows devices, forgetting that Intune policies are platform-specific.

Practice this question →
62
MCQeasy

Refer to the exhibit. You are reviewing a Windows 10 update ring configuration JSON. What does the 'automaticUpdateBehavior' setting control?

A.The level of update notifications
B.How long to defer feature updates
C.Whether updates are installed automatically and if the user can control reboot timing
D.The branch readiness level
AnswerC

This setting defines the installation and reboot behavior.

Why this answer

The 'automaticUpdateBehavior' setting in a Windows 10 update ring configuration JSON controls whether updates are downloaded and installed automatically, and whether the user can control reboot timing. When set to 'autoInstallAndRebootWithNoUserControl', updates install automatically and reboots occur without user interaction; when set to 'autoInstallAndRebootWithUserControl', the user can schedule or postpone reboots. This directly matches option C, as it governs both automatic installation and reboot control.

Exam trap

The trap here is that candidates confuse 'automaticUpdateBehavior' with deferral periods or notification levels, because all three settings appear in the same update ring configuration JSON, but each controls a distinct aspect of Windows Update behavior.

How to eliminate wrong answers

Option A is wrong because 'automaticUpdateBehavior' does not control the level of update notifications; notification behavior is managed by the 'updateNotificationLevel' setting in the update ring policy. Option B is wrong because deferring feature updates is controlled by the 'deferFeatureUpdatesPeriodInDays' setting, not by 'automaticUpdateBehavior'. Option D is wrong because branch readiness level is set via the 'branchReadinessLevel' property (e.g., 'CurrentBranch' or 'SemiAnnualChannel'), which is independent of the automatic update behavior.

Practice this question →
63
Multi-Selecthard

Which THREE steps are required to configure a Windows 10 device for kiosk mode using Microsoft Intune? (Choose three)

Select 3 answers
A.Configure Autopilot for the device.
B.Create a device compliance policy to enforce kiosk mode.
C.Create a device configuration profile with the kiosk settings.
D.Assign the kiosk profile to a Microsoft Entra ID group containing the target devices.
E.Ensure the device is enrolled in Microsoft Intune.
AnswersC, D, E

Kiosk settings are configured via a configuration profile.

Why this answer

A device configuration profile in Microsoft Intune is the mechanism used to define the specific kiosk settings, such as the user account, app type (e.g., single-app or multi-app kiosk), and browser configuration. This profile applies the kiosk mode configuration to the device via the Windows 10/11 kiosk policy CSP (Policy Configuration Service Provider).

Exam trap

The trap here is that candidates confuse device compliance policies with device configuration profiles, mistakenly thinking compliance policies can enforce kiosk mode, when in fact compliance policies only evaluate and report on device health and security settings.

Practice this question →
64
MCQhard

A user has an iOS device enrolled in Intune. The device is lost, and you need to immediately prevent unauthorized access to corporate data. The device contains both corporate and personal data. Which action should you take?

A.Disable the user's account in Microsoft Entra ID
B.Initiate a selective wipe
C.Initiate a full wipe
D.Use Remote Lock to lock the device
AnswerD

Remote lock immediately locks the device, preventing access.

Why this answer

Remote Lock immediately locks the iOS device, preventing unauthorized access to both corporate and personal data without altering the device's content. This is the correct first step to secure data while preserving the ability to recover the device later, as it does not remove any data or accounts.

Exam trap

The trap here is that candidates often confuse 'immediate prevention of unauthorized access' with data removal, leading them to choose a wipe option, but Remote Lock is the correct first step because it secures the device without destroying personal data or requiring re-enrollment.

How to eliminate wrong answers

Option A is wrong because disabling the user's account in Microsoft Entra ID revokes access to cloud services but does not lock the device itself, leaving local data accessible. Option B is wrong because a selective wipe removes only corporate data and apps, which still leaves personal data exposed and does not immediately prevent access to the device. Option C is wrong because a full wipe erases all data, including personal content, which is overly destructive and irreversible; it should only be used as a last resort after confirming the device cannot be recovered.

Practice this question →
65
MCQhard

Your organization uses Microsoft Intune to manage devices. You need to deploy a PowerShell script that runs every time a user logs in to a Windows 10 device. The script must run with administrative privileges. Which deployment approach should you use?

A.Package the script as a Win32 app and assign it as required.
B.Deploy the script as a proactive remediation in Intune.
C.Use Intune PowerShell scripts targeting the user, with a scheduled task triggered by logon.
D.Use a custom compliance policy to run the script.
AnswerC

Intune PowerShell scripts can run in user context; a scheduled task triggered at logon can elevate privileges.

Why this answer

Intune PowerShell scripts can be deployed to users and configured to run as the logged-on user. To run with administrative privileges and on every logon, a scheduled task triggered by logon can be created that runs the script with elevated rights. Option A is incorrect because deploying a PowerShell script as a Win32 app typically runs once per assigned device, not on every user logon.

Option B is incorrect because proactive remediations run on a schedule (e.g., daily) and can detect/fix issues but are not triggered by user logon events. Option D is incorrect because custom compliance policies evaluate device settings for compliance and do not execute scripts on login.

Practice this question →
66
MCQhard

You are designing a Windows Update for Business deployment for a hybrid environment with 5,000 devices. You need to ensure that critical security updates are deployed within 48 hours while allowing feature updates to be delayed up to 60 days. Which policy configuration should you use?

A.Configure a 'Quality update deadline' of 2 days and a 'Feature update deadline' of 60 days.
B.Use a 'Quality update deferral period' of 48 hours and a 'Feature update deferral period' of 60 days in a Windows 10 update ring.
C.Set the 'Update notification level' to '2 - Disable all notifications' and configure active hours.
D.Configure a 'Quality update deferral period' of 2 days and a 'Feature update deferral period' of 60 days.
AnswerA

Deadline policies are the modern approach to enforce update installation within a specific timeframe.

Why this answer

Windows Update for Business uses 'deadline' policies to enforce when updates must be installed, not deferral periods. A 'Quality update deadline' of 2 days ensures critical security updates are installed within 48 hours, while a 'Feature update deadline' of 60 days allows feature updates to be delayed up to 60 days. Deferral periods only postpone when an update is offered, not when it must be installed, making deadlines the appropriate mechanism for enforcing installation timelines.

Exam trap

The trap here is that candidates confuse deferral periods with deadlines, assuming a deferral of 2 days achieves the same result as a 2-day deadline, but deferrals only delay the offer while deadlines enforce installation timing.

How to eliminate wrong answers

Option B is wrong because deferral periods delay the offer of updates but do not enforce an installation deadline; a 48-hour deferral would only delay when the quality update is first offered, not ensure it is installed within 48 hours. Option C is wrong because notification settings and active hours control user experience and restart timing, not the deployment timeline for security or feature updates. Option D is wrong because a deferral period of 2 days for quality updates only delays the offer by 2 days, failing to guarantee installation within 48 hours; deadlines are required to enforce the installation window.

Practice this question →
67
MCQmedium

A user reports that their Windows 11 device is not receiving Microsoft 365 Apps updates from Intune. You verify the device is enrolled and compliant. The device has a Microsoft 365 Apps update policy assigned. What is the most likely cause?

A.The Microsoft 365 Apps update channel is not configured in the policy
B.The device is in a low-power state and not checking in for updates
C.The device is not connected to the internet
D.The device has an older version of Office installed that does not support Intune management
AnswerB

If the device is in a low-power state, update policies may not apply until it is active.

Why this answer

The most likely cause is that the device is in a low-power state (e.g., sleep or hibernation) and not checking in for updates. Intune relies on the Microsoft 365 Apps update service, which uses a scheduled task that runs only when the device is awake and connected. If the device is in a low-power state, it cannot execute the update check, even though it is enrolled and compliant.

Exam trap

The trap here is that candidates often assume the update channel must be configured (Option A) or that internet connectivity is the issue (Option C), but Intune policies have default channels and the device is already compliant, so the real culprit is the device's power state preventing the update check from running.

How to eliminate wrong answers

Option A is wrong because if the update channel were not configured, the policy would either fail to apply or use a default channel, but the device would still attempt to check for updates; the issue is that the device is not checking in at all. Option C is wrong because the question states the device is enrolled and compliant, which requires internet connectivity for Intune communication; if it were not connected, the device would not be compliant or would show as disconnected. Option D is wrong because all versions of Office that support Intune management (Microsoft 365 Apps, Office 2019 or later) can receive updates via Intune policies; an older version like Office 2016 would not be managed by Intune at all, but the device is already enrolled and has a policy assigned.

Practice this question →
68
MCQeasy

You need to enforce encryption on Windows 10 devices managed by Intune. Which policy type should you configure?

A.Endpoint Protection profile
B.Device compliance policy
C.Windows Update for Business policy
D.Device configuration profile (settings catalog)
AnswerA

Endpoint Protection profiles include settings for BitLocker encryption.

Why this answer

Endpoint Protection profiles in Intune include the 'Windows Encryption' settings category, which allows you to enforce BitLocker Drive Encryption on Windows 10 devices. This profile directly manages encryption policies such as requiring BitLocker on OS and fixed drives, configuring encryption methods (e.g., XTS-AES 128-bit), and setting recovery password options. It is the correct policy type for enforcing encryption because it specifically targets security settings like device encryption and BitLocker.

Exam trap

The trap here is that candidates confuse Device Compliance Policies (which can check encryption status) with the actual policy that enforces encryption, leading them to select Option B, but compliance policies are read-only evaluations and cannot configure BitLocker settings.

How to eliminate wrong answers

Option B is wrong because Device Compliance Policies evaluate whether devices meet security requirements (e.g., encryption status) but do not configure or enforce encryption settings; they only mark devices as compliant or non-compliant. Option C is wrong because Windows Update for Business policies manage update rings, deferrals, and feature updates, not encryption or BitLocker settings. Option D is wrong because while the Settings Catalog in Device Configuration Profiles can include many settings, it does not contain the specific 'Windows Encryption' or 'BitLocker' policy categories that are exclusive to Endpoint Protection profiles for encryption enforcement.

Practice this question →
69
MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned Windows 10 devices are allowed to access Microsoft 365 services. You have configured a conditional access policy to require compliant devices. What else must you do to identify corporate-owned devices?

A.Configure a device compliance policy to require corporate ownership.
B.Set enrollment restrictions to block personally owned devices.
C.Deploy an app protection policy to block personal devices.
D.Add corporate device identifiers (e.g., serial numbers) in Intune.
AnswerD

Corporate identifiers allow Intune to automatically mark devices as corporate-owned upon enrollment.

Why this answer

Corporate device identifiers, such as serial numbers or IMEI numbers, are the specific mechanism in Microsoft Intune used to mark a device as corporate-owned. While a conditional access policy requiring compliant devices ensures only compliant devices can access Microsoft 365, it does not distinguish between corporate and personal devices. By uploading corporate identifiers, Intune automatically sets the ownership type to 'Corporate' upon enrollment, which can then be used in conditional access policies to restrict access to only those devices.

Exam trap

The trap here is that candidates often confuse device compliance policies with ownership identification, not realizing that compliance policies evaluate security posture, not ownership, and that corporate identifiers are the dedicated Intune feature for marking devices as corporate-owned.

How to eliminate wrong answers

Option A is wrong because device compliance policies evaluate security settings (e.g., encryption, OS version) but do not include a setting to require corporate ownership; ownership type is a separate attribute managed via enrollment or device identifiers. Option B is wrong because enrollment restrictions block personally owned devices from enrolling at all, which is a pre-enrollment control, but the question asks what else must be done after configuring a conditional access policy to require compliant devices—enrollment restrictions would prevent personal devices from being enrolled, not identify corporate-owned devices among those already enrolled. Option C is wrong because app protection policies (MAM) manage data access within apps and can block personal devices from accessing corporate data, but they do not identify corporate-owned devices; they apply to both enrolled and unenrolled devices based on app-level controls, not device ownership.

Practice this question →
70
Multi-Selecteasy

Which TWO of the following are device configuration settings you can manage with Microsoft Intune? (Choose two.)

Select 2 answers
A.Application settings for Microsoft 365 Apps
B.Device restrictions (e.g., camera, Bluetooth)
C.Wi-Fi profiles
D.Lock screen settings
E.Email profiles for Exchange Online
AnswersB, D

Device restrictions are part of device configuration.

Why this answer

Device restrictions, such as disabling the camera or Bluetooth, are a core configuration setting in Microsoft Intune. These are managed through device configuration profiles that enforce policies on devices, regardless of the user logged in. Option B is correct because Intune's device restrictions profile allows administrators to control hardware and system features at the device level.

Exam trap

The trap here is that candidates often confuse device restrictions with other configuration profile types like Wi-Fi or email profiles, but the question specifically asks for 'device configuration settings' that manage device-level features, not connectivity or account settings.

Practice this question →
71
MCQeasy

You need to deploy a line-of-business (LOB) iOS app to company-owned devices using Microsoft Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

A.Managed Browser app.
B.iOS/iPadOS LOB app.
C.iOS/iPadOS store app.
D.Volume Purchase Program (VPP) app.
AnswerB

LOB app type supports custom enterprise-signed apps.

Why this answer

An iOS/iPadOS LOB app deployment in Intune is specifically designed for line-of-business apps that are signed with an enterprise certificate and distributed internally. This method allows you to upload the .ipa file directly to Intune and deploy it to company-owned devices without requiring the Apple App Store or a Volume Purchase Program.

Exam trap

The trap here is that candidates often confuse LOB app deployment with VPP apps, mistakenly thinking that any app not from the public store must use VPP, but VPP is only for App Store apps, while LOB apps are for enterprise-signed .ipa files uploaded directly to Intune.

How to eliminate wrong answers

Option A is wrong because the Managed Browser app is a specific Intune policy for deploying Microsoft Edge or a managed browser configuration, not a method for deploying custom LOB apps. Option C is wrong because an iOS/iPadOS store app deployment requires the app to be publicly available in the Apple App Store, which does not apply to a custom LOB app signed with an enterprise certificate. Option D is wrong because a Volume Purchase Program (VPP) app is used for purchasing and deploying App Store apps in bulk with managed licenses, not for sideloading enterprise-signed LOB apps.

Practice this question →
72
MCQhard

Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

A.The device does not have BitLocker encryption enabled.
B.The device does not have a password set.
C.The device OS version exceeds the maximum allowed version.
D.The password type is not set to alphanumeric.
AnswerC

The maximum version is 10.0.22621.0, and the device is 22621.1, which is higher.

Why this answer

The compliance policy sets a maximum OS version. The device's OS version (10.0.22621.1) is higher than the maximum allowed version specified in the policy, causing the device to be marked as noncompliant. Therefore, option C is correct.

Exam trap

The trap is that candidates may assume a lower build number means the device is under the maximum, but the policy's maximum is set to an even lower build number, so the device's version actually exceeds it.

How to eliminate wrong answers

Option A is wrong because the JSON policy does not include any BitLocker settings; it only defines OS version requirements and password policies, so BitLocker encryption is not evaluated. Option B is wrong because the policy does not require a password; it only specifies password type and length, but the 'password required' setting is not present in the JSON, so a missing password would not cause noncompliance. Option D is wrong because the policy does not specify a password type; the JSON only includes 'passwordMinimumLength' and 'passwordRequiredType' is not defined, so the password type is not evaluated.

Practice this question →
73
MCQhard

You have a Windows 10 device running OS version 10.0.19043.1234. The device is compliant with all settings except password requirements. The device does not have a password set. What is the compliance status?

A.Noncompliant because passwordRequired is true and no password set.
B.Noncompliant because storage encryption is not enabled.
C.Noncompliant because OS version is not within range.
D.Compliant
AnswerA

The policy requires a password, and the device has none.

Why this answer

The device is noncompliant due to the passwordRequired policy setting being set to true while no password is configured on the device. In Microsoft Intune, compliance policies evaluate each setting independently; if a required setting like passwordRequired is not met, the device is marked noncompliant regardless of other compliant settings. The OS version 10.0.19043.1234 is within a supported range, and storage encryption is not evaluated unless explicitly required by a policy, so only the missing password triggers noncompliance.

Exam trap

The trap here is that candidates assume a device is compliant if most settings are met, but Microsoft Intune evaluates each compliance policy setting independently, and a single failure—such as missing a password—results in overall noncompliance.

How to eliminate wrong answers

Option B is wrong because storage encryption is not a default compliance requirement for Windows 10 devices; it must be explicitly configured in a compliance policy, and the question states only password requirements are noncompliant. Option C is wrong because OS version 10.0.19043.1234 corresponds to Windows 10 21H1, which is within the supported range for Intune compliance policies, and no OS version range issue is indicated. Option D is wrong because the device fails the passwordRequired setting, which is a mandatory compliance check, so it cannot be marked compliant.

Practice this question →
74
MCQmedium

Your company has iOS/iPadOS devices enrolled in Microsoft Intune. You need to ensure that users cannot remove the Microsoft Intune Company Portal app from their devices. What should you configure?

A.Configure an App Configuration policy for Company Portal.
B.Configure an App Protection policy for Company Portal.
C.Configure a Required app assignment with removal prevention.
D.Configure a Device Compliance policy to require Company Portal installation.
AnswerC

Required apps with removal prevention prevent users from removing the app.

Why this answer

Configuring a Required app assignment with removal prevention in Microsoft Intune ensures that the Company Portal app is installed as a required app and users cannot uninstall it. This setting is specifically designed to prevent removal of managed apps on iOS/iPadOS devices enrolled in Intune, leveraging the MDM channel to enforce the policy.

Exam trap

The trap here is that candidates confuse App Protection policies (which control data behavior) with app assignment settings (which control installation and removal), leading them to choose Option B instead of C.

How to eliminate wrong answers

Option A is wrong because App Configuration policies are used to supply custom settings or managed app configuration to apps, not to prevent uninstallation. Option B is wrong because App Protection policies (MAM) manage data protection and access control for apps, but they do not control app removal at the device level. Option D is wrong because Device Compliance policies check device health and configuration but cannot enforce app installation or prevent removal; they only mark devices as non-compliant if the app is missing.

Practice this question →
75
MCQeasy

You need to ensure that users can access corporate resources on their personal iOS devices only if they are jailbroken. Which Intune policy should you configure?

A.App Protection Policy
B.Device Configuration Policy
C.Device Compliance Policy
D.Conditional Access Policy
AnswerC

Correct. Compliance policies can detect jailbroken devices.

Why this answer

Device Compliance Policy in Microsoft Intune allows you to set rules that devices must meet to be considered compliant, including a jailbreak detection rule for iOS devices. When a device is detected as jailbroken, you can mark it as non-compliant and then use Conditional Access to block access to corporate resources. This directly addresses the requirement to control access based on jailbreak status.

Exam trap

The trap here is that candidates often confuse Device Compliance Policy with Conditional Access Policy, thinking that Conditional Access itself performs the jailbreak detection, when in fact it only enforces the compliance status reported by the Device Compliance Policy.

How to eliminate wrong answers

Option A is wrong because App Protection Policies (APP) manage how data is handled within managed apps (e.g., preventing copy/paste or requiring PIN) and do not include jailbreak detection or device-level compliance checks. Option B is wrong because Device Configuration Policies are used to configure device settings (e.g., Wi-Fi, VPN, email profiles) and do not evaluate or enforce compliance based on jailbreak status. Option D is wrong because Conditional Access Policy is an Azure AD feature that enforces access controls based on signals like device compliance, but it cannot directly detect jailbreak status; it relies on a Device Compliance Policy to provide that signal.

Practice this question →
Page 1 of 4 · 285 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Manage and maintain devices questions.

Start 20-question session