CCNA Manage and maintain devices Questions — Page 2 of 4

MCQmedium

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

A.Unenroll and re-enroll the device.

B.Restart the Microsoft Intune Management Extension service on the device.

C.Verify that the device is compliant with BitLocker encryption requirements.

D.Check the device's compliance policy assignment.

AnswerB

This service handles delivery of configuration policies, scripts, and apps; restarting it forces a sync.

Why this answer

The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Exam trap

The trap here is that candidates often confuse device 'active' status with successful policy delivery, leading them to jump to compliance checks or re-enrollment instead of first troubleshooting the local agent that actually applies the policies.

How to eliminate wrong answers

Option A is wrong because unenrolling and re-enrolling is a drastic step that should only be taken after verifying that the IME service or sync process is not the issue; it also requires re-provisioning the device and can cause unnecessary downtime. Option C is wrong because BitLocker compliance is a specific policy setting, not a prerequisite for receiving any configuration policies; the device can be non-compliant with BitLocker yet still receive other policies. Option D is wrong because checking compliance policy assignment addresses whether the device meets compliance rules, not whether the policy delivery mechanism (IME) is functioning; a device can be compliant but still fail to receive policies if the agent is not running.

Practice this question →

MCQmedium

You have a Windows 11 device enrolled in Intune that is not receiving configuration profiles. The device shows 'Pending' status for all profiles. You confirm the device is connected to the internet and can reach Microsoft's servers. What is the most likely cause?

A.The device is not in the correct security group for the profile assignment.

B.The device has a certificate issue preventing it from receiving profiles.

C.The device is not syncing with Intune.

D.The Intune service is experiencing an outage.

AnswerC

If the device is not syncing, it will show 'Pending'.

Why this answer

If the device is not syncing, it will show 'Pending'. Option A is wrong because group membership is for assignment, not sync. Option B is wrong because certificate issues affect authentication, not profile delivery.

Option D is wrong because the Intune service health is for global issues, not a single device.

Practice this question →

MCQeasy

An organization uses Microsoft Intune to manage Windows devices. They want to ensure that only devices with a TPM 2.0 chip can access corporate email. Which policy should be configured?

A.Device enrollment restriction to require TPM 2.0

B.Device configuration profile to enable TPM 2.0

C.Device compliance policy with a condition for TPM 2.0, combined with a conditional access policy

D.App protection policy to require TPM 2.0

AnswerC

The compliance policy checks for TPM 2.0, and conditional access blocks devices that are non-compliant.

Why this answer

A device compliance policy can evaluate whether a device has TPM 2.0 (via the TPM specification version check), and when combined with a Conditional Access policy, it can block access to corporate email for non-compliant devices. This is the standard Microsoft approach for enforcing hardware-based security requirements for cloud app access.

Exam trap

The trap here is that candidates often confuse device compliance policies with enrollment restrictions, thinking that blocking enrollment is sufficient, but Conditional Access is required to enforce access control after enrollment.

How to eliminate wrong answers

Option A is wrong because device enrollment restrictions control which devices can enroll in Intune, but they do not enforce ongoing access control for corporate email after enrollment; they only block enrollment itself. Option B is wrong because a device configuration profile cannot enable TPM 2.0—TPM is a hardware component that is either present or not, and configuration profiles manage settings, not hardware capabilities. Option D is wrong because app protection policies (MAM) manage data protection within apps without requiring device-level compliance checks like TPM presence; they are designed for unmanaged or BYOD scenarios where device compliance is not evaluated.

Practice this question →

MCQeasy

You need to ensure that all corporate-owned Windows 11 devices automatically install critical security updates as soon as they are released by Microsoft. Which Intune feature should you configure?

A.Expedited quality updates in a Windows 10 update ring.

B.A WSUS policy pushed via Group Policy.

C.Windows 10 update rings with a deferral period of 0 days.

D.Windows Autopatch.

AnswerA

Expedited quality updates force immediate installation.

Why this answer

Expedited quality updates in a Windows 10 update ring allow you to push critical security updates immediately, bypassing any deferral periods or gradual rollout settings. This feature uses the Windows Update for Business service to force the installation of a specific update as soon as it is released by Microsoft, ensuring compliance with security requirements for corporate-owned devices.

Exam trap

The trap here is that candidates confuse a zero-day deferral period with immediate installation, not realizing that update rings still use gradual rollout percentages and device check-in schedules, whereas expedited updates force an immediate, non-deferred installation.

How to eliminate wrong answers

Option B is wrong because WSUS (Windows Server Update Services) is an on-premises solution that requires Group Policy configuration and does not leverage Intune's cloud-based update management; it also introduces latency due to synchronization schedules and approval workflows. Option C is wrong because setting a deferral period of 0 days in a Windows 10 update ring still respects the gradual rollout (e.g., percentage-based rings) and does not guarantee immediate installation; updates are offered based on Microsoft's release cadence and device check-in cycles. Option D is wrong because Windows Autopatch is a service for automating update deployment across multiple update rings and policies, but it does not provide a mechanism to force immediate installation of a specific critical security update; it focuses on maintaining a baseline update cadence, not expedited deployment.

Practice this question →

Multi-Selecteasy

Your organization requires that all managed Windows devices have Microsoft Defender Antivirus enabled and running. Which TWO methods can you use to verify this compliance?

Select 2 answers

A.Create an Intune compliance policy for Windows Defender.

B.Check Microsoft Entra ID device settings.

C.Use Microsoft Defender XDR device health reports.

D.Review the Local Group Policy Editor on each device.

E.Run a Configuration Manager hardware inventory.

AnswersA, C

Correct. Compliance policies can check Defender state.

Why this answer

Intune compliance policies include a 'Microsoft Defender for Endpoint' category that allows you to require Defender Antivirus to be enabled and running. When a device reports its Defender status via the Intune Management Extension, the compliance policy evaluates the real-time protection state and marks the device as noncompliant if Defender is off or disabled. Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides device health reports that aggregate antivirus status across all enrolled devices, including whether Defender is active and up to date.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID device settings (which manage device identity and registration) with device compliance monitoring, leading them to incorrectly select Option B as a verification method.

Practice this question →

MCQmedium

You have assigned the above compliance policy to all Windows 10 devices. A user's device shows as noncompliant with a reason of 'TPM not found'. What should you do to resolve the issue?

A.Disable the TPM requirement in the policy.

B.Assign the policy to a different group that excludes those devices.

C.Create a new compliance policy without the TPM requirement and assign it to devices without TPM.

D.Change the password complexity requirement to 'none'.

AnswerC

This allows different requirements for different hardware.

Why this answer

The device lacks TPM hardware, so the compliance policy requirement for TPM cannot be met. The appropriate solution is to create a separate compliance policy without the TPM requirement and assign it to devices that do not have TPM, ensuring those devices can still be compliant without compromising security requirements for TPM-capable devices.

Exam trap

The trap here is that candidates may think disabling the TPM requirement in the existing policy is the simplest fix, but this overlooks the need to maintain security for TPM-capable devices and the best practice of using targeted policies for different hardware capabilities.

How to eliminate wrong answers

Option A is wrong because disabling the TPM requirement in the existing policy would remove the security control for all devices, including those that do have TPM, weakening the overall security posture. Option B is wrong because assigning the policy to a different group that excludes non-TPM devices does not resolve the noncompliance for the existing devices; it only avoids the issue by not applying the policy to them, leaving them without any compliance policy. Option D is wrong because changing the password complexity requirement to 'none' is unrelated to the TPM not found issue; it addresses a different compliance setting and does not fix the missing TPM hardware.

Practice this question →

MCQhard

You have a Windows 11 device that is co-managed with Configuration Manager and Microsoft Intune. After migrating the Windows Update workload to Intune, users report that they can still manually check for updates in Windows Settings and install optional driver and firmware updates that are not signed by Microsoft. You need to prevent users from installing these optional updates. Which setting should you configure in Intune?

A.Set 'Configure Automatic Updates' to '2 - Notify for download and notify for install'.

B.Set 'Defer quality updates' to '30 days'.

C.Set 'Allow non-Microsoft signed updates' to 'Block'.

D.Set 'Specify intranet Microsoft update service location' to point to WSUS.

AnswerC

Set 'Allow non-Microsoft signed updates' to 'Block' prevents installation of non-Microsoft signed optional updates, which are the typical optional updates users can install.

Why this answer

Setting 'Allow non-Microsoft signed updates' to 'Block' directly prevents users from installing the optional driver and firmware updates that are not signed by Microsoft, which are precisely the updates described in the scenario. Option A changes notification behavior, Option B defers quality updates, and Option D redirects to WSUS, none of which block optional updates.

Exam trap

Some may think that blocking non-Microsoft signed updates also blocks all optional updates, but since the scenario specifically targets non-Microsoft signed updates, this setting is appropriate and addresses the requirement.

How to eliminate wrong answers

Option A is wrong because 'Configure Automatic Updates' set to '2 - Notify for download and notify for install' controls the notification behavior for updates but does not prevent users from manually checking for or installing optional updates; it only changes the download and install timing. Option B is wrong because 'Defer quality updates' to '30 days' delays the installation of quality updates but does not block optional updates; it is a deferral policy, not a block. Option D is wrong because 'Specify intranet Microsoft update service location' to point to WSUS is used to redirect update scanning to an internal WSUS server, which is not relevant when the Windows Update workload is managed by Intune and does not prevent optional updates from being installed.

Practice this question →

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

A.Check the certificate profile assigned to the devices.

B.Verify that the devices can communicate with an on-premises domain controller.

C.Ensure the devices have a VPN connection to the corporate network.

D.Review the conditional access policies for the users.

AnswerB

Hybrid Azure AD join devices need to connect to a domain controller to complete registration.

Why this answer

In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Exam trap

The trap here is that candidates often jump to conditional access or certificate issues because they sound security-related, but the core requirement for hybrid Azure AD joined devices is on-premises domain controller connectivity for authentication.

How to eliminate wrong answers

Option A is wrong because certificate profiles are used for authentication or encryption, but the issue here is about general resource access; if certificates were the problem, you would typically see specific authentication failures rather than a complete inability to access resources. Option C is wrong because a VPN connection is not a prerequisite for hybrid Azure AD joined devices to access corporate resources; they can use DirectAccess or a cloud proxy, and the question does not indicate remote access requirements. Option D is wrong because conditional access policies control access based on conditions like compliance, but since compliance policies are already applied and verified, reviewing conditional access is a later step after confirming network connectivity to the domain controller.

Practice this question →

Multi-Selecteasy

Which TWO methods can you use to enroll a Windows 10 device in Microsoft Intune?

Select 2 answers

A.Navigate to the Intune enrollment URL in a browser.

B.Use the Company Portal website to enroll.

C.Sign in to Settings > Accounts > Access work or school and connect.

D.Join the device to Azure AD during OOBE.

E.Enroll from the Microsoft 365 admin center.

AnswersC, D

This is the manual enrollment method.

Why this answer

Enrolling a Windows 10 device via Settings > Accounts > Access work or school and clicking 'Connect' initiates a device enrollment that registers the device with Azure AD and automatically enrolls it in Intune (if auto-enrollment is configured via GPO or MDM discovery). This method uses the MDM enrollment protocol over the Enrollment REST service, requiring only a work or school account.

Exam trap

The trap here is that candidates confuse the Company Portal website (a web interface for app installation) with the Company Portal app (a native client that can initiate enrollment), leading them to incorrectly select Option B as a valid enrollment method.

Practice this question →

MCQhard

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

A.Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

B.Create a device configuration policy that blocks access to corporate resources.

C.Create an app protection policy in Intune to block access to apps.

D.Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.

AnswerD

Conditional Access evaluates device compliance and blocks access if not compliant, with user notification.

Why this answer

Conditional Access policies in Microsoft Entra ID can evaluate device compliance status from Intune to grant or block access to corporate resources like Exchange Online. When a device is marked non-compliant (e.g., missing BitLocker, outdated OS, jailbroken/rooted), the Conditional Access policy blocks access and can display a notification. Option A is incorrect because device enrollment restrictions only control whether a device can enroll in Intune or join Azure AD; they do not enforce access after enrollment.

Option B is incorrect because device configuration policies apply settings but do not enforce access control. Option C is incorrect because app protection policies protect data within apps but rely on device compliance for access decisions.

Practice this question →

MCQmedium

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

A.Verify that the device meets the compliance policy for Android.

B.Confirm that the user has an Exchange Online license.

C.Check the device's last check-in time with Intune.

D.Ensure the device is enrolled in Intune.

AnswerC

The profile may not have been applied yet.

Why this answer

The device is already compliant and enrolled, and the email profile is assigned, so the most likely issue is that the device has not recently checked in with Intune to receive the latest policy or profile. Checking the last check-in time is the first troubleshooting step because Intune relies on periodic device check-ins to push configuration profiles, including email profiles. If the device hasn't checked in recently, it won't have the email profile applied, even if it's compliant and enrolled.

Exam trap

The trap here is that candidates assume compliance or enrollment guarantees policy delivery, but Intune requires a successful device check-in to actually apply profiles, making the last check-in time the critical first check.

How to eliminate wrong answers

Option A is wrong because the device already shows as compliant, so verifying compliance again would be redundant and not address why the email profile hasn't been applied. Option B is wrong because the user's ability to receive email from the corporate tenant is not dependent on an Exchange Online license; the email profile configuration and Intune policy delivery are the immediate technical blockers. Option D is wrong because the device is already enrolled in Intune (as stated in the scenario), so re-checking enrollment is unnecessary and does not explain why the email profile hasn't been delivered.

Practice this question →

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

A.Full wipe from the Intune console.

B.Selective wipe from the Intune console.

C.Delete the device from Microsoft Entra ID.

D.Retire the device from Intune.

AnswerB

Selective wipe removes corporate data only.

Why this answer

A selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Exam trap

The trap here is that candidates often confuse 'full wipe' with 'selective wipe' in Android Enterprise, mistakenly thinking a full wipe is required for stolen devices, but Microsoft Intune's selective wipe is the correct and recommended action for corporate data removal while preserving personal data.

How to eliminate wrong answers

Option A is wrong because a full wipe resets the entire device to factory defaults, erasing both corporate and personal data, which is overly aggressive and may not be necessary or desired for a stolen device scenario. Option C is wrong because deleting the device from Microsoft Entra ID only removes the device object from identity management, but it does not trigger any data wipe on the device itself, leaving corporate data accessible. Option D is wrong because retiring a device from Intune removes management and wipes corporate data, but the term 'retire' is synonymous with selective wipe in Intune; however, the question specifically asks for the action to configure, and 'selective wipe' is the precise term used in the Intune console for this operation, while 'retire' is the broader action that includes selective wipe.

Practice this question →

MCQhard

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

A.The device is low on storage

B.The app is assigned to users, not devices

C.The app is available but not required

D.The device has offline files enabled

AnswerB

If the app is assigned to users instead of devices, the device may not receive the required installation.

Why this answer

When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy.

The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Exam trap

The trap here is that candidates assume a compliant device with a healthy connection will always receive required apps, overlooking the critical difference between user-assigned and device-assigned app policies in Intune.

How to eliminate wrong answers

Option A is wrong because low storage would typically generate a specific error message or status in Intune (e.g., 'not enough disk space') and is not the most likely cause given the device is compliant and healthy. Option C is wrong because the question states the app is assigned as required, not available; if it were available, the user would need to manually install it, which contradicts the 'required' assignment. Option D is wrong because offline files (Client-Side Caching) do not prevent Intune from installing required applications; they affect file synchronization, not policy application.

Practice this question →

MCQmedium

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

A.The app protection policy is misconfigured.

B.The device model is blocked by a Conditional Access policy.

C.The device is not compliant with the compliance policy.

D.The user is blocked by a Conditional Access policy due to sign-in risk.

AnswerD

Conditional Access can block based on user risk, which would prevent access.

Why this answer

The user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Azure AD Identity Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Exam trap

The trap here is that candidates assume a device compliance issue is the root cause because the error is connectivity-related, but the question explicitly states the device is compliant, forcing you to consider user-specific Conditional Access controls like sign-in risk.

How to eliminate wrong answers

Option A is wrong because a misconfigured app protection policy (MAM policy) would typically block data access or show a policy-related error, not a generic 'Cannot connect to server' message, and it would affect all users with that policy applied, not just one user. Option B is wrong because if the device model were blocked by a Conditional Access policy, all users with that model would be affected, not just a single user. Option C is wrong because the question explicitly states the device is compliant, so non-compliance cannot be the cause.

Practice this question →

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom shell script that runs once on each device. What should you configure?

A.A shell script with the 'Run script once per device' option.

B.A device compliance policy with a custom shell script.

C.A custom configuration profile with a script payload.

D.A managed app that includes the script.

AnswerA

Shell scripts in Intune can be set to run once per device.

Why this answer

Microsoft Intune provides a native 'Shell script' policy type for macOS that includes a 'Run script once per device' setting. This ensures the script executes exactly one time on each target device, meeting the requirement without additional configuration or workarounds.

Exam trap

The trap here is that candidates confuse configuration profiles (which set settings) with script execution, or assume compliance policies can run scripts, when Intune separates these functions into distinct policy types for macOS management.

How to eliminate wrong answers

Option B is wrong because device compliance policies evaluate device health and configuration state, not execute scripts; they cannot run custom shell scripts. Option C is wrong because custom configuration profiles use property list (plist) payloads to set settings, not to execute scripts; they lack a script execution engine. Option D is wrong because managed apps are deployed to install or configure applications, not to run arbitrary shell scripts; scripts are not part of the app deployment workflow.

Practice this question →

MCQeasy

You are an Intune administrator for a company that has recently deployed Windows 11 devices. Management wants to ensure that all devices are running the latest feature update (Windows 11 23H2) within 60 days of release. You need to configure a Windows Update for Business policy in Intune to achieve this goal. Which settings should you configure?

A.Set the feature update deferral period to 60 days and assign the policy to all devices.

B.Set the feature update deferral period to 60 days and pause updates for 30 days.

C.Set the feature update deadline to 60 days and assign the policy to a device group.

D.Set the feature update deferral period to 0 days and assign to all users.

AnswerA

Deferral of 60 days means the update will be offered within 60 days after release.

Why this answer

Setting the feature update deferral period to 60 days in a Windows Update for Business policy ensures that devices will wait up to 60 days after Microsoft releases a feature update (e.g., Windows 11 23H2) before installing it. This meets the requirement of having all devices running the latest feature update within 60 days of release, as the deferral period defines the maximum delay from the release date. Assigning the policy to all devices ensures blanket coverage across the Windows 11 fleet.

Exam trap

The trap here is that candidates confuse the 'deferral period' (which delays the initial offering of the update) with the 'deadline' (which forces installation after the update is already available), leading them to incorrectly select a deadline-based option when the goal is to control how soon after release the update becomes available to devices.

How to eliminate wrong answers

Option B is wrong because pausing updates for 30 days would block updates entirely for that period, preventing devices from receiving the feature update within the 60-day window; the deferral period and pause are mutually exclusive controls. Option C is wrong because setting a feature update deadline to 60 days does not control the initial availability of the update—it only enforces a forced installation deadline after the update is already offered, which could result in devices not receiving the update until well after 60 days from release. Option D is wrong because setting the deferral period to 0 days would cause devices to install the feature update immediately upon release, which does not align with the goal of ensuring installation within 60 days (it would be too aggressive and could cause disruption), and assigning to all users instead of devices is less effective for device-level update management.

Practice this question →

Multi-Selecthard

You are planning the deployment of Windows 11 using Intune. Which TWO components are required to perform an in-place upgrade from Windows 10?

Select 2 answers

A.A Group Policy to enable Windows Update for Business.

B.A valid Windows 11 product key.

C.The Intune Management Extension installed on the device.

D.A Windows 11 feature update profile in Intune.

E.Hardware that meets Windows 11 system requirements.

AnswersD, E

A Windows 11 feature update profile in Intune is required. This profile specifies the target version and deploys the feature update to eligible devices.

Why this answer

To perform an in-place upgrade from Windows 10 to Windows 11 using Intune, you need two core components: a Windows 11 feature update profile in Intune to trigger the upgrade, and hardware that meets Windows 11 system requirements for compatibility. Although the question asks for three components, only two of the listed options are correct. A valid product key is not needed because the digital license carries forward.

The Intune Management Extension is not used for feature updates, and Group Policy for Windows Update for Business is not required when using Intune's built-in update management. The third component is not applicable in this context.

Exam trap

The question states 'which THREE components are required', but only two correct options (D and E) are provided. The trap is that candidates may feel compelled to select three answers, leading them to pick an incorrect option such as A, B, or C. In reality, the question likely expects only two required components; the 'three' may be a typo or misdirection.

Practice this question →

MCQmedium

You manage Windows 10 devices with Intune. You need to collect diagnostic logs from a remote device that is experiencing application crashes. Which Intune feature should you use?

A.Collect diagnostics

B.Company Portal app

C.Autopilot Reset

D.Windows Update for Business

AnswerA

This remote action collects logs without user intervention.

Why this answer

The 'Collect diagnostics' feature in Intune allows you to remotely gather diagnostic logs from Windows 10 devices without user interaction. This is the correct tool for troubleshooting application crashes because it collects system logs, event logs, and crash dumps directly from the device via the Intune management channel, enabling analysis of the failure.

Exam trap

The trap here is that candidates may confuse 'Collect diagnostics' with the Company Portal's ability to view device status or sync policies, but the Company Portal cannot initiate log collection; only the Intune admin console's 'Collect diagnostics' action can remotely gather crash logs.

How to eliminate wrong answers

Option B is wrong because the Company Portal app is a self-service portal for users to install applications, access corporate resources, and enroll devices, not a tool for collecting diagnostic logs. Option C is wrong because Autopilot Reset is used to reset a device to a business-ready state, removing user data and apps, which would destroy the crash logs needed for diagnosis. Option D is wrong because Windows Update for Business manages update policies and deployment rings, not diagnostic log collection; it focuses on keeping devices patched, not troubleshooting application crashes.

Practice this question →

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is classified as a 'Quality Update' by Microsoft. You have configured a Windows Update for Business policy in Intune with a 'Quality update deadline' of 1 day. However, after 48 hours, some devices still have not installed the update. You verify that the devices are online and have checked in with Intune recently. What should you do to ensure the update is installed immediately on the remaining devices?

A.Ask users to restart their devices.

B.Reassign the update ring to a broader device group.

C.Use the 'Update Immediately' setting in the Windows Update for Business policy.

D.Increase the 'Quality update deadline' to 3 days.

AnswerC

This setting forces the device to check for and install available updates immediately.

Why this answer

The 'Update Immediately' setting in the Windows Update for Business policy forces devices to check for and install updates immediately, overriding the configured deadline. Option A is incorrect because restarting alone does not trigger installation of pending updates. Option B is incorrect because reassigning the update ring does not affect the urgency of already applied policies.

Option D is incorrect because increasing the deadline would allow more delay, not cause immediate installation.

Practice this question →

Multi-Selecthard

Which THREE factors should you consider when planning the deployment of Windows 10 feature updates using Intune?

Select 3 answers

A.Devices must have sufficient disk space to download the update.

B.A deployment ring strategy should be used to test updates on a pilot group first.

C.The version of Windows 10 determines which update rings are available.

D.The feature update compatibility report is only available for Windows 11.

E.Deferral periods can be set to delay the update installation.

AnswersA, B, E

Sufficient disk space is required for feature updates.

Why this answer

Windows 10 feature updates require sufficient free disk space (typically 20–32 GB depending on the version) to download and stage the update files. If a device lacks adequate space, the update will fail or be blocked by Intune's update readiness checks, which evaluate disk space before initiating the deployment.

Exam trap

The trap here is that candidates often confuse update ring availability with OS version, assuming older Windows 10 versions lack ring support, when in fact all Windows 10 versions (1507 and later) support update rings, and the compatibility report is not limited to Windows 11.

Practice this question →

MCQmedium

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

A.The compliance policy has been removed from these devices.

B.The devices are still within the grace period and can access resources.

C.The devices were recently remediated and are now compliant.

D.The devices have exceeded the grace period and should be blocked from accessing resources.

AnswerD

Past expiration means grace period has been exceeded.

Why this answer

The complianceGracePeriodExpirationDateTime represents the deadline by which a device must become compliant after initially being marked noncompliant. When this timestamp is in the past, it means the grace period has expired, and the device should be blocked from accessing corporate resources as per the conditional access policy. This is a standard behavior in Microsoft Intune for managing noncompliant devices.

Exam trap

The trap here is that candidates confuse the complianceGracePeriodExpirationDateTime with the last check-in time or assume a past timestamp means the device is still compliant, when in fact it signals the end of the grace period and triggers blocking actions.

How to eliminate wrong answers

Option A is wrong because removing the compliance policy from a device does not affect the grace period timestamp; the timestamp is set when the device is marked noncompliant and persists regardless of policy removal. Option B is wrong because a past grace period expiration indicates the grace period has ended, not that the device is still within it; devices within the grace period would have a future timestamp. Option C is wrong because remediated devices would have a new compliance status and a reset complianceGracePeriodExpirationDateTime, not a past one; a past timestamp indicates the grace period was not resolved in time.

Practice this question →

MCQmedium

You deployed this endpoint protection policy to a Windows 10 device. A user reports that a known malicious file was downloaded but not blocked. What is the most likely reason?

A.Real-time scanning is set to monitorAllFiles, but the file was an archive.

B.The scan type is set to quick, which does not scan downloaded files.

C.The cloud block level is set to high, which may block unknown files, but known files might be missed.

D.The policy has not been applied to the device yet.

AnswerD

If the policy hasn't applied, settings are not active.

Why this answer

If the endpoint protection policy has not been applied to the device, the Microsoft Defender for Endpoint settings (including real-time scanning and cloud-delivered protection) are not active. The policy must be successfully delivered via Microsoft Intune or Configuration Manager before any protection rules take effect. Without policy application, the device runs with default or no protection, allowing known malicious files to be downloaded without being blocked.

Exam trap

The trap here is that candidates assume a protection policy is automatically active once created, but Microsoft Intune policies require device check-in and successful application before they take effect, and the cloud block level setting is often misunderstood as affecting known malware detection.

How to eliminate wrong answers

Option A is wrong because real-time scanning set to monitorAllFiles includes archives; Microsoft Defender scans archive files (e.g., .zip, .rar) by default when monitorAllFiles is enabled, so an archive would still be scanned. Option B is wrong because the scan type (quick, full, or custom) applies to scheduled or on-demand scans, not to real-time protection; real-time scanning always inspects files as they are downloaded or accessed, regardless of the scan type setting. Option C is wrong because the cloud block level setting (high, moderate, etc.) affects how aggressively unknown files are sent to the cloud for analysis, but known malicious files are blocked locally by signature-based detection and do not rely on cloud block level; a known file would be blocked even with a high cloud block level.

Practice this question →

MCQeasy

You need to retire a device in Microsoft Intune. What is the effect of retiring a device?

A.The device is unenrolled, and corporate data and apps are removed. Personal data is preserved.

B.The device is factory reset to its original settings.

C.The device remains enrolled but can no longer access corporate resources.

D.The device is deleted from Azure AD and Intune.

AnswerA

Retirement removes company data and unenrolls the device.

Why this answer

Retiring a device in Microsoft Intune performs a selective wipe that removes only corporate-managed data and apps while preserving the user's personal data. The device is also unenrolled from Intune management, meaning it no longer receives policy or compliance enforcement. This is distinct from a full wipe, which resets the entire device to factory settings.

Exam trap

The trap here is that candidates often confuse 'retire' with 'wipe' (factory reset), assuming both remove all data, but Intune's selective wipe is designed specifically to preserve personal data while removing corporate resources.

How to eliminate wrong answers

Option B is wrong because it describes a factory reset (full wipe), which removes all data including personal content, whereas retirement only removes corporate data. Option C is wrong because a retired device is unenrolled and loses all access to corporate resources, not remaining enrolled with restricted access. Option D is wrong because while the device record is removed from Intune, it is not automatically deleted from Azure AD; the device object in Azure AD remains until explicitly removed or until the user's sync cycle cleans it up.

Practice this question →

MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that only approved corporate apps can be installed on work profiles. What should you configure?

A.Device compliance policy to block noncompliant devices

B.Device restrictions configuration profile

C.App configuration policy for managed Google Play

D.Conditional access policy to require approved apps

AnswerC

App configuration policies can define an approved list of apps for work profiles.

Why this answer

To restrict app installation on Android Enterprise work profiles to only approved corporate apps, you must configure an app configuration policy for managed Google Play. This policy enforces a list of required and allowed apps, preventing users from installing unapproved apps from the Play Store on the work profile. Device compliance and conditional access policies control access to resources, not app installation, while device restrictions lack the granularity to enforce app whitelisting on managed Google Play.

Exam trap

The trap here is that candidates often confuse app configuration policies (which control app installation and settings) with app protection policies (which control data behavior within apps), leading them to incorrectly select conditional access or compliance policies instead.

How to eliminate wrong answers

Option A is wrong because device compliance policies evaluate device health (e.g., encryption, root status) and can block access to resources, but they do not control which apps can be installed on the work profile. Option B is wrong because device restrictions configuration profiles manage device settings (e.g., camera, Bluetooth) but cannot enforce a whitelist of approved apps for installation on managed Google Play. Option D is wrong because conditional access policies require approved apps for resource access (e.g., Exchange Online) but do not prevent installation of unapproved apps on the work profile; they only gate access after the app is already installed.

Practice this question →

100

MCQhard

The above PowerShell cmdlet returns the following output: DeviceName: LAPTOP001 LastSyncDateTime: 2025-03-15T08:30:00Z ComplianceState: noncompliant ManagementState: managed OSVersion: 10.0.19044.1288 The device last synced 3 days ago. What is the most likely reason for the noncompliant status?

A.The device is running an outdated OS version.

B.The device has been retired or wiped.

C.The device has not synced in over 24 hours.

D.The device has no compliance policy assigned.

AnswerC

Many compliance policies require a recent sync to remain compliant.

Why this answer

The device last synced 3 days ago, and the output shows ComplianceState: noncompliant. In Microsoft Intune, a device that has not checked in for more than 24 hours is automatically marked as noncompliant because the compliance policies cannot be evaluated without a recent sync. The LastSyncDateTime of 2025-03-15T08:30:00Z confirms the device has not synced within the required 24-hour window, making C the correct answer.

Exam trap

The trap here is that candidates assume 'noncompliant' always means a policy rule violation (like outdated OS or missing encryption) rather than recognizing that Intune can mark a device noncompliant simply for failing to sync within the required timeframe, even if all other policies are satisfied.

How to eliminate wrong answers

Option A is wrong because the OSVersion (10.0.19044.1288) corresponds to a supported build of Windows 10 21H2, which is not inherently outdated for compliance unless a specific policy requires a newer version, and the output does not indicate an OS version mismatch. Option B is wrong because the ManagementState is 'managed', not 'retired' or 'wiped', so the device is still under management and has not been removed. Option D is wrong because if no compliance policy were assigned, the device would typically show a ComplianceState of 'unknown' or 'not evaluated', not 'noncompliant'.

Practice this question →

101

MCQeasy

A user's device is marked as 'Noncompliant' in Microsoft Intune due to missing required updates. The device is configured with a compliance policy that requires a minimum OS version. The user claims the device is up-to-date. What should you verify first?

A.The current OS version on the device.

B.The user's license status.

C.The compliance policy is assigned to the device.

D.The device is connected to the internet.

AnswerA

The device might not have the required OS version.

Why this answer

The first step in troubleshooting a noncompliant device due to a missing minimum OS version is to verify the actual OS version currently installed on the device. The user's claim that the device is up-to-date may be based on a misunderstanding of what version is required, or the device may have pending updates that have not been applied. Intune compliance policies evaluate the OS version reported by the device during check-in, so confirming the exact build number against the policy requirement is the logical starting point.

Exam trap

The trap here is that candidates may jump to verifying policy assignment or connectivity, overlooking that the most direct and immediate verification is the actual OS version on the device, which is the specific attribute being evaluated by the compliance policy.

How to eliminate wrong answers

Option B is wrong because license status affects enrollment and access to Intune features, but it does not directly cause a device to be marked noncompliant due to a missing OS version; a licensed user can still have a noncompliant device. Option C is wrong because if the compliance policy were not assigned to the device, the device would not be evaluated against that policy and would not be marked noncompliant for that reason; the fact that it is marked noncompliant indicates the policy is assigned. Option D is wrong because while internet connectivity is required for the device to check in with Intune and report compliance, the device is already reporting its noncompliant status, meaning it has communicated with the service; connectivity is not the root cause of the OS version mismatch.

Practice this question →

102

Multi-Selecteasy

You need to deploy Microsoft Defender for Endpoint to Windows 10 devices using Microsoft Intune. Which TWO methods can you use to deploy the Microsoft Defender for Endpoint client?

Select 2 answers

A.Using Group Policy connected to Intune.

B.As a line-of-business (LOB) app in Intune.

C.From the Microsoft Store for Business.

D.Via a device configuration profile using the 'Microsoft Defender for Endpoint' CSP.

E.Via Microsoft Configuration Manager.

AnswersB, D

You can upload the MDATP installer as an LOB app.

Why this answer

You can deploy the Microsoft Defender for Endpoint client as a line-of-business (LOB) app in Intune by uploading the Windows Defender ATP client installation file (e.g., WindowsDefenderATPOnboardingPackage.zip) and targeting it to Windows 10 devices. Option D is correct because you can use a device configuration profile with the 'Microsoft Defender for Endpoint' Configuration Service Provider (CSP) to configure and deploy the client settings, such as onboarding and policy enforcement, directly via Intune.

Exam trap

The trap here is that candidates often confuse Group Policy with MDM policies or think the Microsoft Store for Business can distribute security agents, but Intune relies on CSPs and LOB app deployment for Defender for Endpoint, not traditional Group Policy or store distribution.

Practice this question →

103

MCQeasy

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

A.appVersion: 96.0.1054.62

B.channel: Stable

C.uninstallPrevious: true

D.intent: required

AnswerC

This removes previous versions before installing.

Why this answer

The `uninstallPrevious` setting in the Microsoft Edge Intune deployment profile forces the removal of any existing version of Edge (e.g., Beta, Dev, or older Stable) before the new version is installed. This ensures a clean installation and prevents conflicts, which is critical when deploying Edge as a required app via Intune for Windows devices.

Exam trap

The trap here is that candidates often confuse `uninstallPrevious` with `channel` or `appVersion`, assuming that specifying a version or channel alone will automatically replace older installations, but Microsoft Edge requires an explicit flag to trigger removal of prior versions.

How to eliminate wrong answers

Option A is wrong because `appVersion: 96.0.1054.62` specifies the version of Edge to install, not the removal of previous versions; it does not trigger uninstallation. Option B is wrong because `channel: Stable` defines the update channel (Stable, Beta, Dev) but has no effect on whether prior versions are removed; it only determines which build is deployed. Option D is wrong because `intent: required` makes the app mandatory for users but does not control the removal of older Edge installations; it only enforces installation.

Practice this question →

104

MCQmedium

You manage devices with Microsoft Intune. Users report that after a recent policy change, some devices are not receiving updated policies. You verify that the devices are online and have connectivity. What should you do to force a policy refresh?

A.Ask users to restart their devices.

B.Ask users to run Windows Update.

C.Adjust the MDM sync interval in Intune.

D.In the Intune portal, select the devices and click 'Sync'.

AnswerD

The Sync action forces the devices to check in and apply latest policies.

Why this answer

The Intune 'Sync' action sends a direct MDM policy refresh command to the device via the Microsoft Intune service. This triggers the device's enrollment client to immediately check in with the MDM server, download the latest policies, and apply them without waiting for the next scheduled sync interval. Since the devices are online and have connectivity, this remote sync forces an immediate policy refresh.

Exam trap

The trap here is that candidates often confuse a device restart or Windows Update with triggering an MDM policy refresh, but Intune's MDM sync is a distinct, remote action that must be initiated from the Intune portal or via a manual sync on the device itself.

How to eliminate wrong answers

Option A is wrong because restarting the device does not force an MDM policy sync; it only reboots the OS, and the device will still wait for its next scheduled sync interval (typically every 8 hours) unless a sync is triggered via Intune. Option B is wrong because running Windows Update checks for OS and driver updates, not MDM policy changes; policy updates are handled by the MDM client, not Windows Update. Option C is wrong because adjusting the MDM sync interval in Intune only changes the default check-in frequency for future syncs; it does not force an immediate refresh for devices that have already missed a policy update.

Practice this question →

105

MCQhard

You manage a hybrid Microsoft Entra ID environment with 5,000 Windows 10 devices enrolled in Microsoft Intune. You need to deploy a critical security update that requires a reboot to all devices within the next 4 hours. Users must be able to postpone the reboot for up to 8 hours. You configure a device restart policy in Intune. Which deadline and grace period settings should you use?

A.Deadline: 8 hours, Grace period: 4 hours

B.Deadline: 2 hours, Grace period: 12 hours

C.Deadline: 4 hours, Grace period: 8 hours

D.Deadline: 4 hours, Grace period: 30 minutes

AnswerC

Correct. The deadline ensures reboot within 4 hours, and the grace period allows postponement up to 8 hours.

Why this answer

The deadline (4 hours) matches the required deployment window for the critical update, and the grace period (8 hours) allows users to postpone the reboot for up to 8 hours after the deadline. In Intune device restart policies, the deadline specifies when the update must be installed and the reboot initiated, while the grace period defines how long users can delay the restart after the deadline. With a 4-hour deadline and 8-hour grace period, the update is enforced within 4 hours, and users can postpone the reboot for up to 8 hours from that point, meeting both requirements.

Exam trap

The trap here is confusing the deadline with the grace period, leading candidates to think the deadline should be the total time allowed for postponement (8 hours) and the grace period the deployment window (4 hours), which reverses the correct logic.

How to eliminate wrong answers

Option A is wrong because a deadline of 8 hours exceeds the required 4-hour deployment window, meaning the update would not be enforced within the necessary timeframe. Option B is wrong because a deadline of 2 hours is too short, forcing the update and reboot before the 4-hour window is fully utilized, and a 12-hour grace period is excessive, allowing postponement beyond the 8-hour user flexibility requirement. Option D is wrong because a grace period of 30 minutes is far too short, preventing users from postponing the reboot for up to 8 hours as required.

Practice this question →

106

MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only approved corporate apps can be installed on these devices. Which restriction profile setting should you configure?

A.Allow app installation from App Store only

B.Require app store password

C.Allow managed apps to unmanaged accounts

D.Allow automatic app downloads

AnswerA

Correct. Setting 'Allow app installation from App Store only' to 'No' blocks the App Store, so only managed apps deployed via Intune can be installed, ensuring only approved corporate apps.

Why this answer

Configuring 'Allow app installation from App Store only' to 'No' effectively blocks the App Store, preventing users from installing any apps from the store. Only apps deployed via Intune (managed apps) can then be installed, ensuring only approved corporate apps are on the devices. Option B is incorrect because requiring a password for App Store transactions does not block the installation of unapproved apps if the user has the password.

Options C and D are unrelated to app installation restrictions.

Exam trap

Candidates may mistakenly think 'Require app store password' restricts installation to approved apps, but it only adds a password prompt. The correct approach is to block the App Store entirely via 'Allow app installation from App Store only' set to No, forcing all app installations to come from Intune management.

Practice this question →

107

MCQmedium

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

A.The devices are not enrolled in Microsoft Intune.

B.The Microsoft Defender for Endpoint sensor is not installed or configured correctly.

C.The devices are not compliant with conditional access policies.

D.The devices have lost connectivity to the internet.

AnswerB

The sensor must be onboarded to communicate with the Defender for Endpoint service.

Why this answer

The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Exam trap

The trap here is that candidates often confuse device enrollment (Intune) with sensor onboarding, assuming that a device must be managed by Intune to report to Defender for Endpoint, when in fact any Windows 10 device can be onboarded via a simple script or GPO.

How to eliminate wrong answers

Option A is wrong because enrollment in Microsoft Intune is not a prerequisite for Defender for Endpoint reporting; devices can be onboarded via Group Policy, local script, or other methods without Intune. Option C is wrong because conditional access compliance policies control access to cloud apps, not the reporting of security health to Defender for Endpoint; a non-compliant device can still report telemetry. Option D is wrong because while internet connectivity is required for the sensor to communicate with the cloud, the question states some devices are inactive, not all; if connectivity were the issue, all devices would likely be affected, and the sensor would still attempt to report (showing as 'misconfigured' rather than 'inactive').

Practice this question →

108

Multi-Selecthard

Your organization is implementing a zero-trust security model using Microsoft Intune. Devices must be compliant before accessing corporate resources. You need to deploy compliance policies for Windows 10 devices that require BitLocker encryption and a minimum OS version. Which two policy settings should you configure? (Choose two.)

Select 2 answers

A.Minimum OS version.

B.Require device health attestation.

C.Require firewall (Windows Defender Firewall).

D.Require encryption of data storage on device.

E.Maximum OS version.

AnswersA, D

This setting ensures the device meets the minimum OS version requirement.

Why this answer

The 'Minimum OS version' setting in a Windows 10 compliance policy ensures that devices must be running at least a specified build number (e.g., 10.0.19041 for Windows 10 20H1). This directly enforces the zero-trust requirement that only devices with a supported, up-to-date OS can access corporate resources, reducing exposure to known vulnerabilities. Option D is correct because the 'Require encryption of data storage on device' setting mandates BitLocker encryption on the system drive, which is a core data protection control in a zero-trust model.

Exam trap

The trap here is that candidates often confuse 'Require encryption of data storage on device' with 'Require device health attestation,' mistakenly thinking health attestation covers encryption, when in fact health attestation focuses on boot integrity and does not enforce BitLocker status.

Practice this question →

109

MCQhard

Refer to the exhibit. You see the following Intune device properties for a Windows device. The device is noncompliant and the grace period expires on 2025-02-20. Today is 2025-02-15. The compliance policy requires a minimum OS version of 10.0.19041 but the device is on 10.0.18363. What will happen if the device does not become compliant before the grace period expires?

A.The device will automatically update to the required OS version

B.The device will be blocked from accessing corporate resources

C.The device will be retired immediately

D.The device will be retired after the grace period expires

AnswerD

After grace period, the configured noncompliance action (e.g., retire) will be applied.

Why this answer

When a noncompliant device's grace period expires, Intune enforces the compliance policy by retiring the device. Retirement removes the device from Intune management and revokes access to corporate resources, but it does not immediately block access or force an OS update. The grace period allows a window for remediation; after expiration, the device is marked for retirement.

Exam trap

The trap here is that candidates confuse the immediate conditional access block (which can occur during noncompliance) with the post-grace-period retirement action, or assume Intune can force OS updates automatically.

How to eliminate wrong answers

Option A is wrong because Intune does not have the capability to automatically push OS version updates to Windows devices; compliance policies only report noncompliance and trigger actions like blocking access or retirement, not OS upgrades. Option B is wrong because blocking access (conditional access) occurs when the device is noncompliant, but the grace period allows continued access until it expires; after expiration, the device is retired, not merely blocked. Option C is wrong because retirement is not immediate upon noncompliance; it occurs only after the grace period expires, as specified in the policy configuration.

Practice this question →

110

MCQeasy

A user reports that their Microsoft Intune enrolled device is not receiving required compliance policies. The device shows as 'Not evaluated' in the Microsoft Intune admin center. What is the most likely cause?

A.The device is not connected to the internet

B.The Intune Management Extension is not installed

C.The user does not have an Intune license assigned

D.The device is not enrolled in Intune

AnswerB

Without the extension, policies cannot be evaluated, leading to 'Not evaluated'.

Why this answer

When the Intune Management Extension is not installed, the device cannot process compliance policies, resulting in a 'Not evaluated' status. Option A (No internet) would typically show as 'Not compliant' or 'Unknown'. Option C (No license) would prevent enrollment, so the device wouldn't be enrolled.

Option D (Not enrolled) would show as 'Not enrolled', not 'Not evaluated'.

Practice this question →

111

MCQhard

You are deploying Windows 11 devices using Windows Autopilot. Some devices are not registering in Microsoft Intune. You have verified that the hardware hashes are uploaded correctly. What is the most likely cause?

A.The devices are not connected to the internet.

B.The hardware hashes are invalid.

C.The devices are not running Windows 11 Pro or Enterprise.

D.The user does not have an Intune license.

AnswerA

Autopilot requires internet connectivity to register with Intune.

Why this answer

Windows Autopilot requires internet connectivity during the out-of-box experience (OOBE) to contact the Autopilot deployment service and Microsoft Intune. Without internet access, the device cannot download the Autopilot profile or register in Intune, even if hardware hashes are correctly uploaded. The hardware hash upload is a separate step that does not guarantee the device can later connect to the service.

Exam trap

The trap here is that candidates often assume hardware hash upload is the only prerequisite for Autopilot registration, overlooking the critical requirement for internet connectivity during the device's initial boot process.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that the hardware hashes are uploaded correctly, so invalid hashes are not the issue. Option C is wrong because Windows Autopilot supports Windows 11 Pro, Enterprise, and Education editions; the device not registering is not caused by running an unsupported edition. Option D is wrong because the user license is not required for device registration via Autopilot; device enrollment occurs before user sign-in, and Intune licenses are only needed for user-based management after enrollment.

Practice this question →

112

MCQhard

Refer to the exhibit. You have configured the compliance policy shown above. A user reports that their Windows 11 device is compliant with all settings except the threat level. The device has no threat protection agent installed. What will happen when the user tries to access corporate resources?

A.Access is granted but the user receives a warning notification.

B.Access is blocked only after a 24-hour grace period.

C.Access is blocked immediately.

D.Access is granted because the device meets all other compliance requirements.

AnswerC

Device is noncompliant and action is to block immediately.

Why this answer

The compliance policy requires a minimum threat level, which cannot be evaluated because the device has no threat protection agent installed. In Microsoft Intune, when a required compliance setting cannot be assessed (e.g., no agent), the device is treated as non-compliant, and access is blocked immediately. There is no grace period for missing required agents, and conditional access enforces the block at the time of the access request.

Exam trap

The trap here is that candidates assume a grace period applies to all non-compliance scenarios, but grace periods are only applicable to specific settings (like password expiration) and not to missing required agents or unassessable settings.

How to eliminate wrong answers

Option A is wrong because access is not granted with a warning; Intune conditional access blocks non-compliant devices immediately, and a warning notification is only sent if the device is compliant but has a warning-level issue. Option B is wrong because a 24-hour grace period applies only to specific non-compliance actions (e.g., password expiration) when configured in a compliance policy, not to missing required agents like a threat protection agent. Option D is wrong because meeting all other compliance requirements does not override the specific threat level requirement; the device is non-compliant overall, and access is blocked.

Practice this question →

113

MCQmedium

You need to implement a solution that automatically wipes a company-owned Windows 10 device when it has not connected to Intune for 30 days. Which Intune feature should you configure?

A.A PowerShell script that runs on the device to self-destruct after 30 days.

B.Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.

C.Device cleanup rules to automatically delete devices after 30 days.

D.Device configuration profile with a setting to require periodic check-in.

AnswerB

Correct. A compliance policy can include a rule for 'Maximum days since last check-in' to mark the device non-compliant, and you can configure a non-compliance action to retire (wipe) the device after the specified period.

Why this answer

A compliance policy can include a rule for 'Maximum days since last check-in' that marks the device non-compliant if it hasn’t connected for 30 days. You then configure a non-compliance action to retire the device, which triggers a wipe. Option A is wrong because a PowerShell script cannot reliably execute on a device that hasn’t connected to Intune for 30 days—it requires connectivity to run.

Option C is wrong because device cleanup rules only remove stale device records from Intune, they do not trigger a wipe on the device. Option D is wrong because configuration profiles set settings but do not enforce check-in frequency or trigger wipe actions.

Practice this question →

114

MCQmedium

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Company Portal app is not installing required apps. You verify that the devices are compliant and checked in recently. What is the most likely cause?

A.The users are not members of the Azure AD group assigned to the required app.

B.The devices are not connected to a Wi-Fi network configured in Intune.

C.The devices are not compliant with the compliance policy.

D.The enrollment restrictions are blocking the devices from receiving apps.

AnswerA

App assignment targeting is based on group membership; if users are not in the group, the app won't be required.

Why this answer

In Microsoft Intune, app deployment is based on Azure AD group assignments. Even if a device is compliant and has recently checked in, the required app will not install unless the user or device is a member of the Azure AD group that the app is assigned to. Intune evaluates group membership at each check-in to determine which apps should be pushed, so missing group membership is the most likely cause when compliance and connectivity are verified.

Exam trap

The trap here is that candidates often assume compliance or device connectivity is the primary blocker for app installation, overlooking that Intune's app delivery is strictly gated by Azure AD group membership, not by device health or network type.

How to eliminate wrong answers

Option B is wrong because Intune does not require a specific Wi-Fi network configured in Intune for app installation; apps can be delivered over any network connection, including cellular, as long as the device has internet access. Option C is wrong because the question explicitly states that devices are compliant, so non-compliance cannot be the cause. Option D is wrong because enrollment restrictions control which devices can enroll in Intune, not the delivery of apps to already enrolled devices; once enrolled, restrictions do not block app assignments.

Practice this question →

115

MCQeasy

You need to retire a corporate-owned iOS device that is no longer in use. The device is enrolled in Intune with user affinity. Which action should you perform?

A.Disable the device in Intune.

B.Wipe the device from Intune.

C.Retire the device from Intune.

D.Delete the device from Microsoft Entra ID.

AnswerC

Retire removes management and corporate data.

Why this answer

The 'Retire' action in Intune removes the managed app data and policies from the device while preserving the user's personal data, which is appropriate for a corporate-owned device with user affinity that is no longer in use. Retiring also removes the device from Intune management and revokes the company portal access, ensuring compliance without unnecessary data loss.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Wipe' or 'Disable', not realizing that Retire is the correct action for removing corporate data without affecting personal data on a corporate-owned device with user affinity.

How to eliminate wrong answers

Option A is wrong because disabling a device in Intune only blocks it from synchronizing and receiving policies, but does not remove corporate data or unenroll the device, leaving it partially managed. Option B is wrong because wiping the device performs a factory reset, which would erase all data including personal content, which is excessive for a corporate-owned device that simply needs to be decommissioned. Option D is wrong because deleting the device from Microsoft Entra ID removes the device object from Azure AD but does not trigger the Intune retirement process, leaving the device still enrolled and potentially able to access resources.

Practice this question →

116

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are no longer receiving compliance policies. You verify that the devices are enrolled and show as active in Intune. What should you check first?

A.Verify that the compliance policy is assigned to the correct Windows version.

B.Check if the devices can connect to the Intune service.

C.Ensure the users are members of the correct Azure AD group.

D.Re-enroll the devices in Intune.

AnswerA

The update may have changed the OS version, and the policy might not target that version.

Why this answer

The correct first step is to verify that the compliance policy is assigned to the correct Windows version. After a Windows update, the OS version may change, and if the policy targets a specific version that no longer matches, devices may stop receiving it. Option B is incorrect because connectivity issues would affect all Intune communication, not just compliance policy receipt.

Option C is incorrect because group membership does not directly affect policy delivery to already-enrolled devices. Option D is incorrect because re-enrollment is unnecessary and disruptive; the issue is likely a policy targeting mismatch.

Practice this question →

117

MCQeasy

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

A.The user's Intune license has expired.

B.The Outlook app is not installed on the device.

C.A compliance policy was updated requiring a newer OS version or additional security settings.

D.The device is not enrolled in Intune.

AnswerC

Updated policies can cause previously compliant devices to become non-compliant.

Why this answer

Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Exam trap

The trap here is that candidates assume the error means the device is not enrolled or that the app is missing, but the question explicitly states the device is enrolled and compliant, so the most likely cause is a policy change that retroactively affects compliance status.

How to eliminate wrong answers

Option A is wrong because an expired Intune license would prevent the user from enrolling the device or accessing Intune-managed resources entirely, but the device is already enrolled and compliant, and the error specifically states non-compliance, not a licensing issue. Option B is wrong because if the Outlook app were not installed, the user would not be able to launch it or see an error within the app; the error is displayed by the app itself, confirming it is installed. Option D is wrong because the question explicitly states the device is enrolled in Intune and compliant, so the device is enrolled; the error is due to a change in compliance status, not enrollment status.

Practice this question →

118

MCQhard

Users report that their Android Enterprise fully managed devices are not receiving email profiles pushed from Intune. You confirm the devices are enrolled and show as compliant. What is the most likely cause?

A.The devices are using work profile instead of fully managed.

B.The devices are not compliant with the compliance policy.

C.A device restrictions profile blocks the email app.

D.The 'Android Device Policy' app is not set to 'Required' in the app assignment.

AnswerD

This app is essential for managing fully managed devices.

Why this answer

For Android Enterprise fully managed devices, the Android Device Policy app must be deployed as a required app assignment to the device. Without this assignment, the device lacks the necessary app to receive and apply email profiles pushed from Intune. The app configuration policy does not make the app required; instead, the app must be assigned as required via Intune app deployment.

Exam trap

The trap here is that candidates often assume compliance is sufficient for profile delivery, but Intune requires the 'Android Device Policy' app to be explicitly assigned as a required app (via app deployment) for fully managed devices to receive email profiles. Confusing app assignment with app configuration policy is a common mistake.

How to eliminate wrong answers

Option A is wrong because the question specifies that the devices are 'Android Enterprise fully managed devices,' so they are not using a work profile; the issue is not about profile type. Option B is wrong because the question explicitly states the devices 'show as compliant,' so non-compliance is not the cause. Option C is wrong because a device restrictions profile blocking the email app would prevent the app from running, but the issue is that email profiles are not being received, not that the app is blocked from functioning.

Practice this question →

119

Multi-Selecteasy

You need to configure conditional access for managed devices accessing Exchange Online. Which THREE conditions can be used?

Select 3 answers

A.Device platform (e.g., iOS, Android).

B.Device risk level from Microsoft Defender XDR.

C.Device compliance status.

D.App protection policy status.

E.User location based on IP address.

AnswersA, B, C

Platform can be restricted.

Why this answer

Conditional Access for managed devices can target specific device platforms (e.g., iOS, Android, Windows) to enforce policies like requiring a compliant device. This allows administrators to restrict access based on the operating system, which is a fundamental condition in Conditional Access policies for Exchange Online.

Exam trap

The trap here is that candidates often confuse App protection policy status (which applies to unmanaged devices with app-level controls) with device compliance status (which applies to managed devices), leading them to incorrectly select option D as a condition for managed devices.

Practice this question →

120

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?

A.Require device to be marked as compliant.

B.Require multi-factor authentication.

C.Require app protection policy.

D.Require device to be enrolled in Intune.

AnswerA

This ensures only compliant devices access corporate resources.

Why this answer

Conditional access in Microsoft Entra ID includes the grant control 'Require device to be marked as compliant,' which ensures that only devices meeting compliance policies can access corporate Exchange Online email. Option A is correct because this setting directly enforces compliance. Option B (Require multi-factor authentication) is separate—it adds identity verification but does not check device compliance.

Option C (Require app protection policy) applies to mobile app management, not device-level access. Option D (Require device to be enrolled in Intune) ensures enrollment but does not guarantee compliance; a device could be non-compliant even if enrolled. Therefore, only the compliance requirement meets the goal.

Practice this question →

121

MCQmedium

Refer to the exhibit. You have a compliance policy for Windows 10 devices. A device reports as non-compliant with the reason 'TPM not found'. The device does have a TPM 2.0 chip but it is disabled in BIOS. What should you do to resolve the compliance issue?

A.Replace the device's motherboard.

B.Enable the TPM in the device's BIOS settings.

C.Assign a grace period for the device.

D.Remove the tpmRequired setting from the compliance policy.

AnswerB

This will allow the TPM to be detected.

Why this answer

The device has a TPM 2.0 chip that is disabled in BIOS. Enabling the TPM in BIOS allows the device to report its TPM presence to Microsoft Intune, satisfying the compliance policy's tpmRequired setting. No hardware replacement, grace period, or policy modification is needed when the TPM is physically present but disabled.

Exam trap

The trap here is that candidates may assume a 'TPM not found' error indicates missing hardware, leading them to choose motherboard replacement or policy removal, rather than recognizing that a disabled TPM in BIOS is a common configuration issue that can be resolved without hardware changes.

How to eliminate wrong answers

Option A is wrong because replacing the motherboard is unnecessary when the TPM chip is already present and functional; the issue is only that it is disabled in BIOS. Option C is wrong because assigning a grace period would only delay enforcement of the non-compliance, not resolve the underlying TPM detection failure. Option D is wrong because removing the tpmRequired setting from the compliance policy would lower the security baseline, whereas the correct action is to enable the existing TPM hardware.

Practice this question →

122

MCQeasy

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that only devices with a passcode of at least 6 characters can access corporate email. What should you create?

A.A device compliance policy with a required passcode length of 6.

B.A device configuration profile with a passcode payload.

C.An app protection policy for Microsoft Outlook.

D.A conditional access policy requiring compliant devices.

AnswerA

Device compliance policies enforce device-level security requirements.

Why this answer

A device compliance policy in Microsoft Intune evaluates whether devices meet specific security requirements, such as a minimum passcode length. By creating a compliance policy with a required passcode length of 6, Intune marks any iOS device with a shorter passcode as noncompliant. This noncompliant status can then be used by a conditional access policy to block access to corporate email, achieving the stated goal.

Exam trap

The trap here is that candidates often confuse a device configuration profile (which enforces settings) with a device compliance policy (which evaluates and reports compliance), leading them to choose Option B instead of A.

How to eliminate wrong answers

Option B is wrong because a device configuration profile with a passcode payload enforces the passcode settings on the device (e.g., requiring the user to set a 6-character passcode), but it does not evaluate compliance or block access to corporate email on its own; it only configures the device. Option C is wrong because an app protection policy for Microsoft Outlook manages data protection within the app (e.g., preventing copy/paste or requiring a PIN for app access), but it does not enforce a device-level passcode length requirement. Option D is wrong because a conditional access policy requiring compliant devices is the mechanism that blocks access based on compliance status, but it does not define the passcode length requirement itself; you must first create the compliance policy (Option A) to set that requirement.

Practice this question →

123

MCQeasy

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved apps can be installed on corporate devices. Which policy type should you configure?

A.Device Configuration Profile with 'Allow app installation only from App Store' setting.

B.App Configuration Policy to restrict app installation.

C.Device Compliance Policy with 'Require approved apps' setting.

D.App Protection Policy with 'Allow only managed apps' setting.

AnswerD

This restricts installation to apps managed by Intune.

Why this answer

App Protection Policies (APP) in Microsoft Intune control which apps can access corporate data on iOS devices. The 'Allow only managed apps' setting restricts data transfer and app usage to apps that are managed by Intune, effectively preventing installation of unapproved apps. This is the appropriate policy for enforcing approved app installation on corporate devices.

Exam trap

The trap here is that candidates confuse App Protection Policies (which control app-level data access and approved app lists) with Device Compliance Policies (which evaluate device-level settings), leading them to select Option C despite the absence of a 'Require approved apps' setting in compliance policies.

How to eliminate wrong answers

Option A is wrong because Device Configuration Profiles with 'Allow app installation only from App Store' control the source of app installation (App Store vs. sideloading), not which specific apps are approved; it does not restrict unapproved apps from being installed from the App Store. Option B is wrong because App Configuration Policies are used to supply custom settings or managed app configurations to apps, not to restrict app installation or enforce approval lists. Option C is wrong because Device Compliance Policies evaluate device health and settings (e.g., jailbreak detection, minimum OS version), but they do not have a 'Require approved apps' setting; compliance policies can mark devices noncompliant based on app inventory but do not block installation.

Practice this question →

124

MCQeasy

You need to block users from enrolling personal Android devices in Microsoft Intune. Which enrollment restriction should you configure?

A.Set the 'Block personally owned devices' restriction for Android.

B.Set the 'Block Android' platform restriction.

C.Set the 'Block Android Enterprise' device type restriction.

D.Configure a device compliance policy to mark personal devices as non-compliant.

AnswerA

This blocks only personal devices while allowing corporate-owned.

Why this answer

The 'Block personally owned devices' restriction in Intune prevents users from enrolling personal (BYOD) Android devices. Option B is incorrect because the 'Block Android' platform restriction blocks all Android devices regardless of ownership, not just personal ones. Option C is incorrect because 'Block Android Enterprise' restricts Android Enterprise enrollment, not personally owned devices.

Option D is incorrect because device compliance policies evaluate devices after enrollment, they do not block enrollment itself.

Practice this question →

125

Multi-Selecthard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices with a passcode can access corporate resources. Which THREE configurations should you implement?

Select 3 answers

A.Device configuration profile with passcode settings

B.Windows Autopilot deployment profile

C.Conditional Access policy requiring compliant devices

D.App protection policy with passcode for managed apps

E.Device compliance policy with passcode requirement

AnswersA, C, E

Configures passcode on devices.

Why this answer

A device configuration profile with passcode settings enforces the passcode requirement directly on the iOS/iPadOS device via the MDM channel, ensuring the device itself is locked. Option C is correct because a Conditional Access policy requiring compliant devices checks the device's compliance status (which includes passcode compliance) before granting access to corporate resources like Exchange Online or SharePoint. Option E is correct because a device compliance policy with a passcode requirement defines the specific passcode rules (e.g., minimum length, complexity) and marks the device as noncompliant if unmet, which then triggers Conditional Access to block access.

Exam trap

The trap here is that candidates confuse app-level passcode enforcement (Option D) with device-level passcode enforcement, not realizing that Conditional Access and compliance policies require the device itself to be passcode-protected, not just the app.

Practice this question →

126

MCQmedium

Your organization has a mix of Windows 10 and Windows 11 devices managed by Intune. You need to enforce BitLocker encryption on all devices. Which policy type should you configure?

A.Device configuration profile with Administrative Templates.

B.Endpoint Protection profile in Device restrictions.

C.Device compliance policy.

D.Windows Update ring policy.

AnswerB

Endpoint Protection profile contains BitLocker settings.

Why this answer

The correct policy type is an Endpoint Protection profile within Device restrictions, because BitLocker settings for Windows 10/11 devices managed by Intune are configured under the 'Windows Encryption' category of an Endpoint Protection profile. This profile directly controls BitLocker drive encryption, including encryption method, recovery key management, and silent encryption enforcement, which is required for the scenario.

Exam trap

The trap here is that candidates confuse a compliance policy (which only reports and remediates non-compliance) with a configuration profile (which actually enforces the BitLocker encryption settings), leading them to select Option C.

How to eliminate wrong answers

Option A is wrong because Administrative Templates in a Device configuration profile are used for configuring Group Policy-like settings (e.g., registry-based policies) but do not include the specific BitLocker encryption settings; BitLocker is managed via the Endpoint Protection profile. Option C is wrong because a Device compliance policy evaluates whether a device meets security requirements (e.g., BitLocker enabled) but does not enforce or configure BitLocker settings; it only marks devices as compliant or non-compliant. Option D is wrong because a Windows Update ring policy controls update deferral and delivery optimization, not encryption or security settings like BitLocker.

Practice this question →

127

MCQeasy

Your organization has 200 Windows 10 devices that are not yet managed. You need to enroll them in Microsoft Intune. The devices are already joined to on-premises Active Directory. You want to enable hybrid Azure AD join and automatic enrollment via Group Policy. The devices are located in multiple sites with limited internet bandwidth. You need to minimize the amount of data transferred over the WAN during enrollment. What should you do?

A.Use Azure AD Connect to sync the devices to Azure AD and then enable automatic enrollment via Group Policy.

B.Configure a staging server to perform the initial Azure AD sync and then enable automatic enrollment via Group Policy.

C.Use Windows Autopilot to reset the devices and enroll them in Intune.

D.Manually enroll each device by signing in to the Company Portal.

AnswerB

Staging reduces WAN traffic by syncing locally.

Why this answer

Deploying a staging server (or an Azure AD Connect staging server) allows the initial device synchronization to Azure AD to occur locally, minimizing WAN traffic. After the sync, you can enable automatic enrollment via Group Policy, which only sends lightweight registration requests over the network rather than full device data.

Exam trap

The trap here is that candidates often assume Azure AD Connect is always the best choice for hybrid join, but they overlook the staging server feature specifically designed to minimize WAN traffic during initial bulk syncs.

How to eliminate wrong answers

Option A is wrong because using Azure AD Connect to sync devices directly over the WAN would transfer the full device objects and attributes across limited bandwidth links, increasing data transfer rather than minimizing it. Option C is wrong because Windows Autopilot resets the devices and requires internet connectivity for cloud-based provisioning, which would consume significant bandwidth and is not designed to minimize WAN data transfer during enrollment. Option D is wrong because manually enrolling each device via the Company Portal requires user interaction and still transfers enrollment data over the network, failing to minimize WAN traffic and being impractical for 200 devices.

Practice this question →

128

MCQeasy

A user's Windows 11 device is not receiving the Company Portal app after enrollment. The device is enrolled in Microsoft Intune. What is the most likely cause?

A.The device is not compliant with security policies.

B.The device is running Windows 10 instead of Windows 11.

C.The device is not connected to the internet.

D.The user does not have an Intune license.

AnswerC

Company Portal download requires internet connectivity.

Why this answer

The Company Portal app is delivered to enrolled devices via Intune, but the initial download and installation require an active internet connection to reach Microsoft's cloud services. If the device is not connected to the internet, the enrollment process may complete locally, but the Company Portal app will not be pushed or installed until connectivity is restored. This is the most likely cause because the question states the device is already enrolled, ruling out licensing or compliance issues that would prevent enrollment itself.

Exam trap

The trap here is that candidates often assume compliance policies or licensing are the root cause for missing apps, but the question explicitly states the device is enrolled, which already confirms a valid license and a successful initial connection, making internet connectivity the most logical remaining factor.

How to eliminate wrong answers

Option A is wrong because non-compliance with security policies does not block the installation of the Company Portal app; it may restrict access to resources or trigger remediation, but the app is still delivered. Option B is wrong because the Company Portal app is fully supported on Windows 10 (version 1607 and later) and Windows 11; the OS version is not a factor. Option D is wrong because the user must have an Intune license to enroll the device, and since the device is already enrolled, the license is present; a missing license would prevent enrollment entirely, not just the app delivery.

Practice this question →

129

Multi-Selecteasy

Which TWO methods can you use to deploy Microsoft 365 Apps to Windows 10 devices managed by Intune?

Select 2 answers

A.Use the Microsoft 365 Apps (Windows) app type in Intune.

B.Use the Microsoft 365 Apps admin center to create a configuration and deploy via Intune.

C.Use the Office Deployment Tool wrapped as a Win32 app.

D.Use Group Policy to assign Office installation.

E.Deploy the Microsoft Store version of Office.

AnswersA, B

This built-in app type simplifies deployment.

Why this answer

The 'Microsoft 365 Apps (Windows)' app type in Intune is a built-in deployment method specifically designed to install Office 365 ProPlus (now Microsoft 365 Apps) on managed Windows 10 devices. It allows you to select the installation channel, language, and update settings directly from the Intune console without needing external tools.

Exam trap

The trap here is that candidates often confuse the 'Microsoft 365 Apps (Windows)' app type with the Office Deployment Tool wrapped as a Win32 app, thinking both are equally native Intune methods, but the question specifically asks for methods that use Intune—and the ODT wrapper is a custom deployment, not a native Intune app type.

Practice this question →

130

MCQhard

You are troubleshooting an iPhone that cannot enroll in Microsoft Intune. The user receives an error stating 'This device is already enrolled in another MDM.' What is the most likely cause?

A.The device is already enrolled in Apple Business Manager or another MDM.

B.The device has a VPN configuration installed.

C.The device is not running the latest iOS version.

D.The user's license is expired.

AnswerA

Apple devices can only be enrolled in one MDM at a time. The device must be removed from the other MDM first.

Why this answer

The error 'This device is already enrolled in another MDM' indicates that the iPhone has an existing MDM profile that conflicts with Intune enrollment. This typically occurs when the device is already enrolled in Apple Business Manager (ABM) or another MDM solution, as iOS enforces a single MDM enrollment per device. Intune cannot overwrite an existing MDM profile without first removing it.

Exam trap

The trap here is that candidates may confuse MDM enrollment conflicts with other common issues like outdated OS or licensing, but the specific error message directly points to an existing MDM profile, not generic configuration or access problems.

How to eliminate wrong answers

Option B is wrong because a VPN configuration does not prevent MDM enrollment; it is a separate network setting that can coexist with an MDM profile. Option C is wrong because while an outdated iOS version might cause compatibility issues, it does not produce the specific 'already enrolled' error; Intune supports a range of iOS versions with appropriate requirements. Option D is wrong because an expired user license would block Intune enrollment with a different error (e.g., 'License not found' or 'Access denied'), not the 'already enrolled' message.

Practice this question →

131

MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps can be installed on corporate-owned devices. Which configuration profile type should you use?

A.Email profile.

B.Device features profile.

C.Apple Configurator enrollment profile.

D.Device restrictions profile with 'Allow app installation from App Store only' set to 'Block'.

AnswerD

This blocks installation of apps not from the App Store.

Why this answer

The 'Device restrictions profile' in Microsoft Intune includes the 'Allow app installation from App Store only' setting. Setting this to 'Block' prevents users from installing apps from the App Store, effectively restricting installations to only those apps that are deployed through Intune as managed apps or volume-purchased apps. This ensures that only approved apps can be installed on corporate-owned iOS/iPadOS devices.

Exam trap

The trap here is that candidates often confuse 'Device restrictions profile' with 'Device features profile' or think that enrollment profiles can enforce app restrictions, when in fact only the restrictions profile contains the granular app installation controls.

How to eliminate wrong answers

Option A is wrong because an Email profile is used to configure email account settings (e.g., Exchange ActiveSync, SMTP) on devices, not to control app installation policies. Option B is wrong because a Device features profile configures device-specific features like AirPrint, AirPlay, or wallpaper, and does not include app installation restrictions. Option C is wrong because an Apple Configurator enrollment profile is used for automated device enrollment (DEP/ABM) and initial setup, not for restricting app installations post-enrollment.

Practice this question →

132

MCQhard

You are designing a Windows 11 update strategy for a fleet of 500 devices managed by Intune. The organization requires that critical security updates be applied within 7 days, but feature updates can be delayed up to 60 days. Which Update Rings configuration should you use?

A.Assign a Quality Update policy with deferral of 7 days

B.Create an Update Ring with quality update deferral of 7 days and feature update deferral of 60 days

C.Configure Windows Update for Business via Group Policy on-premises

D.Assign a Feature Update policy with deferral of 60 days

AnswerB

Update Rings allow separate deferrals for quality and feature updates.

Why this answer

Update Rings in Intune allow you to independently configure deferral periods for quality updates (security fixes) and feature updates. Setting quality update deferral to 7 days ensures critical security patches are applied within the required window, while feature update deferral of 60 days delays non-security feature updates as needed, all managed via cloud-based Windows Update for Business policies.

Exam trap

The trap here is that candidates often confuse Update Rings with separate Quality or Feature Update policies, not realizing that Update Rings are the single object that can simultaneously control both deferral periods, while the other options only address one type of update.

How to eliminate wrong answers

Option A is wrong because a Quality Update policy (via Windows 10/11 feature update policies) only controls deferral for quality updates, but does not address the feature update deferral requirement of 60 days; it is an incomplete solution. Option C is wrong because configuring Windows Update for Business via on-premises Group Policy contradicts the requirement that devices are managed by Intune; Intune uses cloud-based policies, not local Group Policy, and this approach would not leverage the centralized mobile device management (MDM) capabilities. Option D is wrong because a Feature Update policy only controls deferral for feature updates, ignoring the quality update deferral requirement of 7 days; it addresses only half of the requirement.

Practice this question →

133

MCQhard

You are planning a Windows 11 deployment for 500 new devices using Windows Autopilot. The devices will be shipped directly to users from the manufacturer. You need to ensure that the devices are automatically enrolled in Intune and joined to Microsoft Entra ID. What should you do?

A.Register the device hashes in Intune and assign an Autopilot deployment profile

B.Pre-install the Intune Management Extension on each device

C.Configure a provisioning package and include it with the shipment

D.Create a hybrid Azure AD join configuration in Intune

AnswerA

Registering device hashes and assigning an Autopilot deployment profile with the desired join type is the standard approach.

Why this answer

Windows Autopilot uses device hashes (hardware IDs) to identify devices in Intune. By registering these hashes and assigning an Autopilot deployment profile, the devices are automatically enrolled in Intune and joined to Microsoft Entra ID during the out-of-box experience (OOBE), without requiring manual intervention or additional infrastructure.

Exam trap

The trap here is that candidates often confuse hybrid Azure AD join with Microsoft Entra ID join, or think provisioning packages are needed for Autopilot, when in fact Autopilot is designed for zero-touch, cloud-only scenarios without any on-premises dependency.

How to eliminate wrong answers

Option B is wrong because the Intune Management Extension is automatically installed during Intune enrollment, not pre-installed on devices before Autopilot runs. Option C is wrong because provisioning packages (PPKG files) are used for manual or bulk provisioning, not for the zero-touch, cloud-driven Autopilot scenario where devices are shipped directly to users. Option D is wrong because hybrid Azure AD join requires a connection to on-premises Active Directory and is not the default for Autopilot; the scenario specifies Microsoft Entra ID join, not hybrid.

Practice this question →

134

MCQeasy

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

A.Windows 10 20H2

B.Windows 10 1903

C.Windows 10 21H2

D.Windows 10 2004

AnswerD

10.0.19041 corresponds to Windows 10 version 2004.

Why this answer

The exhibit shows a compliance policy with a minimum OS version requirement set to '2004'. In Microsoft Intune, when you specify a minimum OS version for Windows 10 compliance, you must use the four-digit version number (e.g., 2004) rather than the marketing name (e.g., 20H2). Therefore, the minimum OS version required is Windows 10 2004.

Exam trap

The trap here is that candidates confuse the marketing names (like 20H2 or 21H2) with the actual version numbers used in Intune policies, leading them to select a later release instead of the exact version specified in the policy.

How to eliminate wrong answers

Option A is wrong because Windows 10 20H2 is a later feature update (released in 2020 H2) and is not the version specified in the policy; the policy explicitly requires 2004. Option B is wrong because Windows 10 1903 (version 1903) is an older release that does not meet the minimum version of 2004. Option C is wrong because Windows 10 21H2 is a newer version (released in 2021 H2) and is not the minimum version stated; the policy requires exactly 2004 as the baseline.

Practice this question →

135

MCQhard

Refer to the exhibit. You apply this device configuration profile to a group of Windows 10 devices. Users report that they receive update notifications outside of active hours. Which setting should you modify to suppress notifications during active hours?

A.Set updateNotificationLevel to 'turnOffAllNotifications'.

B.Modify activeHoursStart and activeHoursEnd to cover the full day.

C.Set cloudBlockLevel to 'normal'.

D.Set detectionFrequency to a higher value.

AnswerA

This disables all Windows Update notifications.

Why this answer

The setting updateNotificationLevel controls whether Windows Update displays notifications to users. Setting it to 'turnOffAllNotifications' suppresses all update notifications, including those that appear outside of active hours. This is the correct configuration to prevent users from seeing update notifications during active hours.

Exam trap

The trap here is that candidates often confuse active hours (which control update installation timing) with notification suppression, leading them to incorrectly choose modifying active hours instead of the dedicated notification control setting.

How to eliminate wrong answers

Option B is wrong because modifying activeHoursStart and activeHoursEnd to cover the full day would prevent updates from being installed during that time, but it does not suppress the notifications themselves; users would still receive update notifications outside the defined active hours. Option C is wrong because cloudBlockLevel is a Microsoft Defender for Endpoint setting that controls cloud-delivered protection levels, not Windows Update notification behavior. Option D is wrong because detectionFrequency controls how often the device checks for updates, not whether notifications are shown; increasing it would not suppress notifications.

Practice this question →

136

MCQeasy

You need to ensure that corporate devices automatically install critical Windows updates within 24 hours of release. Which update ring setting should you configure in Intune?

A.Grace Period for Restarts (days)

B.Defer Quality Updates (days)

C.Update Deadline for Quality Updates (days)

D.Active Hours

AnswerC

This setting enforces installation by a deadline.

Why this answer

The 'Update Deadline for Quality Updates (days)' setting in Intune's update ring policy enforces a deadline by which quality updates must be installed. Configuring this to 1 day ensures that devices install critical Windows updates within 24 hours of release, as the deadline triggers automatic installation and restart after the specified number of days.

Exam trap

The trap here is that candidates confuse 'Defer Quality Updates' (which delays updates) with 'Update Deadline for Quality Updates' (which enforces installation timing), leading them to incorrectly select Option B thinking it controls installation speed.

How to eliminate wrong answers

Option A is wrong because 'Grace Period for Restarts (days)' controls how long after the deadline a user can postpone a restart, not the time to install the update. Option B is wrong because 'Defer Quality Updates (days)' delays the availability of updates, which would prevent automatic installation within 24 hours of release. Option D is wrong because 'Active Hours' defines a time window during which restarts are avoided, but does not enforce a deadline for update installation.

Practice this question →

137

Multi-Selectmedium

Which TWO actions can you perform to reduce the amount of time it takes for a Windows 10 device to receive a new policy from Microsoft Intune?

Select 2 answers

A.Increase the policy refresh interval in the device configuration profile.

B.Manually trigger a sync from the device's Settings > Accounts > Access work or school.

C.Restart the device.

D.Change the device's DNS to point to a local Intune server.

E.Configure the device to sync more frequently using the Intune management extension.

AnswersB, E

Manual sync triggers immediate policy retrieval.

Why this answer

Manually triggering a sync from Settings > Accounts > Access work or school forces the device to immediately check in with Microsoft Intune, bypassing the default polling interval. This action initiates an immediate policy retrieval and application cycle, reducing the wait time for new policies to be received.

Exam trap

The trap here is that candidates often confuse the 'policy refresh interval' setting (which controls how often the device checks for new policies) with a manual sync action, mistakenly thinking increasing the interval speeds up delivery, when in fact it does the opposite.

Practice this question →

138

MCQhard

You apply the custom policy shown in the exhibit to a Windows 11 device. Users report that they cannot use Bluetooth devices (e.g., mouse, keyboard) after the policy applies. Which setting in the policy is causing this issue?

A.allowBluetooth set to false

B.allowStorageCard set to false

C.allowCopyPaste set to false

D.allowCamera set to false

AnswerA

Disabling Bluetooth prevents all Bluetooth devices from connecting.

Why this answer

The `allowBluetooth` setting set to `false` explicitly disables the Bluetooth radio on the device, preventing any Bluetooth peripherals (mouse, keyboard, etc.) from pairing or connecting. This is a common policy in Windows CSP (Policy CSP – Bluetooth/AllowBluetooth) that controls the Bluetooth stack at the OS level, and setting it to false blocks all Bluetooth functionality.

Exam trap

The trap here is that candidates may confuse `allowBluetooth` with other device restriction policies (like camera or storage) or assume Bluetooth issues are caused by a network or driver problem, rather than recognizing the specific CSP policy that directly disables the Bluetooth radio.

How to eliminate wrong answers

Option B is wrong because `allowStorageCard` controls the use of removable storage (e.g., SD cards), not Bluetooth connectivity. Option C is wrong because `allowCopyPaste` restricts clipboard sharing between the device and other systems (e.g., in Remote Desktop or Kiosk mode), not Bluetooth device pairing. Option D is wrong because `allowCamera` disables the built-in camera, which has no impact on Bluetooth radio or peripheral connections.

Practice this question →

139

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company-specific application (a .pkg file) to all macOS devices. The application requires a specific configuration file that must be placed in the /Library/Application Support/ directory. You also need to ensure that the application is installed silently without user interaction. How should you configure the deployment in Intune?

A.Use a shell script in Intune to download and install the .pkg file from a secure URL.

B.Create a device configuration profile for macOS that includes the app installation settings.

C.Add the .pkg file as a macOS line-of-business app in Intune, specify installation arguments for silent install, and include a script to copy the configuration file post-install.

D.Use Apple Volume Purchase Program (VPP) to distribute the app as a managed app.

AnswerC

This is the standard method for deploying custom macOS apps with configuration.

Why this answer

Intune's macOS line-of-business (LOB) app deployment supports .pkg files and allows you to specify installation arguments (e.g., `-silent` or `--acceptLicense`) for silent installation. To place the configuration file in /Library/Application Support/, you must use a post-install script because Intune does not natively copy files to specific directories during LOB app deployment. This combination ensures the app is installed silently and configured correctly.

Exam trap

The trap here is that candidates often confuse device configuration profiles (which only manage settings) with app deployment, or they assume a simple script can replace the structured LOB app deployment with its silent install and post-install script capabilities.

How to eliminate wrong answers

Option A is wrong because a shell script in Intune can download and install a .pkg, but it does not provide the built-in silent install arguments or the post-install script capability that LOB app deployment offers; additionally, Intune's script deployment lacks the same reporting and dependency management as LOB apps. Option B is wrong because device configuration profiles in Intune are used for settings (e.g., restrictions, preferences) and cannot deploy applications or run scripts. Option D is wrong because VPP is for distributing apps from the Apple App Store, not for deploying custom .pkg files or managing configuration files.

Practice this question →

140

MCQhard

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

A.Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.

B.Include the settings in the Windows 365 provisioning policy.

C.Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

D.Use a Group Policy Object (GPO) applied via on-premises AD.

AnswerA

Settings Catalog allows granular configuration of Defender and firewall settings.

Why this answer

Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Azure AD group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Exam trap

The trap here is that candidates mistakenly think Windows 365 provisioning policies can include security configurations, but in reality, they only define infrastructure settings, while all post-provisioning management (including Defender and firewall rules) must be handled by Intune policies.

How to eliminate wrong answers

Option B is wrong because Windows 365 provisioning policies only define Cloud PC configuration (e.g., region, network, image) and do not support granular security settings like Defender or custom firewall rules; those must be applied via Intune after provisioning. Option C is wrong because PowerShell scripts run during provisioning via Azure Automation are not natively integrated with Windows 365 provisioning; the recommended approach is to use Intune configuration profiles, which are designed for post-provisioning device management. Option D is wrong because Group Policy Objects (GPOs) require on-premises Active Directory and domain-joined devices, but Cloud PCs are Azure AD-joined or Hybrid Azure AD-joined by default and do not support direct GPO application without additional infrastructure like Group Policy Administrative Templates in Intune.

Practice this question →

141

Multi-Selecteasy

You are troubleshooting a Windows device that is not receiving policies from Intune. Which TWO actions should you take?

Select 2 answers

A.Configure a Conditional Access policy

B.Reset the user's password

C.Verify the device is enrolled in Intune

D.Check the device sync status in the Intune console

E.Review the app protection policy assignment

AnswersC, D

Device must be enrolled to receive policies.

Why this answer

A device must be enrolled in Intune to receive policies; if enrollment is missing, the device will not appear in the Intune console and cannot process MDM policies. Verifying enrollment status (e.g., via Settings > Accounts > Access work or school) confirms the device is managed and can receive policy payloads.

Exam trap

The trap here is that candidates confuse policy delivery issues with authentication or app-level controls, leading them to select Conditional Access or app protection policies instead of focusing on the fundamental enrollment and sync prerequisites.

Practice this question →

142

MCQeasy

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. A device is marked as non-compliant even though it has a password of length 8, firewall enabled, and Defender enabled. What is the most likely cause?

A.Microsoft Defender is not running.

B.The device firewall is not active.

C.The device does not lock after inactivity.

D.The device password is not complex enough.

AnswerC

The policy requires lock after inactivity.

Why this answer

The compliance policy JSON includes a setting for 'requireDeviceLock' or similar inactivity lock enforcement. Even though the device has a password of length 8, firewall enabled, and Defender enabled, if the device does not lock after a period of inactivity, it violates the policy. The policy likely specifies a maximum inactivity timeout (e.g., 5 minutes) and a grace period; failure to meet this requirement results in non-compliance regardless of other settings.

Exam trap

The trap here is that candidates focus on the explicitly stated enabled features (password, firewall, Defender) and assume compliance is based solely on those, ignoring the hidden requirement for device lock after inactivity which is a common but easily missed policy setting.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that Defender is enabled, so Microsoft Defender is running. Option B is wrong because the question explicitly states that the firewall is enabled, so the device firewall is active. Option D is wrong because the password length is 8, which typically meets complexity requirements for Windows 10 compliance policies (e.g., minimum length of 6 or 8, and often no additional complexity requirement unless explicitly set); the issue is not password complexity but the lack of device lock after inactivity.

Practice this question →

143

Multi-Selectmedium

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows 11 devices remotely? (Choose two.)

Select 2 answers

A.Collect diagnostics

B.Deploy a line-of-business app

C.Restart the device

D.Create a VPN profile

E.Assign a compliance policy

AnswersA, C

Remote diagnostics collection is a remote action.

Why this answer

Collecting diagnostics is a remote action available in the Microsoft Intune admin center under the 'Devices' blade. It allows administrators to gather detailed logs (e.g., MDM diagnostic logs, event logs, and registry keys) from a Windows 11 device without user interaction, which is critical for troubleshooting issues remotely.

Exam trap

The trap here is that candidates confuse policy-based actions (like deploying apps or assigning compliance policies) with immediate remote actions, which are specifically listed under the 'Device actions' menu in the Intune admin center.

Practice this question →

144

MCQeasy

A user's iOS device is enrolled in Microsoft Intune. The user reports that they cannot install the Company Portal app from the App Store. What is the most likely reason?

A.The user does not have an Apple ID.

B.The App Store is disabled by a device restriction policy.

C.The device is not enrolled in Intune.

D.The device is not supervised.

AnswerB

A device restriction policy can block the App Store.

Why this answer

A device restriction policy in Microsoft Intune can block access to the App Store on iOS devices. When the App Store is disabled via a configuration profile, users cannot install or update any apps from the App Store, including the Company Portal app. This is a common policy setting used by organizations to control app installation sources.

Exam trap

The trap here is that candidates often assume the Company Portal app must be pre-installed or that device supervision is required for app installation, but Intune can deploy the Company Portal to unsupervised devices, and the issue is specifically a policy blocking the App Store.

How to eliminate wrong answers

Option A is wrong because an Apple ID is required to download apps from the App Store, but the absence of an Apple ID would prevent any app installation, not specifically the Company Portal app, and Intune enrollment does not require an Apple ID. Option C is wrong because the user's device is already enrolled in Intune as stated in the question, so lack of enrollment cannot be the reason. Option D is wrong because device supervision is not a prerequisite for installing the Company Portal app; supervised mode is primarily used for advanced management capabilities like device configuration and restrictions, but the Company Portal can be installed on both supervised and unsupervised devices.

Practice this question →

145

MCQeasy

A company uses Microsoft Intune to manage iOS devices. They want to ensure that only devices with a passcode of at least 6 characters and without jailbreak can access corporate email. Which policy type should they configure?

A.Conditional Access policy

B.App protection policy

C.Device compliance policy

D.Device configuration policy

AnswerC

Compliance policies define required device configurations like passcode and jailbreak status.

Why this answer

Device compliance policies in Microsoft Intune evaluate device-level security settings such as jailbreak status and passcode length. By configuring a compliance policy that requires a passcode of at least 6 characters and detects jailbroken devices, Intune can mark non-compliant devices and, when combined with Conditional Access, block access to corporate email. This is the correct policy type because it directly assesses the device's security posture rather than app-level or configuration settings.

Exam trap

The trap here is that candidates confuse 'Conditional Access' (the gatekeeper) with the policy that defines the conditions (Device Compliance), leading them to select Option A because they think the policy that 'ensures only devices with... can access' is the access control policy itself, rather than the compliance policy that provides the evaluation signal.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies are access-control rules that rely on signals from compliance policies or other sources; they do not themselves define or enforce device-level requirements like passcode length or jailbreak detection. Option B is wrong because App protection policies (MAM) manage data protection at the app level (e.g., PIN for opening an app, data encryption) and do not evaluate device-level attributes such as jailbreak status or system passcode length. Option D is wrong because Device configuration policies push settings (e.g., Wi-Fi, VPN, email profiles) to devices but do not enforce compliance checks or block access based on security state; they are not designed for conditional access enforcement.

Practice this question →

146

MCQmedium

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Windows Update for Business policy is not applying to some devices. You verify the devices are assigned the correct update ring. What should you check first?

A.Increase the sync frequency for the devices.

B.Check if the devices are compliant with device compliance policies.

C.Ensure the Windows Update service is not disabled on the devices.

D.Verify the Intune Management Extension is installed.

AnswerC

The Windows Update for Business policy requires the Windows Update service to be enabled. If disabled, updates won't apply, making this the first thing to check.

Why this answer

The Windows Update for Business policy requires the Windows Update service to be enabled. If the service is disabled, updates cannot be applied regardless of update ring assignment. Option A is incorrect: increasing sync frequency may speed up policy delivery but does not prevent the policy from applying; the issue is likely a service issue, not sync timing.

Option B is incorrect: device compliance policies are separate from update rings; non-compliant devices can still receive update policies. Option D is incorrect: the Intune Management Extension is used for Win32 app deployment, not for Windows Update policy; update rings rely on the Windows Update service directly.

Practice this question →

147

MCQmedium

You manage devices at Fabrikam Inc. using Microsoft Intune. You have a Windows 11 device that is not compliant because it is missing a required application. The device shows as 'Not evaluated' in Intune for the compliance policy. The user reports that the device syncs manually but still shows as non-compliant. You have verified that the device is enrolled and policy is assigned. What should you do first to resolve the issue?

A.Verify that the user has a valid Microsoft 365 license.

B.Create a new compliance policy with the same requirements and assign it to the device.

C.From the Intune console, select the device and run the 'Sync' action with the option 'Re-evaluate compliance policies'.

D.Remove the device from Intune and re-enroll it.

AnswerC

Triggers a fresh compliance evaluation.

Why this answer

Re-evaluating the compliance policy by running a sync with the Intune management extension can trigger a fresh assessment. Creating a new compliance policy is unnecessary. Removing and re-enrolling is disruptive.

Checking the user's license is not relevant to compliance evaluation.

Practice this question →

148

MCQmedium

Your organization uses Microsoft Intune for Windows device management. Users report that after a recent update, the company VPN client fails to start. You suspect a driver conflict. Which Intune feature should you use to roll back the problematic driver without affecting other updates?

A.Windows Update Rings

B.Group Policy Administrative Templates

C.Microsoft 365 Apps Admin Center

D.Windows Driver Update Rings

AnswerD

Windows Driver Update Rings is the correct feature; it allows you to manage and roll back driver updates independently.

Why this answer

Windows Driver Update Rings (D) is the correct feature. This Intune policy type allows you to manage driver updates separately from quality updates. You can decline a problematic driver update that has already been installed, which will trigger the device to uninstall it and revert to the previous driver version.

This provides granular rollback without affecting other updates. Option A (Windows Update Rings) manages all Windows updates but does not directly support rolling back a driver that is already installed. Option B (Group Policy Administrative Templates) is for device configuration, not driver rollback.

Option C (Microsoft 365 Apps Admin Center) manages Office apps. Option D is the appropriate tool for this scenario.

Exam trap

Many candidates mistakenly believe that Windows Update Rings is the only place to manage driver updates. However, Intune provides a dedicated Windows Driver Update Rings policy that offers more granular control, including the ability to roll back specific driver updates.

How to eliminate wrong answers

Option A is wrong because Windows Update Rings control the deployment of all Windows updates (quality, feature, and driver updates) as a group, and cannot selectively roll back a single driver without reverting other updates. Option B is wrong because Group Policy Administrative Templates manage configuration settings via registry-based policies, not driver versions or rollbacks. Option C is wrong because the Microsoft 365 Apps Admin Center is used to manage Office 365 app updates and policies, not Windows drivers or device-level driver rollbacks.

Practice this question →

149

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

A.Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

B.Create a configuration profile for Windows 11 using 'Start layout' setting.

C.Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.

D.Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

AnswerC

This is the correct setting for Windows 10.

Why this answer

The Start layout for Windows 10 devices managed by Intune is configured under Device restrictions, not Administrative Templates. The 'Start layout' setting in Device restrictions allows you to upload an XML file that defines the Start menu layout, which can be applied to restore the missing layout after a software update.

Exam trap

The trap here is that candidates confuse Administrative Templates (which host ADMX-backed policies) with Device restrictions (which host mobile device management-specific settings like Start layout), leading them to choose options A or D instead of C.

How to eliminate wrong answers

Option A is wrong because Administrative Templates in Intune are used for Group Policy-like settings (e.g., registry-based policies) and do not include a 'Start layout' option; the Start layout is a device restriction, not an administrative template. Option B is wrong because the question specifies Windows 10 devices, not Windows 11, and the Start layout setting for Windows 11 is also under Device restrictions, but the option incorrectly targets Windows 11. Option D is wrong because Administrative Templates do not contain a 'Start layout' policy; the correct path is under Device restrictions for Windows 10.

Practice this question →

150

MCQhard

Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?

A.The device has not synced recently; the compliance policy may require a more recent check-in.

B.The device is company-owned, which is noncompliant by default.

C.The device is a userless device and cannot be compliant.

D.The device's operating system version is not supported.

AnswerA

Compliance policies often require devices to sync within a certain period; the last sync is March 15, which may be older than the policy threshold.

Why this answer

The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant.

Option A correctly identifies this as the most likely cause.

Exam trap

The trap here is that candidates often assume noncompliance is due to an unsupported OS version or ownership type, but the JSON explicitly shows a supported OS and no ownership-based policy, while the stale lastSyncDateTime is the clear indicator of a check-in failure.

How to eliminate wrong answers

Option B is wrong because company-owned devices are not noncompliant by default; ownership type (corporate vs. personal) does not directly affect compliance state unless a specific compliance policy targets ownership. Option C is wrong because userless devices (e.g., kiosk or shared devices) can be compliant if they meet all policy requirements; Intune supports device compliance for userless scenarios via device enrollment. Option D is wrong because the JSON shows the operating system version as '10.0.22621' (Windows 11 22H2), which is a supported version; there is no indication of an unsupported OS.

Practice this question →