Courseiva
← MD-102
Full test
Manage and maintain devices →hardMultiple ChoiceObjective-mapped

Device Non-Compliant Because OS Version Exceeds Maximum Allowed

Exhibit

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "description": "Device compliance policy for Windows 10 devices",
  "displayName": "Windows 10 Compliance Policy v2",
  "passwordRequired": true,
  "passwordMinimumLength": 8,
  "passwordRequiredType": "deviceDefault",
  "passwordMinutesOfInactivityBeforeLock": 15,
  "storageRequireEncryption": true,
  "activeFirewallRequired": true,
  "defenderEnabled": true,
  "defenderVersion": "4.18.2207.7",
  "osMinimumVersion": "10.0.19042.0",
  "osMaximumVersion": "10.0.22621.0"
}

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running OS version 10.0.22621.100. The device has a password set, firewall active, and Defender enabled. However, the device is marked as non-compliant. What is the most likely reason?

Quick Answer

The answer is that the device is non-compliant because its OS version exceeds the maximum allowed version specified in the policy. In Microsoft Intune compliance policies, the "Maximum OS version" setting enforces an upper build limit; if a device’s OS build number is greater than the configured value, it is marked non-compliant regardless of meeting other conditions like password, firewall, or Defender status. Here, the device runs build 10.0.22621.100, which surpasses the policy’s maximum of 10.0.22621.0, triggering the non-compliance. On the MD-102 exam, this scenario tests your understanding that Intune treats OS version thresholds as strict boundaries—a common trap is assuming only minimum versions matter. Remember the memory tip: "Max means maximum—if you go over, you’re out." This concept is critical for managing OS version compliance policy in Intune, especially when rolling out updates to avoid untested builds.

⚠ Common exam trap

A common mix-up: candidates assume non-compliance is due to a missing or weak password or Defender version, overlooking that the OS version can be too high, not just too low.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The OS version exceeds the maximum allowed version specified in the policy.

The device OS version 10.0.22621.100 exceeds the maximum OS version specified in the policy (10.0.22621.0). In Microsoft Intune compliance policies, the 'Maximum OS version' setting marks a device as non-compliant if the device's OS build number is greater than the specified value, even if all other conditions are met. This is a common configuration to prevent devices from running untested or incompatible OS builds.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The password length is exactly 8 characters, but the policy requires more than 8.

    Why it's wrong here

    The policy requires minimum 8, so 8 is acceptable.

  • ✗

    Microsoft Defender is not at the required version 4.18.2207.7.

    Why it's wrong here

    The device has Defender enabled; version is not evaluated for compliance unless specified.

  • ✓

    The OS version exceeds the maximum allowed version specified in the policy.

    Why this is correct

    The device build 22621.100 is greater than the maximum 22621.0, causing non-compliance.

  • ✗

    The device does not have a password set.

    Why it's wrong here

    The stem states a password is set.

About these practice questions

Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on MD-102

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. You have created the compliance policy shown in JSON format. The policy is assigned to a group containing Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.1) is showing as noncompliant. What is the most likely reason?

hard
  • A.The device does not have BitLocker encryption enabled.
  • B.The device does not have a password set.
  • ✓ C.The device OS version exceeds the maximum allowed version.
  • D.The password type is not set to alphanumeric.

Why C: The compliance policy sets a maximum OS version. The device's OS version (10.0.22621.1) is higher than the maximum allowed version specified in the policy, causing the device to be marked as noncompliant. Therefore, option C is correct.

Variation 2. Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

easy
  • A.Windows 10 20H2
  • B.Windows 10 1903
  • C.Windows 10 21H2
  • ✓ D.Windows 10 2004

Why D: The exhibit shows a compliance policy with a minimum OS version requirement set to '2004'. In Microsoft Intune, when you specify a minimum OS version for Windows 10 compliance, you must use the four-digit version number (e.g., 2004) rather than the marketing name (e.g., 20H2). Therefore, the minimum OS version required is Windows 10 2004.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.