Manage and maintain devices practice questions

Trigger a device sync from the Microsoft Intune admin center.

A device sync forces the Intune-enrolled device to check in and re-evaluate its assigned required applications, which can re-trigger installation or repair of the Company Portal app. This is the least invasive first step before investigating app configuration or reinstallation.

Upload the app as a LOB app in Intune and assign it to the target group.

Uploading the LOB app as a Windows app (Win32) or MSI in Intune and assigning it to the target group publishes it to the Company Portal for user installation. Intune handles delivery; certificate trust must be resolved separately via a trusted root certificate profile.

Devices have not synced with Intune to receive the updated policy.

Windows Update for Business policies only apply once the device checks in with Intune. Devices that have not synced retain their previous update configuration, so the 7-day deferral never takes effect and quality updates remain uninstalled.

Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.

Correct. A compliance policy can include a rule for 'Maximum days since last check-in' to mark the device non-compliant, and you can configure a non-compliance action to retire (wipe) the device after the specified period.

The device has a stale record in Intune that needs to be deleted.

A stale Intune record retains the device's serial number and hardware hash, so Autopilot or manual enrolment matches the existing object and stalls at 'Pending' rather than creating a new one. Deleting the record clears that binding, satisfying the stem's requirement that re-enrolment succeed after the reset.

Enable Delivery Optimization to use peer-to-peer sharing within the same network.

Delivery Optimization caches content locally and shares it peer-to-peer among devices on the same network, so each update or app downloads once from Intune rather than per device, directly easing the limited-bandwidth constraint across distributed sites.

Configure Windows Update for Business to use 'Download only' mode to reduce update size.

Download only mode uses express updates to download only changes, reducing bandwidth.

The device must be Microsoft Entra ID joined.

Self-deploying mode performs a Microsoft Entra ID join automatically during OOBE, so the device must be Microsoft Entra joined — this is the join state the profile provisions, satisfying the stem's requirement. Hybrid Microsoft Entra join is unsupported here because it needs an on-premises domain controller, which self-deploying mode cannot contact.

The device must have a TPM 2.0 chip.

Self-deploying mode requires TPM 2.0 attestation to authenticate the device against Microsoft Entra ID without any user credentials, satisfying the stem's hardware condition. TPM 1.2 or absent chips cannot perform the attestation handshake, so the device would fail enrolment before the deployment profile applies.

The device must be registered as an Autopilot device.

Self-deploying mode requires the device's hardware hash to be uploaded so Microsoft Entra ID and Intune can match it during OOBE. Without an Autopilot device registration, the profile cannot target the device, so enrolment never triggers. This satisfies the stem's prerequisite that the device be known to the Autopilot service before provisioning begins.

Use the Microsoft 365 Apps (Windows) app type in Intune.

The Microsoft 365 Apps (Windows) app type is a built-in Intune workload that wraps the Office Deployment Tool, letting you select Office apps, update channel and architecture, then assign to device or user groups. It satisfies the stem's requirement for an Intune-native deployment method.

Use the Microsoft 365 Apps admin center to create a configuration and deploy via Intune.

The Microsoft 365 Apps admin centre builds a customisation XML configuration, then integrates directly with Intune to create and assign the app. This provides a supported deployment path without manually packaging Office, satisfying the stem's deployment-method requirement.

The OS version exceeds the maximum allowed version specified in the policy.

The policy enforces a maximum OS version, and build 10.0.22621.100 sits above that ceiling, so the device fails the version comparison despite satisfying password, firewall and Defender requirements. Compliance evaluates each configured setting independently; exceeding the permitted maximum triggers non-compliance even when every other condition passes.

Set updateNotificationLevel to 'turnOffAllNotifications'.

The updateNotificationLevel setting controls which update notifications users see; setting it to turnOffAllNotifications suppresses all update-related notifications, including those appearing outside active hours. Active hours alone restrict restarts, not notification delivery, so this setting is required.

Verify that the compliance policy is assigned to the correct Windows version.

Compliance policy assignment can be scoped to specific Windows versions, so devices on an unassigned version stop receiving the policy even while enrolled and active. Checking the assignment's OS version scope directly addresses the reported loss of compliance policies.

Initiate a selective wipe from the Intune console.

A selective wipe removes only corporate data, including managed apps, profiles and policy-assigned content, while leaving personal apps and media untouched. This directly satisfies the stem's requirement that users keep personal apps and data after remediation, and it protects corporate data on a lost or stolen iOS device.

Upload the script as a PowerShell script in Intune and assign it to the device group.

Intune's PowerShell script deployment runs in the system context by default on Windows 10 devices when assigned to a device group, satisfying the requirement that the script execute as SYSTEM during enrolment without user interaction.

Verify that the devices can communicate with an on-premises domain controller.

Hybrid Microsoft Entra ID join requires line-of-sight to an on-premises domain controller for authentication and token acquisition; if devices cannot reach a domain controller, corporate resource access fails even though enrolment and compliance policies are correctly applied.

Endpoint Protection profile

Endpoint Protection profiles include the BitLocker disk-encryption settings that satisfy the stem's encryption requirement on Intune-managed Windows 10 devices. Configuring BitLocker within this profile enforces full-volume encryption and escrows recovery keys to Microsoft Entra ID, meeting the compliance and data-protection constraint directly.

App configuration policy for managed Google Play

App configuration policies can define an approved list of apps for work profiles.

Use Remote Lock to lock the device

Remote Lock immediately locks the lost iOS device, blocking unauthorised access without erasing personal data. A selective wipe would remove corporate data but leave the device usable, so Remote Lock best satisfies the requirement to prevent access while preserving the user's personal content.

Proactive remediation in Microsoft Intune

Proactive remediations run PowerShell scripts on a recurring schedule and can execute in the user context when configured, satisfying both the scheduling and user-context constraints. They also report compliance and remediation status, unlike one-off script deployment.

Configuration profile with a scheduled task

A configuration profile containing a scheduled task deploys a PowerShell script that executes on a defined schedule, and the task can be configured to run under the signed-in user's context. This satisfies both the scheduling and user-context requirements.

Wipe

Wipe is a valid Intune device management action, satisfying the stem's requirement for genuine remote actions. It performs a factory reset, removing company and personal data from the device. This differs from Retire, which removes only organisational data, and Fresh Start, which reinstalls Windows while preserving user files.

Retire

Retire removes only corporate data, management profiles and the Microsoft Entra ID device record, leaving personal files intact. It satisfies the scenario's requirement for a management action that deprovisions a device without wiping user-owned content, unlike a full factory reset.

Sync

Sync forces a device to check in with Microsoft Intune immediately, pulling pending policies, apps and configuration updates rather than waiting for the scheduled check-in interval. This satisfies the stem's requirement for a valid device management action, as it is a supported remote action available on enrolled devices.

The device OS version exceeds the maximum allowed version.

The policy enforces a maximum OS version, and build 22621.1 sits above that ceiling, so the device fails the version comparison and is marked noncompliant. Minimum-version rules would flag older builds instead; exceeding a maximum is the only mechanism here that rejects a newer Windows 10 release.