Courseiva

CCNA Manage Maintain Devices Questions

60 of 285 questions · Page 4/4 · Manage Maintain Devices topic · Answers revealed

Practice these questionsExam hubAll questions
226
MCQmedium

Your organization uses Microsoft Intune for device management. A user reports that their Android device is not receiving a required app that is assigned as 'Required' for all users. The device shows as 'Compliant' in Intune. What is the most likely cause?

A.The device is marked non-compliant.
B.The user has not installed the Company Portal app.
C.The device is not enrolled in Intune.
D.The app is not supported on the device's Android version.
AnswerD

App incompatibility is a common reason for required apps not installing.

Why this answer

The device is compliant and enrolled, and the user has the Company Portal app (required for Android enrollment). The most likely reason the required app is not installing is that the app is not supported on the device's Android version. Intune will skip installation if the minimum OS version requirement defined in the app assignment is not met, even if the device is otherwise compliant.

Exam trap

The trap here is that candidates assume a compliant device will always receive required apps, overlooking that app-level OS version requirements are evaluated separately from device compliance policies.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as 'Compliant' in Intune, so non-compliance cannot be the cause. Option B is wrong because the Company Portal app is required for Android enrollment; if it were missing, the device would not be enrolled or compliant. Option C is wrong because the device shows as 'Compliant' in Intune, which requires successful enrollment; an unenrolled device would not have a compliance status.

Practice this question →
227
Multi-Selecteasy

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Select 2 answers
A.Device compliance policy
B.Enrollment restriction
C.App protection policy
D.Device configuration policy
E.Windows update ring
AnswersA, C

Compliance policies can be assigned to user groups to evaluate devices of those users.

Why this answer

Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Exam trap

The trap here is that candidates often assume all Intune policies can be assigned to user groups, but Microsoft explicitly restricts enrollment restrictions, device configuration policies, and update rings to device groups only.

Practice this question →
228
MCQeasy

You need to configure Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. What is the recommended method to onboard devices?

A.Install the Defender for Endpoint client manually on each device.
B.Use a device configuration profile in Intune to deploy the onboarding package.
C.Use the Microsoft 365 Defender portal to generate a script that users run.
D.Use Group Policy to configure the onboarding registry keys.
AnswerB

Correct: Device configuration profiles in Intune can deploy the onboarding package to enrolled devices.

Why this answer

Intune's device configuration profiles allow you to deploy the Defender for Endpoint onboarding package (a .zip containing the onboarding script and required files) directly to Windows 10 devices. This method is recommended as it integrates seamlessly with Intune's management framework, supports bulk deployment via policies, and ensures devices are properly configured without manual intervention or user interaction.

Exam trap

The trap here is that candidates often assume Group Policy (Option D) is the standard for all Windows management, but for Intune-managed devices, the recommended and supported method is the device configuration profile, not Group Policy, which requires on-premises infrastructure and does not integrate with cloud-based enrollment.

How to eliminate wrong answers

Option A is wrong because manually installing the Defender for Endpoint client on each device is not scalable for enterprise environments and contradicts the recommended automated approach via Intune. Option C is wrong because the Microsoft 365 Defender portal generates a script for local execution, but relying on users to run it introduces security risks, compliance gaps, and lacks centralized enforcement. Option D is wrong because Group Policy is not the recommended method for Intune-managed devices; while it can configure registry keys, it requires on-premises Active Directory and does not leverage Intune's cloud-native device management capabilities.

Practice this question →
229
MCQeasy

A user's mobile device is lost. You need to remotely wipe the device using Microsoft Intune. What is the correct sequence of actions?

A.Ask the user to reset the device from the Company Portal app.
B.Create a device compliance policy with the Action for noncompliance set to 'Remote wipe'.
C.In the Microsoft Intune admin center, select the device and choose Retire/Wipe.
D.Remove the device from Microsoft Entra ID and it will automatically wipe.
AnswerC

This is the correct action to wipe a device.

Why this answer

The Retire/Wipe action in the Microsoft Intune admin center is the direct, administrator-initiated method to remotely wipe a lost device. This action sends a wipe command to the device via the Intune service, which the device's management agent (Company Portal or MDM agent) processes to perform a factory reset, removing all corporate and personal data.

Exam trap

The trap here is that candidates confuse the automatic wipe triggered by a compliance policy (Option B) with the manual, immediate wipe needed for a lost device, or they assume removing the device from Entra ID (Option D) will wipe it, which it does not.

How to eliminate wrong answers

Option A is wrong because the Company Portal app allows a user to initiate a remote wipe themselves, but the scenario states the device is lost, so the user cannot access the app; the administrator must perform the wipe. Option B is wrong because a device compliance policy with 'Action for noncompliance' set to 'Remote wipe' only triggers a wipe when the device becomes noncompliant (e.g., after a policy violation), not as an immediate, on-demand wipe for a lost device. Option D is wrong because removing a device from Microsoft Entra ID (formerly Azure AD) only revokes its access to cloud resources and does not send a wipe command; the device remains intact with all data.

Practice this question →
230
Multi-Selecteasy

Which THREE are valid device management actions in Microsoft Intune? (Choose three.)

Select 3 answers
A.Wipe
B.Delete
C.Retire
D.Sync
E.Reboot
AnswersA, C, D

Wipe restores the device to factory settings.

Why this answer

Wipe is a valid Intune device action that restores a device to factory default settings, removing all data and corporate resources. It is typically used for devices that are lost, stolen, or being repurposed, and it can be applied to both corporate-owned and personally-owned devices enrolled in Intune.

Exam trap

Microsoft often tests the distinction between 'Wipe' and 'Retire' actions, and candidates may confuse 'Delete' with 'Retire' or assume 'Reboot' is a built-in action when it is not directly available in the Intune console.

Practice this question →
231
MCQhard

You manage a hybrid Azure AD joined Windows 10 device with Intune. The device is showing as 'Pending' enrollment. You have verified that the user has an Intune license and the device is synced with Azure AD Connect. What is the most likely issue?

A.The user is not the primary user of the device.
B.The Group Policy for automatic Intune enrollment is not applied to the device.
C.The device is not co-managed with Configuration Manager.
D.Azure AD Connect has not synced the device object.
AnswerB

Hybrid Azure AD joined devices need a GPO with the MDM discovery URL.

Why this answer

When a hybrid Azure AD joined device shows 'Pending' enrollment in Intune, the most common cause is that the Group Policy setting 'Automatically enroll devices to Microsoft Intune' has not been applied to the device. This policy triggers the automatic MDM enrollment via the device's scheduled task during user sign-in. Without this policy, the device remains in a pending state even if the user has a license and the device object is synced.

Exam trap

The trap here is that candidates often assume a synced device object and a licensed user are sufficient for enrollment, overlooking the critical Group Policy trigger that initiates the automatic MDM enrollment workflow.

How to eliminate wrong answers

Option A is wrong because the 'Pending' enrollment status is not related to the primary user assignment; Intune enrollment for hybrid Azure AD joined devices is device-based and does not require a designated primary user. Option C is wrong because co-management with Configuration Manager is not a prerequisite for Intune enrollment; it is an optional configuration that can be added after enrollment. Option D is wrong because the device object has already been synced with Azure AD Connect (as stated in the question), and the 'Pending' status indicates the enrollment process has started but is waiting for the MDM discovery step, not for the device object to appear in Azure AD.

Practice this question →
232
MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the corporate Wi-Fi profile no longer connects automatically. You verify the profile is still assigned and the device shows 'Not compliant' in Intune. What should you check first?

A.Review the device's compliance policy status and resolve any non-compliance.
B.Re-enroll the device in Intune.
C.Create a new Wi-Fi profile and assign it.
D.Verify the device's certificate for the Wi-Fi profile is still valid.
AnswerA

Non-compliance can block policies; resolving it will allow the Wi-Fi profile to apply.

Why this answer

The device shows 'Not compliant' in Intune, which directly prevents the Wi-Fi profile from applying or connecting automatically. Intune enforces compliance before allowing configuration profiles to take effect; resolving the non-compliance will restore automatic connectivity. This is the most direct and likely cause given the scenario.

Exam trap

The trap here is that candidates often jump to certificate or profile issues, overlooking that Intune's compliance enforcement can block profile application even when the profile is correctly assigned and certificates are valid.

How to eliminate wrong answers

Option B is wrong because re-enrolling the device is a drastic step that does not address the root cause of non-compliance; the profile is already assigned, and re-enrollment would not fix compliance issues. Option C is wrong because creating a new Wi-Fi profile would be redundant and ineffective if the existing profile is still assigned but blocked by non-compliance; the issue is not the profile itself. Option D is wrong because while certificate validity could cause connectivity issues, the device's 'Not compliant' status is the immediate blocker, and certificate issues would typically manifest as authentication failures, not a failure to connect automatically.

Practice this question →
233
MCQhard

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

A.Screen timeout exceeds the policy setting
B.Device threat protection level is not set to high
C.Storage encryption is not enabled
D.OS version is above the maximum allowed
AnswerA

Policy requires lock after 5 minutes; device may have longer timeout.

Why this answer

The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Exam trap

The trap here is that candidates assume noncompliance must be due to a security feature like encryption or threat protection, but the question explicitly states those are met, so the correct answer is the less obvious screen timeout setting, which is a common misconfiguration in Intune compliance policies.

How to eliminate wrong answers

Option B is wrong because the device uses Microsoft Defender for Endpoint with a 'high' security level, which meets the threat protection requirement; the policy likely requires a minimum level of 'high' or 'medium', and 'high' satisfies it. Option C is wrong because BitLocker is enabled, which satisfies storage encryption requirements for compliance; the policy does not require additional encryption beyond what BitLocker provides. Option D is wrong because the OS version 10.0.22621.500 corresponds to Windows 11 22H2, which is below the maximum allowed version (typically the latest supported build), and the policy does not set a maximum OS version that would exclude this build.

Practice this question →
234
Multi-Selectmedium

You are troubleshooting an Intune-managed Windows 10 device that is not receiving a required application. Which THREE steps should you take to diagnose the issue? (Choose three.)

Select 3 answers
A.Ensure the device has network connectivity
B.Review the app requirement rules (e.g., OS version)
C.Check the app assignment status in the Intune console
D.Verify the device is compliant with compliance policies
E.Perform a factory reset on the device
AnswersA, B, C

The device must be able to reach Intune to download the app.

Why this answer

Network connectivity is a prerequisite for Intune-managed devices to communicate with the Microsoft Intune service. Without connectivity, the device cannot check in, download app policies, or retrieve application payloads. You should verify the device can reach endpoints like *.manage.microsoft.com and that the Windows Push Notification Services (WNS) channel is open.

Exam trap

The trap here is confusing compliance policies with app delivery prerequisites; candidates often assume a non-compliant device cannot receive any apps, but Intune separates compliance from app assignment unless conditional access is explicitly configured.

Practice this question →
235
MCQhard

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

A.bitLockerEncryptionMethod set to aes256
B.passwordRequired set to true
C.bitLockerDisableWarningForOtherDiskEncryption set to false
D.bitLockerDisableWarningForOtherDiskEncryption set to true
AnswerC

When false, the warning is shown and BitLocker will not enable if other encryption exists.

Why this answer

Setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Exam trap

The trap here is that candidates often confuse bitLockerDisableWarningForOtherDiskEncryption with a simple warning toggle, not realizing that setting it to false actively blocks BitLocker enablement when other encryption is detected, while setting it to true allows BitLocker to proceed without warning.

How to eliminate wrong answers

Option A is wrong because bitLockerEncryptionMethod set to aes256 only specifies the encryption algorithm to use (AES-256) when BitLocker is enabled; it does not control whether BitLocker can be enabled if another encryption method is already present. Option B is wrong because passwordRequired set to true mandates that a recovery password be configured for BitLocker, but it does not affect the detection or blocking of other disk encryption methods. Option D is wrong because setting bitLockerDisableWarningForOtherDiskEncryption to true would suppress the warning and allow BitLocker to be enabled even if another encryption method is in use, which is the opposite of the desired behavior.

Practice this question →
236
MCQhard

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

A.Enable the work profile on the devices via a device configuration profile.
B.Change the device encryption method to full-disk encryption using a device configuration profile.
C.Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.
D.Create a device configuration profile that enforces encryption on the work profile.
AnswerC

The compliance policy should correctly assess file-based encryption as compliant; re-evaluation may resolve false non-compliance.

Why this answer

The issue is likely a misconfiguration of the compliance policy assignment or evaluation. Android Enterprise work profile devices use file-based encryption by default, which Intune considers compliant. If devices are marked non-compliant despite encryption being enabled, you should verify that the compliance policy is correctly assigned to the target groups and re-evaluate the policy.

Option A is incorrect because the work profile is already enabled on the device. Option B is incorrect because Intune cannot change the encryption method on Android devices; encryption type is device-specific. Option D is incorrect because device configuration profiles cannot enforce encryption on the work profile; encryption is managed by the device OS.

Practice this question →
237
MCQmedium

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

A.requireCodeIntegrity
B.passwordMinimumLength
C.requireDeviceEncryption
D.requireSecureBoot
AnswerB

The policy requires minimum 8 characters, but the device has only 6.

Why this answer

The compliance policy requires a minimum password length, and the device's 6-character password does not meet that requirement, making it non-compliant. The passwordMinimumLength setting directly controls the minimum number of characters a password must have, so a password shorter than the configured value triggers non-compliance.

Exam trap

The trap here is that candidates often confuse passwordMinimumLength with password complexity or other security settings like requireCodeIntegrity or requireSecureBoot, assuming any security-related non-compliance must be due to a broader security feature rather than the specific password length.

How to eliminate wrong answers

Option A is wrong because requireCodeIntegrity enforces that code integrity features (like Windows Defender Application Control) are enabled, which is unrelated to password length. Option C is wrong because requireDeviceEncryption mandates BitLocker or device encryption, not password length. Option D is wrong because requireSecureBoot checks that Secure Boot is enabled in UEFI, which is a hardware security feature, not a password policy.

Practice this question →
238
MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

A.Set up an automatic enrollment policy that retires devices after 30 days of inactivity.
B.Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.
C.Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.
D.Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.
AnswerC

This directly enforces retirement after 30 days of inactivity.

Why this answer

Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Exam trap

The trap here is that candidates often confuse Intune device cleanup rules (which simply remove stale device records from the console) with compliance policy actions (which can actually retire the device and revoke company data), leading them to select Option B incorrectly.

How to eliminate wrong answers

Option A is wrong because automatic enrollment policies are used to enroll devices into Intune, not to retire them after inactivity; there is no 'retire after inactivity' setting in enrollment policies. Option B is wrong because Intune device cleanup rules remove devices from the Intune console after a specified number of days of no check-in, but they do not trigger a retire action—they simply delete the device record, which does not send a retire command to the device or revoke company data. Option D is wrong because device configuration profiles manage settings like security policies and compliance, but they do not include a 'Device Health' setting to require check-in within a certain number of days, nor do they have the ability to trigger a retire action based on check-in frequency.

Practice this question →
239
Multi-Selectmedium

Your organization is planning to use Microsoft Intune to manage Windows 11 devices. Which TWO are prerequisites for enrolling a Windows device in Intune?

Select 2 answers
A.Local administrator account on the device.
B.Microsoft Copilot for Microsoft 365 license.
C.Azure AD Premium P2 license.
D.Network connectivity to https://manage.microsoft.com and other Intune endpoints.
E.A Microsoft account (work or school) with an Intune license.
AnswersD, E

Connectivity is required for enrollment and management.

Why this answer

Network connectivity to https://manage.microsoft.com and other Intune endpoints is essential for device enrollment. Without this connectivity, the device cannot communicate with the Intune service to complete registration, policy retrieval, or management tasks. This requirement applies to all enrollment methods, including automatic enrollment via Azure AD join and manual enrollment via the Company Portal.

Exam trap

The trap here is that candidates often confuse the licensing requirements for Intune enrollment with Azure AD Premium P2, but Intune enrollment only requires an Intune license (or a bundled license like Microsoft 365 E3), not Azure AD P2.

Practice this question →
240
MCQhard

A user reports that their Windows 11 device cannot connect to the corporate Wi-Fi network. In Intune, the device shows a status of 'Pending' for the Wi-Fi configuration profile. The profile is assigned to a group that includes the user. What is the most likely cause of the issue?

A.The device does not have the required root certificate installed.
B.The Wi-Fi profile is not assigned to the user's group.
C.The Wi-Fi profile requires user affinity and the device is shared.
D.The device has not checked in to Intune within the last 8 hours.
AnswerD

Devices check in periodically; a pending status means the policy hasn't been applied yet.

Why this answer

The 'Pending' status in Intune for a Wi-Fi configuration profile indicates that the policy has been assigned but not yet applied to the device. This typically occurs when the device has not performed a recent check-in with the Intune service. By default, devices check in every 8 hours, so if the device has not checked in within that window, the profile remains in a 'Pending' state until the next successful sync.

Exam trap

The trap here is that candidates often assume 'Pending' means a configuration error (like missing certificates or incorrect assignment) rather than recognizing it as a synchronization delay, which is a common Intune behavior tested on the MD-102 exam.

How to eliminate wrong answers

Option A is wrong because a missing root certificate would typically cause a connection failure after the profile is applied, not a 'Pending' status in Intune; the profile would still be delivered and show as 'Succeeded' or 'Error' depending on the certificate validation. Option B is wrong because the question explicitly states the profile is assigned to a group that includes the user, so assignment is not the issue. Option C is wrong because user affinity affects how profiles are targeted (user vs. device), but a 'Pending' status is not caused by user affinity settings; it is a sync timing issue.

Practice this question →
241
Multi-Selecthard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the user context on a schedule. Which TWO methods can you use? (Choose two.)

Select 2 answers
A.Device compliance policy with a custom script
B.Proactive remediation in Microsoft Intune
C.Configuration profile with a scheduled task
D.Line-of-business app deployment package
E.PowerShell script deployment from the Intune console
AnswersB, C

Proactive remediations can run PowerShell scripts on a schedule in user context.

Why this answer

Proactive remediations in Microsoft Intune allow you to run PowerShell scripts in the user context on a schedule, making option B correct. They are designed for detection and remediation of common support issues, supporting both user and system context execution with configurable schedules.

Exam trap

The trap here is that candidates confuse the one-time execution of Intune PowerShell scripts (option E) with the scheduled execution capability of proactive remediations, or mistakenly think a configuration profile with a scheduled task (option C) is not valid because it requires manual creation of the scheduled task XML, but it is actually a supported method for running scripts on a schedule in the user context.

Practice this question →
242
MCQeasy

A Windows 10 device is assigned this update ring policy. A new quality update is released today. When will the device install the update?

A.In 7 days
B.In 30 days
C.Today
D.Never, because automatic update mode requires reboot with warning.
AnswerC

Deferral is 0 days, so it installs as soon as available.

Why this answer

The update ring policy is configured with 'Automatic update behavior' set to 'Auto install and restart without end-user control' and 'Servicing channel' set to 'Current branch (CB)'. When a new quality update is released, devices in this configuration will download and install the update immediately, typically within 24 hours of release, without any deferral period. The policy does not specify any deferral for quality updates, so the installation occurs today.

Exam trap

The trap here is that candidates confuse the 'Automatic update behavior' setting (which controls restart behavior) with the deferral period (which controls when the update is offered), leading them to incorrectly assume that a 'reboot with warning' mode delays the installation itself.

How to eliminate wrong answers

Option A is wrong because a 7-day deferral would only apply if the update ring policy had a 'Quality update deferral period (days)' set to 7, which is not indicated in the scenario. Option B is wrong because a 30-day deferral is typically used for feature updates, not quality updates, and the policy does not specify such a deferral for quality updates. Option D is wrong because 'Automatic update mode' with 'Auto install and restart without end-user control' does not prevent installation; it allows the update to install and then reboots with a warning, but the update itself is installed immediately upon availability.

Practice this question →
243
Multi-Selecteasy

A company uses Microsoft Intune to manage devices. They want to use a script to collect inventory data from Windows devices. Which TWO methods can be used?

Select 2 answers
A.Device configuration profile
B.Proactive remediations
C.Custom compliance policy
D.PowerShell script deployment
E.App protection policy
AnswersB, C

Detection scripts in proactive remediations can collect inventory data.

Why this answer

Proactive remediations (B) are correct because they allow you to run PowerShell scripts on a schedule to detect and remediate issues, and the detection script can output custom inventory data that is collected and reported in Intune. Custom compliance policies (C) are correct because they can execute a PowerShell script to evaluate compliance settings, and the script's output (e.g., registry values, file versions) can be used to gather inventory data as part of the compliance check.

Exam trap

The trap here is that candidates confuse 'running a script' (PowerShell script deployment) with 'collecting inventory data from a script' (Proactive remediations or custom compliance policies), not realizing that only the latter two methods natively capture and report script output back to Intune as inventory.

Practice this question →
244
MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

A.Wipe
B.Remove work profile
C.Retire
D.Delete
AnswerB

This action removes only the work profile, preserving personal apps and data.

Why this answer

The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Remove work profile' because both remove corporate data, but on Android Enterprise personally-owned work profile devices, 'Remove work profile' is the explicit and correct action name, while 'Retire' is a legacy or generic term that may not be listed as a separate action in the Intune console for this device type.

How to eliminate wrong answers

Option A is wrong because 'Wipe' performs a full factory reset of the entire device, erasing both personal and corporate data, which is not appropriate when only the work profile needs to be removed. Option C is wrong because 'Retire' is a generic action that removes management and all company data from the device, but on Android Enterprise personally-owned work profile devices, it effectively performs the same as 'Remove work profile'; however, the specific and correct action name for this scenario is 'Remove work profile', not 'Retire'. Option D is wrong because 'Delete' is not a valid remote action in Microsoft Intune for Android Enterprise devices; it typically refers to deleting the device object from the console without initiating a wipe or profile removal.

Practice this question →
245
Multi-Selecthard

Which THREE conditions must be met for a Windows 10 device to be able to use Windows Autopilot self-deploying mode?

Select 3 answers
A.The device must be Azure AD joined.
B.The device must have a TPM 2.0 chip.
C.The device must be Hybrid Azure AD joined.
D.The device must be registered as an Autopilot device.
E.A user must be assigned to the device in Autopilot.
AnswersA, B, D

Self-deploying mode requires Azure AD join.

Why this answer

Azure AD join is required for self-deploying mode because this mode provisions a device for shared or kiosk scenarios without user interaction. The device must be joined to Azure AD to establish a device identity and allow policy application before any user signs in, which is a core requirement for the zero-touch provisioning flow.

Exam trap

The trap here is that candidates often confuse self-deploying mode with user-driven modes and incorrectly assume a user must be assigned, or they think Hybrid Azure AD join is supported in self-deploying mode, but Microsoft explicitly restricts self-deploying to Azure AD join only.

Practice this question →
246
MCQmedium

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the result?

A.A list of all devices regardless of operating system.
B.A list of all Windows devices with their last activity.
C.A count of unique Windows devices per device name in the last 7 days.
D.A count of security alerts per device.
AnswerC

Correct. The query summarizes unique devices by name.

Why this answer

The KQL query uses `DeviceInfo` (a Microsoft Sentinel table for device inventory), filters with `where` to include only rows where `OperatingSystem` contains 'Windows', then uses `summarize` with `dcount(DeviceName)` to count distinct device names, and `bin(TimeGenerated, 7d)` to group by 7-day intervals. This produces a count of unique Windows devices per device name over the last 7 days, making option C correct.

Exam trap

The trap here is that candidates may misinterpret `dcount(DeviceName)` as a count of rows or a list of devices, rather than recognizing it as a distinct count aggregation, and may overlook that `DeviceInfo` is an inventory table, not an alert table.

How to eliminate wrong answers

Option A is wrong because the query explicitly filters for Windows devices (`where OperatingSystem contains 'Windows'`), so it does not return all devices regardless of OS. Option B is wrong because the query does not retrieve any 'last activity' data; it uses `dcount(DeviceName)` to count unique devices, not to list devices with their last activity timestamp. Option D is wrong because the query operates on `DeviceInfo`, which is a device inventory table, not a security alerts table; there is no alert data or alert count logic in the query.

Practice this question →
247
MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that devices cannot connect to unsecured Wi-Fi networks. Which policy type should you configure?

A.Device configuration profile with network settings.
B.Compliance policy.
C.Certificate profile.
D.Wi-Fi profile.
AnswerD

Wi-Fi profiles define allowed networks and their security settings.

Why this answer

A Wi-Fi profile in Microsoft Intune is specifically designed to configure Wi-Fi settings on devices, including security protocols and authentication methods. By configuring a Wi-Fi profile to only allow connections to secured networks (e.g., WPA2-Enterprise or WPA3), you can prevent devices from connecting to unsecured Wi-Fi networks. This policy type directly controls the Wi-Fi connection behavior at the device level.

Exam trap

The trap here is that candidates often confuse a Wi-Fi profile with a device configuration profile or compliance policy, not realizing that only a Wi-Fi profile can enforce the specific security settings required to block unsecured network connections.

How to eliminate wrong answers

Option A is wrong because a device configuration profile with network settings can configure various network-related policies (e.g., proxy, VPN), but it does not include the specific Wi-Fi security settings needed to block unsecured networks. Option B is wrong because a compliance policy evaluates device compliance after a connection is made and can mark a device as non-compliant, but it cannot proactively prevent the device from connecting to an unsecured Wi-Fi network. Option C is wrong because a certificate profile is used to deploy certificates for authentication (e.g., for Wi-Fi or VPN), but it does not define the Wi-Fi connection rules or security requirements.

Practice this question →
248
Multi-Selectmedium

Which TWO actions can an Intune administrator take to ensure that only compliant devices can access corporate Exchange Online email?

Select 2 answers
A.Configure an Exchange Active Sync policy in Intune.
B.Create a device configuration profile to enforce security settings.
C.Deploy an app protection policy for Outlook for iOS and Android.
D.Create a device compliance policy that checks for required settings.
E.Create a conditional access policy in Microsoft Entra ID that requires devices to be marked as compliant.
AnswersD, E

Device compliance policies mark devices as compliant or non-compliant, used by conditional access.

Why this answer

A device compliance policy in Intune defines the rules (e.g., requiring a minimum OS version, encryption, or a jailbreak/root status check) that a device must meet to be considered compliant. This policy is a prerequisite for conditional access, ensuring only devices that satisfy these security baselines can access corporate resources like Exchange Online.

Exam trap

The trap here is that candidates confuse device compliance policies (which check device state) with app protection policies (which protect data at the app layer), leading them to incorrectly select Option C, even though app protection policies do not enforce device-level compliance for conditional access.

Practice this question →
249
MCQhard

You are troubleshooting a Windows 11 device that fails to install an Intune-managed update. The device has been offline for two weeks. After reconnecting, the update does not install. In the Intune console, the update shows 'Failed to install' with error code 0x800f0831. What is the most likely cause?

A.The device does not have internet connectivity.
B.The device's Windows component store is corrupted due to missing prerequisites.
C.The device does not have enough disk space.
D.The update is superseded and no longer applicable.
AnswerB

Being offline for a long time can cause prerequisite issues, leading to this error.

Why this answer

Error code 0x800f0831 indicates that the Windows component store (CBS) is corrupted because a required servicing stack or prerequisite update is missing. When a device has been offline for two weeks, it may lack the necessary baseline updates that the current update depends on, causing the installation to fail even after reconnecting to the network.

Exam trap

The trap here is that candidates often assume 'offline for two weeks' implies a connectivity issue (option A), but the specific error code 0x800f0831 points to a corrupted component store from missing prerequisites, not a network problem.

How to eliminate wrong answers

Option A is wrong because the device has reconnected to the network and the Intune console shows the update attempt with a specific error code, which implies internet connectivity is present; a lack of connectivity would typically result in a 'pending download' or 'not applicable' status, not a specific CBS error. Option C is wrong because insufficient disk space usually produces error codes like 0x80070070 or 0x80070008, not 0x800f0831, which is specific to component store corruption. Option D is wrong because a superseded update would show as 'not applicable' or 'superseded' in the Intune console, not 'Failed to install' with a CBS-related error code; superseded updates are simply no longer offered to the device.

Practice this question →
250
MCQeasy

A user reports that after resetting their Windows 10 device, they cannot re-enroll it in Intune. The device appears as 'Pending' in the admin center. What is the most likely reason?

A.The device has a stale record in Intune that needs to be deleted.
B.The user is trying to enroll with a different Azure AD account.
C.The MDM authority is not set to Intune.
D.The user does not have an Intune license assigned.
AnswerA

A previous enrollment record can block re-enrollment; deleting it resolves the issue.

Why this answer

When a Windows 10 device is reset, its existing Intune enrollment record becomes stale. The device attempts to re-enroll but the old record causes a conflict, leaving the device in a 'Pending' state in the admin center. Deleting the stale device record from Intune allows the enrollment to complete successfully.

Exam trap

The trap here is that candidates may think a 'Pending' state is due to licensing or authority misconfiguration, but the real cause is the stale device record left behind after a reset, which is a specific enrollment conflict scenario tested in MD-102.

How to eliminate wrong answers

Option B is wrong because enrolling with a different Azure AD account would typically result in a different device identity or a registration failure, not a 'Pending' state; the issue is a stale record, not an account mismatch. Option C is wrong because if the MDM authority were not set to Intune, the device would fail to enroll entirely or show an error, not remain in 'Pending'; the authority is already configured for Intune. Option D is wrong because a missing Intune license would prevent enrollment initiation or show a licensing error, not cause a 'Pending' state after a reset; the user was previously enrolled, so licensing is already in place.

Practice this question →
251
Multi-Selecthard

Your organization uses Microsoft Intune to manage devices. You need to collect diagnostic logs from a remote Windows device without user interaction. Which THREE methods can you use?

Select 3 answers
A.MDM diagnostic log collection policy
B.Device configuration profile
C.Device diagnostics (Intune device action)
D.Microsoft Support and Recovery Assistant
E.Remote Windows PowerShell session
AnswersA, C, E

Policy can trigger log upload to Intune.

Why this answer

The MDM diagnostic log collection policy is a built-in Intune feature that allows administrators to configure and trigger the collection of device diagnostic logs from Windows devices remotely without any user interaction. This policy leverages the Windows MDM protocol to gather logs such as event viewer logs, registry keys, and network traces, and uploads them to an Azure storage container for analysis.

Exam trap

The trap here is that candidates often confuse Device configuration profiles (which manage settings) with diagnostic collection actions, or assume that SaRA can be triggered remotely via Intune, when in fact it requires local user initiation.

Practice this question →
252
MCQeasy

You need to ensure that all Windows 11 devices in your organization have BitLocker enabled and the recovery key escrowed to Microsoft Entra ID. Which Intune policy should you configure?

A.Compliance Policy
B.Device Restrictions profile
C.Endpoint Protection profile
D.Device Configuration profile
AnswerC

Correct. Endpoint Protection profile includes BitLocker settings.

Why this answer

The Endpoint Protection profile in Microsoft Intune contains the BitLocker settings, including the requirement to enable BitLocker and automatically escrow the recovery key to Microsoft Entra ID. This profile is specifically designed for security configurations like disk encryption, firewall, and antivirus, making it the correct choice for this task.

Exam trap

The trap here is that candidates often confuse Compliance Policy with configuration policies, thinking that compliance can enforce BitLocker, but compliance only reports and can trigger remediation actions—it does not configure the encryption or key escrow settings itself.

How to eliminate wrong answers

Option A is wrong because Compliance Policy evaluates whether devices meet security requirements (e.g., BitLocker enabled) but cannot enforce or configure BitLocker settings or escrow keys; it only reports non-compliance. Option B is wrong because Device Restrictions profile controls device-level settings like password policies and browser restrictions, not disk encryption or key escrow. Option D is wrong because Device Configuration profile is a general container for settings like email, Wi-Fi, and certificates, but BitLocker-specific policies are managed under the dedicated Endpoint Protection profile.

Practice this question →
253
MCQhard

Adventure Works uses Microsoft Intune for device management. You need to deploy a custom PowerShell script to all Windows 10 devices to configure a registry key for security compliance. The script is already uploaded to Intune as a PowerShell script. However, the script is not running on some devices. You have confirmed that the devices are enrolled, have the Intune Management Extension installed, and are online. What should you check first?

A.Check that the user has administrative privileges on the device.
B.Confirm that the device is running a 64-bit version of Windows.
C.Ensure the script is assigned to the device group.
D.Verify that the PowerShell execution policy on the devices allows script execution (e.g., RemoteSigned or Bypass).
AnswerD

Execution policy can block scripts.

Why this answer

The script execution policy may block scripts. The Intune Management Extension runs scripts under the system account, which respects the local execution policy. Checking the execution policy is the first step.

The script assignment should be verified if it wasn't assigned, but the question states it is uploaded; assignment is a separate step. The user's role does not affect script execution. The device's OS architecture is unlikely the issue.

Practice this question →
254
MCQmedium

You are managing a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a critical security update that Microsoft released out-of-band. The update must be installed on all devices within 24 hours. You have configured Windows Update for Business policies in Intune, but the update is not being installed on many devices. You check the update compliance reports and see that most devices are showing the update as 'pending'. What should you do to expedite the installation?

A.Modify the existing Windows Update for Business policy to set the deferral period to 0 days.
B.Create a compliance policy that requires the update to be installed and assign it to all devices.
C.Use Configuration Manager to push the update via on-premises WSUS.
D.Create an update policy for Windows 10 and later using the 'Quality update' deployment ring and set the deadline to immediate.
AnswerD

An update policy with immediate deadline forces the update installation.

Why this answer

Deploying an out-of-band security update with a deadline set to immediate overrides any deferral periods and forces the update to install within the specified deadline. In Intune, Windows Update for Business policies allow you to create a 'Quality update' deployment ring and set the deadline to immediate (0 days), which instructs Windows Update to download and install the update as soon as possible, bypassing normal deferral delays. This directly addresses the 'pending' status by enforcing a mandatory installation timeline.

Exam trap

The trap here is that candidates often confuse compliance policies with update enforcement, thinking that marking a device non-compliant will force an update, when in reality compliance policies only report status and require a separate update policy with a deadline to trigger installation.

How to eliminate wrong answers

Option A is wrong because modifying the existing Windows Update for Business policy to set the deferral period to 0 days only removes the delay for future updates but does not force an immediate installation of an already-pending update; the update may still wait for other conditions like active hours or scan intervals. Option B is wrong because compliance policies in Intune are used to assess device configuration and trigger remediation actions (e.g., marking a device non-compliant), but they do not directly install updates; they rely on separate update policies to enforce installation. Option C is wrong because using Configuration Manager with WSUS is a valid on-premises solution, but the question specifies a fleet managed with Microsoft Intune, and the goal is to expedite installation using Intune policies, not to introduce a hybrid management overhead that may not be available or configured.

Practice this question →
255
MCQhard

A company uses Microsoft Intune for mobile device management. They have a group of Android Enterprise devices that need to be enrolled in a way that allows the device to have a work profile while keeping personal apps separate. Which enrollment method should be used?

A.Android Enterprise corporate-owned fully managed devices
B.Android Enterprise personally-owned devices with a work profile
C.Android Enterprise corporate-owned dedicated devices
D.Android Enterprise corporate-owned work profile
AnswerB

This allows a work profile on a personally-owned device, keeping personal apps separate.

Why this answer

Android Enterprise personally-owned devices with a work profile (BYOD) is designed specifically to create a separate, managed work profile on the device while leaving personal apps and data untouched. This enrollment method uses the Android Device Policy app to establish a containerized work profile, ensuring that corporate policies apply only to the work side, and the user retains full control over the personal side. It is the standard approach for BYOD scenarios where the device is owned by the user but needs to access corporate resources securely.

Exam trap

The trap here is that candidates often confuse 'corporate-owned work profile' (Option D) with 'personally-owned work profile' (Option B), mistakenly assuming both provide the same separation, but the key differentiator is device ownership—corporate-owned work profile still implies the device is company property, while the question explicitly states the devices are personally owned.

How to eliminate wrong answers

Option A is wrong because Android Enterprise corporate-owned fully managed devices enroll the entire device as corporate-owned, with no separation between work and personal data; this is intended for company-owned devices where full control is required, not for keeping personal apps separate. Option C is wrong because Android Enterprise corporate-owned dedicated devices are designed for single-purpose kiosk or line-of-business scenarios, where the device is locked to a specific set of apps and does not support a work profile or personal apps at all. Option D is wrong because Android Enterprise corporate-owned work profile is used for company-owned devices that need a work profile, but it still treats the device as corporate-owned and does not apply to personally-owned devices; the question specifies 'personally-owned devices,' making this option incorrect.

Practice this question →
256
MCQhard

Refer to the exhibit. You apply this device configuration profile to a Windows 10 device. A user downloads a file that is classified as potentially unwanted application (PUA). What action will Defender take?

A.Audit the detection and allow the download.
B.Send the file to the cloud for analysis.
C.Automatically clean the file.
D.Block the file from being downloaded.
AnswerD

PUA protection enabled blocks the file.

Why this answer

The device configuration profile shown in the exhibit sets the 'PUAProtection' policy to 'Enabled' with the 'Block' option selected. When a user attempts to download a file classified as a potentially unwanted application (PUA), Microsoft Defender for Endpoint enforces this policy by blocking the download entirely, preventing the file from being written to disk. Option D is correct because the explicit 'Block' setting overrides any other behavior, ensuring the PUA is not allowed to execute or persist on the device.

Exam trap

The trap here is that candidates confuse the 'Block' action of PUA protection with the 'Allow' or 'Audit' options, or mistakenly think that cloud analysis or automatic remediation occurs at the point of download, when in fact the block is enforced immediately by the local policy setting.

How to eliminate wrong answers

Option A is wrong because 'Audit' mode would log the detection but allow the download, which contradicts the 'Block' setting specified in the profile. Option B is wrong because sending a file to the cloud for analysis is a behavior of cloud-delivered protection or automatic sample submission, not a direct action of the PUA protection policy when set to 'Block'. Option C is wrong because automatic cleaning (e.g., removing or quarantining) occurs after detection during a scan or real-time protection event, but the PUA protection policy at download time blocks the file before it can be saved or cleaned.

Practice this question →
257
MCQeasy

You need to wipe a lost corporate-owned Windows 10 device that is enrolled in Intune. Which action should you take?

A.Delete the device from Intune.
B.Select the device and choose Wipe.
C.Select the device and choose Retire.
D.Reset the device using the Company Portal.
AnswerB

Correct. Wipe resets the device to factory settings.

Why this answer

The Wipe action in Intune restores a Windows 10 device to its factory default settings, removing all data and corporate access. This is the appropriate action for a lost corporate-owned device because it ensures sensitive data is erased while retaining the device's enrollment record for potential recovery or re-provisioning.

Exam trap

The trap here is confusing the Retire action (which only removes management and corporate data) with the Wipe action (which performs a full factory reset), leading candidates to choose Retire when a complete data erasure is required.

How to eliminate wrong answers

Option A is wrong because deleting the device from Intune only removes the device object from the console; it does not send a wipe command to the device, so data remains intact. Option C is wrong because Retire removes managed apps and policies but preserves personal data and does not perform a full factory reset, leaving corporate data potentially accessible. Option D is wrong because the Company Portal reset is a user-initiated action that requires the device to be physically accessible and logged in, which is not possible for a lost device.

Practice this question →
258
Multi-Selectmedium

You need to ensure that corporate data on lost or stolen iOS devices is protected. Which TWO actions should you configure in Intune?

Select 2 answers
A.Enable device inventory reporting.
B.Configure a device passcode policy.
C.Perform a selective wipe to remove corporate data only.
D.Retire the device from Intune.
E.Enable remote wipe on the device.
AnswersB, E

A passcode prevents unauthorized access.

Why this answer

(Configure a device passcode policy) is correct because requiring a passcode protects data on lost or stolen devices by preventing unauthorized access. Option E (Enable remote wipe on the device) is correct because remote wipe can erase all data on a lost or stolen iOS device, ensuring corporate data is not compromised. Option A is incorrect because device inventory reporting is a management feature, not a protective action.

Option C is incorrect because selective wipe (retire) removes corporate data but does not protect the device itself. Option D is incorrect because retiring the device removes management but does not immediately protect data.

Practice this question →
259
Multi-Selecthard

You are configuring app protection policies (MAM) in Microsoft Intune for iOS devices. Which THREE settings can you configure to prevent data leakage?

Select 3 answers
A.Require device PIN.
B.Restrict web content transfer to managed browsers.
C.Restrict cut, copy, and paste between apps.
D.Prevent 'Save as' to local storage.
E.Block screenshots of corporate data.
AnswersB, C, D

Ensures web links open in managed browsers.

Why this answer

Restricting web content transfer to managed browsers ensures that corporate data opened via web links can only be viewed in browsers that support Intune MAM policies (e.g., Microsoft Edge). This prevents data from being opened in unmanaged browsers where app protection policies cannot enforce data leakage controls, such as preventing copy/paste or requiring encryption.

Exam trap

The trap here is that candidates often confuse device-level restrictions (like blocking screenshots or requiring a device PIN) with MAM app protection policy settings, but MAM policies only control app-level behaviors and cannot enforce hardware-level or OS-level restrictions like screenshots or device PINs.

Practice this question →
260
Multi-Selecthard

Which TWO Windows Update for Business policies can you configure using Microsoft Intune?

Select 2 answers
A.Feature update version targeting
B.Quality update deferral period
C.Driver update deferral period
D.Windows Defender definition update schedule
E.Microsoft 365 Apps update channel
AnswersA, B

Correct. Feature update version targeting is a Windows Update for Business policy in Intune that allows you to specify a feature update version for devices to stay on.

Why this answer

Microsoft Intune allows you to configure a 'Feature update version targeting' policy, which specifies a target feature update version (e.g., Windows 11 23H2) for devices. Option B is correct because you can configure a 'Quality update deferral period' within an update ring policy to delay quality updates. Option C is incorrect because, although a driver update deferral period can be configured in an update ring policy, it is not a separate Windows Update for Business policy type; the question expects the two distinct policy types: Feature update version targeting and Quality update deferral period.

Option D is incorrect because Windows Defender definition update schedule is not a Windows Update for Business policy; it is managed via Microsoft Defender for Endpoint or other settings. Option E is incorrect because Microsoft 365 Apps update channel is not a Windows Update for Business policy; it is configured separately for Office applications.

Exam trap

The trap is that candidates often think only quality and feature update deferrals are configurable in Intune, overlooking that driver update deferral periods are also part of Windows Update for Business policies. This leads them to select only A and B, missing C.

Practice this question →
261
MCQhard

A company uses Microsoft Intune to manage iOS devices. They need to ensure that corporate data on these devices is protected if a device is lost or stolen. The solution must allow users to continue using personal apps and data after a selective wipe. What should they configure?

A.Initiate a selective wipe from the Intune console.
B.Configure a full wipe action in a compliance policy.
C.Use Remote Lock from the Intune console.
D.Create a device compliance policy that marks the device as noncompliant.
AnswerA

Selective wipe removes only managed corporate data and apps, preserving personal data.

Why this answer

A selective wipe from the Intune console removes only corporate data (e.g., managed apps, email profiles, VPN configurations) while preserving personal apps and data on the iOS device. This meets the requirement of protecting corporate data on a lost or stolen device without affecting the user's personal content. Intune uses the iOS Management Profile and the built-in selective wipe capability that targets only the MDM-managed corporate partition.

Exam trap

The trap here is that candidates confuse a selective wipe with a full wipe or assume that noncompliance actions automatically perform a data wipe, but Microsoft explicitly separates these actions, and only a selective wipe preserves personal data while removing corporate data.

How to eliminate wrong answers

Option B is wrong because a full wipe (also called a factory reset) erases all data on the device, including personal apps and data, which violates the requirement to allow users to continue using personal content. Option C is wrong because Remote Lock only locks the device screen and does not remove any corporate data, so it does not protect corporate data if the device is lost or stolen. Option D is wrong because marking a device as noncompliant in a compliance policy does not automatically remove corporate data; it can trigger conditional access blocks but not a wipe action, so it fails to protect data on a lost device.

Practice this question →
262
MCQeasy

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Microsoft Intune to manage its Windows 10 devices. The company recently experienced a ransomware attack that encrypted local files on several devices. To mitigate future attacks, management wants to ensure that all devices have real-time protection enabled in Microsoft Defender Antivirus and that Controlled Folder Access is turned on. You need to configure these settings via Intune. You decide to create a device configuration profile for Windows 10. What is the most efficient way to deploy these settings to all existing and future devices?

A.Create a device configuration profile and assign it to a device group that includes all devices.
B.Use PowerShell scripts deployed via Intune to enable the settings on each device.
C.Create a device configuration profile and assign it to a user group that includes all users.
D.Create a compliance policy that requires these settings and assign it to all devices.
AnswerA

Assigning to a device group ensures all devices receive the settings regardless of user.

Why this answer

A device configuration profile in Intune can include Microsoft Defender Antivirus settings (such as real-time protection and Controlled Folder Access) and is assigned to a device group. This ensures that both existing and future devices that join the group automatically receive the settings, providing a scalable and efficient deployment method without requiring user interaction or additional scripts.

Exam trap

The trap here is that candidates often confuse compliance policies with configuration profiles, thinking that compliance policies can enforce settings, when in reality they only evaluate and report on settings, requiring a separate configuration profile to actually apply the desired state.

How to eliminate wrong answers

Option B is wrong because PowerShell scripts deployed via Intune are executed on a per-device or per-user basis and require manual assignment or targeting; they do not provide the same declarative, policy-driven enforcement as a device configuration profile, and they cannot be as easily applied to future devices without ongoing script management. Option C is wrong because assigning the profile to a user group applies settings based on user identity, not device identity; if a user logs into a different device, the settings may not apply, and devices without a signed-in user (e.g., kiosks) would be missed. Option D is wrong because a compliance policy is designed to report or mark devices as non-compliant, not to enforce settings; it cannot enable real-time protection or Controlled Folder Access—it only checks if those settings are present and can trigger remediation actions only if configured with a corresponding device configuration profile.

Practice this question →
263
Multi-Selecthard

Which THREE conditions must be met for a Windows device to be able to enroll in Microsoft Intune using Microsoft Entra ID join? (Choose three.)

Select 3 answers
A.The device must be running Windows 10 or later
B.The device must have internet connectivity to Microsoft Entra ID
C.The user must have an Intune license assigned
D.The device must have a TPM 2.0 chip
E.The device must be joined to an on-premises Active Directory domain
AnswersA, B, C

Windows 10/11 are supported for Microsoft Entra ID join.

Why this answer

Microsoft Entra ID join requires a minimum of Windows 10 (any edition) to support the modern authentication and device registration protocols. Devices running earlier versions like Windows 8.1 or Windows 7 lack the necessary components (e.g., the Device Registration Service client) to complete the join process. This requirement ensures the device can communicate using OAuth 2.0 and the Microsoft Entra ID device registration endpoint.

Exam trap

The trap here is that candidates often confuse the TPM 2.0 requirement for Windows Hello for Business or BitLocker with the Microsoft Entra ID join prerequisites, or mistakenly think an on-premises domain join is a stepping stone to Entra ID join, when in fact it requires a separate hybrid join path.

Practice this question →
264
MCQmedium

A user reports that their iOS device is unable to access corporate email after updating to a new iOS version. Other iOS devices are working fine. The device is enrolled in Intune and shows as compliant. What should you check?

A.Check the conditional access policy in Microsoft Entra ID to ensure the device platform is still supported.
B.Ensure the email profile is configured correctly.
C.Confirm that the device is still enrolled in Intune.
D.Verify that the device compliance policy includes the new iOS version.
AnswerA

A new iOS version might not be supported by the conditional access policy.

Why this answer

When a device is compliant but still fails to access corporate email after an iOS update, the most likely cause is that the conditional access policy in Microsoft Entra ID (formerly Azure AD) has been updated to block the new iOS version. Conditional access policies can specify allowed device platforms and OS versions; if the new iOS version is not explicitly permitted, access will be denied even though the device is compliant. This is a common scenario after major OS updates, as administrators must update the policy to include the new version.

Exam trap

The trap here is that candidates assume a compliant device always has access, but conditional access policies can block access based on OS version even when the device is compliant, so the focus should be on the conditional access policy rather than the compliance policy or email profile.

How to eliminate wrong answers

Option B is wrong because the email profile configuration is managed by Intune and would not change automatically due to an iOS update; if other devices are working, the profile is likely correct. Option C is wrong because the device is already reported as compliant in Intune, which implies it is still enrolled; enrollment status is not affected by an OS update. Option D is wrong because the device compliance policy includes the new iOS version by default (or can be updated), and the device is showing as compliant, so the issue is not with the compliance policy itself but with the conditional access policy that enforces access based on compliance.

Practice this question →
265
MCQmedium

A company manages Windows 10 and Windows 11 devices using Microsoft Intune. They need to ensure that devices that have not checked in with Intune for more than 30 days are automatically marked as inactive and excluded from compliance policies. Which configuration should be used?

A.Configure a compliance policy with a grace period of 30 days
B.Create a conditional access policy blocking devices inactive for 30 days
C.Set the device compliance status to 'not compliant' after 30 days of inactivity
D.Configure the Intune device cleanup rule to delete devices inactive for 30 days
AnswerD

The device cleanup rule automatically removes devices that haven't checked in for the configured number of days.

Why this answer

The Intune device cleanup rule is specifically designed to automatically remove or mark devices as inactive when they have not checked in for a configurable number of days (default 30). Once a device is deleted by this rule, it is excluded from compliance policies and no longer evaluated. This directly meets the requirement to mark devices inactive after 30 days of no check-in and exclude them from compliance.

Exam trap

The trap here is that candidates confuse the device cleanup rule with compliance policy settings or conditional access, thinking that marking a device non-compliant or blocking access is equivalent to excluding it from compliance policies, but only the cleanup rule actually removes the device from evaluation.

How to eliminate wrong answers

Option A is wrong because a compliance policy grace period gives users extra time to become compliant after a policy violation, not to mark devices inactive based on check-in frequency. Option B is wrong because conditional access policies control access to cloud apps based on signals like device compliance, but they do not automatically mark devices as inactive or remove them from Intune. Option C is wrong because setting the device compliance status to 'not compliant' after 30 days of inactivity is not a native Intune configuration; compliance policies evaluate based on device settings and health, not on last check-in time, and marking a device non-compliant does not exclude it from compliance policies—it still gets evaluated.

Practice this question →
266
MCQeasy

Refer to the exhibit. You are configuring a bulk enrollment token for Windows 10 devices in Intune. The token is set to expire on June 1, 2025. You need to ensure that devices can enroll using this token until June 30, 2025. What should you do?

A.Update the expirationDateTime property of the token.
B.Modify the tokenType to a different type.
C.Create a new bulk enrollment token with a later expiration date.
D.Re-create the token with the same name but later expiration.
AnswerA

You can edit the token and set a new expiration date.

Why this answer

The bulk enrollment token's expiration is controlled by the `expirationDateTime` property in Microsoft Intune. By updating this property to June 30, 2025, you extend the token's validity without needing to create a new token or change its type. This is the direct and supported method to adjust the expiration date of an existing token.

Exam trap

The trap here is that candidates often assume you must create a new token to change the expiration date, overlooking the fact that the existing token's `expirationDateTime` property can be updated directly via the Intune portal or Graph API.

How to eliminate wrong answers

Option B is wrong because `tokenType` defines the enrollment method (e.g., 'azureADJoin' or 'bulkEnrollment'), not the expiration date; changing it would alter the enrollment behavior, not extend the token's life. Option C is wrong because creating a new token is unnecessary and introduces a new token identifier, which would require re-distributing the token to devices, whereas the existing token can simply be updated. Option D is wrong because re-creating the token with the same name but later expiration is functionally identical to updating the `expirationDateTime` property, but it is an indirect approach that involves deleting and re-adding the token, which is less efficient and not the recommended method.

Practice this question →
267
Multi-Selectmedium

You are managing devices with Microsoft Intune. You need to ensure that only compliant devices can access corporate email. Which TWO components should you configure?

Select 2 answers
A.Device configuration profile
B.Compliance policy for Microsoft Intune
C.Device compliance policy
D.Conditional Access policy in Microsoft Entra ID
E.App protection policy
AnswersB, D

Correct - defines compliance rules that devices must meet to be considered compliant.

Why this answer

To ensure only compliant devices can access corporate email, you need a compliance policy (Option B) that defines device health rules and a Conditional Access policy (Option D) that enforces access based on compliance status. Option C is essentially the same concept as Option B and should not be selected as an additional component. Option A (device configuration profile) sets device settings but does not define compliance.

Option E (app protection policy) protects app data but does not evaluate device compliance.

Exam trap

The trap is that candidates may mistakenly include additional components such as configuration profiles or app protection policies, not realizing that only two components are necessary: Compliance Policy and Conditional Access.

Practice this question →
268
MCQhard

You are the Intune administrator for Contoso Ltd., a company with 5,000 Windows 11 devices and 1,000 iOS devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint for threat detection. You need to implement a solution that ensures devices are compliant before they can access corporate resources. You have the following requirements: 1. Windows devices must have Defender for Endpoint running and report a threat level of 'low' or better. 2. iOS devices must have a PIN of at least 6 characters and be jailbreak-detected as 'not jailbroken'. 3. If a device becomes noncompliant, it should be blocked immediately with no grace period. 4. Noncompliant devices should receive a notification to the user. You create compliance policies for Windows and iOS. You also create a conditional access policy in Microsoft Entra ID to require compliant devices. After deploying, you find that some Windows devices that are missing Defender for Endpoint are still able to access email. What should you do to resolve this issue?

A.Configure a notification to users when their device is noncompliant.
B.Modify the conditional access policy to require a compliant device and a specific client app.
C.Enable the 'Require Defender for Endpoint' setting in the Windows compliance policy.
D.Set the required threat level to 'medium' in the Windows compliance policy.
AnswerC

This setting ensures devices without the agent are marked noncompliant.

Why this answer

The Windows compliance policy must explicitly have the 'Require Defender for Endpoint' setting enabled to enforce that the Defender for Endpoint sensor is present and active on the device. Without this setting, the compliance policy only checks the threat level reported by Defender for Endpoint but does not require the sensor to be installed or running. Enabling this setting ensures that devices missing the Defender for Endpoint sensor are marked as noncompliant, which then triggers the conditional access policy to block access to corporate resources like email.

Exam trap

The trap here is that candidates often assume that setting the required threat level to 'low' automatically enforces the presence of Defender for Endpoint, but in reality, the threat level check only evaluates the last reported threat score, not the sensor's installation or running state.

How to eliminate wrong answers

Option A is wrong because configuring a notification to users when their device is noncompliant does not enforce compliance or block access; it only informs the user after the device is already noncompliant. Option B is wrong because modifying the conditional access policy to require a specific client app does not address the missing Defender for Endpoint sensor; the conditional access policy already requires a compliant device, and the issue is that the compliance policy is not correctly evaluating the Defender for Endpoint requirement. Option D is wrong because setting the required threat level to 'medium' would allow devices with a threat level of 'medium' to be compliant, which is less restrictive than 'low' and does not solve the problem of devices missing Defender for Endpoint entirely.

Practice this question →
269
Multi-Selectmedium

Which THREE actions can you perform using Microsoft Intune's remote assistance feature for Windows devices?

Select 3 answers
A.View the user's screen.
B.Reset the device's password.
C.Transfer files to and from the device.
D.Take full control of the user's desktop.
E.Restart a Windows service.
AnswersA, C, D

Screen viewing is supported.

Why this answer

Microsoft Intune's remote assistance feature, built on Windows Remote Assistance (WRA) using the Remote Desktop Protocol (RDP) over HTTPS, allows a help desk operator to view the user's screen with the user's explicit consent. This is a core capability for troubleshooting without taking control, enabling the administrator to see what the user sees in real time.

Exam trap

The trap here is that candidates confuse Intune's remote assistance with full remote control tools like TeamViewer or RDP, assuming all remote management actions (password reset, service restart) are bundled, but Microsoft deliberately limits remote assistance to view and full control only, with no administrative actions like password or service management.

Practice this question →
270
MCQhard

You are troubleshooting a Windows 10 device that shows as 'Noncompliant' in Intune despite having all required compliance policies applied. The device is domain-joined and configured with hybrid Azure AD join. What is the most likely cause?

A.The Intune Management Extension is not installed.
B.The device is not registered in Microsoft Entra ID.
C.The device's health attestation certificate has expired.
D.The device is not enrolled in Intune.
AnswerC

Expired health attestation can cause noncompliance.

Why this answer

A device that is hybrid Azure AD joined and domain-joined but shows as 'Noncompliant' in Intune, despite having all required compliance policies applied, is most likely failing compliance due to an expired health attestation certificate. Intune uses Windows Health Attestation Service (HAS) to verify device integrity; if the attestation certificate has expired, the device cannot prove its health status, causing it to be marked noncompliant even when policies are correctly assigned.

Exam trap

The trap here is that candidates often assume noncompliance is due to missing enrollment or registration, but the question explicitly states the device is hybrid joined and enrolled, so the real issue is a stale or expired health attestation certificate that prevents the compliance check from completing.

How to eliminate wrong answers

Option A is wrong because the Intune Management Extension is used for deploying PowerShell scripts and Win32 apps, not for compliance evaluation; compliance is handled by the Intune agent and the enrollment state. Option B is wrong because the device is described as hybrid Azure AD joined, which inherently means it is registered in Microsoft Entra ID (Azure AD); lack of registration would prevent hybrid join from succeeding. Option D is wrong because the device is already enrolled in Intune (it shows as 'Noncompliant' in Intune), so the issue is not a lack of enrollment but a failure in the compliance check process.

Practice this question →
271
MCQhard

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

A.Automated investigation and response
B.Threat analytics
C.Device inventory
D.Alert queue
AnswerA

Correct. This page contains settings for automation.

Why this answer

The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Exam trap

The trap here is that candidates often confuse the 'Automated investigation and response' configuration with the 'Alert queue' or 'Threat analytics' because they all appear under the same XDR portal section, but only the AIR setting directly manages the automation behavior for device-level response actions.

How to eliminate wrong answers

Option B is wrong because Threat Analytics is a feature that provides threat intelligence, vulnerability reports, and mitigation recommendations, but it does not configure the automatic investigation and response behavior for devices. Option C is wrong because Device Inventory is a list of all managed devices with their security status and configuration details, not a setting to enable or adjust automated response actions. Option D is wrong because Alert Queue is a view of security alerts generated by Defender for Endpoint, and while it allows manual triage of alerts, it does not control the automation level or response configuration for investigations.

Practice this question →
272
MCQmedium

Your organization uses Microsoft Intune to manage 1,000 Windows 10 devices and 500 iOS devices. You need to enforce device compliance policies. For Windows devices, you require BitLocker encryption and Windows Defender Antivirus enabled. For iOS devices, you require a passcode of at least 6 characters and device encryption. Devices that become noncompliant should be marked as such and users should receive a notification email. After 7 days of noncompliance, the device should be blocked from accessing corporate email. You also need to create a report that shows the compliance status of all devices. Which combination of actions should you take?

A.Create Windows and iOS compliance policies with the required settings. Configure actions for noncompliance: send email immediately and block access after 7 days. Use the built-in compliance report.
B.Create app protection policies to require encryption and passcode. Use conditional access to block noncompliant devices.
C.Create device configuration profiles for BitLocker and encryption. Use conditional access to block noncompliant devices. Manually generate reports using PowerShell.
D.Use Autopilot to enforce encryption and passcode. Use Intune reporting for compliance status.
AnswerA

Compliance policies with actions and conditional access meet all requirements.

Why this answer

Intune compliance policies directly enforce device-level settings like BitLocker and passcode length, and they include built-in actions for noncompliance (e.g., send email, block access after a specified number of days). The built-in compliance report in the Intune portal provides an immediate view of all devices' compliance status without requiring manual scripting or additional tools.

Exam trap

Microsoft often tests the distinction between compliance policies (device-level enforcement with built-in actions) and app protection policies (data-level controls), leading candidates to confuse which policies can enforce BitLocker or trigger time-based blocking.

How to eliminate wrong answers

Option B is wrong because app protection policies (MAM) manage data-level security within apps, not device-level settings like BitLocker or device encryption; they cannot enforce BitLocker or Windows Defender Antivirus. Option C is wrong because device configuration profiles apply settings but do not include built-in actions for noncompliance (like sending email or blocking access after a delay); conditional access alone cannot trigger time-based actions, and manually generating reports with PowerShell is unnecessary when Intune provides a built-in compliance report. Option D is wrong because Autopilot is a deployment tool, not a compliance enforcement mechanism; it cannot enforce passcode length or device encryption on iOS, and Intune reporting is not limited to Autopilot.

Practice this question →
273
MCQhard

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data on these devices is automatically removed when a user is unenrolled from Intune. Which action should you configure?

A.Configure a selective wipe policy.
B.Configure a compliance policy to mark the device as noncompliant.
C.Configure a remote lock action.
D.Configure a full wipe action.
AnswerA

Selective wipe removes corporate data while leaving personal data intact.

Why this answer

A selective wipe policy in Microsoft Intune removes only corporate data from an iOS device while leaving personal data intact. When a user is unenrolled from Intune, the selective wipe targets managed apps and their associated data, ensuring that company information is automatically removed without affecting the user's personal content.

Exam trap

The trap here is that candidates often confuse selective wipe with full wipe, assuming that any data removal requires a complete device reset, but the exam tests the specific Intune behavior where selective wipe is the correct method for removing only corporate data upon unenrollment.

How to eliminate wrong answers

Option B is wrong because configuring a compliance policy to mark the device as noncompliant does not automatically remove corporate data; it triggers conditional access blocks or notifications but requires a separate wipe action. Option C is wrong because a remote lock action only locks the device screen and does not remove any data. Option D is wrong because a full wipe action resets the entire device to factory settings, removing both corporate and personal data, which is not the requirement for selective removal of corporate data only.

Practice this question →
274
MCQmedium

Your organization uses Microsoft Intune for Windows device management. You need to deploy a PowerShell script to all Windows 10 devices to remediate a security issue. The script must run in the user context. What is the best approach?

A.Add the script to Intune as a PowerShell script and set 'Run this script using the logged on credentials' to Yes.
B.Create a device configuration profile with a custom OMA-URI setting to execute the script.
C.Use a device compliance policy to trigger the script when noncompliant.
D.Use Intune proactive remediations and configure the script to run as a detection script.
AnswerA

This runs the script in the user context.

Why this answer

Intune's PowerShell script deployment feature allows you to upload a script and set 'Run this script using the logged on credentials' to Yes, which executes the script in the user context on Windows 10 devices. This is the only native Intune method that directly supports running a PowerShell script in the user context without additional configuration or third-party tools.

Exam trap

The trap here is that candidates often confuse the execution context of Intune PowerShell scripts (user vs. system) and assume proactive remediations or compliance policies can run scripts in the user context, but only the PowerShell script deployment feature with the logged-on credentials option supports this.

How to eliminate wrong answers

Option B is wrong because a device configuration profile with a custom OMA-URI setting can only execute scripts in the system context via the DeviceManagement/Remediation CSP, not in the user context. Option C is wrong because a device compliance policy cannot directly trigger script execution; it only evaluates compliance and can mark devices noncompliant, but does not run remediation scripts. Option D is wrong because Intune proactive remediations run detection and remediation scripts in the system context by default, not the user context, and cannot be configured to run as a detection script in the user context.

Practice this question →
275
MCQmedium

A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?

A.Device configuration policy (settings catalog).
B.Conditional Access policy.
C.Device compliance policy.
D.App protection policy.
AnswerC

Compliance policies evaluate passcode settings and mark devices as non-compliant if not met.

Why this answer

Device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level.

Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.

Practice this question →
276
Multi-Selectmedium

A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)

Select 3 answers
A.Number of failed attempts before wipe.
B.Maximum passcode age (days).
C.Minimum passcode length.
D.Allow simple passcode.
E.Allow Touch ID.
AnswersA, C, E

This triggers a wipe after 10 failed attempts.

Why this answer

The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.

Exam trap

The trap here is that candidates often confuse 'Maximum passcode age' with the wipe-on-failed-attempts setting, or mistakenly think 'Allow simple passcode' is required to enable Touch ID, when in fact Touch ID is a separate toggle that does not depend on simple passcode being allowed.

Practice this question →
277
MCQhard

You are troubleshooting a Windows 11 device that fails to receive a PowerShell script deployed via Intune. The script is assigned to a group containing the device. Other policies on the device apply successfully. What should you check first?

A.Ensure the device has internet connectivity.
B.Check the Windows PowerShell execution policy on the device.
C.Check that the script is digitally signed.
D.Verify that the device is in the correct security group.
AnswerB

PowerShell scripts require the execution policy to be set to allow scripts.

Why this answer

The Windows PowerShell execution policy controls whether scripts can run on the device. Even if the script is successfully delivered by Intune, a restrictive execution policy (e.g., Restricted) will block its execution. Since other policies apply successfully, connectivity and group membership are not the issue, making the execution policy the most likely cause.

Exam trap

The trap here is that candidates often assume script signing (Option C) is required for Intune deployments, but Intune does not enforce digital signatures by default; the local execution policy is the primary gatekeeper.

How to eliminate wrong answers

Option A is wrong because internet connectivity is required for Intune communication, but since other policies apply successfully, the device already has connectivity. Option C is wrong because Intune does not require PowerShell scripts to be digitally signed by default; the execution policy can be configured to allow unsigned scripts (e.g., RemoteSigned). Option D is wrong because the device is already in the correct group (as stated in the question), and other policies from that group apply successfully.

Practice this question →
278
MCQeasy

You are the endpoint administrator for Contoso Ltd. The company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a critical security update to all devices within 24 hours. The update is a quality update (KB5001234). You have created an update ring policy named 'Critical Ring' assigned to all devices. The policy currently has a deferral period of 7 days. You need to ensure that the update is installed immediately. What should you do?

A.Change the update ring policy deadline to 7 days to ensure devices have enough time.
B.Create a new feature update policy for KB5001234 and assign it to all devices.
C.Modify the 'Critical Ring' update ring policy to set the quality update deferral period to 0 days and the deadline for updates to 1 day.
D.Use the Windows Server Update Services (WSUS) console to approve the update for immediate installation.
AnswerC

Removes deferral and sets a short deadline.

Why this answer

The update ring policy controls deferral and deadline. To install immediately, set deferral to 0 and deadline to 1 day. Creating a feature update policy is for feature updates, not quality updates.

Manually approving in WSUS is not relevant as Intune manages updates. Changing the deadline to 7 days would not meet the 24-hour requirement.

Practice this question →
279
MCQmedium

A company uses Microsoft Intune to manage Windows devices. They want to deploy a custom line-of-business (LOB) app as a Win32 app. The app requires .NET Framework 4.8 and must be installed silently. Which file type should you use for the app deployment in Intune?

A..msi
B..appx
C..intunewin
D..exe
AnswerC

.intunewin is the required format for Win32 app deployment via Intune.

Why this answer

The .intunewin file is required for Win32 app deployment in Intune because it packages the installation files and detection rules into a single format that Intune can process. For a custom LOB app that needs silent installation and has dependencies like .NET Framework 4.8, the .intunewin wrapper allows you to specify the installation command (e.g., msiexec /i app.msi /qn) and detection logic, which is not possible with raw .msi or .exe files in the Win32 app context.

Exam trap

The trap here is that candidates mistakenly think a raw .exe or .msi can be deployed as a Win32 app in Intune, but Intune requires the .intunewin wrapper to handle detection, dependencies, and installation behavior for non-Store apps.

How to eliminate wrong answers

Option A is wrong because .msi files can be deployed directly as line-of-business apps in Intune, but they do not support the Win32 app deployment method's advanced features like custom detection rules, dependencies, or requirement rules; for a Win32 app, you must wrap the .msi in an .intunewin file. Option B is wrong because .appx files are used for Universal Windows Platform (UWP) apps, not Win32 apps, and they require a different deployment pipeline (e.g., Store or LOB app type). Option D is wrong because .exe files cannot be deployed directly as Win32 apps in Intune without being wrapped in an .intunewin file; the .intunewin packaging tool is required to encapsulate the .exe and its installation parameters.

Practice this question →
280
Multi-Selecteasy

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Select 2 answers
A.Android Enterprise corporate-owned devices with work profile
B.Android Enterprise personally-owned devices with work profile
C.Android Device Administrator
D.Apple Business Manager
E.Windows Autopilot
AnswersA, B

This is a valid enrollment method.

Why this answer

Android Enterprise corporate-owned devices with work profile is a valid enrollment method in Microsoft Intune that allows IT to manage a work profile on company-owned devices while keeping the personal space separate. This method uses the Android Enterprise platform to enforce corporate policies without requiring full device management, leveraging the work profile container for security and compliance.

Exam trap

The trap here is that candidates often confuse Android Device Administrator (a deprecated legacy method) as a valid enrollment option, but Microsoft Intune now requires Android Enterprise enrollment for new devices, making options like C incorrect.

Practice this question →
281
MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that automatically retires a device if it does not check in for 30 days. Which policy type should you configure?

A.Device configuration policy
B.Compliance policy
C.Windows Update for Business policy
D.Device health attestation policy
AnswerB

Compliance policies can include a grace period and action for non-compliance, including retiring devices after a specified period of inactivity.

Why this answer

A compliance policy in Microsoft Intune can include a 'Maximum days since device last checked in' setting. When a device fails to check in for the specified period (e.g., 30 days), Intune marks it as noncompliant, and a conditional access policy or automated action (such as retiring the device) can be triggered. This directly meets the requirement to automatically retire a device after 30 days of inactivity.

Exam trap

The trap here is that candidates often confuse a device configuration policy (which controls settings) with a compliance policy (which enforces conditions and triggers actions like retirement), leading them to select Option A instead of B.

How to eliminate wrong answers

Option A is wrong because a device configuration policy manages settings like passwords, encryption, and restrictions, but it does not include a check-in timeout or retirement trigger. Option C is wrong because a Windows Update for Business policy controls update deferrals and delivery optimization, not device check-in monitoring or retirement. Option D is wrong because a device health attestation policy verifies boot integrity and security features (e.g., Secure Boot, BitLocker) via the TPM, but it does not enforce a check-in interval or automatic retirement.

Practice this question →
282
MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?

A.Device compliance policies.
B.No additional configuration is needed.
C.Device configuration policies.
D.App protection policies.
AnswerA

Compliance policies must be configured and assigned to devices.

Why this answer

A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.

Exam trap

The trap here is that candidates assume Conditional Access policies are self-sufficient for compliance enforcement, overlooking that Intune compliance policies are the required mechanism to generate the compliance state that Conditional Access evaluates.

How to eliminate wrong answers

Option B is wrong because Conditional Access alone cannot enforce compliance; it only checks the compliance status reported by Intune, so additional configuration in Intune is mandatory. Option C is wrong because device configuration policies manage settings like Wi-Fi or VPN profiles, not compliance evaluation; they do not mark a device as compliant or non-compliant for Conditional Access. Option D is wrong because app protection policies (MAM) manage data protection at the app level without requiring device enrollment, but they do not make a device compliant for device-based Conditional Access policies targeting Exchange Online.

Practice this question →
283
MCQmedium

You are implementing Windows Autopilot for your organization. You need to ensure that during the first boot, the device automatically enrolls in Microsoft Intune and joins Microsoft Entra ID. What is the minimum requirement for the device?

A.The device must have a local administrator account.
B.The device must be joined to an on-premises Active Directory domain.
C.The device must have a TPM 2.0 chip.
D.The device must be registered in Autopilot with a valid profile.
AnswerD

Autopilot requires registration and profile assignment.

Why this answer

Windows Autopilot requires the device to be registered in the Autopilot service with a valid profile assigned. This profile contains the settings that dictate the out-of-box experience (OOBE), including automatic enrollment into Microsoft Intune and joining Microsoft Entra ID (formerly Azure AD). Without a registered Autopilot profile, the device will not trigger the automated enrollment and join process during first boot.

Exam trap

The trap here is that candidates often confuse hardware prerequisites (like TPM 2.0) with the mandatory requirement of a registered Autopilot profile, leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because a local administrator account is not a prerequisite for Autopilot; the device can be a standard user device and still enroll via Autopilot. Option B is wrong because Autopilot devices are designed to join Microsoft Entra ID directly, not an on-premises Active Directory domain; hybrid join is an optional configuration, not a minimum requirement. Option C is wrong because while TPM 2.0 is recommended for self-deploying mode and Windows Hello for Business, it is not a minimum requirement for user-driven Autopilot enrollment and Entra ID join; devices without TPM 2.0 can still use user-driven mode with password-based authentication.

Practice this question →
284
MCQhard

You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?

A.OS version is above the maximum allowed
B.Password minimum length is not met
C.Device threat protection level is below medium
D.TPM is not present
AnswerA

The device build 22621.1500 exceeds the maximum 22621.1000.

Why this answer

The compliance policy in the exhibit specifies a maximum OS version of 10.0.22621.1000, but the Windows 11 device is running build 10.0.22621.1500, which is above that maximum. Intune compares the device's OS version against the configured maximum OS version setting; if the device's version exceeds the maximum, it is marked as noncompliant. This setting is used to prevent devices with newer, potentially untested builds from accessing corporate resources.

Exam trap

The trap here is that candidates often assume noncompliance is due to missing security features like TPM or password policies, but the exhibit clearly shows a maximum OS version setting that the device's build exceeds, making it the direct cause.

How to eliminate wrong answers

Option B is wrong because the compliance policy does not include a password minimum length requirement, so the device cannot be noncompliant due to that setting. Option C is wrong because the policy does not configure a device threat protection level; the device threat protection setting is not present in the exhibit, so it cannot cause noncompliance. Option D is wrong because the policy does not require TPM presence; the TPM setting is not configured in the exhibit, so a missing TPM would not trigger noncompliance.

Practice this question →
285
MCQmedium

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

A.Sync-IntuneDevice -DeviceId ...
B.Start-DeviceSync -DeviceName PC-001
C.Invoke-IntuneDeviceAction -DeviceId ... -Action Sync
D.Update-IntuneDevice -DeviceId ...
AnswerA

This cmdlet initiates a sync with Intune.

Why this answer

The correct cmdlet is Sync-IntuneDevice, which is specifically designed to trigger an immediate synchronization for a Microsoft Intune-managed device by specifying its DeviceId. This cmdlet sends a sync request to the Intune service, forcing the device to check in and apply any pending policies or actions without waiting for the next scheduled sync interval.

Exam trap

The trap here is that candidates often confuse Invoke-IntuneDeviceAction with a sync action because it supports many device actions, but they fail to recognize that the correct parameter value for a sync is 'SyncDevice' (not 'Sync'), and that Sync-IntuneDevice is the dedicated cmdlet for this purpose.

How to eliminate wrong answers

Option B is wrong because Start-DeviceSync is not a valid Microsoft Intune cmdlet; it does not exist in the Microsoft Graph or Intune PowerShell module. Option C is wrong because Invoke-IntuneDeviceAction is a valid cmdlet but it requires an -Action parameter with a value like 'SyncDevice', not just 'Sync', and it is used for remote device actions such as wipe or retire, not for triggering a policy sync. Option D is wrong because Update-IntuneDevice is not a standard Intune cmdlet; it may be confused with Update-AutopilotDevice or similar, but it does not perform a sync action.

Practice this question →
← PreviousPage 4 of 4 · 285 questions total

Ready to test yourself?

Try a timed practice session using only Manage Maintain Devices questions.

Start 20-question session