Optimize endpoint operations by using automation, monitoring, and reporting
Domain 5 of MD-102 accounts for 10-15% of the exam. EarnYourCert has 85 original questions for this domain, all with explanations: 35 multiple choice, 19 yes/no and 31 completion or ordering items, like the real exam.
Domain 5 sample questions
8 questions from our 85-question bank for this domain. Try to answer before revealing the solution.
1. Which Microsoft Graph request triggers an immediate Intune sync on a specific managed device?
- POST /deviceManagement/managedDevices/{id}/syncDevice
- GET /deviceManagement/managedDevices/{id}/sync
- DELETE /deviceManagement/managedDevices/{id}
- PATCH /devices/{id}/refresh
Show answer
Correct answer: A. Remote actions are exposed as POST actions on the managedDevice resource, such as syncDevice, rebootNow or wipe.
2. Your Graph script receives HTTP 429 (Too Many Requests) while processing thousands of devices. What is the recommended approach?
- Honor the Retry-After header and batch requests to cut the number of calls
- Switch to the beta endpoint, which is never throttled for administrator accounts
- Retry immediately in a tight loop
- Run the same script from several admin accounts at once to spread the request load
Show answer
Correct answer: A. Graph throttles heavy callers; the correct behavior is to wait the time given in Retry-After and combine requests with $batch (up to 20 per batch).
3. What must a custom compliance discovery script return for Intune to evaluate it against the JSON rules?
- A compressed JSON object with the discovered setting values
- An exit code of 0 or 1 only, with no other output
- An XML report saved on the desktop of the currently signed-in user
- A text file uploaded to SharePoint
Show answer
Correct answer: A. The script writes a JSON object to standard output; each key is matched to a SettingName in the JSON rules file.
4. What is the role of a Security Copilot agent in Microsoft Intune?
- An AI assistant that analyzes tenant data and proposes changes for admins to review
- A replacement for Intune role-based access control that assigns permissions on its own
- A client app that must be installed on each device before it can report its status
- A PowerShell module for Win32 app packaging
Show answer
Correct answer: A. Security Copilot agents in Intune analyze signals, explain findings and suggest actions; the administrator stays in control and approves or dismisses recommendations.
5. Which Security Copilot agent capability in Intune helps prioritize software vulnerabilities from Microsoft Defender Vulnerability Management and suggests how to fix them?
- The Vulnerability Remediation Agent
- The Autopilot Deployment Agent
- The Delivery Optimization Agent
- The Company Portal Agent
Show answer
Correct answer: A. The Vulnerability Remediation Agent correlates Defender vulnerability data with Intune-managed devices, prioritizes by risk and recommends remediation steps for the admin to approve.
6. In a remediation script package, what does the detection script signal to trigger the remediation script?
- An exit code of 1, meaning an issue was detected
- An exit code of 0, meaning an issue was detected
- A reboot of the device
- An email to the administrator
Show answer
Correct answer: A. Exit code 0 means the device is healthy; exit code 1 means an issue was found and the remediation script is run.
7. A help desk wants to know which devices have recurring blue screens and long restart times so it can prioritize hardware refresh. Which Intune capability supports this analysis?
- Endpoint analytics reliability and startup insights
- Apple VPP token status and sync logs
- Conditional Access sign-in logs by device
- Autopilot deployment profile assignment status report
Show answer
Correct answer: A. Endpoint analytics reports restart frequency, stop errors and startup times, helping to identify devices that are candidates for replacement.
8. Where can an Intune administrator check whether there is an ongoing Intune service incident that may explain failing enrollments?
- Tenant administration > Tenant status (Service health) in Intune
- Device configuration profiles, under the per-setting status report
- The Company Portal app
- Windows Update for Business reports in the Azure Monitor workbook
Show answer
Correct answer: A. Tenant status shows service health incidents and advisories, tenant connector health and licensing, so check it before troubleshooting deeper.