MD-102 - Protect Devices (18% of the exam) - Section 3.2

Manage device updates for Windows, Apple and Android devices by using Intune.

Plan device updates and create update rings, feature update and quality update policies for Windows, then implement Windows Autopatch and Hotpatch policies. Manage iOS, iPadOS and macOS updates through the Settings Catalog and Android updates through configuration profiles or FOTA, configure Delivery Optimization, and monitor update status.

update ringsfeature updatesWindows AutopatchHotpatchDelivery Optimizationfirmware-over-the-air

Practice question for this objective

Free sampleProtect Devicesmedium

Your Windows 11 Enterprise devices are registered with Windows Autopatch, and you have created a Windows quality update policy in Microsoft Intune with hotpatch enabled and assigned it to those devices. The devices also stay on an update ring that defers quality updates by seven days. Reporting shows them continuing to take restart-requiring cumulative updates rather than hotpatch updates. What should you change so that the hotpatch policy governs them?

ASet the quality update deferral period on the update ring assigned to those devices to zero days, leaving the ring assigned. Correct
BPause quality updates on the update ring assigned to the devices, so that the hotpatch policy applies while the pause is in force.
CCreate a Windows 11 feature update policy naming the current feature version and assign it to the same devices alongside the ring.
DRaise the quality update deferral period on the update ring assigned to those devices so that the hotpatch policy is evaluated later.

Hotpatch quality updates require the assigned update ring to defer quality updates by zero days, otherwise the standard cumulative update is taken. Enabling hotpatch in a Windows quality update policy does not override the deferral configured in the update ring that also targets the device. While the ring holds quality updates back, the device falls outside the hotpatch offering conditions and receives the ordinary restart-requiring cumulative update instead, so the deferral has to be reduced to zero days.

Why A is correct: Hotpatch quality updates are offered only where the update ring puts no deferral between the release and the device. Reducing the deferral to zero days lets the hotpatch policy govern the monthly quality update while the ring keeps its other settings.

Why B is wrong: Pausing is a genuine update ring control and stopping the competing behaviour feels like the fix, but a pause stops quality updates reaching the devices altogether. Hotpatch updates are quality updates, so the pause suppresses the very thing you want installed.

Why C is wrong: A feature update policy is the right instrument for holding devices on a named feature version, which is a hotpatch prerequisite in spirit. It governs feature updates rather than quality updates, so it has no effect on which monthly quality update the device takes.

Why D is wrong: This treats the deferral as a scheduling nudge and moves it in the wrong direction. A longer deferral widens the gap between release and offer, which keeps the devices outside the conditions under which a hotpatch update is offered.

See more MD-102 practice questions, answers explained.

Exam traps in Protect Devices

Answers that look right on this material and are not. Each one is a distractor from a different question in the MD-102 bank for this domain.

The devices have Delivery Optimization set to a download mode that prevents update status from being uploaded, so reporting is suppressed for as long as that download mode stays in place.
Why it is wrong: Tempting because Delivery Optimization is configured alongside update rings and does involve traffic between the device and the service. It is wrong because a download mode governs only where update content comes from and has no bearing on whether update state is reported.
They hold at their current patch level and install nothing further until an administrator removes the hotpatch policy from the assignment.
Why it is wrong: This matches the service desk assumption that an unmet condition blocks servicing, which is why it appeals. Hotpatch changes how a monthly update installs rather than whether a device is serviced, so leaving devices unpatched is not the designed behaviour.
The policy reaches handsets whose ownership is recorded as corporate, so editing the ownership attribute on the personally owned handsets brings them into scope of the same policy.
Why it is wrong: Ownership does affect which management surfaces apply to a handset, which makes this tempting, but ownership is a label an administrator sets in Intune and it does not make a handset supervised. Editing it would change reporting and some restriction behaviour without giving Intune the ability to command an update.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.