MD-102 Manage, maintain, and protect devices Practice Test 2 — 15 Questions

Question 1

An administrator runs the above PowerShell command on a Windows 10 device managed by Microsoft Defender for Endpoint. The device is reporting as healthy in the security console. Based on the output, which protection feature is disabled?

Accepted Answer

Real-time protection. The PowerShell command `Get-MpComputerStatus` returns the current status of Microsoft Defender Antivirus. The output shows `AMServiceEnabled : False`, which indicates the antimalware service is disabled, but the critical indicator is `RealTimeProtectionEnabled : False`. Real-time protection monitors file system activity for malware in real time; when disabled, the device may still report as healthy in the Microsoft Defender for Endpoint console if other components (e.g., cloud-delivered protection) are active, but the device is not fully protected against immediate threats.

Answer

IOAV protection

Answer

Antimalware service

Answer

Antivirus

Question 2

A company uses Microsoft Intune to manage Windows 10 devices. The security team reports that several devices are missing critical security updates. You need to ensure that devices install updates within 7 days of release. What should you configure?

Accepted Answer

Create an update ring for Windows 10 with a deadline of 7 days.. Option B is correct because update rings in Microsoft Intune allow you to configure Windows Update for Business settings, including a deadline for feature and quality updates. Setting a deadline of 7 days ensures that devices must install released updates within that timeframe, directly addressing the requirement for timely installation of critical security updates.

Answer

Create a compliance policy for Windows 10 update compliance.

Answer

Create a device configuration profile for Windows 10 updates.

Answer

Configure a Windows Update for Business policy in Group Policy.

Question 3

A user reports that their Windows 10 device is not receiving policies from Microsoft Intune. The device shows as 'Not compliant' in the Intune console. You run the Get-MgDeviceManagementManagedDevice cmdlet and see that the device is enrolled and appears in the list. However, the LastSyncTime is 14 days ago. What is the most likely cause?

Accepted Answer

The Intune Management Extension service is not running on the device.. The Intune Management Extension (IME) service is responsible for synchronizing policies, including compliance and configuration policies, from Intune to Windows 10 devices. If the IME service is not running, the device will not receive new policies or sync status, leading to a stale LastSyncTime (14 days ago) and a 'Not compliant' state, even though the device is enrolled and appears in the Get-MgDeviceManagementManagedDevice output.

Answer

The MDM certificate has expired.

Answer

The device is not connected to the internet due to a proxy misconfiguration.

Answer

The device is not enrolled in Intune.

Question 4

You are deploying Microsoft Defender for Endpoint to Windows 10 devices managed by Microsoft Intune. After onboarding, you need to verify that the sensor is running. Which cmdlet should you use on the device?

Accepted Answer

Get-Service -Name Sense. The correct cmdlet is Get-Service -Name Sense because the Microsoft Defender for Endpoint sensor runs as a Windows service named 'Sense' (Microsoft Defender Advanced Threat Protection Service). Checking this service confirms the sensor is installed and running, which is the standard verification step after onboarding devices to Defender for Endpoint.

Answer

Get-Service -Name WinDefend

Answer

Get-DefenderEndpoint

Answer

Get-MpComputerStatus

Question 5

A company uses Microsoft Intune to manage iOS/iPadOS devices. The compliance policy requires a minimum OS version of 15.0. A user reports that their iPad running iOS 14.8 cannot access company email and shows as non-compliant. However, the device is up to date with the latest available OS for that hardware. What should you do to allow the device to access email while maintaining security?

Accepted Answer

Configure a compliance grace period of 30 days on the policy.. Option A is correct because a compliance grace period allows the device to remain non-compliant for a specified duration (e.g., 30 days) without immediately blocking access to company resources. This gives the user time to update the OS if possible, but since the iPad hardware cannot go beyond iOS 14.8, the grace period still permits email access while the device is marked non-compliant, maintaining security by not permanently exempting the device.

Answer

Change the minimum OS version to 14.8 in the policy.

Answer

Delete the compliance policy that requires iOS 15.0.

Answer

Request the user to update the iPad to iOS 15.0.

Question 6

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

Accepted Answer

%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Answer

%windir%	emp\MdmEnrollment.log

Answer

%windir%\Panther\setupact.log

Answer

Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

Question 7

You are configuring Microsoft Intune to manage Windows 10 devices. Which TWO actions are required to enable BitLocker encryption on devices?

Accepted Answer

Create a device configuration profile for endpoint protection and enable BitLocker settings.. Option A is correct because BitLocker settings are configured via a device configuration profile for endpoint protection in Microsoft Intune. This profile includes policies such as requiring TPM startup PIN or startup key, encryption method, and OS drive encryption. Without this profile, BitLocker cannot be enforced or configured on managed Windows 10 devices.

Answer

Create a compliance policy that requires BitLocker.

Answer

Configure a device cleanup rule.

Answer

Deploy a Windows 10 update ring.

Question 8

You manage a hybrid Azure AD joined environment with Microsoft Intune. You need to migrate Group Policy objects (GPOs) to Intune policies for Windows 10 devices. Which THREE tools or methods should you use?

Accepted Answer

MDM Migration Analysis Tool (MMAT). The MDM Migration Analysis Tool (MMAT) is correct because it analyzes existing on-premises Group Policy Objects (GPOs) and generates a report mapping each GPO setting to its equivalent MDM policy in Intune, including a readiness score. This tool directly supports the migration workflow by identifying which GPOs can be converted and which require manual intervention, making it essential for planning a GPO-to-Intune migration.

Answer

Desktop Analytics

Answer

PowerShell scripts to apply registry settings

Question 9

You have the following JSON compliance policy for Windows 10 devices in Intune. A device with OS version 10.0.19042.0, build 19042, with BitLocker enabled, Secure Boot enabled, but Code Integrity disabled reports as non-compliant. Which setting is causing the non-compliance?

Accepted Answer

requireCodeIntegrity. The device reports as non-compliant because the compliance policy requires `requireCodeIntegrity` to be enabled, but the device has Code Integrity disabled. Even though BitLocker and Secure Boot are enabled, and the OS version meets the minimum requirement, the absence of Code Integrity enforcement triggers non-compliance. In Intune, Windows 10 compliance policies evaluate each setting independently, and a failure on any required setting results in overall non-compliance.

Answer

minimumOsVersion

Answer

requireSecureBoot

Answer

requireDeviceEncryption

Question 10

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices with BitLocker enabled can access corporate email via Exchange Online. Which configuration should the administrator use to enforce this requirement?

Accepted Answer

Create a Conditional Access policy that requires device compliance and assign it to Exchange Online.. Option B is correct because a Conditional Access policy in Azure AD can require that devices accessing Exchange Online be marked as compliant in Intune. By combining a Device Compliance policy that requires encryption (BitLocker) with a Conditional Access policy targeting Exchange Online, only compliant devices with BitLocker enabled will be granted access to corporate email.

Answer

Create a Device Compliance policy for Windows 10 with the 'Require encryption of data storage on device' setting enabled.

Answer

Create an App Protection policy for the Outlook mobile app that requires device encryption.

Answer

Configure Windows Defender Firewall to block non-BitLocker encrypted devices.

Question 11

A technician is troubleshooting a Windows 11 device that is enrolled in Intune. The device reports as 'Not compliant' due to missing required updates. The administrator runs the following command on the device and receives the output shown. What should the administrator do next to resolve the compliance issue?

Accepted Answer

Restart the device.. The command output indicates that the Windows Update service is in a 'Stopped' state, which prevents the device from installing required updates. Restarting the device (Option D) will restart the Windows Update service and trigger a fresh update scan, allowing the device to become compliant on the next Intune check-in. This is the most direct fix for a stopped service that is blocking update installation.

Answer

Check for a policy conflict in Intune.

Answer

Run a manual sync from the Company Portal app.

Answer

Verify network connectivity to Microsoft Update.

Question 12

You are a Microsoft 365 Endpoint Administrator for a global organization with 5,000 Windows 11 devices managed by Intune. The company has a strict security policy requiring that all devices have BitLocker enabled with TPM validation, PIN, and startup key. Currently, only 80% of devices are compliant with BitLocker. After investigating, you discover that many non-compliant devices are older models that lack TPM 2.0, but they do have TPM 1.2. Additionally, some devices are virtual machines (VMs) that do not have a TPM at all. The security team insists that all devices must be encrypted, but they are willing to accept alternative configurations for devices without TPM 2.0. You need to propose a solution that maximizes security while ensuring compliance. What should you do?

Accepted Answer

Create multiple compliance policies: one for devices with TPM 2.0 requiring full BitLocker, one for devices with TPM 1.2 requiring BitLocker with TPM validation, and one for VMs requiring BitLocker with startup password.. Option C is correct because it uses multiple compliance policies to enforce the strongest possible BitLocker configuration based on each device's TPM capabilities. Devices with TPM 2.0 can meet the full requirement (TPM validation, PIN, startup key), devices with TPM 1.2 can use TPM-only validation (since TPM 1.2 does not support PIN+startup key in the same way), and VMs without a TPM can use a startup password. This approach maximizes security while ensuring all devices remain compliant with the security policy's intent.

Answer

Create a single compliance policy that requires BitLocker with TPM validation, PIN, and startup key, and exclude devices without TPM 2.0 from the policy.

Answer

Modify the existing compliance policy to remove the PIN requirement so that all devices can comply.

Answer

Downgrade all non-compliant devices to Windows 10 and enable BitLocker with TPM 1.2.

Question 13

You are a Microsoft 365 Endpoint Administrator for a medium-sized company that uses Intune to manage Windows 10 and iOS devices. The company recently experienced a malware outbreak on several Windows 10 devices. The security team wants to implement a solution that can automatically remediate threats on Windows 10 devices by isolating them from the network and running a full antivirus scan. They also want to be alerted when a threat is detected. You have already configured Microsoft Defender for Endpoint (MDE) and devices are onboarded. What should you configure in Intune to meet these requirements?

Accepted Answer

Create a device compliance policy that marks devices with active threats as non-compliant, and configure the non-compliance action to 'Retire device' and 'Send notification'.. Option B is correct because it leverages Intune's device compliance policy to detect active threats via Microsoft Defender for Endpoint integration. When a device has an active threat, it is marked as non-compliant, and the configured non-compliance action 'Retire device' ensures the device is isolated from corporate resources, while 'Send notification' alerts the security team. This meets the requirements for automatic remediation and alerting without additional manual steps.

Answer

Configure a device compliance policy to require Device Health Attestation (DHA) and set the action for non-compliance to 'Quarantine device'.

Answer

Enable Windows Defender Firewall with advanced security and create an inbound rule to block all traffic.

Answer

Configure AppLocker to block all apps and set the action to 'Run antivirus scan'.

Question 14

A company uses Microsoft Intune to manage Windows 10 devices. A user reports that their device is not receiving critical security updates despite being compliant with all update policies. You verify that the device is online and communicating with Intune. Which action should you take to resolve the issue?

Accepted Answer

Review the Windows Update Rings policy assigned to the device and adjust the deferral settings for quality updates.. The user's device is compliant and online, but not receiving critical security updates. The most likely cause is that the Windows Update Rings policy assigned to the device has a deferral period configured for quality updates, which delays the installation of security patches. Adjusting the deferral settings for quality updates to 0 days ensures that critical security updates are installed immediately upon release, resolving the issue without changing the feature update deferral.

Answer

Verify that the device meets the minimum hardware requirements for the update.

Answer

Force a sync from the device via Intune Company Portal or Settings > Accounts > Access work or school.

Answer

Reassign the device to a different Update Ring policy that has no feature update deferral.

Question 15

Which TWO actions are supported by Microsoft Intune for managing macOS devices?

Accepted Answer

Apply device compliance policies.. Option B is correct because Microsoft Intune supports device compliance policies for macOS devices, allowing administrators to define rules (e.g., OS version, encryption status, firewall settings) that devices must meet to be considered compliant. These policies are evaluated by the Intune Company Portal app on macOS and can trigger conditional access controls to block non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business.

Answer

Enable BitLocker encryption.

Answer

Deploy .app applications.

MD-102 Manage, maintain, and protect devices Practice Test 2 — 15 Questions

Exhibit

MD-102 Manage, maintain, and protect devices Practice Test 2 — 15 Questions

Exhibit