MD-102 Protect devices — 100 Questions

Question 1

Which TWO actions can you perform using Microsoft Intune to protect devices from malware?

Accepted Answer

Enforce Windows Defender Antivirus real-time protection. Options D and E are correct because Microsoft Intune can enforce Windows Defender Antivirus real-time protection via endpoint security policies (Antivirus policy template) and configure Windows Defender Firewall rules via endpoint security policies (Firewall policy). Real-time protection detects and blocks malware execution, while firewall rules prevent network-based malware infections and command-and-control traffic. Both are native Intune capabilities for malware protection.

Answer

Create network segmentation rules

Answer

Enable email attachment scanning

Answer

Deploy third-party antivirus software

Question 2

You need to ensure that devices enrolled in Microsoft Intune automatically receive Windows quality updates as soon as they are released. Which update ring setting should you configure?

Accepted Answer

Set 'Quality update deferral period (days)' to 0. Setting the 'Quality update deferral period (days)' to 0 ensures that devices receive Windows quality updates immediately upon release, with no delay. This directly addresses the requirement for automatic and immediate installation. Option A affects driver updates, not quality updates. Option C affects feature updates, which are separate from quality updates. Option D's 'Microsoft product updates' setting controls updates for other Microsoft products and does not specifically address Windows quality updates.

Answer

Set 'Driver update deferral period (days)' to 0

Answer

Set 'Feature update deferral period (days)' to 0

Answer

Set 'Microsoft product updates' to 'Allow'

Question 3

You manage Windows 10 devices with Intune. After deploying a new compliance policy requiring BitLocker, many devices show as non-compliant. You verify that BitLocker is enabled on the system drive. What is the most likely cause?

Accepted Answer

The device has multiple drives and BitLocker is not enabled on all. Intune compliance policies for BitLocker often require encryption on all drives. If the policy specifies 'Require encryption of data storage on device' or 'Require encryption on all drives', then only encrypting the system drive is insufficient. Devices with multiple drives where only the system drive is encrypted will be reported as non-compliant.

Answer

BitLocker recovery key is not backed up to Microsoft Entra ID

Answer

The device does not have a TPM chip

Answer

The compliance policy requires 'Encryption' but the device reports 'Encrypted'

Question 4

Your organization uses Microsoft Intune with co-management and Configuration Manager. Some Windows 10 devices are enrolled in Intune but also managed by Configuration Manager. You need to ensure that the Intune compliance policy is evaluated and enforced on these devices. What should you configure?

Accepted Answer

Set the Device Compliance workload to Intune in co-management properties.. In co-management, workloads can be configured to be managed by either Configuration Manager or Intune. To have Intune compliance policies evaluated and enforced on co-managed devices, the Device Compliance workload must be set to 'Intune' in the co-management properties. This ensures that compliance policies created in Intune are applied and enforced. Option A is incorrect because the Configuration Manager client setting does not control workload shifting; that is done in the co-management properties. Option B is incorrect because changing the MDM authority is not necessary and could disrupt management. Option C is incorrect because simply assigning the policy to a device group does not enable evaluation if the workload is still managed by Configuration Manager.

Answer

Configure the Configuration Manager client setting to enable compliance evaluation.

Answer

Assign the compliance policy to a device group that includes these devices.

Answer

Change the MDM authority to Intune.

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. After deploying, users report that the app is not available in the work profile. What is the most likely cause?

Accepted Answer

The app has not been approved in the managed Google Play store.. Managed Google Play apps must be approved before they can be deployed to work profile devices. Without approval, the app will not appear in the work profile's Play Store.

Answer

The app is only available for corporate-owned devices.

Answer

Android Enterprise enrollment is not enabled in Intune.

Answer

The device does not have a work profile configured.

Question 6

Your organization uses Microsoft Entra ID joined devices and Microsoft Intune for mobile device management. A user reports that their device is not receiving compliance policies. The device shows as 'Compliant' in Intune but the Conditional Access policy still blocks access. What should you verify first?

Accepted Answer

Review the Conditional Access policy to ensure it requires compliant device.. The device shows as 'Compliant' in Intune, indicating enrollment and policy assignment are not the issue. The Conditional Access policy may be misconfigured to require a different condition (e.g., hybrid Azure AD join) or may not be set to require compliant device. Reviewing the policy ensures it enforces the correct requirement. Option A is incorrect because the device is already compliant, implying the policy is assigned. Option C is incorrect since the device is already enrolled (shown by compliance status). Option D is incorrect because group membership is irrelevant if the policy itself doesn't require a compliant device.

Answer

Check if the compliance policy is assigned to the device's group.

Answer

Confirm the device is enrolled in Intune.

Answer

Verify the user is in the correct Azure AD group for Conditional Access.

Question 7

Your organization uses Microsoft Intune to manage iOS and Android devices. You have a compliance policy that requires a minimum OS version: iOS 16.0 and Android 12.0. You also have a Conditional Access policy that requires compliant devices. Several users report that they cannot access corporate email on their personal Android devices. The devices are Android 11.0. You need to allow these users to access email while ensuring that corporate data is protected. What should you do?

Accepted Answer

Create a Conditional Access policy that grants access but requires app protection policies and session controls.. It allows access from non-compliant devices while enforcing data protection through app protection policies (MAM) and session controls, such as limiting access to the web or approved apps. This balances security and usability. Option A is incorrect because removing the Conditional Access policy entirely would allow all devices, including those that are non-compliant, without any data protection. Option B is incorrect because lowering the minimum OS version in the compliance policy weakens the security baseline and may not align with organizational requirements. Option D is incorrect because upgrading devices may not be immediately possible for all users, and the organization needs a solution that works with existing devices.

Answer

Remove the Conditional Access policy for these users.

Answer

Update the compliance policy to accept Android 11.0.

Answer

Ask users to upgrade their devices to Android 12.0.

Question 8

Your company uses Microsoft Intune to manage 1,000 Windows 10 devices. You need to deploy a security baseline that includes BitLocker encryption, Windows Defender Antivirus settings, and firewall rules. You create a security baseline policy in Intune and assign it to a group containing all devices. After 48 hours, you notice that only 800 devices have applied the baseline. The remaining 200 devices show 'Pending' status. These devices are online and have network connectivity. What is the most likely cause and solution?

Accepted Answer

The devices need a reboot to apply the baseline settings; schedule a reboot.. Windows 10 security baselines deployed via Intune use Configuration Service Provider (CSP) settings that often require a reboot to fully apply. The 200 devices showing 'Pending' status likely need a reboot to complete the configuration. Scheduling a reboot during maintenance hours will apply the baseline. Option B is wrong because the policy is assigned to the correct group (all devices), and reassignment won't help. Option C is wrong because re-creating the policy does not address the pending status caused by missing reboot. Option D is wrong because low battery is not the cause; devices are online and have network connectivity.

Answer

The devices are not in the correct group; re-assign the policy.

Answer

Re-create the security baseline and assign again.

Answer

The devices have low battery; plug them in.

Question 9

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. Forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration. Option D is wrong because the device is already joined.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 10

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. App Protection Policies (APP) in Microsoft Intune provide data protection at the application layer, independent of device management. By setting 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' to 'Policy managed apps', corporate data in Microsoft 365 apps is prevented from leaking to unmanaged or compromised apps, even if the device itself is jailbroken or otherwise compromised. This ensures data remains protected regardless of the device's security state.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 11

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. When devices show as 'Inactive' in the Microsoft Defender XDR portal after onboarding, it typically indicates that the Microsoft Defender for Endpoint service (Sense) is not running or has stalled. Restarting the service forces the sensor to reinitialize and re-establish communication with the cloud backend, resolving the inactive state without requiring a full re-onboarding.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 12

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.. Creating a Conditional Access policy in Microsoft Entra ID that requires compliant devices for Exchange Online is the correct integration because it directly enforces device compliance as a condition for accessing corporate email. This policy evaluates the device's compliance status reported by Intune before granting access to Exchange Online, ensuring only compliant devices can use Outlook for Windows.

Answer

Enable App Protection Policies for Outlook for Windows.

Answer

Require all devices to be enrolled in Intune before accessing email.

Answer

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Question 13

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. If the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 14

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. The Autopilot deployment profile includes a setting called 'Join to Azure AD as' that determines whether the device performs an Azure AD join or an Azure AD registration. By default, this setting may be configured as 'Azure AD registered', which results in a device that is only registered (workplace-joined) rather than fully joined. Changing this setting to 'Azure AD joined' ensures the device completes a full Azure AD join during the user-driven deployment, making it a managed device in Microsoft Entra ID.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.

Question 15

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.

Question 16

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 17

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Running a full scan is the first recommended troubleshooting step when macOS devices show a 'Sensor disconnected' status in Microsoft Defender XDR. This status often indicates that the sensor process (e.g., mdatp) is not running or has crashed, and a full scan can trigger the sensor to restart and re-establish communication with the cloud backend. It is a non-disruptive, quick check that validates the agent's core functionality before escalating to more invasive steps.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 18

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Accepted Answer

Retire (selective wipe). A Retire (selective wipe) in Microsoft Intune removes managed corporate data and policies from a Windows 10 device while preserving the user's personal data. This is achieved by unenrolling the device from Intune and removing company-managed apps, certificates, and profiles, leaving the device in a usable state for the user. Option E is also correct: a Full wipe (remote wipe) restores the device to its factory default settings, erasing all data including personal files and applications. This is used when the device is lost or stolen, or when it needs to be completely reset.

Answer

Factory reset from Windows Settings

Answer

Remote lock

Answer

Delete device from Intune

Question 19

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Accepted Answer

Devices must be enrolled in Microsoft Intune.. Microsoft Defender for Endpoint (MDE) deployment via Intune requires devices to be enrolled in Intune (MDM) to receive the configuration policies and security baselines that enable and manage MDE. Without Intune enrollment, the device cannot process the MDE onboarding policy or the required Windows Security settings pushed through the Microsoft Endpoint Manager console.

Answer

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Answer

Devices must have Microsoft 365 Apps for enterprise installed.

Question 20

Which TWO of the following are valid reasons to use Windows Autopilot Reset? (Select TWO.)

Accepted Answer

To reassign a device to a new user without re-imaging.. Options A and E are correct. Windows Autopilot Reset returns an already-enrolled device to a clean, ready-to-use state without re-imaging, preserving hardware identity and enrollment. Option A is correct because it allows reassigning a device to a new user quickly. Option E is correct because it resolves performance issues by resetting to a clean state. Options B, C, and D are incorrect: Autopilot Reset does not enroll new devices (B), does not change Azure AD join type (C), and does not deploy custom images (D).

Answer

To enroll a new device that was not purchased through an OEM.

Answer

To change a device from Azure AD joined to Hybrid Azure AD joined.

Answer

To deploy a custom Windows image to a device.