MD-102 Protect devices — 30 Questions

Question 1

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. App Protection Policies (APP) in Microsoft Intune provide data protection at the application layer, independent of device management. By setting 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' to 'Policy managed apps', corporate data in Microsoft 365 apps is prevented from leaking to unmanaged or compromised apps, even if the device itself is jailbroken or otherwise compromised. This ensures data remains protected regardless of the device's security state.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 2

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. When devices show as 'Inactive' in the Microsoft Defender XDR portal after onboarding, it typically indicates that the Microsoft Defender for Endpoint service (Sense) is not running or has stalled. Restarting the service forces the sensor to reinitialize and re-establish communication with the cloud backend, resolving the inactive state without requiring a full re-onboarding.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 3

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. If the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 4

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 5

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Running a full scan is the first recommended troubleshooting step when macOS devices show a 'Sensor disconnected' status in Microsoft Defender XDR. This status often indicates that the sensor process (e.g., mdatp) is not running or has crashed, and a full scan can trigger the sensor to restart and re-establish communication with the cloud backend. It is a non-disruptive, quick check that validates the agent's core functionality before escalating to more invasive steps.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 6

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Accepted Answer

Retire (selective wipe). Option B, Retire (selective wipe), is correct because in Microsoft Intune the Retire action removes company-managed data, policies, and management profiles from the device while leaving the user's personal files and settings intact, which is a valid wipe method for Windows 10. Option E, Full wipe (remote wipe), is correct because Intune's Wipe action performs a factory reset of the Windows 10 device, removing all data and settings and restoring it to its original state. Option A, Factory reset from Windows Settings, is not an Intune method since it is performed locally on the device by the user, not initiated through the Intune service. Option C, Remote lock, only locks the device screen and does not erase any data, so it is not a wipe. Option D, Delete device from Intune, only removes the device record from the Intune console and does not wipe or erase data on the device itself.

Answer

Factory reset from Windows Settings

Answer

Remote lock

Answer

Delete device from Intune

Question 7

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Accepted Answer

Devices must be enrolled in Microsoft Intune.. Option A is correct because Intune can only deliver configuration and onboarding policies to devices that are enrolled in Microsoft Intune, making enrollment a hard prerequisite for deploying Defender for Endpoint through Intune. Option D is correct because each user (or device, depending on licensing model) must be assigned a Microsoft Defender for Endpoint license so the tenant is entitled to the service and the onboarding policy can be applied. Option E is correct because Defender for Endpoint onboarding via Intune requires the device to run a supported Windows 10 version (for example, Windows 10 version 1709 or later, with newer builds recommended) so the built-in Defender Antivirus and onboarding components function properly. Option B is incorrect because the Defender for Endpoint client is not separately downloaded from the Microsoft 365 admin center; onboarding is done through the built-in Windows Defender components and an Intune/Defender portal onboarding package or policy. Option C is incorrect because Microsoft 365 Apps for enterprise is not required to deploy Defender for Endpoint, as the service works independently of the Office suite.

Answer

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Answer

Devices must have Microsoft 365 Apps for enterprise installed.

Question 8

Which TWO of the following are valid reasons to use Windows Autopilot Reset? (Select TWO.)

Accepted Answer

To reassign a device to a new user without re-imaging.. Option A is correct because Windows Autopilot Reset removes user-specific data, apps, and settings while preserving the device's Microsoft Entra ID join, Intune enrollment, and Autopilot registration, so the device can be handed to a new user without re-imaging or re-provisioning. Option E is correct because Autopilot Reset returns the device to a clean, business-ready state in a fraction of the time of a full reimage, making it a fast remedy for performance or configuration problems. Option B is incorrect because Autopilot Reset applies only to devices already registered with Autopilot; new non-OEM devices must first be registered via hardware hash or a provisioning package. Option C is incorrect because changing join type from Microsoft Entra ID joined to Hybrid Microsoft Entra ID joined requires reconfiguration or reimaging, not Autopilot Reset. Option D is incorrect because Autopilot Reset does not deploy custom images; it resets the existing Windows installation to a known good state.

Answer

To enroll a new device that was not purchased through an OEM.

Answer

To change a device from Azure AD joined to Hybrid Azure AD joined.

Answer

To deploy a custom Windows image to a device.

Question 9

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device running Windows 10 version 20H2 (OS build 19042.1234) reports as compliant. However, the device does not have BitLocker enabled. Why is the device compliant?

Accepted Answer

The storageRequireEncryption setting is evaluated but not enforced because the device doesn't support encryption.. The storageRequireEncryption setting in the compliance policy requires encryption, but it is only evaluated and not enforced if the device does not support encryption (e.g., lacks TPM or compatible hardware). The device is correctly reported as compliant because the setting is not applicable. Option B is incorrect because the report is accurate; the policy is not enforced due to lack of support. Option C is incorrect because the password requirement is unrelated to the encryption compliance. Option D is incorrect because an OS version above the minimum does not override the encryption requirement; the device would be non-compliant if encryption were enforced.

Answer

The device is not actually compliant; the report is incorrect.

Answer

The password requirement is not enforced because passwordRequiredType is set to deviceDefault.

Answer

The OS version is above the minimum, so compliance is granted regardless of encryption.

Question 10

Refer to the exhibit. You apply this configuration profile to Windows 10 devices. A user reports that their device's diagnostic data level is set to 'Full' in Settings > Diagnostics & feedback. What is the most likely reason?

Accepted Answer

The policy is not assigned to the device or the device is not enrolled.. The most common reason for a configuration profile not taking effect is that the policy is not assigned to the device or the device is not enrolled in Intune. Without proper enrollment, the device never receives the policy, so the default or user-chosen diagnostic data level remains. Even if the policy is assigned, if the device is not enrolled, Intune cannot manage it.

Answer

The user manually changed the setting after the policy applied.

Answer

Windows Defender is blocking the policy application.

Answer

A conflicting Group Policy object is overriding the Intune policy.

Question 11

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune recently.. The most likely cause is that the devices have not checked in with Intune recently. Intune compliance policies are evaluated only when devices check in via the Intune Management Extension or the MDM agent. If a device hasn't synced within the configured check-in frequency (default every 8 hours), its compliance status becomes stale and may show as 'Not compliant' even if it meets the requirements locally. This is a common scenario where the policy is correctly configured, but the device's last sync timestamp is too old.

Answer

The OS build version is not reported correctly.

Answer

BitLocker is not enabled on the system drive.

Answer

The devices need to be rebooted for the policy to apply.

Question 12

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

Accepted Answer

The policy is not applied to Exchange Online as a cloud app.. The Conditional Access policy must explicitly include Exchange Online as a cloud app to govern access to it. If the policy is not applied to Exchange Online, it will not enforce compliance requirements for that service, allowing unenrolled devices to connect. Intune's Conditional Access policies are app-specific; omitting the target cloud app renders the policy ineffective for that workload.

Answer

The policy does not include iOS as a device platform.

Answer

The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

Answer

The policy is not scoped to all users.

Question 13

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

Accepted Answer

The app is not assigned to the user's device group.. The app is assigned as 'Available for enrolled devices' in Intune, which means it must be assigned to a device group that includes the user's device. Since the device is enrolled and compliant, the most likely issue is that the app is not assigned to the correct device group, preventing it from appearing in the Company Portal for installation.

Answer

The device is not compliant with the compliance policy.

Answer

The app is not approved in the Android Enterprise managed Google Play.

Answer

The Company Portal app is not installed on the device.

Question 14

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

Accepted Answer

The devices have the Windows Update for Business policy assigned.. Windows Update for Business (WUfB) policies must be explicitly assigned to devices to control update behavior via Intune. Even if update rings are configured and devices are enrolled, without the WUfB policy, devices may show 'Up to date' while missing critical security updates because they are not receiving the update instructions from Intune. The WUfB policy is what actually pushes the update configuration to the Windows Update client on the device.

Answer

The deferral settings are too long.

Answer

The update ring is assigned to the correct device group.

Answer

The devices are compliant with the compliance policy.

Question 15

You are configuring an app protection policy (MAM) in Intune for iOS and Android devices. The policy should prevent users from copying corporate data to personal apps. Which setting should you configure?

Accepted Answer

Save copies of org data.. The 'Save copies of org data' setting controls whether users can save corporate data to personal apps or locations, which directly prevents copying corporate data to personal apps. Option A is incorrect because 'Restrict cut, copy, and paste between apps' controls clipboard actions like cutting, copying, and pasting, not saving. Option B is incorrect because 'Allow app to transfer data to other apps' controls data sharing between apps, not saving. Option D is incorrect because 'Require PIN for access' controls device access authentication, not data saving.

Answer

Restrict cut, copy, and paste between apps.

Answer

Allow app to transfer data to other apps.

Answer

Require PIN for access.

Question 16

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage device threat detection. You have integrated Defender for Endpoint with Intune for compliance. Some devices are showing as non-compliant due to 'active threats' that are actually low-risk. How can you adjust the compliance policy to allow low-risk threats?

Accepted Answer

Set the 'Threat level' in the Intune compliance policy to 'Low'.. The Intune compliance policy includes a 'Threat level' setting that determines the minimum threat severity required for a device to be considered compliant. By setting this value to 'Low', devices with only low-risk threats will be marked as compliant, allowing them to pass the policy check. This directly addresses the scenario where low-risk threats are incorrectly causing non-compliance.

Answer

Modify the Conditional Access policy to require device compliance.

Answer

Configure the 'Machine risk score' in Defender for Endpoint.

Answer

Whitelist the specific threats in Defender for Endpoint.

Question 17

Which TWO conditions must be met for a Windows 10 device to be considered compliant with an Intune compliance policy that requires BitLocker and Secure Boot?

Accepted Answer

Secure Boot is enabled.. Option B is correct because the compliance policy explicitly requires Secure Boot, so the device must report Secure Boot as enabled in its Intune device health attestation for the policy to evaluate as compliant. Option E is correct because the BitLocker requirement in an Intune compliance policy is satisfied when BitLocker protection is enabled on the OS/system drive, which is the drive the policy evaluates by default. Option A is not required by the stated policy; although TPM is a prerequisite for BitLocker and Secure Boot attestation, the policy conditions listed are Secure Boot and BitLocker, not TPM presence. Option C is incorrect because the policy requires BitLocker on the system drive, not necessarily encryption of all fixed drives. Option D is incorrect because Windows Defender Antivirus status is a separate compliance setting and is not part of the BitLocker and Secure Boot requirements described.

Answer

TPM is present and enabled.

Answer

All fixed drives are encrypted with BitLocker.

Answer

Windows Defender Antivirus is active.

Question 18

Which TWO settings must be configured to enable Windows Hello for Business in an Intune policy?

Accepted Answer

Use Windows Hello for Business.. To enable Windows Hello for Business in an Intune policy, you must configure two settings: 'Use Windows Hello for Business' acts as the master toggle to enable WHfB, and 'Minimum PIN length' establishes a mandatory PIN security baseline. Biometrics (facial recognition or fingerprint) is optional and not required to enable Windows Hello for Business.

Answer

Enable Windows Hello for Business provisioning.

Answer

Configure biometrics (facial recognition or fingerprint).

Answer

Certificate enrollment policy.

Question 19

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned work profile.. Android device administrator (DA) is a legacy enrollment method that is deprecated and not recommended for new enrollments. Option B is incorrect because it is a legacy method and not one of the intended two modern methods. Option C is correct because Android Enterprise corporate-owned work profile is a valid enrollment method that enables management of organization-owned devices with a work profile. Option D is correct because Android Enterprise fully managed is a separate, fully managed enrollment method for corporate-owned devices. Both C and D are distinct Android Enterprise enrollment methods in Intune.

Answer

Apple Device Enrollment Program (DEP).

Answer

Android device administrator.

Answer

Windows Autopilot.

Question 20

Refer to the exhibit. A Windows 10 device with OS build 10.0.19041.1 is evaluated against this compliance policy. The device meets all settings except one: the OS version is 10.0.19041.1, which is below the minimum 10.0.19041.0? Actually it is above. But wait, the device has BitLocker enabled, Secure Boot enabled, and firewall enabled. Which setting will cause the device to be non-compliant?

Accepted Answer

Antivirus signatures are out of date.. The compliance policy requires antivirus signatures to be up to date. Since the device meets all other settings (BitLocker enabled, Secure Boot enabled, firewall enabled, and OS version 10.0.19041.1 is above the minimum 10.0.19041.0), the only remaining setting that can cause non-compliance is outdated antivirus signatures. In Microsoft Intune, the 'Antivirus' compliance rule checks for the presence and recency of signature updates via Windows Defender or a third-party AV, and if signatures are older than the configured threshold, the device is marked non-compliant.

Answer

BitLocker is not enabled on the device.

Answer

Secure Boot is not enabled on the device.

Answer

The firewall is not enabled on the device.