MD-102 Protect devices Practice Test 1 — 15 Questions

Question 1

Which TWO actions can you perform using Microsoft Intune to protect devices from malware?

Accepted Answer

Enforce Windows Defender Antivirus real-time protection. Options D and E are correct because Microsoft Intune can enforce Windows Defender Antivirus real-time protection via endpoint security policies (Antivirus policy template) and configure Windows Defender Firewall rules via endpoint security policies (Firewall policy). Real-time protection detects and blocks malware execution, while firewall rules prevent network-based malware infections and command-and-control traffic. Both are native Intune capabilities for malware protection.

Answer

Create network segmentation rules

Answer

Enable email attachment scanning

Answer

Deploy third-party antivirus software

Question 2

You need to ensure that devices enrolled in Microsoft Intune automatically receive Windows quality updates as soon as they are released. Which update ring setting should you configure?

Accepted Answer

Set 'Quality update deferral period (days)' to 0. Setting the 'Quality update deferral period (days)' to 0 ensures that devices receive Windows quality updates immediately upon release, with no delay. This directly addresses the requirement for automatic and immediate installation. Option A affects driver updates, not quality updates. Option C affects feature updates, which are separate from quality updates. Option D's 'Microsoft product updates' setting controls updates for other Microsoft products and does not specifically address Windows quality updates.

Answer

Set 'Driver update deferral period (days)' to 0

Answer

Set 'Feature update deferral period (days)' to 0

Answer

Set 'Microsoft product updates' to 'Allow'

Question 3

You manage Windows 10 devices with Intune. After deploying a new compliance policy requiring BitLocker, many devices show as non-compliant. You verify that BitLocker is enabled on the system drive. What is the most likely cause?

Accepted Answer

The device has multiple drives and BitLocker is not enabled on all. Intune compliance policies for BitLocker often require encryption on all drives. If the policy specifies 'Require encryption of data storage on device' or 'Require encryption on all drives', then only encrypting the system drive is insufficient. Devices with multiple drives where only the system drive is encrypted will be reported as non-compliant.

Answer

BitLocker recovery key is not backed up to Microsoft Entra ID

Answer

The device does not have a TPM chip

Answer

The compliance policy requires 'Encryption' but the device reports 'Encrypted'

Question 4

Your organization uses Microsoft Intune with co-management and Configuration Manager. Some Windows 10 devices are enrolled in Intune but also managed by Configuration Manager. You need to ensure that the Intune compliance policy is evaluated and enforced on these devices. What should you configure?

Accepted Answer

Set the Device Compliance workload to Intune in co-management properties.. In co-management, workloads can be configured to be managed by either Configuration Manager or Intune. To have Intune compliance policies evaluated and enforced on co-managed devices, the Device Compliance workload must be set to 'Intune' in the co-management properties. This ensures that compliance policies created in Intune are applied and enforced. Option A is incorrect because the Configuration Manager client setting does not control workload shifting; that is done in the co-management properties. Option B is incorrect because changing the MDM authority is not necessary and could disrupt management. Option C is incorrect because simply assigning the policy to a device group does not enable evaluation if the workload is still managed by Configuration Manager.

Answer

Configure the Configuration Manager client setting to enable compliance evaluation.

Answer

Assign the compliance policy to a device group that includes these devices.

Answer

Change the MDM authority to Intune.

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. After deploying, users report that the app is not available in the work profile. What is the most likely cause?

Accepted Answer

The app has not been approved in the managed Google Play store.. Managed Google Play apps must be approved before they can be deployed to work profile devices. Without approval, the app will not appear in the work profile's Play Store.

Answer

The app is only available for corporate-owned devices.

Answer

Android Enterprise enrollment is not enabled in Intune.

Answer

The device does not have a work profile configured.

Question 6

Your organization uses Microsoft Entra ID joined devices and Microsoft Intune for mobile device management. A user reports that their device is not receiving compliance policies. The device shows as 'Compliant' in Intune but the Conditional Access policy still blocks access. What should you verify first?

Accepted Answer

Review the Conditional Access policy to ensure it requires compliant device.. The device shows as 'Compliant' in Intune, indicating enrollment and policy assignment are not the issue. The Conditional Access policy may be misconfigured to require a different condition (e.g., hybrid Azure AD join) or may not be set to require compliant device. Reviewing the policy ensures it enforces the correct requirement. Option A is incorrect because the device is already compliant, implying the policy is assigned. Option C is incorrect since the device is already enrolled (shown by compliance status). Option D is incorrect because group membership is irrelevant if the policy itself doesn't require a compliant device.

Answer

Check if the compliance policy is assigned to the device's group.

Answer

Confirm the device is enrolled in Intune.

Answer

Verify the user is in the correct Azure AD group for Conditional Access.

Question 7

Your organization uses Microsoft Intune to manage iOS and Android devices. You have a compliance policy that requires a minimum OS version: iOS 16.0 and Android 12.0. You also have a Conditional Access policy that requires compliant devices. Several users report that they cannot access corporate email on their personal Android devices. The devices are Android 11.0. You need to allow these users to access email while ensuring that corporate data is protected. What should you do?

Accepted Answer

Create a Conditional Access policy that grants access but requires app protection policies and session controls.. It allows access from non-compliant devices while enforcing data protection through app protection policies (MAM) and session controls, such as limiting access to the web or approved apps. This balances security and usability. Option A is incorrect because removing the Conditional Access policy entirely would allow all devices, including those that are non-compliant, without any data protection. Option B is incorrect because lowering the minimum OS version in the compliance policy weakens the security baseline and may not align with organizational requirements. Option D is incorrect because upgrading devices may not be immediately possible for all users, and the organization needs a solution that works with existing devices.

Answer

Remove the Conditional Access policy for these users.

Answer

Update the compliance policy to accept Android 11.0.

Answer

Ask users to upgrade their devices to Android 12.0.

Question 8

Your company uses Microsoft Intune to manage 1,000 Windows 10 devices. You need to deploy a security baseline that includes BitLocker encryption, Windows Defender Antivirus settings, and firewall rules. You create a security baseline policy in Intune and assign it to a group containing all devices. After 48 hours, you notice that only 800 devices have applied the baseline. The remaining 200 devices show 'Pending' status. These devices are online and have network connectivity. What is the most likely cause and solution?

Accepted Answer

The devices need a reboot to apply the baseline settings; schedule a reboot.. Windows 10 security baselines deployed via Intune use Configuration Service Provider (CSP) settings that often require a reboot to fully apply. The 200 devices showing 'Pending' status likely need a reboot to complete the configuration. Scheduling a reboot during maintenance hours will apply the baseline. Option B is wrong because the policy is assigned to the correct group (all devices), and reassignment won't help. Option C is wrong because re-creating the policy does not address the pending status caused by missing reboot. Option D is wrong because low battery is not the cause; devices are online and have network connectivity.

Answer

The devices are not in the correct group; re-assign the policy.

Answer

Re-create the security baseline and assign again.

Answer

The devices have low battery; plug them in.

Question 9

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. Forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration. Option D is wrong because the device is already joined.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 10

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. App Protection Policies (APP) in Microsoft Intune provide data protection at the application layer, independent of device management. By setting 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' to 'Policy managed apps', corporate data in Microsoft 365 apps is prevented from leaking to unmanaged or compromised apps, even if the device itself is jailbroken or otherwise compromised. This ensures data remains protected regardless of the device's security state.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 11

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. When devices show as 'Inactive' in the Microsoft Defender XDR portal after onboarding, it typically indicates that the Microsoft Defender for Endpoint service (Sense) is not running or has stalled. Restarting the service forces the sensor to reinitialize and re-establish communication with the cloud backend, resolving the inactive state without requiring a full re-onboarding.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 12

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.. Creating a Conditional Access policy in Microsoft Entra ID that requires compliant devices for Exchange Online is the correct integration because it directly enforces device compliance as a condition for accessing corporate email. This policy evaluates the device's compliance status reported by Intune before granting access to Exchange Online, ensuring only compliant devices can use Outlook for Windows.

Answer

Enable App Protection Policies for Outlook for Windows.

Answer

Require all devices to be enrolled in Intune before accessing email.

Answer

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Question 13

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. If the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 14

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. The Autopilot deployment profile includes a setting called 'Join to Azure AD as' that determines whether the device performs an Azure AD join or an Azure AD registration. By default, this setting may be configured as 'Azure AD registered', which results in a device that is only registered (workplace-joined) rather than fully joined. Changing this setting to 'Azure AD joined' ensures the device completes a full Azure AD join during the user-driven deployment, making it a managed device in Microsoft Entra ID.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.

Question 15

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.