MD-102 Protect devices Practice Test 10 — 15 Questions

Question 1

Your organization, Fabrikam, uses Microsoft Intune to manage iOS/iPadOS and Android devices. You need to implement a solution that ensures company email can only be accessed from the Outlook mobile app, and that data from the Outlook app cannot be copied to personal apps. You also need to ensure that when a user leaves the company, the corporate data in Outlook is removed without affecting personal data. You plan to use app protection policies (MAM). The devices are not enrolled in Intune (unmanaged). You configure the app protection policies for Outlook on iOS and Android. However, users report that they can still copy email content to personal apps. What should you check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the 'Cut, copy, and paste' setting in the app protection policy is set to 'No' or 'Policy managed apps'.. The 'Cut, copy, and paste' setting in the app protection policy controls data transfer between apps. To prevent copying email content to personal apps, this setting must be set to 'No' or 'Policy managed apps'. Option A is incorrect because device enrollment is not required for MAM policies on unmanaged devices. Option B is incorrect because device compliance policies are not applicable without enrollment. Option D is incorrect because Outlook is already a managed app; the issue is the policy setting.

Answer

Ensure that the devices are enrolled in Intune.

Answer

Check that the device compliance policy is assigned.

Answer

Confirm that the Outlook app is a managed app in Intune.

Question 2

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, the Start menu layout is not enforced. The administrator verified the policy is assigned to the correct device groups. What should the administrator check next?

Accepted Answer

Review the policy status in the Troubleshooting + support blade. To verify that the policy is not in a conflict state by using the Troubleshooting + support blade. Option A is incorrect because the policy is already assigned. Option B is incorrect because the enrollment restrictions are not related to Start layout. Option D is incorrect because the update ring policy does not affect Start layout enforcement.

Answer

Check the enrollment restrictions for Windows

Answer

Reassign the policy to the same group

Answer

Modify the Windows Update ring policy

Question 3

An organization uses Microsoft Defender for Endpoint (MDE) with Microsoft Intune for device management. The security team wants to automatically remediate risks detected by MDE on Windows devices. Which Intune feature should be used to trigger remediation actions based on MDE alerts?

Accepted Answer

Conditional Launch policy for MDE. The Conditional Launch policy in Microsoft Defender for Endpoint (MDE) allows you to define automatic remediation actions (e.g., running a scan, isolating a device) triggered by specific MDE threat alerts. This policy is configured within the MDE security settings managed by Intune, enabling a direct, automated response to risks without manual intervention.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

Windows Update rings

Question 4

An IT administrator needs to ensure that iOS devices enrolled in Intune require a PIN of at least 6 digits. Where should the administrator configure this setting?

Accepted Answer

Device compliance policy for iOS. Evice compliance policy for iOS. Device compliance policies can enforce device-level settings such as requiring a PIN of at least 6 digits on iOS devices. Option A (App protection policy) applies to apps, not device-level PIN. Option C (Conditional Access policy) controls access based on conditions, not device settings. Option D (Enrollment restrictions) governs device enrollment, not post-enrollment settings.

Answer

App protection policy

Answer

Conditional Access policy

Answer

Enrollment restrictions

Question 5

A company uses Intune to manage Android Enterprise devices. The administrator deployed a compliance policy that requires encryption and a minimum OS version. Some devices are not showing as compliant even though they meet the requirements. The administrator suspects a time delay. What is the default compliance check interval for Android Enterprise devices in Intune?

Accepted Answer

Every 8 hours. The default compliance check interval for Android Enterprise devices in Intune is every 8 hours. This interval determines how often devices re-evaluate their compliance status against assigned policies, and it is not configurable for Android Enterprise devices. The administrator's suspicion of a time delay is valid because even if a device meets the requirements, it will not report as compliant until the next scheduled check occurs.

Answer

Every 1 hour

Answer

Every 30 minutes

Answer

Every 24 hours

Question 6

Refer to the exhibit. An Intune administrator finds this configuration on a Windows 10 device. What is the purpose of this setting?

Accepted Answer

Define the Intune MDM discovery URL. It defines the Intune MDM discovery URL, which is used by the device to locate the Intune service for enrollment and management. Option B is incorrect because the compliance policy evaluation URL is different. Option C is incorrect because the Windows Update service endpoint is separate. Option D is incorrect because the URL is for MDM, not Defender ATP.

Answer

Set the compliance policy evaluation URL

Answer

Configure Windows Update service endpoint

Answer

Specify the Microsoft Defender ATP tenant

Question 7

An administrator needs to ensure that only devices with a specific manufacturer are allowed to enroll in Intune. Which setting should the administrator configure?

Accepted Answer

Enrollment restrictions. Nrollment restrictions. Enrollment restrictions allow administrators to block devices based on manufacturer, OS version, or device platform. Conditional Access policies work after enrollment. Device categories are for organizational grouping, not blocking enrollment. Device compliance policies evaluate device health after enrollment.

Answer

Conditional Access policy

Answer

Device category

Answer

Device compliance policy

Question 8

A hospital uses Intune to manage Windows 10 devices used by doctors. The devices should automatically install critical updates from Windows Update for Business. Which type of policy should the administrator create?

Accepted Answer

Update rings for Windows 10. Update rings for Windows 10 are the correct policy type in Intune to manage when and how Windows 10 devices receive updates from Windows Update for Business. This policy allows you to configure deferral periods, pause updates, and set the update behavior (e.g., automatic installation of critical updates) without requiring on-premises WSUS or manual approval.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (Update settings)

Question 9

An organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. The security team wants to automatically apply an Intune app protection policy (APP) when a user accesses a risky app from an unmanaged device. What should the administrator use?

Accepted Answer

Conditional Access App Control with session control. Conditional Access App Control with session control is the correct solution because it allows the administrator to monitor and control app sessions in real time, applying Intune app protection policies (APP) when a user accesses a risky app from an unmanaged device. This integration uses reverse proxy architecture to intercept traffic and enforce data protection policies, such as blocking downloads or requiring managed apps, directly within the cloud app session.

Answer

Device configuration policy

Answer

App protection policy assignment to users

Answer

Device compliance policy

Question 10

A company wants to prevent corporate data from being copied from managed apps to personal apps on iOS devices. Which Intune policy should the administrator configure?

Accepted Answer

App protection policy. App Protection Policies (APP) in Microsoft Intune are specifically designed to manage and protect corporate data within applications, regardless of the device enrollment state. On iOS, you can configure data transfer settings such as 'Allow app to transfer data to other apps' to restrict copying corporate data from managed apps to personal apps, using the iOS native inter-app control mechanisms like the Open-In management feature.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

Enrollment restrictions

Question 11

An Intune administrator needs to ensure that Windows 10 devices are compliant with security requirements. Which TWO options are valid compliance settings for Windows 10?

Accepted Answer

Require BitLocker. Require BitLocker is a valid compliance setting in Microsoft Intune for Windows 10 devices. It ensures that BitLocker drive encryption is enabled on the system drive, which is a critical security requirement for data protection. This setting can be enforced via a compliance policy to mark devices as noncompliant if encryption is not active.

Answer

Device category must be 'Corporate'

Answer

Device enrollment type must be 'Corporate'

Answer

Require app protection policy

Question 12

A company uses Intune to manage Android Enterprise devices. The administrator wants to deploy a set of required apps silently to fully managed devices. Which THREE steps are necessary?

Accepted Answer

Create a managed Google Play account. A managed Google Play account is required to bind the Intune tenant to Google's Android Enterprise ecosystem. Without this binding, Intune cannot deploy or manage apps on fully managed Android Enterprise devices. This account enables the administrator to approve, license, and silently push apps from the managed Google Play store to devices.

Answer

Configure a user enrollment profile

Answer

Create an app protection policy for the apps

Question 13

An organization uses Microsoft Defender for Endpoint to detect threats on Windows devices. The security team wants Intune to automatically increase the device's risk score when a threat is detected. Which TWO components are required?

Accepted Answer

Device compliance policy with 'Require device threat level' set to 'Low'. A device compliance policy with 'Require device threat level' set to 'Low' forces Intune to evaluate the threat level reported by Microsoft Defender for Endpoint. When a threat is detected that exceeds the 'Low' threshold, the device is marked as noncompliant, which effectively increases the device's risk score in Intune and can trigger subsequent actions like Conditional Access blocks.

Answer

Device configuration profile

Answer

App protection policy

Answer

Conditional Access policy

Question 14

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are implementing a new security policy that requires all devices to have BitLocker enabled with TPM validation. You create a device configuration profile for BitLocker and assign it to all devices. After two days, you notice that only 3,200 devices are compliant with the BitLocker policy. The remaining devices show 'Not applicable' for the setting. You verify that all devices are Windows 10 Pro or Enterprise and have TPM 2.0. What is the most likely cause of the 'Not applicable' status?

Accepted Answer

The system partition is not configured correctly. BitLocker requires a system partition (active partition) that is of sufficient size (typically at least 100 MB) and properly configured. If the system partition is missing or misconfigured, the BitLocker setting will appear as 'Not applicable' even if the device meets other requirements like TPM 2.0. Option A is incorrect because all devices have TPM 2.0 as stated. Option C is incorrect because Secure Boot is not a prerequisite for BitLocker. Option D is incorrect because the devices are already enrolled in Intune.

Answer

Some devices have TPM 1.2 instead of TPM 2.0

Answer

Secure Boot is disabled on some devices

Answer

The devices are not enrolled in Intune

Question 15

Your company uses Intune to manage iOS devices. You need to deploy a new app that is available in the Apple App Store. You create an iOS store app in Intune and assign it as 'Required' to a group of users. After 24 hours, some users report that the app is not installed. You verify that the app is available in the App Store and that the devices are online. The devices are supervised and enrolled via Apple Business Manager. What should you do first to troubleshoot the issue?

Accepted Answer

Verify that a VPP token is configured and assigned. For supervised iOS devices enrolled via Apple Business Manager, a Volume Purchase Program (VPP) token must be configured in Intune and assigned to the device group to allow automatic installation of store apps assigned as 'Required'. Without a valid VPP token, the app installation will fail even if the app is available and devices are online. Option A is incorrect because while device restrictions policy could block certain apps, it is not the first step in troubleshooting a missing app installation. Option B is incorrect because the devices are already enrolled (as stated in the scenario). Option C is incorrect because an app configuration policy is used to customize app settings, not to control installation.

Answer

Review the iOS device restrictions policy

Answer

Confirm that the devices are enrolled in Intune

Answer

Check the app configuration policy for the app