MD-102 Protect devices Practice Test 2 — 15 Questions

Question 1

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune recently.. Option B is correct because compliance policies in Intune are evaluated based on the last check-in time; if a device hasn't checked in recently, its status may be outdated. Option A is wrong because a reboot is not required for compliance evaluation. Option C is wrong because BitLocker status is reported correctly if enabled. Option D is wrong because OS build version reporting is accurate.

Answer

The OS build version is not reported correctly.

Answer

BitLocker is not enabled on the system drive.

Answer

The devices need to be rebooted for the policy to apply.

Question 2

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

Accepted Answer

The policy is not applied to Exchange Online as a cloud app.. Option D is correct because the Conditional Access policy must target all cloud apps, including Exchange Online. Option A is wrong because the policy can apply to all users. Option B is wrong because the policy applies to device platforms. Option C is wrong because the policy should be set to 'Require device to be marked as compliant'.

Answer

The policy does not include iOS as a device platform.

Answer

The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

Answer

The policy is not scoped to all users.

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

Accepted Answer

Use the built-in Windows 10 security baseline in Intune.. Option A is correct because Microsoft Intune provides pre-built security baselines for Windows 10 that can be customized. Option B is wrong because Configuration Manager is on-premises and not the modern approach. Option C is wrong because Group Policy is not managed via Intune. Option D is wrong because PowerShell scripts are not a baseline but can be used for custom configurations.

Answer

Create a custom configuration profile using Configuration Manager.

Answer

Deploy a PowerShell script via Intune to configure the settings.

Answer

Apply Group Policy Objects from on-premises Active Directory.

Question 4

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

Accepted Answer

The app is not assigned to the user's device group.. Option B is correct because the app must be assigned to the user or device group. Option A is wrong because the device is compliant. Option C is wrong because Android app approval status is not a common issue. Option D is wrong because Company Portal is installed.

Answer

The device is not compliant with the compliance policy.

Answer

The app is not approved in the Android Enterprise managed Google Play.

Answer

The Company Portal app is not installed on the device.

Question 5

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

Accepted Answer

The devices have the Windows Update for Business policy assigned.. Option C is correct because the device must have the 'Windows Update for Business' (WUfB) policy assigned. Option A is wrong because compliance does not affect update deployment. Option B is wrong because the update ring is configured. Option D is wrong because deferral settings affect timing, not delivery.

Answer

The deferral settings are too long.

Answer

The update ring is assigned to the correct device group.

Answer

The devices are compliant with the compliance policy.

Question 6

You need to ensure that only compliant devices can access Microsoft 365 resources. You create a Conditional Access policy in Microsoft Entra ID. Which condition should you use?

Accepted Answer

Require device to be marked as compliant.. Option A is correct because Conditional Access policy can require device compliance. Option B is wrong because it's not a condition. Option C is wrong because it's a control, not a condition. Option D is wrong because it's a location condition.

Answer

Locations condition set to trusted IPs.

Answer

Grant access with multi-factor authentication.

Answer

Device platform condition set to all.

Question 7

You are configuring an app protection policy (MAM) in Intune for iOS and Android devices. The policy should prevent users from copying corporate data to personal apps. Which setting should you configure?

Accepted Answer

Save copies of org data.. Option D is correct because 'Save copies of org data' controls save actions. Option A is wrong because it controls app access. Option B is wrong because it controls data transfer from other apps. Option C is wrong because it controls clipboards, not save.

Answer

Restrict cut, copy, and paste between apps.

Answer

Allow app to transfer data to other apps.

Answer

Require PIN for access.

Question 8

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage device threat detection. You have integrated Defender for Endpoint with Intune for compliance. Some devices are showing as non-compliant due to 'active threats' that are actually low-risk. How can you adjust the compliance policy to allow low-risk threats?

Accepted Answer

Set the 'Threat level' in the Intune compliance policy to 'Low'.. Option C is correct because the Intune compliance policy for Defender for Endpoint has a 'Threat level' setting that can be set to 'Low' to allow low-risk threats. Option A is wrong because you cannot whitelist specific threats. Option B is wrong because it's not a Conditional Access policy setting. Option D is wrong because the threat level is configured in the compliance policy, not in Defender.

Answer

Modify the Conditional Access policy to require device compliance.

Answer

Configure the 'Machine risk score' in Defender for Endpoint.

Answer

Whitelist the specific threats in Defender for Endpoint.

Question 9

You need to wipe a lost corporate-owned iOS device that is enrolled in Intune. Which action should you perform?

Accepted Answer

Wipe the device.. Option B is correct because 'Wipe' resets the device to factory settings. Option A is wrong because 'Retire' removes company data but leaves personal data. Option C is wrong because 'Delete' removes the device record. Option D is wrong because 'Disable' is not an action.

Answer

Delete the device from Intune.

Answer

Retire the device.

Answer

Disable the device.

Question 10

Which TWO conditions must be met for a Windows 10 device to be considered compliant with an Intune compliance policy that requires BitLocker and Secure Boot?

Accepted Answer

Secure Boot is enabled.. Options A and C are correct. BitLocker must be enabled on the system drive, and Secure Boot must be enabled. Option B is wrong because TPM is required for BitLocker but not a separate compliance setting. Option D is wrong because encryption of other drives is not required. Option E is wrong because antivirus is not part of this policy.

Answer

TPM is present and enabled.

Answer

All fixed drives are encrypted with BitLocker.

Answer

Windows Defender Antivirus is active.

Question 11

Which THREE settings must be configured to enable Windows Hello for Business in an Intune policy?

Accepted Answer

Use Windows Hello for Business.. Options B, C, and D are correct. You must enable Windows Hello for Business, configure minimum PIN length, and configure biometrics if desired. Option A is wrong because certificate enrollment is separate. Option E is wrong because it's not a setting.

Answer

Enable Windows Hello for Business provisioning.

Answer

Certificate enrollment policy.

Question 12

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android device administrator.. Options A and D are correct. Android Enterprise corporate-owned work profile is for company-owned devices, and Android device administrator (legacy) is also an option. Option B is wrong because iOS supervision is for iOS. Option C is wrong because Windows Autopilot is for Windows. Option E is wrong because Android Enterprise fully managed is for corporate-owned devices with a single user, but work profile is also valid.

Answer

Apple Device Enrollment Program (DEP).

Answer

Android Enterprise fully managed.

Answer

Windows Autopilot.

Question 13

Refer to the exhibit. A Windows 10 device with OS build 10.0.19041.1 is evaluated against this compliance policy. The device meets all settings except one: the OS version is 10.0.19041.1, which is below the minimum 10.0.19041.0? Actually it is above. But wait, the device has BitLocker enabled, Secure Boot enabled, and firewall enabled. Which setting will cause the device to be non-compliant?

Accepted Answer

Antivirus signatures are out of date.. Option C is correct. The policy requires osMinimumVersion "10.0.19041.0" and osMaximumVersion "10.0.19043.0". The device has 10.0.19041.1, which is above the minimum but below the maximum, so it is within range. However, the policy has "signatureOutOfDate": false meaning it requires antivirus signatures to be up to date. The exhibit doesn't specify signature status, but the question implies the device is non-compliant due to signature out of date. Actually, re-evaluating: The policy sets "signatureOutOfDate": false, meaning the device must have up-to-date signatures. If the device has outdated signatures, it will be non-compliant. Options A, B, and D are all satisfied per the exhibit. So the correct answer is that signatureOutOfDate is false, but the device may have outdated signatures. However, the question asks which setting will cause non-compliance. The most likely is that the device has outdated signature definitions. But the exhibit shows the policy requirement; the device might not meet it. Since the device meets all others, the answer is related to signatureOutOfDate. But the options given are A) BitLocker not enabled, B) Secure Boot not enabled, C) Antivirus signatures out of date, D) Firewall not enabled. The device has all these enabled except possibly signatures. So C is correct.

Answer

BitLocker is not enabled on the device.

Answer

Secure Boot is not enabled on the device.

Answer

The firewall is not enabled on the device.

Question 14

Refer to the exhibit. You run this PowerShell script using the Microsoft Graph PowerShell SDK. What is the purpose of this script?

Accepted Answer

To identify devices that are not supported for compliance policies.. Option B is correct. The script iterates through managed devices and outputs a message for Windows RT and Windows Mobile devices, indicating they are not supported for compliance. Option A is wrong because it does not remove devices. Option C is wrong because it does not check compliance status. Option D is wrong because it does not enroll devices.

Answer

To check compliance status of devices.

Answer

To enroll devices in Intune.

Answer

To remove unsupported devices from Intune.

Question 15

Refer to the exhibit. You are deploying a custom OMA-URI policy to Windows 10 devices. What is the effect of this policy?

Accepted Answer

Device telemetry is set to enhanced.. Option A is correct. The OMA-URI for AllowTelemetry set to 2 enables diagnostic data at the enhanced level. Option B is wrong because Cortana is disabled (value 0). Option C is wrong because neither setting relates to Windows Update. Option D is wrong because the policy does not disable Windows Defender.

Answer

Windows Update is configured to defer updates.

Answer

Windows Defender is disabled.

Answer

Cortana is enabled.