MD-102 Protect devices Practice Test 2 — 15 Questions

Question 1

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 2

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Running a full scan is the first recommended troubleshooting step when macOS devices show a 'Sensor disconnected' status in Microsoft Defender XDR. This status often indicates that the sensor process (e.g., mdatp) is not running or has crashed, and a full scan can trigger the sensor to restart and re-establish communication with the cloud backend. It is a non-disruptive, quick check that validates the agent's core functionality before escalating to more invasive steps.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 3

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Accepted Answer

Retire (selective wipe). A Retire (selective wipe) in Microsoft Intune removes managed corporate data and policies from a Windows 10 device while preserving the user's personal data. This is achieved by unenrolling the device from Intune and removing company-managed apps, certificates, and profiles, leaving the device in a usable state for the user. Option E is also correct: a Full wipe (remote wipe) restores the device to its factory default settings, erasing all data including personal files and applications. This is used when the device is lost or stolen, or when it needs to be completely reset.

Answer

Factory reset from Windows Settings

Answer

Remote lock

Answer

Delete device from Intune

Question 4

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Accepted Answer

Devices must be enrolled in Microsoft Intune.. Microsoft Defender for Endpoint (MDE) deployment via Intune requires devices to be enrolled in Intune (MDM) to receive the configuration policies and security baselines that enable and manage MDE. Without Intune enrollment, the device cannot process the MDE onboarding policy or the required Windows Security settings pushed through the Microsoft Endpoint Manager console.

Answer

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Answer

Devices must have Microsoft 365 Apps for enterprise installed.

Question 5

Which TWO of the following are valid reasons to use Windows Autopilot Reset? (Select TWO.)

Accepted Answer

To reassign a device to a new user without re-imaging.. Options A and E are correct. Windows Autopilot Reset returns an already-enrolled device to a clean, ready-to-use state without re-imaging, preserving hardware identity and enrollment. Option A is correct because it allows reassigning a device to a new user quickly. Option E is correct because it resolves performance issues by resetting to a clean state. Options B, C, and D are incorrect: Autopilot Reset does not enroll new devices (B), does not change Azure AD join type (C), and does not deploy custom images (D).

Answer

To enroll a new device that was not purchased through an OEM.

Answer

To change a device from Azure AD joined to Hybrid Azure AD joined.

Answer

To deploy a custom Windows image to a device.

Question 6

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device running Windows 10 version 20H2 (OS build 19042.1234) reports as compliant. However, the device does not have BitLocker enabled. Why is the device compliant?

Accepted Answer

The storageRequireEncryption setting is evaluated but not enforced because the device doesn't support encryption.. The storageRequireEncryption setting in the compliance policy requires encryption, but it is only evaluated and not enforced if the device does not support encryption (e.g., lacks TPM or compatible hardware). The device is correctly reported as compliant because the setting is not applicable. Option B is incorrect because the report is accurate; the policy is not enforced due to lack of support. Option C is incorrect because the password requirement is unrelated to the encryption compliance. Option D is incorrect because an OS version above the minimum does not override the encryption requirement; the device would be non-compliant if encryption were enforced.

Answer

The device is not actually compliant; the report is incorrect.

Answer

The password requirement is not enforced because passwordRequiredType is set to deviceDefault.

Answer

The OS version is above the minimum, so compliance is granted regardless of encryption.

Question 7

Refer to the exhibit. You configure this Enrollment Status Page (ESP) policy for Windows Autopilot deployments. During a deployment, a device fails to install a required app. What happens?

Accepted Answer

The device will be blocked from use until the app is installed or the device is reset.. The Enrollment Status Page (ESP) policy in Windows Autopilot can be configured to block device use until all required apps are installed. When a required app fails to install, the ESP enters a blocking state, preventing the user from accessing the desktop until the installation succeeds or the device is reset. This behavior is controlled by the 'Block device use until required apps are installed' setting in the ESP profile.

Answer

The user can retry the installation manually.

Answer

The timeout will extend by 60 minutes.

Answer

The device will automatically retry the installation.

Question 8

Refer to the exhibit. You apply this configuration profile to Windows 10 devices. A user reports that their device's diagnostic data level is set to 'Full' in Settings > Diagnostics & feedback. What is the most likely reason?

Accepted Answer

The policy is not assigned to the device or the device is not enrolled.. The most common reason for a configuration profile not taking effect is that the policy is not assigned to the device or the device is not enrolled in Intune. Without proper enrollment, the device never receives the policy, so the default or user-chosen diagnostic data level remains. Even if the policy is assigned, if the device is not enrolled, Intune cannot manage it.

Answer

The user manually changed the setting after the policy applied.

Answer

Windows Defender is blocking the policy application.

Answer

A conflicting Group Policy object is overriding the Intune policy.

Question 9

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune recently.. The most likely cause is that the devices have not checked in with Intune recently. Intune compliance policies are evaluated only when devices check in via the Intune Management Extension or the MDM agent. If a device hasn't synced within the configured check-in frequency (default every 8 hours), its compliance status becomes stale and may show as 'Not compliant' even if it meets the requirements locally. This is a common scenario where the policy is correctly configured, but the device's last sync timestamp is too old.

Answer

The OS build version is not reported correctly.

Answer

BitLocker is not enabled on the system drive.

Answer

The devices need to be rebooted for the policy to apply.

Question 10

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

Accepted Answer

The policy is not applied to Exchange Online as a cloud app.. The Conditional Access policy must explicitly include Exchange Online as a cloud app to govern access to it. If the policy is not applied to Exchange Online, it will not enforce compliance requirements for that service, allowing unenrolled devices to connect. Intune's Conditional Access policies are app-specific; omitting the target cloud app renders the policy ineffective for that workload.

Answer

The policy does not include iOS as a device platform.

Answer

The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

Answer

The policy is not scoped to all users.

Question 11

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

Accepted Answer

Use the built-in Windows 10 security baseline in Intune.. The recommended approach is to use the built-in Windows 10 security baseline in Intune (Option C). Intune provides pre-configured security baselines that include settings for BitLocker encryption and Windows Defender Antivirus, which can be customized as needed. Option A is incorrect because custom configuration profiles do not provide the pre-built baseline and are more manual. Option B is incorrect because PowerShell scripts are not a baseline and are less manageable at scale. Option D is incorrect because Group Policy from on-premises AD is not integrated with Intune and requires hybrid infrastructure.

Answer

Create a custom configuration profile using Configuration Manager.

Answer

Deploy a PowerShell script via Intune to configure the settings.

Answer

Apply Group Policy Objects from on-premises Active Directory.

Question 12

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

Accepted Answer

The app is not assigned to the user's device group.. The app is assigned as 'Available for enrolled devices' in Intune, which means it must be assigned to a device group that includes the user's device. Since the device is enrolled and compliant, the most likely issue is that the app is not assigned to the correct device group, preventing it from appearing in the Company Portal for installation.

Answer

The device is not compliant with the compliance policy.

Answer

The app is not approved in the Android Enterprise managed Google Play.

Answer

The Company Portal app is not installed on the device.

Question 13

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

Accepted Answer

The devices have the Windows Update for Business policy assigned.. Windows Update for Business (WUfB) policies must be explicitly assigned to devices to control update behavior via Intune. Even if update rings are configured and devices are enrolled, without the WUfB policy, devices may show 'Up to date' while missing critical security updates because they are not receiving the update instructions from Intune. The WUfB policy is what actually pushes the update configuration to the Windows Update client on the device.

Answer

The deferral settings are too long.

Answer

The update ring is assigned to the correct device group.

Answer

The devices are compliant with the compliance policy.

Question 14

You need to ensure that only compliant devices can access Microsoft 365 resources. You create a Conditional Access policy in Microsoft Entra ID. Which condition should you use?

Accepted Answer

Require device to be marked as compliant.. The question specifically asks to ensure that only compliant devices can access Microsoft 365 resources. In a Conditional Access policy, the 'Require device to be marked as compliant' grant control enforces that the device must be enrolled in Microsoft Intune and meet all compliance policies (e.g., encryption, OS version, threat level) before access is granted. This directly ties device health to resource access, which is the core requirement.

Answer

Locations condition set to trusted IPs.

Answer

Grant access with multi-factor authentication.

Answer

Device platform condition set to all.

Question 15

You are configuring an app protection policy (MAM) in Intune for iOS and Android devices. The policy should prevent users from copying corporate data to personal apps. Which setting should you configure?

Accepted Answer

Save copies of org data.. The 'Save copies of org data' setting controls whether users can save corporate data to personal apps or locations, which directly prevents copying corporate data to personal apps. Option A is incorrect because 'Restrict cut, copy, and paste between apps' controls clipboard actions like cutting, copying, and pasting, not saving. Option B is incorrect because 'Allow app to transfer data to other apps' controls data sharing between apps, not saving. Option D is incorrect because 'Require PIN for access' controls device access authentication, not data saving.

Answer

Restrict cut, copy, and paste between apps.

Answer

Allow app to transfer data to other apps.

Answer

Require PIN for access.