MD-102 Protect devices Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage device threat detection. You have integrated Defender for Endpoint with Intune for compliance. Some devices are showing as non-compliant due to 'active threats' that are actually low-risk. How can you adjust the compliance policy to allow low-risk threats?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the 'Threat level' in the Intune compliance policy to 'Low'.. The Intune compliance policy includes a 'Threat level' setting that determines the minimum threat severity required for a device to be considered compliant. By setting this value to 'Low', devices with only low-risk threats will be marked as compliant, allowing them to pass the policy check. This directly addresses the scenario where low-risk threats are incorrectly causing non-compliance.

Answer

Modify the Conditional Access policy to require device compliance.

Answer

Configure the 'Machine risk score' in Defender for Endpoint.

Answer

Whitelist the specific threats in Defender for Endpoint.

Question 2

You need to wipe a lost corporate-owned iOS device that is enrolled in Intune. Which action should you perform?

Accepted Answer

Wipe the device.. The correct action is to wipe the device because a corporate-owned iOS device that is lost requires a full factory reset to remove all data and prevent unauthorized access. In Microsoft Intune, the 'Wipe' action performs a factory reset, returning the device to its out-of-box state and removing all corporate and personal data, which is appropriate for a lost corporate-owned device.

Answer

Delete the device from Intune.

Answer

Retire the device.

Answer

Disable the device.

Question 3

Which TWO conditions must be met for a Windows 10 device to be considered compliant with an Intune compliance policy that requires BitLocker and Secure Boot?

Accepted Answer

Secure Boot is enabled.. Secure Boot is a required condition in an Intune compliance policy that mandates Secure Boot. Intune checks that Secure Boot is enabled on the device to ensure that only trusted firmware and OS components are loaded during startup, which is a core security requirement for compliance.

Answer

TPM is present and enabled.

Answer

All fixed drives are encrypted with BitLocker.

Answer

Windows Defender Antivirus is active.

Question 4

Which TWO settings must be configured to enable Windows Hello for Business in an Intune policy?

Accepted Answer

Use Windows Hello for Business.. To enable Windows Hello for Business in an Intune policy, you must configure two settings: 'Use Windows Hello for Business' acts as the master toggle to enable WHfB, and 'Minimum PIN length' establishes a mandatory PIN security baseline. Biometrics (facial recognition or fingerprint) is optional and not required to enable Windows Hello for Business.

Answer

Enable Windows Hello for Business provisioning.

Answer

Configure biometrics (facial recognition or fingerprint).

Answer

Certificate enrollment policy.

Question 5

Which TWO methods can be used to enroll Android devices in Microsoft Intune?

Accepted Answer

Android Enterprise corporate-owned work profile.. Android device administrator (DA) is a legacy enrollment method that is deprecated and not recommended for new enrollments. Option B is incorrect because it is a legacy method and not one of the intended two modern methods. Option C is correct because Android Enterprise corporate-owned work profile is a valid enrollment method that enables management of organization-owned devices with a work profile. Option D is correct because Android Enterprise fully managed is a separate, fully managed enrollment method for corporate-owned devices. Both C and D are distinct Android Enterprise enrollment methods in Intune.

Answer

Apple Device Enrollment Program (DEP).

Answer

Android device administrator.

Answer

Windows Autopilot.

Question 6

Refer to the exhibit. A Windows 10 device with OS build 10.0.19041.1 is evaluated against this compliance policy. The device meets all settings except one: the OS version is 10.0.19041.1, which is below the minimum 10.0.19041.0? Actually it is above. But wait, the device has BitLocker enabled, Secure Boot enabled, and firewall enabled. Which setting will cause the device to be non-compliant?

Accepted Answer

Antivirus signatures are out of date.. The compliance policy requires antivirus signatures to be up to date. Since the device meets all other settings (BitLocker enabled, Secure Boot enabled, firewall enabled, and OS version 10.0.19041.1 is above the minimum 10.0.19041.0), the only remaining setting that can cause non-compliance is outdated antivirus signatures. In Microsoft Intune, the 'Antivirus' compliance rule checks for the presence and recency of signature updates via Windows Defender or a third-party AV, and if signatures are older than the configured threshold, the device is marked non-compliant.

Answer

BitLocker is not enabled on the device.

Answer

Secure Boot is not enabled on the device.

Answer

The firewall is not enabled on the device.

Question 7

Refer to the exhibit. You run this PowerShell script using the Microsoft Graph PowerShell SDK. What is the purpose of this script?

Accepted Answer

To identify devices that are not supported for compliance policies.. The script uses the `Get-MgDeviceManagementManagedDevice` cmdlet to retrieve all managed devices from Intune, then filters for devices where the `operatingSystem` property is not in the list of supported OS versions for compliance policies (e.g., Windows 10/11, iOS, Android, macOS). The output identifies devices that are unsupported for compliance policies, which aligns with option D. It does not check compliance status, enroll devices, or remove them.

Answer

To check compliance status of devices.

Answer

To enroll devices in Intune.

Answer

To remove unsupported devices from Intune.

Question 8

Refer to the exhibit. You are deploying a custom OMA-URI policy to Windows 10 devices. What is the effect of this policy?

Accepted Answer

Device telemetry is set to enhanced.. The OMA-URI policy configured in the exhibit sets the 'System/AllowTelemetry' value to '2', which corresponds to the 'Enhanced' telemetry level in Windows 10. This policy enables Microsoft to collect additional diagnostic data, including how Windows and apps are used, to improve the user experience and device performance. It does not affect Windows Update deferral, Defender state, or Cortana.

Answer

Windows Update is configured to defer updates.

Answer

Windows Defender is disabled.

Answer

Cortana is enabled.

Question 9

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot. Conditional Access policies in Microsoft Entra ID can require devices to be marked as compliant before granting access to corporate resources. A device compliance policy in Intune can be configured to check for TPM 2.0 and Secure Boot status on Windows 11 devices. Only when both conditions are met will the device be considered compliant, and the Conditional Access policy will enforce that compliance requirement, effectively blocking non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business in Intune

Answer

Deploy an attack surface reduction rule in Microsoft Defender XDR

Answer

Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

Question 10

Contoso has iOS/iPadOS devices managed by Intune. They need to prevent users from installing apps from outside the Apple App Store and ensure that devices with a jailbreak are blocked from accessing corporate email. Which two policies should they combine?

Accepted Answer

Device compliance policy and Conditional Access. To prevent installation of apps from outside the Apple App Store, you need a Device Compliance Policy that includes the 'require non-removable app store' setting (which blocks sideloading). To block jailbroken devices from accessing corporate email, you combine that compliance policy with a Conditional Access policy that requires the device to be marked as compliant. Only the combination of Device Compliance Policy and Conditional Access enforces both restrictions at the device level before granting access to corporate resources.

Answer

Windows Autopilot and Intune enrollment

Answer

Device configuration profile and Microsoft Defender XDR

Answer

App protection policy and Conditional Access

Question 11

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor on the devices. (Microsoft Defender for Endpoint sensor) is correct. The sensor is the agent installed on devices that collects and reports vulnerability information to Microsoft Defender XDR. If the sensor is misconfigured, missing, or not running, devices will not report vulnerability data. Option A (Microsoft Sentinel workspace) is a SIEM that ingests security data but is not the source of vulnerability data. Option C (Intune MDM authority) manages device compliance and configuration but does not directly collect vulnerability data. Option D (Microsoft Purview compliance portal) handles data governance and compliance, not vulnerability reporting.

Answer

Microsoft Sentinel workspace

Answer

Intune MDM authority

Answer

Microsoft Purview compliance portal

Question 12

An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?

Accepted Answer

Endpoint security disk encryption policy. The Endpoint security disk encryption policy in Intune is specifically designed to enforce encryption (e.g., BitLocker) on Windows 10/11 devices. It provides a dedicated, streamlined interface for configuring encryption settings and monitoring compliance, unlike general device configuration profiles which require manual setup via the settings catalog. This policy type is the correct choice because it directly targets disk encryption as a security baseline, aligning with the organization's goal to enforce encryption across all managed devices.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (settings catalog)

Question 13

A company uses Intune to manage macOS devices. They need to deploy a custom configuration profile that enforces FileVault encryption. What is the recommended approach?

Accepted Answer

Create an endpoint security disk encryption policy in Intune and assign it to the devices. The recommended approach is to create an endpoint security disk encryption policy in Intune (option A). Intune provides built-in FileVault settings under endpoint security disk encryption for macOS. Option B (Apple Configurator) is a local configuration tool, not an MDM solution, and cannot be used for remote management. Option C (manually enabling FileVault) is not scalable for enterprise deployment. Option D (JAMF Pro) is a third-party MDM, not Microsoft Intune.

Answer

Use Apple Configurator to create the profile and import it into Intune

Answer

Ask users to manually enable FileVault

Answer

Use JAMF Pro to manage FileVault

Question 14

Your organization uses Windows Defender Application Control (WDAC) to allow only approved apps. After deploying a WDAC policy via Intune, some users report that a critical line-of-business app is blocked. How should you troubleshoot?

Accepted Answer

Review CodeIntegrity/Operational logs in Event Viewer. WDAC blocks or allows applications based on code integrity rules, and when a policy is enforced, blocked execution events are logged in the CodeIntegrity/Operational event log under Event Viewer. Reviewing this log provides specific block events with file details and rule identifiers, enabling you to identify why the LOB app was blocked and adjust the policy accordingly.

Answer

Check AppLocker logs in Event Viewer

Answer

Review Intune device management events for policy errors

Answer

Check Microsoft 365 Defender portal for WDAC alerts

Question 15

A company wants to prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. What should they configure?

Accepted Answer

Intune app protection policy. Intune app protection policies (APP) are designed to manage and protect corporate data within applications, regardless of the device management state. By configuring data protection settings such as 'Allow app to transfer data to other apps' set to 'Policy managed apps only' and 'Save copies of org data' set to 'Block', you can prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. This policy applies at the app layer, using the Intune App SDK or MAM (Mobile Application Management) channel, and does not require device enrollment.

Answer

Device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access policy