MD-102 Protect devices Practice Test 3 — 15 Questions

Question 1

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot. Option B is correct: Conditional Access with device compliance policy is the standard method to enforce device health before granting access. Option A (Windows Hello for Business) is for passwordless authentication, not device health enforcement. Option C (Attack surface reduction) is a Defender policy for threat protection. Option D (Autopilot) is for device provisioning, not access control.

Answer

Configure Windows Hello for Business in Intune

Answer

Deploy an attack surface reduction rule in Microsoft Defender XDR

Answer

Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

Question 2

Contoso has iOS/iPadOS devices managed by Intune. They need to prevent users from installing apps from outside the Apple App Store and ensure that devices with a jailbreak are blocked from accessing corporate email. Which two policies should they combine?

Accepted Answer

Device compliance policy and Conditional Access. Option D is correct: Device compliance policy can detect jailbroken devices and mark them noncompliant; Conditional Access then blocks access. Option A (App protection policy) can restrict app installation to managed apps but not detect jailbreak. Option B (Device configuration profile) can enforce restrictions but jailbreak detection is a compliance feature. Option C (Autopilot) is for provisioning only.

Answer

Windows Autopilot and Intune enrollment

Answer

Device configuration profile and Microsoft Defender XDR

Answer

App protection policy and Conditional Access

Question 3

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor on the devices. Option A is correct: Microsoft Defender for Endpoint relies on its agent (sensor) to collect vulnerability data. If the sensor is not installed or running, vulnerability data won't be reported. Option B (Intune MDM) manages device configuration but not vulnerability reporting. Option C (Microsoft Purview) is for compliance and data loss prevention. Option D (Microsoft Sentinel) ingests data from Defender but is not the source.

Answer

Microsoft Sentinel workspace

Answer

Intune MDM authority

Answer

Microsoft Purview compliance portal

Question 4

An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?

Accepted Answer

Endpoint security disk encryption policy. Option A is correct: Endpoint security disk encryption policy in Intune manages BitLocker settings. Option B (Device compliance policy) checks encryption status but doesn't enforce it. Option C (Device configuration profile) can include some encryption settings but the dedicated endpoint security policy is recommended. Option D (App protection policy) manages data protection at the app level, not device encryption.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile (settings catalog)

Question 5

A company uses Intune to manage macOS devices. They need to deploy a custom configuration profile that enforces FileVault encryption. What is the recommended approach?

Accepted Answer

Create an endpoint security disk encryption policy in Intune and assign it to the devices. Option D is correct: Intune provides a built-in FileVault setting in the endpoint security disk encryption policy for macOS. Option A (Apple Configurator) is a local tool, not for MDM. Option B (JAMF Pro) is a third-party MDM, not Microsoft Intune. Option C (Manual configuration) is not scalable.

Answer

Use Apple Configurator to create the profile and import it into Intune

Answer

Ask users to manually enable FileVault

Answer

Use JAMF Pro to manage FileVault

Question 6

Your organization uses Windows Defender Application Control (WDAC) to allow only approved apps. After deploying a WDAC policy via Intune, some users report that a critical line-of-business app is blocked. How should you troubleshoot?

Accepted Answer

Review CodeIntegrity/Operational logs in Event Viewer. Option C is correct: WDAC policies generate block events in Event Viewer under Microsoft-Windows-CodeIntegrity/Operational. Option A (AppLocker) is a different technology. Option B (Device Management Events) may not contain WDAC details. Option D (Microsoft 365 Defender portal) shows alerts but not per-app block details.

Answer

Check AppLocker logs in Event Viewer

Answer

Review Intune device management events for policy errors

Answer

Check Microsoft 365 Defender portal for WDAC alerts

Question 7

A company wants to prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. What should they configure?

Accepted Answer

Intune app protection policy. Option B is correct: Intune app protection policies (MAM) control data transfer between managed and unmanaged apps. Option A (Device compliance policy) enforces device health but not app-level data movement. Option C (Conditional Access) controls access but not copy/paste. Option D (Microsoft Defender for Cloud Apps) is for cloud app security, not local app data protection.

Answer

Device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Conditional Access policy

Question 8

Contoso uses Microsoft Defender for Endpoint on Windows servers. They need to ensure that antivirus definitions are always up-to-date even if the server is disconnected from the internet for extended periods. What should they configure?

Accepted Answer

Configure a network file share as an internal update source for Microsoft Defender Antivirus. Option A is correct: Microsoft Defender for Endpoint can use a file share as an internal definition update source. Option B (Windows Update) requires internet. Option C (Intune) manages client devices, not servers typically. Option D (Microsoft Update Catalog) is for manual download, not automatic updates.

Answer

Enable Windows Update for Business group policy

Answer

Use Intune to deliver definition updates

Answer

Download definitions from Microsoft Update Catalog and install manually

Question 9

Your organization uses Microsoft Intune to manage Windows 11 devices. You notice that some devices are not receiving security updates even though update rings are assigned. What is the most likely cause?

Accepted Answer

Update ring policy has a deferral period configured that delays updates. Option D is correct: Windows Update for Business deferral settings in update rings can delay or pause updates. Option A (Device compliance) doesn't block updates. Option B (Network connectivity) would affect all devices. Option C (Enrollment) if assigned, policy should apply.

Answer

Devices are noncompliant and blocked from receiving updates

Answer

Devices are not enrolled in Intune

Answer

Devices are not connected to the internet

Question 10

Which TWO actions should you take to ensure that only healthy Windows 10/11 devices can access Microsoft 365 services? (Choose two.)

Accepted Answer

Create a device compliance policy that includes health attestation checks. Options B and D are correct: Device compliance policy defines health requirements; Conditional Access enforces compliance. Option A (Intune enrollment) is a prerequisite but not an access control. Option C (App protection policy) protects data, not device health. Option E (Autopilot) is for provisioning.

Answer

Configure Intune enrollment

Answer

Use Windows Autopilot to pre-provision devices

Answer

Deploy an app protection policy to M365 apps

Question 11

Which THREE components are essential for a Microsoft Defender for Endpoint deployment on Windows 10 devices? (Choose three.)

Accepted Answer

Cloud-delivered protection enabled. Options A, B, and D are correct: The Defender for Endpoint sensor, Microsoft Defender Antivirus, and cloud-delivered protection are core components. Option C (Intune) is a management tool but not essential for the agent to function. Option E (Microsoft 365 Apps) is unrelated.

Answer

Microsoft Intune management agent

Answer

Microsoft 365 Apps for enterprise

Question 12

Which TWO methods can you use to deploy Microsoft Defender for Endpoint on Windows Server 2019? (Choose two.)

Accepted Answer

Use Group Policy to configure and enable the service. Options B and D are correct: Intune supports server management via endpoint security policies; Group Policy is on-premises method. Option A (Microsoft Store) is not for servers. Option C (Windows Update) does not install Defender for Endpoint. Option E (ConfigMgr) is also valid but not listed as correct here; only two correct answers.

Answer

Install from Microsoft Store

Answer

Enable via Windows Update

Answer

Install manually from Microsoft 365 admin center

Question 13

Refer to the exhibit. The Intune device compliance policy shown is assigned to a group of Windows 10 devices. A user reports that their device is marked as noncompliant. The device has a password set, BitLocker enabled, Secure Boot on, and code integrity (HVCI) enabled. What is the most likely reason?

Accepted Answer

The device uses a biometric sign-in method instead of a password. Option A is correct: The policy requires passwordRequiredType set to "deviceDefault" which typically means a PIN or alphanumeric password. If the user uses a biometric or picture password, it may not satisfy "deviceDefault". Option B (Secure Boot) is enabled. Option C (Device encryption) is enabled. Option D (Code integrity) is enabled.

Answer

Secure Boot is not properly configured in UEFI

Answer

Code integrity (HVCI) is not enabled

Answer

Device encryption is using a software-based method

Question 14

Refer to the exhibit. A PowerShell script is used to check the encryption compliance state of Windows devices managed by Intune. Some devices return a State of 'notApplicable' for the Encryption setting. What does this indicate?

Accepted Answer

The device's operating system edition does not support the encryption setting. Option B is correct: 'notApplicable' means the device's operating system or edition does not support the encryption setting (e.g., Windows 10 Home lacks BitLocker device encryption). Option A (encryption is not required) would show 'compliant'. Option C (policy not assigned) would show 'notEvaluated'. Option D (pending) would show 'pending'.

Answer

The device has pending actions to enable encryption

Answer

The compliance policy is not assigned to the device

Answer

The device does not require encryption per policy

Question 15

Refer to the exhibit. A KQL query in Microsoft Defender XDR returns no results for PC001 and PC002 even though you know there have been antivirus detections on those devices. What is the most likely reason?

Accepted Answer

The ActionType filter is incorrect for antivirus detections. Option C is correct: The query filters ActionType == 'AntivirusDetection', but the actual action type might be 'AntivirusDetectedMalware' or similar. Option A (Timestamp range) is 7 days, which should include recent events. Option B (DeviceName case mismatch) is possible but Defender XDR is case-insensitive by default. Option D (Permissions) would return an error, not empty results.

Answer

The timestamp range is too narrow

Answer

The device names are case-sensitive and are entered incorrectly

Answer

You do not have permissions to view events on those devices