MD-102 Protect devices Practice Test 4 — 15 Questions

Question 1

Contoso uses Microsoft Defender for Endpoint on Windows servers. They need to ensure that antivirus definitions are always up-to-date even if the server is disconnected from the internet for extended periods. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a network file share as an internal update source for Microsoft Defender Antivirus. Microsoft Defender Antivirus supports using a network file share as an internal update source via Group Policy or Configuration Manager. This allows servers that are disconnected from the internet to receive definition updates from a local share, ensuring they remain up-to-date without external connectivity.

Answer

Enable Windows Update for Business group policy

Answer

Use Intune to deliver definition updates

Answer

Download definitions from Microsoft Update Catalog and install manually

Question 2

Your organization uses Microsoft Intune to manage Windows 11 devices. You notice that some devices are not receiving security updates even though update rings are assigned. What is the most likely cause?

Accepted Answer

Update ring policy has a deferral period configured that delays updates. Update ring policies in Microsoft Intune include a deferral period setting that delays the installation of updates for a specified number of days after Microsoft releases them. If a deferral period is configured (e.g., 30 days for feature updates or 7 days for quality updates), devices will not receive security updates until that period expires, even though the update ring is assigned. This is a common configuration to allow testing before broad deployment, but it can mistakenly be overlooked when troubleshooting missing updates.

Answer

Devices are noncompliant and blocked from receiving updates

Answer

Devices are not enrolled in Intune

Answer

Devices are not connected to the internet

Question 3

Which TWO actions should you take to ensure that only healthy Windows 10/11 devices can access Microsoft 365 services? (Choose two.)

Accepted Answer

Create a device compliance policy that includes health attestation checks. A device compliance policy with health attestation checks uses Windows Health Attestation Service (WHAS) to verify that devices have secure boot, BitLocker enabled, and no kernel-level tampering. This ensures only devices meeting hardware-level security baselines can be marked as compliant, which is a prerequisite for Conditional Access policies that gate access to Microsoft 365 services.

Answer

Configure Intune enrollment

Answer

Use Windows Autopilot to pre-provision devices

Answer

Deploy an app protection policy to M365 apps

Question 4

Which THREE components are essential for a Microsoft Defender for Endpoint deployment on Windows 10 devices? (Choose three.)

Accepted Answer

Cloud-delivered protection enabled. A is correct because cloud-delivered protection is a core component of Microsoft Defender for Endpoint (MDE) that enables near-instant threat intelligence updates and behavioral analysis. Without it, the endpoint relies solely on local signatures, missing cloud-based machine learning and automated response capabilities. This setting is enforced via Group Policy or Intune to ensure real-time protection against emerging threats.

Answer

Microsoft Intune management agent

Answer

Microsoft 365 Apps for enterprise

Question 5

Which TWO methods can you use to deploy Microsoft Defender for Endpoint on Windows Server 2019? (Choose two.)

Accepted Answer

Use Group Policy to configure and enable the service. Microsoft Defender for Endpoint on Windows Server 2019 can be enabled and configured using Group Policy. Specifically, you deploy the 'Windows Defender Antivirus' and 'Windows Defender Advanced Threat Protection' administrative templates, then configure the 'Turn on Windows Defender Antivirus' policy and the 'Configure Windows Defender Advanced Threat Protection' policy to point to your onboarding blob. This method is supported for servers that are domain-joined and managed via Active Directory Group Policy.

Answer

Install from Microsoft Store

Answer

Enable via Windows Update

Answer

Install manually from Microsoft 365 admin center

Question 6

Refer to the exhibit. The Intune device compliance policy shown is assigned to a group of Windows 10 devices. A user reports that their device is marked as noncompliant. The device has a password set, BitLocker enabled, Secure Boot on, and code integrity (HVCI) enabled. What is the most likely reason?

Accepted Answer

The device uses a biometric sign-in method instead of a password. The device has a password set, but the compliance policy likely requires a 'password' type credential, not a biometric one. In Intune, the 'Require a password to unlock mobile devices' setting specifically checks for a numeric or alphanumeric password, not biometric methods like Windows Hello face or fingerprint. If the user relies solely on biometric sign-in without a fallback password, the device is marked noncompliant.

Answer

Secure Boot is not properly configured in UEFI

Answer

Code integrity (HVCI) is not enabled

Answer

Device encryption is using a software-based method

Question 7

Refer to the exhibit. A PowerShell script is used to check the encryption compliance state of Windows devices managed by Intune. Some devices return a State of 'notApplicable' for the Encryption setting. What does this indicate?

Accepted Answer

The device's operating system edition does not support the encryption setting. In Intune, the 'notApplicable' state for an encryption compliance setting indicates that the device's operating system edition lacks the required encryption capabilities, such as BitLocker support. BitLocker is only available on Windows Pro, Enterprise, and Education editions; Windows Home edition does not support it, so the compliance check returns 'notApplicable' rather than 'compliant' or 'noncompliant'.

Answer

The device has pending actions to enable encryption

Answer

The compliance policy is not assigned to the device

Answer

The device does not require encryption per policy

Question 8

Refer to the exhibit. A KQL query in Microsoft Defender XDR returns no results for PC001 and PC002 even though you know there have been antivirus detections on those devices. What is the most likely reason?

Accepted Answer

The ActionType filter is incorrect for antivirus detections. Antivirus detections in Microsoft Defender XDR are logged under specific ActionType values such as 'AntivirusDetection' or 'AntivirusDetectionCleaned', not generic detection names. If the KQL query uses an incorrect ActionType filter (e.g., filtering for 'MalwareDetection' or a misspelled value), it will return no results for PC001 and PC002 even though detections exist. The query must reference the exact ActionType string used by Microsoft Defender for Endpoint's antivirus events.

Answer

The timestamp range is too narrow

Answer

The device names are case-sensitive and are entered incorrectly

Answer

You do not have permissions to view events on those devices

Question 9

You are the endpoint administrator for Contoso, a company with 5,000 Windows 11 devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to implement a solution that ensures all devices have the latest Windows security updates installed within 7 days of release. Additionally, you must ensure that if a device misses two consecutive update cycles, it is automatically blocked from accessing corporate resources until it is updated. You have the following requirements: 1. Use Intune update rings to control update deployment. 2. Use MDE vulnerability management to identify missing updates. 3. Device compliance policies should check for missing updates and mark devices noncompliant. 4. Conditional Access should block noncompliant devices. Which combination of actions should you take?

Accepted Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.. Configure an update ring with a 7-day deferral to ensure updates are installed within 7 days. Create a device compliance policy that checks for missing updates to mark devices as noncompliant. Configure Conditional Access to require compliant devices, blocking those that are noncompliant. Option A is incorrect because it uses an app protection policy instead of a device compliance policy. Option B is incorrect because it sets no deferral (deferral 0), which would apply updates immediately, not within 7 days as required. Option D is incorrect because it does not configure Conditional Access, so noncompliant devices would not be blocked.

Answer

Configure an update ring with a 7-day deferral. Create an app protection policy that requires minimum OS version. Assign the app protection policy to all users.

Answer

Configure an update ring with no deferral (deferral 0). Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.

Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Assign the compliance policy to all devices. Do not configure Conditional Access.

Question 10

You configure Windows Update for Business policies in Intune. Users report that updates are not installing during configured active hours. You verify that the policy is applied. What is the most likely cause?

Accepted Answer

Update notification level is set to 'Disable all notifications' and 'Automatic Updates behavior' is set to 'Notify download'.. When 'Automatic Updates behavior' is set to 'Notify download' and 'Disable all notifications' is enabled, the user never receives the notification to approve the download, so updates are never downloaded or installed. This overrides the active hours configuration because the update process never begins, even though the policy is applied.

Answer

Deadline for feature updates is set to 7 days.

Answer

Quality update deferral period is set to 0 days.

Answer

Active hours start is set to 8:00 AM and end to 5:00 PM.

Question 11

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to ensure that when a device is offboarding, all collected forensic data is deleted from Microsoft 365. What should you do?

Accepted Answer

Use the 'Remove device from organization' action in Microsoft Defender XDR console.. The 'Remove device from organization' action in the Microsoft Defender XDR console triggers a full offboarding workflow that deletes all collected forensic data (including machine-level telemetry, alerts, and investigation packages) from the Microsoft 365 backend. This action also revokes the device's access to the Defender for Endpoint service and removes its sensor registration, ensuring compliance with data retention policies.

Answer

Disable the device's onboarding policy in Intune.

Answer

Run a PowerShell script to execute 'Remove-MpPreference -DisableRealtimeMonitoring $true'.

Answer

Uninstall the Microsoft Defender for Endpoint sensor from the device.

Question 12

Your company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a configuration that requires users to use Windows Hello for Business (WHfB) and prohibits the use of FIDO2 security keys. Which CSP and value should you configure?

Accepted Answer

Set 'UseFIDO2' to 0 in the PassportForWork CSP.. The 'UseFIDO2' setting in the PassportForWork CSP controls whether FIDO2 security keys can be used as a credential. Setting it to 0 explicitly disables FIDO2 keys, which meets the requirement to prohibit their use. The question also requires users to use Windows Hello for Business (WHfB), but that is a separate prerequisite—the 'UseFIDO2' value directly addresses the prohibition of FIDO2 keys.

Answer

Set 'EnableWindowsHelloForBusiness' to true in the PassportForWork CSP.

Answer

Set 'RequireSecurityDevice' to true in the PassportForWork CSP.

Answer

Set 'UseFIDO2' to 1 in the PassportForWork CSP.

Question 13

A user reports that their iOS device is not receiving email on their work account. The device is enrolled in Intune. You verify that the Exchange ActiveSync profile is assigned correctly. What should you check next?

Accepted Answer

Check the device's compliance status in Intune.. If the device is noncompliant (e.g., due to a noncompliant app or OS version), Conditional Access policies in Intune will block email access even if the Exchange ActiveSync profile is correctly assigned. Option A is incorrect because the MDM authority is already verified by the fact the device is enrolled and the profile is assigned; changing it would not resolve the issue. Option B is incorrect because app protection policies (MAM) are separate from device-level email access via the native mail app—they manage data protection within apps, not connectivity. Option C is incorrect because Device Enrollment Manager (DEM) mode is used for bulk enrollment scenarios, not for individual device email issues.

Answer

Ensure the MDM authority is set to Intune.

Answer

Check if an app protection policy is assigned to the user.

Answer

Verify that the device is enrolled in device enrollment manager mode.

Question 14

You manage Windows 10 devices with Intune. You need to ensure that only approved apps can run on corporate devices. You configure AppLocker via a custom OMA-URI. However, users can still run unapproved apps. What is the most likely reason?

Accepted Answer

The AppLocker policy is set to 'Audit only' mode.. When AppLocker is configured via custom OMA-URI in Intune, the policy is device-based and can be assigned to device groups. However, if the policy is set to 'Audit only' mode, it only logs events without actually blocking applications. This allows users to still run unapproved apps. Option D is incorrect because assigning the policy to a device group does enforce AppLocker rules; the issue here is mode enforcement, not assignment type.

Answer

The device must be running Windows 10 Pro edition.

Answer

AppLocker rules can only be configured via Group Policy, not OMA-URI.

Answer

The policy is assigned to a device group instead of a user group.

Question 15

Your organization uses Microsoft Defender for Cloud Apps (part of Microsoft Defender XDR). You need to detect when users access cloud apps from unauthorized locations. Which log source should you integrate to get location information?

Accepted Answer

Microsoft Entra ID sign-in logs. Microsoft Defender for Cloud Apps can integrate with Microsoft Entra ID (Azure AD) to receive sign-in logs, which include IP address and location. Option B is wrong because Microsoft Intune device enrollment logs do not contain app access location. Option C is wrong because Microsoft Purview audit logs are for compliance, not real-time access. Option D is wrong because Microsoft Sentinel is a SIEM, not a source of location data.

Answer

Microsoft Intune device enrollment logs

Answer

Microsoft Purview audit logs

Answer

Microsoft Sentinel