MD-102 Protect devices Practice Test 4 — 15 Questions

Question 1

You are the endpoint administrator for Contoso, a company with 5,000 Windows 11 devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to implement a solution that ensures all devices have the latest Windows security updates installed within 7 days of release. Additionally, you must ensure that if a device misses two consecutive update cycles, it is automatically blocked from accessing corporate resources until it is updated. You have the following requirements: 1. Use Intune update rings to control update deployment. 2. Use MDE vulnerability management to identify missing updates. 3. Device compliance policies should check for missing updates and mark devices noncompliant. 4. Conditional Access should block noncompliant devices. Which combination of actions should you take?

Accepted Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.. Option D is correct: Update rings set the deferral period to 7 days; a device compliance policy checks for missing updates and marks noncompliant; Conditional Access blocks noncompliant devices. Option A (compliance policy on missing updates only) misses the Conditional Access block. Option B (app protection policy) is irrelevant. Option C (update ring with deferral 0) applies updates immediately, not within 7 days.

Answer

Configure an update ring with a 7-day deferral. Create an app protection policy that requires minimum OS version. Assign the app protection policy to all users.

Answer

Configure an update ring with no deferral (deferral 0). Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.

Answer

Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Assign the compliance policy to all devices. Do not configure Conditional Access.

Question 2

You configure Windows Update for Business policies in Intune. Users report that updates are not installing during configured active hours. You verify that the policy is applied. What is the most likely cause?

Accepted Answer

Update notification level is set to 'Disable all notifications' and 'Automatic Updates behavior' is set to 'Notify download'.. Option D is correct because the 'Update notification level' set to 'Disable all notifications' can prevent users from seeing restart prompts, but updates still install during active hours. However, if 'Automatic Updates behavior' is set to 'Notify download', updates are not automatically downloaded, causing the issue. Option A is wrong because 'Deadline for feature updates' does not affect active hours. Option B is wrong because 'Active hours start/end' is configured correctly. Option C is wrong because 'Quality update deferral period' does not prevent installation during active hours.

Answer

Deadline for feature updates is set to 7 days.

Answer

Quality update deferral period is set to 0 days.

Answer

Active hours start is set to 8:00 AM and end to 5:00 PM.

Question 3

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to ensure that when a device is offboarding, all collected forensic data is deleted from Microsoft 365. What should you do?

Accepted Answer

Use the 'Remove device from organization' action in Microsoft Defender XDR console.. Option B is correct because the 'Remove device from organization' action in Microsoft Defender XDR triggers deletion of the device's data from the service. Option A is wrong because disabling the onboarding policy only stops future data collection. Option C is wrong because uninstalling the sensor does not remove existing data. Option D is wrong because there is no 'Data Purge' action for individual devices.

Answer

Disable the device's onboarding policy in Intune.

Answer

Run a PowerShell script to execute 'Remove-MpPreference -DisableRealtimeMonitoring $true'.

Answer

Uninstall the Microsoft Defender for Endpoint sensor from the device.

Question 4

Your company uses Microsoft Intune to manage Windows 11 devices. You need to deploy a configuration that requires users to use Windows Hello for Business (WHfB) and prohibits the use of FIDO2 security keys. Which CSP and value should you configure?

Accepted Answer

Set 'UseFIDO2' to 0 in the PassportForWork CSP.. Option C is correct because the PassportForWork CSP's 'UseFIDO2' key, when set to 0 (disabled), prohibits FIDO2 keys while other policies enable WHfB. Option A is wrong because setting 'UseFIDO2' to 1 would allow FIDO2. Option B is wrong because 'EnableWindowsHelloForBusiness' enables WHfB but does not affect FIDO2. Option D is wrong because setting 'RequireSecurityDevice' forces TPM but does not address FIDO2.

Answer

Set 'EnableWindowsHelloForBusiness' to true in the PassportForWork CSP.

Answer

Set 'RequireSecurityDevice' to true in the PassportForWork CSP.

Answer

Set 'UseFIDO2' to 1 in the PassportForWork CSP.

Question 5

A user reports that their iOS device is not receiving email on their work account. The device is enrolled in Intune. You verify that the Exchange ActiveSync profile is assigned correctly. What should you check next?

Accepted Answer

Check the device's compliance status in Intune.. Option A is correct because if the device is marked as noncompliant (e.g., due to noncompliant app or OS), Conditional Access will block email access even if the profile is present. Option B is wrong because if the device is compliant, the profile is applied. Option C is wrong because MDM authority is typically set correctly. Option D is wrong because an app protection policy is for MAM, not for email access via native mail app.

Answer

Ensure the MDM authority is set to Intune.

Answer

Check if an app protection policy is assigned to the user.

Answer

Verify that the device is enrolled in device enrollment manager mode.

Question 6

You manage Windows 10 devices with Intune. You need to ensure that only approved apps can run on corporate devices. You configure AppLocker via a custom OMA-URI. However, users can still run unapproved apps. What is the most likely reason?

Accepted Answer

The policy is assigned to a device group instead of a user group.. Option D is correct because AppLocker rules are applied per user, not per device. If the policy is assigned to user groups but the user is not in the scope, the rules do not apply. Option A is wrong because AppLocker can be configured via OMA-URI. Option B is wrong because AppLocker works on Windows 10/11 Enterprise and Education editions. Option C is wrong because uninstalling the app does not enforce rules.

Answer

The device must be running Windows 10 Pro edition.

Answer

AppLocker rules can only be configured via Group Policy, not OMA-URI.

Answer

The AppLocker policy is set to 'Audit only' mode.

Question 7

Your organization uses Microsoft Defender for Cloud Apps (part of Microsoft Defender XDR). You need to detect when users access cloud apps from unauthorized locations. Which log source should you integrate to get location information?

Accepted Answer

Microsoft Entra ID sign-in logs. Option A is correct because Microsoft Defender for Cloud Apps can integrate with Microsoft Entra ID (Azure AD) to receive sign-in logs, which include IP address and location. Option B is wrong because Microsoft Sentinel is a SIEM, not a source of location data. Option C is wrong because Microsoft Purview is for compliance, not real-time access. Option D is wrong because Intune enrollment logs do not contain app access location.

Answer

Microsoft Intune device enrollment logs

Answer

Microsoft Purview audit logs

Answer

Microsoft Sentinel

Question 8

You need to configure BitLocker encryption for Windows 10 devices managed by Intune. You create a device configuration profile for endpoint protection. After assigning, devices show 'BitLocker not enabled' in the Intune console. What is the most likely cause?

Accepted Answer

The devices do not have a TPM chip.. Option B is correct because BitLocker requires a TPM chip on the device. If the device does not have TPM or it is disabled, BitLocker cannot be enabled. Option A is wrong because the profile is assigned to devices. Option C is wrong because BitLocker is available on Windows 10 Pro and Enterprise. Option D is wrong because Windows 10 can be encrypted with or without Secure Boot.

Answer

The profile is assigned to a user group instead of a device group.

Answer

Secure Boot is not enabled on the devices.

Answer

The devices are running Windows 10 Home edition.

Question 9

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

Accepted Answer

Work profile. Option C is correct because Android Enterprise work profile creates a separate profile on the device that isolates work apps and data from personal apps. Option A is wrong because device administrator mode is legacy and does not provide strong separation. Option B is wrong because corporate-owned personally enabled (COPE) uses work profile but is for corporate-owned devices, not BYOD. Option D is wrong because fully managed is for corporate-owned without personal space.

Answer

Fully managed

Answer

Device administrator

Answer

Corporate-owned personally enabled (COPE)

Question 10

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

Accepted Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}. Option A is correct because the 'deviceHealth' condition with 'defenderSensorVersion' and 'defenderSensorHealth' is the correct syntax for conditional launch in Intune app protection policies. Option B is wrong because 'minimumVersion' is not a valid key. Option C is wrong because 'clientVersion' is used for the app itself, not the sensor. Option D is wrong because the syntax is incorrect.

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": "healthy"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"version": "10.8049.22439.1043"}, "defenderSensorHealth": {"state": "enabled"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

Answer

{"deviceHealth": {"clientVersion": {"minimumVersion": "10.8049.22439.1043"}, "clientHealth": {"minimumVersion": 1}}}

Question 11

Your organization uses Microsoft Intune to manage mobile devices. You need to configure compliance policies that trigger conditional access. Which TWO conditions can be used in a device compliance policy?

Accepted Answer

Minimum OS version is 14.0.. Options A and D are correct. Device compliance policies can check for jailbroken/rooted devices (A) and require a minimum OS version (D). Option B is wrong because app protection policies, not compliance policies, manage app-level restrictions. Option C is wrong because device compliance policies do not enforce encryption of SD cards; they can require device encryption but not specifically SD card. Option E is wrong because device compliance policies do not require a specific MDM authority; they assume Intune.

Answer

Device is enrolled in a specific MDM authority.

Answer

App must have a minimum version.

Answer

SD card encryption is enabled.

Question 12

You deploy a Windows Update for Business policy in Intune. You need to ensure that devices install quality updates within 2 days of release and feature updates within 30 days. Which THREE settings should you configure?

Accepted Answer

Quality update deferral period (days): 2. Options B, D, and E are correct. Quality update deferral period (B) and feature update deferral period (D) set the number of days to wait before offering updates. Quality update deadline (E) forces installation within a set number of days after the update is offered. Option A is wrong because 'Quality update pause' halts updates. Option C is wrong because 'Feature update uninstall period' controls how long users can roll back, not installation.

Answer

Feature update uninstall period (2-60 days): 30

Answer

Quality update pause start date

Question 13

You need to configure Microsoft Defender for Endpoint on macOS devices. Which THREE components must be installed?

Accepted Answer

Microsoft Defender for Endpoint daemon. Options B, C, and D are correct. Microsoft Defender for Endpoint on macOS consists of the main daemon (wdavdaemon), the user interface agent, and the kernel extension (or system extension) for real-time protection. Option A is wrong because Microsoft Endpoint Configuration Manager agent is not required for macOS. Option E is wrong because Microsoft Intune management extension is for Windows, not macOS.

Answer

Microsoft Intune management extension

Answer

Configuration Manager client

Question 14

A user reports that their Windows 11 device cannot install a required line-of-business (LOB) app from Company Portal. The app is assigned to the user and shows as 'Available' in Intune. The device is compliant and managed. What is the most likely cause?

Accepted Answer

The Company Portal app on the device is outdated.. Option C is correct because the Company Portal app on the device might be outdated, causing it to not display the app correctly. Option A is wrong because the user is assigned the app. Option B is wrong because the device is compliant. Option D is wrong because the app is assigned.

Answer

The app is not assigned to the user.

Answer

The app is not assigned to the device group.

Answer

The device is non-compliant with security policies.

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically install critical updates from Windows Update for Business within 3 days of release. Which configuration should you use?

Accepted Answer

Update rings for Windows 10 and later. Option B is correct because 'Update rings' in Intune allow you to configure deferral periods for quality updates. Option A is wrong because Windows Autopatch is for automated patching but not for deferral periods. Option C is wrong because Feature updates are for feature updates, not quality updates. Option D is wrong because Windows 10/11 device configuration policies do not directly manage update rings.

Answer

Windows Autopatch deployment policy

Answer

Windows feature update policy

Answer

Device configuration policy for Windows 10/11