MD-102 Protect devices Practice Test 5 — 15 Questions

Question 1

You need to configure BitLocker encryption for Windows 10 devices managed by Intune. You create a device configuration profile for endpoint protection. After assigning, devices show 'BitLocker not enabled' in the Intune console. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The devices do not have a TPM chip.. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 to store encryption keys securely. Without a TPM chip, BitLocker cannot be enabled by default, and the Intune console will report 'BitLocker not enabled' even if the endpoint protection profile is correctly assigned. This is the most common hardware prerequisite failure in managed environments.

Answer

The profile is assigned to a user group instead of a device group.

Answer

Secure Boot is not enabled on the devices.

Answer

The devices are running Windows 10 Home edition.

Question 2

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

Accepted Answer

Work profile. The Work profile enrollment type is correct because it creates a separate, managed container on Android Enterprise devices that isolates work apps and data from personal apps and data. This sandboxing is enforced by the Android Enterprise framework, ensuring that work apps cannot access personal data and vice versa, which meets the requirement for separation without requiring full device management.

Answer

Fully managed

Answer

Device administrator

Answer

Corporate-owned personally enabled (COPE)

Question 3

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

Accepted Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}. Option E correctly implements the conditional launch policy. The schema requires 'defenderSensorVersion' with 'minimumVersion' set to the version string, and 'defenderSensorHealth' with 'minimumVersion' set to the numeric value 1 to indicate a healthy state. Option A uses the string 'healthy' instead of numeric 1. Option B uses 'version' and 'state' which are incorrect property names. Option D uses 'clientVersion' and 'clientHealth' which are incorrect. Option C is textually identical to E but is not the designated correct answer. Therefore, only option E is correct.

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": "healthy"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"version": "10.8049.22439.1043"}, "defenderSensorHealth": {"state": "enabled"}}}

Answer

{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

Answer

{"deviceHealth": {"clientVersion": {"minimumVersion": "10.8049.22439.1043"}, "clientHealth": {"minimumVersion": 1}}}

Question 4

Your organization uses Microsoft Intune to manage mobile devices. You need to configure compliance policies that trigger conditional access. Which TWO conditions can be used in a device compliance policy?

Accepted Answer

Minimum OS version is 14.0.. Correct answers are C and D. Device compliance policies in Microsoft Intune can check for conditions like minimum OS version (C) and whether the device is jailbroken or rooted (D). These conditions can trigger conditional access to enforce compliance. Option A is incorrect because compliance policies do not check the MDM authority; they assume Intune. Option B is incorrect because app version requirements are managed via app protection policies, not compliance policies. Option E is incorrect because SD card encryption is not a standard compliance policy setting; device encryption is checked but not specifically SD cards.

Answer

Device is enrolled in a specific MDM authority.

Answer

App must have a minimum version.

Answer

SD card encryption is enabled.

Question 5

You deploy a Windows Update for Business policy in Intune. You need to ensure that devices install quality updates within 2 days of release and feature updates within 30 days. Which THREE settings should you configure?

Accepted Answer

Quality update deferral period (days): 2. The Quality update deferral period (days) setting controls how many days after Microsoft releases a quality update that devices will install it. Setting this to 2 ensures that quality updates are installed within 2 days of release, meeting the requirement.

Answer

Feature update uninstall period (2-60 days): 30

Answer

Quality update pause start date

Question 6

You need to configure Microsoft Defender for Endpoint on macOS devices. Which THREE components must be installed?

Accepted Answer

Microsoft Defender for Endpoint daemon. The Microsoft Defender for Endpoint daemon (mdatp) is the core service that runs in the background on macOS, handling threat detection, real-time protection, and communication with the cloud backend. Without this daemon, the product cannot perform its primary security functions, making it a mandatory component for any installation.

Answer

Microsoft Intune management extension

Answer

Configuration Manager client

Question 7

A user reports that their Windows 11 device cannot install a required line-of-business (LOB) app from Company Portal. The app is assigned to the user and shows as 'Available' in Intune. The device is compliant and managed. What is the most likely cause?

Accepted Answer

The Company Portal app on the device is outdated.. The most likely cause is that the Company Portal app on the device is outdated. When Company Portal is outdated, it may fail to properly communicate with Intune to initiate app installation, even though the app assignment is correct. Option B is incorrect because the app is assigned to the user and shows as 'Available'. Option C is incorrect because the app is assigned to the user, not the device group, but that does not prevent installation; the issue is with Company Portal. Option D is incorrect because the device is compliant.

Answer

The app is not assigned to the user.

Answer

The app is not assigned to the device group.

Answer

The device is non-compliant with security policies.

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically install critical updates from Windows Update for Business within 3 days of release. Which configuration should you use?

Accepted Answer

Update rings for Windows 10 and later. Update rings for Windows 10 and later allow you to configure Windows Update for Business settings, including the ability to set a deadline for quality updates. By configuring the 'Quality update deferral period (days)' to 0 and the 'Deadline for quality updates (days)' to 3, devices are forced to install critical updates within 3 days of release. This is the correct policy to enforce automatic installation of critical updates within a specific timeframe.

Answer

Windows Autopatch deployment policy

Answer

Windows feature update policy

Answer

Device configuration policy for Windows 10/11

Question 9

A company uses Microsoft Defender for Endpoint. They want to automatically remediate threats on endpoints using automated investigation and response. They also need to ensure that the remediation actions are approved by the security team before execution. Which configuration should they use?

Accepted Answer

Enable automated investigation and set 'Approval mode' for remediation actions.. Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities include an 'Approval mode' setting that requires security team approval before any remediation action (e.g., isolating a device, removing a file) is executed. This satisfies the requirement for automatic threat detection and investigation while maintaining human oversight over remediation actions.

Answer

Disable automated investigation and use manual response only.

Answer

Enable automated investigation and allow all actions automatically.

Answer

Enable automated investigation and set remediation level to 'Full - remediate threats automatically'.

Question 10

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Company Portal app from their devices. Which configuration should you apply?

Accepted Answer

Assign the Company Portal app as 'Required' with 'Removable' set to No.. When you assign the Company Portal app as 'Required' for iOS/iPadOS devices in Microsoft Intune, you can set the 'Removable' option to 'No'. This configuration prevents users from uninstalling the Company Portal app, ensuring it remains on the device for management and compliance purposes.

Answer

Assign the Company Portal app as 'Available for enrolled devices' with 'Removable' set to Yes.

Answer

Assign the Company Portal app as 'Uninstall' for all devices.

Answer

Create a device restriction policy that blocks removal of the Company Portal app.

Question 11

A user has a Windows 10 device that is managed by Intune. The device is compliant but the user reports that they cannot access corporate email on their device. The email profile is deployed via Intune. Other users can access email successfully. What should you check first?

Accepted Answer

Check if the user's certificate is valid and assigned.. When an email profile is deployed via Intune and the device is compliant, the most likely cause of a single user's failure to access corporate email is an issue with certificate-based authentication. Intune often uses SCEP or PKCS certificates to authenticate email access, and if the user's certificate is missing, expired, or not properly assigned, the email profile will fail to connect even though the device is compliant and the profile is assigned.

Answer

Check if the email profile is assigned to the user.

Answer

Re-create the email profile for all users.

Answer

Verify device compliance status.

Question 12

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting. You check the BitLocker policy and it is assigned correctly. What is the most likely reason?

Accepted Answer

The device does not have a TPM chip.. BitLocker requires a TPM (Trusted Platform Module) version 1.2 or later to provide hardware-based key storage and integrity verification. If a device lacks a TPM chip, the BitLocker policy will not apply, and encryption will fail silently or remain off, even if the policy is correctly assigned. This is the most common cause of encryption not starting on Windows 10 devices managed by Intune.

Answer

The device is running Windows 10 Home edition.

Answer

The BitLocker policy is not assigned to the users.

Answer

The device is non-compliant and encryption is blocked.

Question 13

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data is separated from personal data on the device. Which management approach should you use?

Accepted Answer

Android Enterprise work profile. Android Enterprise work profile creates a separate container for corporate data, keeping it isolated from personal data on the same device. Android Enterprise fully managed devices are for corporate-owned devices and do not have a personal space. Android Enterprise kiosk mode locks the device to a single app or set of apps, not designed for data separation. Android device administrator is a legacy management method that does not provide data separation.

Answer

Android Enterprise kiosk mode

Answer

Android Enterprise fully managed

Answer

Android device administrator

Question 14

A user has a Windows 11 device that is enrolled in Intune. The device is compliant, but the user cannot install apps from the Company Portal. The Company Portal shows 'This app is not available for your device'. The app is assigned to the user and the device meets the minimum requirements. What should you check?

Accepted Answer

Check if the app supports Windows 11.. The error 'This app is not available for your device' in Company Portal typically indicates that the app's installer or metadata does not list Windows 11 as a supported platform. Even if the device meets minimum hardware requirements, the app must be explicitly configured in Intune to support the Windows 11 platform (e.g., by selecting 'Windows 11' under Supported device types or ensuring the app package is compatible).

Answer

Check if the device meets the minimum OS version.

Answer

Check app assignment to user groups.

Answer

Check device compliance policy.

Question 15

Your organization uses Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive data from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on app and device context. By configuring a session policy with the condition 'Device tag equals Unmanaged' and the control 'Block download', you can automatically block downloads of sensitive data from SharePoint Online to unmanaged devices, leveraging reverse proxy architecture to inspect and intercept traffic.

Answer

Activity policy

Answer

App discovery policy

Answer

Access policy