MD-102 Protect devices Practice Test 6 — 15 Questions

Question 1

Which THREE features are available in Microsoft Intune for managing Windows 10/11 device updates?

Accepted Answer

Update rings for Windows 10 and later. Update rings for Windows 10 and later (option B) are a core Intune feature that allows administrators to configure Windows Update for Business settings, such as deferral periods, pause windows, and update deadlines, and then assign these policies to groups of devices. This enables controlled rollout and compliance management of quality and feature updates directly from the cloud without requiring on-premises infrastructure.

Answer

Windows Update for Business

Answer

Windows Server Update Services (WSUS)

Question 2

Which TWO compliance settings can be configured in Microsoft Intune for Android devices?

Accepted Answer

Minimum OS version. The 'Minimum OS version' compliance setting in Microsoft Intune allows administrators to define a minimum Android operating system version that devices must meet to be considered compliant. This is a standard compliance policy rule that helps ensure devices run a supported and secure OS level, reducing exposure to known vulnerabilities.

Answer

Device is not jailbroken

Answer

Require a specific screen lock type

Answer

Require antivirus to be installed

Question 3

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running build 10.0.22621.1000. The device has BitLocker enabled, Secure Boot enabled, and code integrity enabled. The device is compliant?

Accepted Answer

No, the device's OS version exceeds the maximum allowed.. The compliance policy specifies a maximum OS version of 10.0.22621.0, but the device runs build 10.0.22621.1000, which is higher. Therefore, the device is non-compliant due to exceeding the allowed OS version range, regardless of other security settings.

Answer

No, the device does not have a password set.

Answer

Yes, the device meets all requirements.

Answer

Yes, but only if the device is Windows 10 Pro.

Question 4

Refer to the exhibit. An administrator runs this PowerShell command using the Microsoft Graph PowerShell SDK. The output returns no devices. However, the administrator knows that there are non-compliant Windows devices in Intune. What is the most likely reason?

Accepted Answer

The cmdlet requires the -All parameter to return all devices.. The Get-MgDeviceManagementManagedDevice cmdlet from the Microsoft Graph PowerShell SDK, by default, returns only the first 100 devices. When a filter is applied and no devices are returned despite known non-compliant devices existing, the most common cause is that the result set is truncated. Adding the -All parameter forces the cmdlet to page through all results and return the complete set of devices, including those that match the filter.

Answer

The filter string is case-sensitive and should be 'windows' in lowercase.

Answer

The -Filter parameter is not supported for this cmdlet.

Answer

The admin does not have the required permissions to read device compliance.

Question 5

Refer to the exhibit. You deploy this endpoint protection configuration to a Windows 10 device. A user reports that they cannot connect to the device via RDP. What is the most likely cause?

Accepted Answer

The firewall rule 'Allow RDP' is configured to block traffic.. The exhibit shows that the 'Allow RDP' firewall rule has its 'Action' set to 'Block', which overrides any other configuration. Windows Defender Firewall processes rules in order of priority, and a block action explicitly denies inbound RDP traffic (TCP port 3389), preventing any RDP connection to the device. This is the most direct cause of the user's inability to connect via RDP.

Answer

The firewall rule is for outbound traffic, not inbound.

Answer

The malware actions are blocking RDP traffic.

Answer

The firewall rule 'Allow RDP' is configured to allow traffic.

Question 6

You are deploying Windows 10 devices using Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are blocked from bypassing the sign-in screen by clicking 'Skip for now'. Which setting should you configure in the Enrollment Status Page (ESP) profile?

Accepted Answer

Block user from signing in automatically. The correct setting is 'Block user from signing in automatically' in the Enrollment Status Page (ESP) profile. This setting prevents users from bypassing the sign-in screen by clicking 'Skip for now' during OOBE. When enabled, the device forces the user to complete authentication before proceeding, ensuring proper enrollment.

Answer

Block Windows Setup page

Answer

Require device compliance

Answer

Block device setup failure

Question 7

You manage Windows 10 devices with Microsoft Intune. A user reports that a device has a red shield icon in the Windows Security Center, indicating tamper protection is off. You need to re-enable tamper protection on the device using Intune. Which profile type should you configure?

Accepted Answer

Endpoint protection profile (Microsoft Defender Antivirus). Tamper protection is a Microsoft Defender Antivirus setting that prevents unauthorized changes to security features. In Intune, this setting is configured under the 'Endpoint protection profile' using the 'Microsoft Defender Antivirus' template, specifically via the 'Enable tamper protection to prevent Microsoft Defender being disabled' toggle. This profile type directly manages Defender settings, including tamper protection, and applies them to enrolled Windows 10 devices.

Answer

Device configuration profile (settings catalog)

Answer

Security baseline (Windows 10/11)

Answer

Compliance policy

Question 8

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?

Accepted Answer

Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'. Microsoft Defender for Endpoint (MDE) automatically tags devices with a 'HighThreat' security tag when they reach a high threat level. You can create a dynamic device group in Microsoft Entra ID using a rule that queries `device.securityTags -contains 'HighThreat'`, which will automatically include any device that receives this tag from MDE. This group can then be targeted with a compliance policy in Intune to mark those devices as non-compliant, enabling automated remediation or conditional access blocking.

Answer

Create a security group in Microsoft Entra ID and manually add devices with high threat

Answer

Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy

Answer

Create a dynamic device group in Microsoft Intune using a rule based on threat level

Question 9

You have devices enrolled in Microsoft Intune. You need to configure a policy that requires a PIN of at least 6 characters for accessing Microsoft Entra ID resources. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies (Option B) can require a PIN for accessing Microsoft Entra ID resources. Option A is incorrect because device compliance policies evaluate device health but do not enforce PIN requirements for resource access. Option C is incorrect because app protection policies manage app-level data protection, not PIN requirements for Entra ID access. Option D is incorrect because device configuration policies manage device settings like email profiles, not access policies.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration policy

Question 10

Your organization uses Windows Autopilot and Microsoft Intune. You need to ensure that during the Autopilot deployment, the device automatically installs a set of required applications (Microsoft 365 Apps, company portal, and a line-of-business app) before the user can access the desktop. Which configuration should you use?

Accepted Answer

Configure the Enrollment Status Page (ESP) to block device use until required apps are installed. The Enrollment Status Page (ESP) in Windows Autopilot can be configured to block device use until specified required apps are installed. This ensures that Microsoft 365 Apps, Company Portal, and line-of-business apps are fully deployed before the user reaches the desktop, meeting the requirement of a controlled, app-ready deployment.

Answer

Set a device compliance policy to require all apps to be installed

Answer

Use a PowerShell script that runs during Autopilot to install apps

Answer

Configure an Autopilot deployment profile with the 'Skip EULA' option

Question 11

You have an Intune-managed device that is not receiving compliance policies. You check the Intune console and see the device status is 'Pending'. The device is connected to the internet and can sync. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune for more than 7 days. A 'Pending' status in Intune often indicates that the device has not checked in for more than 7 days, even if it can sync. Option A is incorrect because an incorrect time zone would not cause a pending status; it might cause other issues but not pending. Option B is incorrect because an expired certificate would typically show an error or conflict status, not pending. Option D is incorrect because the device is connected to the internet and can sync, so network connectivity is not the issue.

Answer

The device's time zone is incorrect

Answer

The device's certificate has expired

Answer

The device is not connected to the internet

Question 12

You need to ensure that Windows 10 devices automatically receive Microsoft Defender antivirus definition updates from Microsoft. Which update channel should you configure in the endpoint protection profile?

Accepted Answer

Microsoft Update. The 'Microsoft Update' channel delivers Microsoft Defender antivirus definition updates directly from Microsoft. Option B is incorrect because Microsoft Update for Business is typically used for feature and quality updates, not specifically for Defender definition updates; the correct channel for automatic definition updates is Microsoft Update. Option C is incorrect because Windows Update is for OS updates, not definition updates. Option D is incorrect because WSUS may delay definition updates.

Answer

Microsoft Update for Business

Answer

Windows Update

Answer

WSUS

Question 13

You have a Windows 10 device that is managed by Intune and enrolled in Microsoft Defender for Endpoint. The device is reporting a high number of false positive detections from Microsoft Defender Antivirus. You need to configure an exclusion for a specific folder path to reduce false positives. Where should you configure the exclusion?

Accepted Answer

In the endpoint protection profile for Microsoft Defender Antivirus in Intune. In an Intune-managed environment, antivirus exclusions for Microsoft Defender Antivirus are configured within the endpoint protection profile, specifically under the Microsoft Defender Antivirus settings. This profile is assigned to devices via Intune policies, allowing centralized management of exclusions without requiring on-premises Group Policy or direct interaction with the Microsoft Defender Security Center portal.

Answer

In a device compliance policy

Answer

In Group Policy

Answer

In Microsoft Defender Security Center

Question 14

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to enforce that all devices use a 6-digit passcode and that the device automatically wipes after 10 failed attempts. Which profile type should you configure?

Accepted Answer

Device restrictions profile (iOS). A Device restrictions profile (iOS) in Microsoft Intune includes the 'Password' category where you can set minimum passcode length (e.g., 6 digits) and the number of failed attempts before the device wipes. This profile type directly manages device-level security settings on iOS/iPadOS, making it the correct choice for enforcing passcode complexity and auto-wipe behavior.

Answer

Device compliance policy

Answer

Device configuration profile (custom)

Answer

App protection policy

Question 15

You are planning a Windows 10 deployment using Windows Autopilot. You need to ensure that devices are automatically enrolled in Intune during the out-of-box experience. Which two prerequisites must be met? (Choose two.)

Accepted Answer

Devices must have a valid Windows 10/11 Pro or Enterprise license. Windows Autopilot requires that devices have a valid Windows 10/11 Pro, Enterprise, or Education license to enable the automatic enrollment into Intune during the out-of-box experience (OOBE). Without a qualifying license, the device cannot be properly provisioned with Intune management policies. Option C is correct because devices must be registered in Microsoft Entra ID (formerly Azure AD) as Autopilot devices, which is typically done by uploading a hardware hash CSV file to the Autopilot deployment portal, allowing the device to be recognized and automatically enrolled during OOBE.

Answer

Tenant must have Microsoft Entra ID P1 or P2

Answer

On-premises Active Directory synchronization must be configured

Answer

Users must have a Microsoft 365 E3 license