MD-102 Protect devices Practice Test 6 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?

Accepted Answer

Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'. Option A is correct because dynamic device groups in Microsoft Entra ID can use rules based on device properties, including MDE threat level. Option B is wrong because MDE machine groups are not used for compliance policies. Option C is wrong because Intune groups cannot be dynamic based on MDE threat level. Option D is wrong because security groups are static.

Answer

Create a security group in Microsoft Entra ID and manually add devices with high threat

Answer

Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy

Answer

Create a dynamic device group in Microsoft Intune using a rule based on threat level

Question 2

You have devices enrolled in Microsoft Intune. You need to configure a policy that requires a PIN of at least 6 characters for accessing Microsoft Entra ID resources. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Option C is correct because Conditional Access policies can require a PIN for access to resources. Option A is wrong because compliance policies do not enforce PIN requirements. Option B is wrong because device configuration policies are for device settings, not access policies. Option D is wrong because app protection policies are for mobile app management.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration policy

Question 3

Your organization uses Windows Autopilot and Microsoft Intune. You need to ensure that during the Autopilot deployment, the device automatically installs a set of required applications (Microsoft 365 Apps, company portal, and a line-of-business app) before the user can access the desktop. Which configuration should you use?

Accepted Answer

Configure the Enrollment Status Page (ESP) to block device use until required apps are installed. Option B is correct because the Enrollment Status Page (ESP) can block device use until required apps are installed. Option A is wrong because Autopilot profiles do not control app installation blocking. Option C is wrong because device compliance does not control app installation. Option D is wrong because a PowerShell script is not the best method for this requirement and does not enforce blocking.

Answer

Set a device compliance policy to require all apps to be installed

Answer

Use a PowerShell script that runs during Autopilot to install apps

Answer

Configure an Autopilot deployment profile with the 'Skip EULA' option

Question 4

You have an Intune-managed device that is not receiving compliance policies. You check the Intune console and see the device status is 'Pending'. The device is connected to the internet and can sync. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune for more than 7 days. Option A is correct because a pending status often indicates that the device has not checked in recently. Option B is wrong because a certificate issue would show an error. Option C is wrong because incorrect time zone would not cause pending. Option D is wrong because the device is connected and can sync, so network connectivity is not the issue.

Answer

The device's time zone is incorrect

Answer

The device's certificate has expired

Answer

The device is not connected to the internet

Question 5

You need to ensure that Windows 10 devices automatically receive Microsoft Defender antivirus definition updates from Microsoft. Which update channel should you configure in the endpoint protection profile?

Accepted Answer

Microsoft Update. Option D is correct because the 'Microsoft Update' channel delivers definition updates from Microsoft. Option A is wrong because Windows Update is for OS updates. Option B is wrong because WSUS is for on-premises managed updates. Option C is wrong because Microsoft Update for Business is a service, not a channel in the profile.

Answer

Microsoft Update for Business

Answer

Windows Update

Answer

WSUS

Question 6

You have a Windows 10 device that is managed by Intune and enrolled in Microsoft Defender for Endpoint. The device is reporting a high number of false positive detections from Microsoft Defender Antivirus. You need to configure an exclusion for a specific folder path to reduce false positives. Where should you configure the exclusion?

Accepted Answer

In the endpoint protection profile for Microsoft Defender Antivirus in Intune. Option A is correct because exclusions for Microsoft Defender Antivirus are configured in the endpoint protection profile in Intune. Option B is wrong because compliance policies do not handle exclusions. Option C is wrong because Microsoft Defender Security Center is for security operations, not configuration. Option D is wrong because Group Policy is not used when devices are managed by Intune.

Answer

In a device compliance policy

Answer

In Group Policy

Answer

In Microsoft Defender Security Center

Question 7

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to enforce that all devices use a 6-digit passcode and that the device automatically wipes after 10 failed attempts. Which profile type should you configure?

Accepted Answer

Device restrictions profile (iOS). Option C is correct because device restrictions include passcode policies and wipe settings for iOS. Option A is wrong because compliance policies only mark devices as non-compliant, they do not enforce passcode settings. Option B is wrong because device configuration profiles are a general category, but the specific settings are within device restrictions. Option D is wrong because app protection policies are for app-level data protection.

Answer

Device compliance policy

Answer

Device configuration profile (custom)

Answer

App protection policy

Question 8

You are planning a Windows 10 deployment using Windows Autopilot. You need to ensure that devices are automatically enrolled in Intune during the out-of-box experience. Which two prerequisites must be met? (Choose two.)

Accepted Answer

Devices must have a valid Windows 10/11 Pro or Enterprise license. Options A and C are correct. Autopilot requires devices to have a valid Windows license and be registered in Microsoft Entra ID. Option B is wrong because Azure AD is now Microsoft Entra ID, but the requirement is for the device to be registered, not for the tenant to be premium. Option D is wrong because Autopilot does not require on-premises Active Directory. Option E is wrong because a Microsoft 365 E3 license is not a prerequisite; a Windows license is sufficient.

Answer

Tenant must have Microsoft Entra ID P1 or P2

Answer

On-premises Active Directory synchronization must be configured

Answer

Users must have a Microsoft 365 E3 license

Question 9

You have a Microsoft Intune environment with devices running Windows 10 and 11. You need to configure a policy that enforces BitLocker drive encryption with a TPM protector and stores recovery key in Microsoft Entra ID. Which three settings must you configure in the endpoint protection profile? (Choose three.)

Accepted Answer

Store recovery key in Microsoft Entra ID. Options A, B, and D are correct. To enforce BitLocker with TPM and store recovery key in Entra ID, you need to enable BitLocker, configure TPM as protector, and specify Entra ID as the recovery key storage. Option C is wrong because encryption of OS drive is a separate setting. Option E is wrong because the encryption method does not affect recovery key storage.

Answer

Require encryption of OS drive

Answer

Choose encryption method (XTS-AES 128-bit)

Question 10

You are configuring Microsoft Defender for Endpoint for your organization. You need to ensure that devices are onboarded to the service. Which two methods can you use to onboard Windows 10 devices? (Choose two.)

Accepted Answer

Group Policy. Options A and C are correct. Group Policy and Microsoft Intune are both supported methods for onboarding devices. Option B is wrong because Microsoft Endpoint Manager is a suite that includes Intune, but the specific method is Intune. Option D is wrong because Microsoft Configuration Manager (SCCM) is for on-premises management and is not a direct onboarding method. Option E is wrong because PowerShell can be used for scripting, but it is not a primary onboarding method.

Answer

PowerShell script

Answer

Microsoft Endpoint Manager

Answer

Microsoft Configuration Manager

Question 11

You are reviewing an Intune endpoint protection profile for Windows 10. The exhibit shows a JSON snippet of the configuration. A user reports that a device detected malware with moderate severity, but the action taken was 'quarantine'. However, the desired action is 'clean'. Which setting should you modify?

Accepted Answer

defenderDetectedMalwareActions for moderateSeverity. Option A is correct because the JSON shows 'moderateSeverity': 'quarantine'. To change it to 'clean', modify the defenderDetectedMalwareActions setting. Option B is wrong because scan type does not affect actions. Option C is wrong because schedule does not affect actions. Option D is wrong because it is not a global setting.

Answer

defenderScheduleScanDay and defenderScheduleScanTime

Answer

A global setting to override all actions

Answer

defenderScanType

Question 12

You are troubleshooting a Windows 10 device that is showing as non-compliant in Intune. The exhibit shows the PowerShell output from the Microsoft Graph API. Based on the output, what is the most likely reason for the non-compliance?

Accepted Answer

BitLocker drive encryption is not enabled on the device. Option B is correct because the output shows the non-compliance reason is 'RequireEncryption', indicating BitLocker is not enabled. Option A is wrong because the reason is specifically about encryption. Option C is wrong because the reason is not about antivirus. Option D is wrong because the reason is specific to encryption.

Answer

The device does not have a compliant operating system version

Answer

The device is not running a supported version of Windows 10

Answer

The device has a third-party antivirus installed

Question 13

You are reviewing a custom device configuration profile in Intune. The exhibit shows an OMA-URI setting. What is the purpose of this setting?

Accepted Answer

Disables the camera on the lock screen. Option C is correct because the OMA-URI 'PreventLockScreenCamera' with value '1' disables the camera on the lock screen. Option A is wrong because it disables the camera on the lock screen, not the camera generally. Option B is wrong because it disables the camera, not microphone. Option D is wrong because it disables the camera on the lock screen, not all settings.

Answer

Enables the camera on the lock screen

Answer

Disables the camera on the device entirely

Answer

Disables the microphone on the lock screen

Question 14

You need to ensure that devices enrolled in Microsoft Intune automatically receive Windows quality updates as soon as they are released. Which update ring setting should you configure?

Accepted Answer

Set 'Microsoft product updates' to 'Allow'. Option A is correct. The 'Microsoft product updates' setting, when set to 'Allow', ensures that Windows quality updates are installed. Option B is for feature updates. Option C is for driver updates. Option D is for update deferral periods.

Answer

Set 'Driver update deferral period (days)' to 0

Answer

Set 'Quality update deferral period (days)' to 0

Answer

Set 'Feature update deferral period (days)' to 0

Question 15

A user reports that their Windows 11 device cannot access corporate resources after a recent update. The device is enrolled in Intune. You check the device compliance status and find it is marked as non-compliant. Which two actions should you take?

Accepted Answer

Request the user to run the 'Sync' action from the Company Portal. Option A and C are correct. Option A resets the compliance state to force re-evaluation. Option C triggers a sync to apply any pending policies. Option B is for BitLocker issues. Option D is for device wipe.

Answer

Perform a 'Retire' action on the device

Answer

Use the 'Reset' action to re-enroll the device