MD-102 Protect devices Practice Test 7 — 15 Questions

Question 1

You have a Microsoft Intune environment with devices running Windows 10 and 11. You need to configure a policy that enforces BitLocker drive encryption with a TPM protector and stores recovery key in Microsoft Entra ID. Which three settings must you configure in the endpoint protection profile? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store recovery key in Microsoft Entra ID. The 'Store recovery key in Microsoft Entra ID' setting ensures that the BitLocker recovery key is automatically backed up to the user's Microsoft Entra ID object. This is essential for recovery scenarios and is a key requirement for managing BitLocker via Intune, as it allows administrators to retrieve the key from the Entra admin center.

Answer

Require encryption of OS drive

Answer

Choose encryption method (XTS-AES 128-bit)

Question 2

You are configuring Microsoft Defender for Endpoint for your organization. You need to ensure that devices are onboarded to the service. Which two methods can you use to onboard Windows 10 devices? (Choose two.)

Accepted Answer

Group Policy. Group Policy is correct because it allows you to deploy a Group Policy Object (GPO) that configures the Windows 10 device to automatically download and apply the Defender for Endpoint onboarding package, including the required registry keys and service configuration. This method is ideal for on-premises, Active Directory-joined devices that are not managed by a modern management solution like Intune.

Answer

PowerShell script

Answer

Microsoft Endpoint Manager

Answer

Microsoft Configuration Manager

Question 3

You are reviewing an Intune endpoint protection profile for Windows 10. The exhibit shows a JSON snippet of the configuration. A user reports that a device detected malware with moderate severity, but the action taken was 'quarantine'. However, the desired action is 'clean'. Which setting should you modify?

Accepted Answer

defenderDetectedMalwareActions for moderateSeverity. The `defenderDetectedMalwareActions` setting in Intune endpoint protection profiles allows you to specify the remediation action for each threat severity level, including moderate. Since the user wants 'clean' instead of 'quarantine' for moderate severity threats, you must modify the `moderateSeverity` value within this setting. This is the only setting that controls per-severity remediation actions for Microsoft Defender Antivirus.

Answer

defenderScheduleScanDay and defenderScheduleScanTime

Answer

A global setting to override all actions

Answer

defenderScanType

Question 4

You are troubleshooting a Windows 10 device that is showing as non-compliant in Intune. The exhibit shows the PowerShell output from the Microsoft Graph API. Based on the output, what is the most likely reason for the non-compliance?

Accepted Answer

BitLocker drive encryption is not enabled on the device. The output shows the non-compliance reason is 'RequireEncryption', indicating BitLocker is not enabled. Option A is incorrect because the reason is about encryption, not operating system version. Option C is incorrect because the reason is about encryption, not the Windows version. Option D is incorrect because the reason is about encryption, not antivirus.

Answer

The device does not have a compliant operating system version

Answer

The device is not running a supported version of Windows 10

Answer

The device has a third-party antivirus installed

Question 5

You are reviewing a custom device configuration profile in Intune. The exhibit shows an OMA-URI setting. What is the purpose of this setting?

Accepted Answer

Disables the camera on the lock screen. The OMA-URI setting ./Vendor/MSFT/Policy/Config/DeviceLock/PreventLockScreenCamera is used to disable the camera on the Windows lock screen. This policy prevents users from accessing the camera while the device is locked, enhancing security by mitigating privacy risks such as unauthorized camera use. It does not affect camera functionality once the user logs in.

Answer

Enables the camera on the lock screen

Answer

Disables the camera on the device entirely

Answer

Disables the microphone on the lock screen

Question 6

A user reports that their Windows 11 device cannot access corporate resources after a recent update. The device is enrolled in Intune. You check the device compliance status and find it is marked as non-compliant. Which two actions should you take?

Accepted Answer

Request the user to run the 'Sync' action from the Company Portal. The correct actions are B and D. When a device is marked non-compliant after an update, the user can trigger a manual sync from the Company Portal (option B) to force a compliance check and policy refresh. Additionally, an administrator can run an on-demand compliance check from the Intune console (option D) to immediately re-evaluate the device's status. Option A (Retire) would remove the device from management, and option C (Reset) would wipe the device, both of which are overly drastic for this scenario.

Answer

Perform a 'Retire' action on the device

Answer

Use the 'Reset' action to re-enroll the device

Question 7

Your organization uses Microsoft Defender for Endpoint (now part of Defender XDR) and Intune. You need to create a device compliance policy that triggers automatic remediation when a device has a 'Medium' severity alert from Defender. Which setting should you configure?

Accepted Answer

Configure 'Device threat level' to 'Medium' and mark as noncompliant. The 'Device threat level' compliance policy setting in Intune uses the Defender for Endpoint (Defender XDR) alert severity to mark devices as noncompliant. Setting it to 'Medium' means devices with a medium or higher alert will be flagged. Additional actions can then be triggered via noncompliance actions. Option B is a generic noncompliance action that does not specifically target medium alerts. Option C is a Conditional Access policy, which is separate from compliance policies and would not trigger automatic remediation via Intune compliance. Option D refers to a different, deprecated setting (Machine Risk Score) not used in current Intune compliance policies.

Answer

Set 'Noncompliance action' to 'Mark device noncompliant'

Answer

Create a Conditional Access policy to block devices with medium alerts

Answer

Enable 'Require the device to be at or under the Machine Risk Score'

Question 8

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

Accepted Answer

Microsoft 365 Apps (Windows) configuration policy. The Microsoft 365 Apps (Windows) configuration policy is the correct choice because it is specifically designed to manage the deployment, update settings, and configuration of Microsoft 365 Apps for enterprise on Intune-managed Windows devices. This policy type provides granular control over installation parameters, update channels, and app settings, directly aligning with the requirement to deploy a Microsoft 365 Apps configuration.

Answer

Device configuration profile (settings catalog)

Answer

Managed apps policy

Answer

Windows update ring policy

Question 9

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

Accepted Answer

It uses the password type configured in the device's local policy. When the password type is set to 'deviceDefault' in a Microsoft Intune compliance policy for Windows 10, the policy does not enforce a specific password type (e.g., alphanumeric or numeric). Instead, it defers to the password type already configured in the device's local security policy (via Local Group Policy or the SAM registry). This means the device can still be compliant even if the local policy requires only a simple PIN or no complexity, as long as the local password type meets the minimum length and other requirements defined in the compliance policy.

Answer

It requires a password that meets the minimum length but no complexity

Answer

It does not require a password at all

Answer

It requires a password that contains at least one number and one letter

Question 10

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

Accepted Answer

App protection policy (MAM). App protection policies (MAM) protect corporate data in apps like Outlook without requiring device enrollment in MDM. Option A (Device compliance policy) requires MDM enrollment. Option B (Device configuration profile) is for device settings, not data protection. Option C (Conditional Access policy) controls access but does not directly protect data within apps.

Answer

Device compliance policy

Answer

Device configuration profile

Answer

Conditional Access policy

Question 11

You have a hybrid Microsoft Entra ID joined Windows 10 device that is co-managed with Configuration Manager and Intune. You want Intune to manage Windows Update for Business settings. Which slider setting should you configure in Configuration Manager?

Accepted Answer

Move the slider for 'Windows Update policies' to 'Intune'. In a co-management scenario, workload sliders in Configuration Manager determine which authority manages specific workloads. To have Intune manage Windows Update for Business settings, you must move the slider for 'Windows Update policies' to Intune. This shifts the policy authority from Configuration Manager to Intune, allowing Intune's Update Rings and feature update policies to control Windows Update behavior on the device.

Answer

Move the slider for 'Endpoint protection' to 'Intune'

Answer

Move the slider for 'Resource access' to 'Intune'

Answer

Move the slider for 'Device configuration' to 'Intune'

Question 12

You configure a Windows 10 device compliance policy in Intune that requires 'Firewall' to be enabled. The device has Windows Defender Firewall enabled, but the device reports as non-compliant. You verify that the firewall is active. What is the most likely cause?

Accepted Answer

The firewall is enabled only on the Domain profile but not on Public or Private profiles. Intune compliance policies for firewall require that the firewall is enabled on all network profiles (Domain, Private, Public). If the firewall is only enabled on the Domain profile but not on Public or Private, the device will report as non-compliant. Option A is irrelevant because allowing inbound connections does not affect compliance status. Option B is incorrect because the question states the device uses Windows Defender Firewall, not a third-party firewall. Option D is incorrect because the firewall status per adapter is not checked; the policy checks the firewall status per profile.

Answer

The firewall is configured to allow all inbound connections

Answer

The device uses a third-party firewall that Intune does not recognize

Answer

The device has multiple network adapters and the firewall is disabled on one

Question 13

Which TWO settings can be configured in a Windows 10 device restriction profile in Intune to enhance security?

Accepted Answer

Disable the camera. Options C and D are correct. Disabling the camera (C) reduces the attack surface by preventing unauthorized camera usage, and requiring a password (D) enforces authentication to unlock the device. Option A (BitLocker) is an encryption setting, not a device restriction profile setting. Option B (disable copy/paste) is an app restriction, not a device restriction. Option E (Windows Update for Business) is configured in an update policy, not a device restriction profile.

Answer

Require BitLocker encryption

Answer

Disable copy and paste between apps

Answer

Configure Windows Update for Business settings

Question 14

Which THREE actions can you perform from the Microsoft Intune admin center to remediate a non-compliant Windows device?

Accepted Answer

Retire the device. The Retire action removes the device from Intune management and revokes corporate data access, which is a valid remediation for non-compliant Windows devices when the device cannot be brought back into compliance. This action is performed from the Microsoft Intune admin center under the device's compliance status.

Answer

Remote lock

Answer

Assign a compliance policy

Question 15

Which TWO conditions in a Conditional Access policy can be used to enforce device compliance for access to Microsoft 365 services?

Accepted Answer

Client apps (Browser, Mobile apps and desktop clients). The 'Client apps' condition in a Conditional Access policy allows you to target specific client application types (e.g., browser, mobile apps, and desktop clients) to enforce device compliance. Option E is correct because the 'Device state' condition directly checks whether a device is marked as compliant in Microsoft Intune or is domain-joined (hybrid Azure AD join), which is the primary mechanism for enforcing device compliance for access to Microsoft 365 services.

Answer

Sign-in risk

Answer

Locations (trusted IPs)

Answer

Applications (e.g., Exchange Online)