MD-102 Protect devices Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint (now part of Defender XDR) and Intune. You need to create a device compliance policy that triggers automatic remediation when a device has a 'Medium' severity alert from Defender. Which setting should you configure?

Accepted Answer

Configure 'Device threat level' to 'Medium' and mark as noncompliant. Option C is correct. The 'Device threat level' compliance setting uses the Defender for Endpoint threat score to mark devices non-compliant. Option A is for integration enablement. Option B is for non-compliance actions. Option D is for conditional access.

Answer

Set 'Noncompliance action' to 'Mark device noncompliant'

Answer

Create a Conditional Access policy to block devices with medium alerts

Answer

Enable 'Require the device to be at or under the Machine Risk Score'

Question 2

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

Accepted Answer

Microsoft 365 Apps (Windows) configuration policy. Option B is correct. Intune uses 'Microsoft 365 Apps (Windows)' configuration policies specifically for Microsoft 365 Apps. Option A is for general app deployment. Option C is for Windows settings. Option D is for device configuration.

Answer

Device configuration profile (settings catalog)

Answer

Managed apps policy

Answer

Windows update ring policy

Question 3

You manage Windows 10 devices with Intune. After deploying a new compliance policy requiring BitLocker, many devices show as non-compliant. You verify that BitLocker is enabled on the system drive. What is the most likely cause?

Accepted Answer

The compliance policy requires 'Encryption' but the device reports 'Encrypted'. Option D is correct. The compliance policy requires reporting of encryption status via a specific setting. Option A is about TPM not being reported correctly. Option B is about recovery key backup. Option C is about other drives.

Answer

BitLocker recovery key is not backed up to Microsoft Entra ID

Answer

The device has multiple drives and BitLocker is not enabled on all

Answer

The device does not have a TPM chip

Question 4

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

Accepted Answer

It uses the password type configured in the device's local policy. Option C is correct. 'deviceDefault' means the device's own password settings are used, which may not enforce the Intune password requirements. Option A is wrong because it does not require a specific type. Option B is incorrect. Option D is incorrect.

Answer

It requires a password that meets the minimum length but no complexity

Answer

It does not require a password at all

Answer

It requires a password that contains at least one number and one letter

Question 5

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

Accepted Answer

App protection policy (MAM). Option B is correct. App protection policies (MAM) protect data in apps without requiring device enrollment. Option A is for MDM. Option C is for compliance. Option D is for device configuration.

Answer

Device compliance policy

Answer

Device configuration profile

Answer

Conditional Access policy

Question 6

You have a hybrid Microsoft Entra ID joined Windows 10 device that is co-managed with Configuration Manager and Intune. You want Intune to manage Windows Update for Business settings. Which slider setting should you configure in Configuration Manager?

Accepted Answer

Move the slider for 'Windows Update policies' to 'Intune'. Option A is correct. The slider for 'Windows Update policies' must be set to 'Intune' to delegate update management. Option B is for device configuration. Option C is for resource access. Option D is for endpoint protection.

Answer

Move the slider for 'Endpoint protection' to 'Intune'

Answer

Move the slider for 'Resource access' to 'Intune'

Answer

Move the slider for 'Device configuration' to 'Intune'

Question 7

You configure a Windows 10 device compliance policy in Intune that requires 'Firewall' to be enabled. The device has Windows Defender Firewall enabled, but the device reports as non-compliant. You verify that the firewall is active. What is the most likely cause?

Accepted Answer

The firewall is enabled only on the Domain profile but not on Public or Private profiles. Option D is correct. The compliance policy may be checking for the firewall profile to be enabled on all network profiles. Option A is not relevant. Option B is about third-party firewall. Option C is about logging.

Answer

The firewall is configured to allow all inbound connections

Answer

The device uses a third-party firewall that Intune does not recognize

Answer

The device has multiple network adapters and the firewall is disabled on one

Question 8

Which TWO settings can be configured in a Windows 10 device restriction profile in Intune to enhance security?

Accepted Answer

Disable the camera. Options A and D are correct. Disabling the camera and requiring a password are security measures. Option B is about updates, not device restrictions. Option C is about encryption. Option E is about copy/paste.

Answer

Require BitLocker encryption

Answer

Disable copy and paste between apps

Answer

Configure Windows Update for Business settings

Question 9

Which THREE actions can you perform from the Microsoft Intune admin center to remediate a non-compliant Windows device?

Accepted Answer

Retire the device. Options A, C, and D are correct. 'Sync' triggers policy refresh, 'Retire' removes the device, and 'Wipe' resets it. Option B is for iOS. Option E is for compliance policy assignment.

Answer

Remote lock

Answer

Assign a compliance policy

Question 10

Which TWO conditions in a Conditional Access policy can be used to enforce device compliance for access to Microsoft 365 services?

Accepted Answer

Client apps (Browser, Mobile apps and desktop clients). Options A and C are correct. 'Device state' includes compliant and domain-joined conditions. 'Client apps' can target specific apps. Option B is about location. Option D is about sign-in risk. Option E is about application.

Answer

Sign-in risk

Answer

Locations (trusted IPs)

Answer

Applications (e.g., Exchange Online)

Question 11

Refer to the exhibit. You deploy this custom OMA-URI policy to Windows 10 devices. What is the expected outcome?

Accepted Answer

Telemetry is set to 0 - Security (Enterprise only). Option A is correct. Setting AllowTelemetry to 0 disables telemetry data collection. Option B is wrong because value 1 enables basic telemetry. Option C is wrong because 0 is not invalid. Option D is wrong because it targets device context.

Answer

Telemetry is set to 1 - Basic

Answer

The policy applies to users, not devices

Answer

The policy fails because value 0 is not allowed

Question 12

Refer to the exhibit. You run a PowerShell command to check the assignment status of device configuration profiles. The 'BitLocker Policy' shows 'Pending'. What does 'Pending' indicate?

Accepted Answer

The policy has been assigned to the device but not yet applied. Option C is correct. 'Pending' means the policy has been assigned but not yet applied to the device. Option A is for errors. Option B is not a status. Option D is for success.

Answer

The policy is waiting for user approval

Answer

The policy assignment failed due to a conflict

Answer

The policy has been successfully applied

Question 13

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to investigate a device. The result shows RiskScore = 0. What does this indicate about the device?

Accepted Answer

The device has no detected threats. Option B is correct. RiskScore 0 means no risk detected. Option A is wrong because 0 does not indicate vulnerability. Option C is wrong because it is not unknown. Option D is wrong because risk score applies to devices.

Answer

The risk score cannot be calculated for this device

Answer

The device is not enrolled in Defender for Endpoint

Answer

The device is highly vulnerable

Question 14

A user reports that their Windows 10 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which of the following is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently.. The device is not syncing with Intune, so compliance policies are not evaluated. Option A is correct because the Intune Management Extension handles policy retrieval and compliance evaluation. Option B is incorrect because BitLocker is not related to policy evaluation. Option C is incorrect because stale policies do not prevent evaluation; the device would still evaluate. Option D is incorrect because the MDM authority is already set to Intune.

Answer

The MDM authority is set to Configuration Manager.

Answer

The compliance policy is set to 'Not applicable' due to OS version.

Answer

BitLocker encryption is enabled on the device.

Question 15

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with a Trusted Platform Module (TPM) version 2.0 and Secure Boot enabled can access corporate email. What should you configure?

Accepted Answer

Create a compliance policy with device health rules.. Compliance policies in Intune can check device health attestation, including TPM and Secure Boot. Option A is correct because a compliance policy with device health rules enforces these requirements. Option B is incorrect because conditional access policies apply after compliance. Option C is incorrect because configuration policies do not enforce access. Option D is incorrect because Windows Hello for Business is for authentication, not device health.

Answer

Configure Windows Hello for Business with TPM requirement.

Answer

Create a conditional access policy that requires compliant device.

Answer

Create a device configuration policy to enable Secure Boot.