MD-102 Protect devices Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. You deploy this custom OMA-URI policy to Windows 10 devices. What is the expected outcome?

Accepted Answer

Telemetry is set to 0 - Security (Enterprise only). The OMA-URI policy sets the 'AllowTelemetry' value to 0, which in Windows 10 corresponds to the 'Security (Enterprise only)' telemetry level. This level sends only essential security data, such as the Malicious Software Removal Tool (MSRT) and Windows Defender information, and is only available in Enterprise editions. Therefore, the expected outcome is that telemetry is set to 0 - Security (Enterprise only).

Answer

Telemetry is set to 1 - Basic

Answer

The policy applies to users, not devices

Answer

The policy fails because value 0 is not allowed

Question 2

Refer to the exhibit. You run a PowerShell command to check the assignment status of device configuration profiles. The 'BitLocker Policy' shows 'Pending'. What does 'Pending' indicate?

Accepted Answer

The policy has been assigned to the device but not yet applied. In Microsoft Intune, when a device configuration profile shows a status of 'Pending', it means the policy has been successfully assigned to the device in the cloud but has not yet been applied or reported back as compliant. This is a normal transitional state that occurs while the device checks in with the Intune service, downloads the policy, and applies it during the next sync cycle. The 'Pending' status does not indicate failure, conflict, or user approval requirements.

Answer

The policy is waiting for user approval

Answer

The policy assignment failed due to a conflict

Answer

The policy has been successfully applied

Question 3

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to investigate a device. The result shows RiskScore = 0. What does this indicate about the device?

Accepted Answer

The device has no detected threats. In Microsoft Defender XDR, the RiskScore property (0–100) reflects the device's vulnerability level based on active threats and exposures. A RiskScore of 0 indicates that no threats or vulnerabilities have been detected on the device, meaning it is currently clean. This aligns with option D being correct because the absence of detected threats results in the lowest possible risk score.

Answer

The risk score cannot be calculated for this device

Answer

The device is not enrolled in Defender for Endpoint

Answer

The device is highly vulnerable

Question 4

A user reports that their Windows 10 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which of the following is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently.. A device must check in with Intune to receive and report compliance policies. The 'Not evaluated' status indicates that Intune has not received a recent health check from the device. The default check-in interval is approximately 8 hours, but it can be forced manually via Settings > Accounts > Access work or school > Info > Sync or by running the command 'dsregcmd /sync'.

Answer

The MDM authority is set to Configuration Manager.

Answer

The compliance policy is set to 'Not applicable' due to OS version.

Answer

BitLocker encryption is enabled on the device.

Question 5

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with a Trusted Platform Module (TPM) version 2.0 and Secure Boot enabled can access corporate email. What should you configure?

Accepted Answer

Create a compliance policy with device health rules.. To ensure devices meet TPM 2.0 and Secure Boot requirements, create an Intune compliance policy with device health rules. This policy evaluates device health and marks devices compliant only when they meet the configured hardware requirements. Windows Hello for Business (Option B) is a passwordless sign-in method and does not restrict corporate email access based on Secure Boot or TPM. Option C is incorrect because a conditional access policy only enforces an existing compliance state and does not define the TPM/Secure Boot health rules. Option D is incorrect because a device configuration policy applies settings but does not enforce compliance for accessing corporate email.

Answer

Configure Windows Hello for Business with TPM requirement.

Answer

Create a conditional access policy that requires compliant device.

Answer

Create a device configuration policy to enable Secure Boot.

Question 6

A company uses Microsoft Intune to manage iOS devices. Users report that they cannot install the required Microsoft Defender for Endpoint app from the Company Portal. The app shows as 'Not available' in the Company Portal. Which of the following is the most likely reason?

Accepted Answer

The device is marked as non-compliant with Intune compliance policies.. When a device is marked as non-compliant with Intune compliance policies, the Company Portal will display required apps as 'Not available' because Intune blocks the installation of required apps on non-compliant devices to enforce security baselines. This behavior is controlled by the 'Mark devices with no compliance policy as' setting and the 'Action for noncompliance' configuration, which can block app deployment until the device is remediated.

Answer

The app requires a valid Apple VPP token that has expired.

Answer

The Company Portal app version is outdated.

Answer

The device has 'Unknown Sources' enabled.

Question 7

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

Accepted Answer

Device configuration profile for Windows Update for Business. Windows Update for Business (WUfB) policies are configured using a device configuration profile in Microsoft Intune, specifically under the 'Windows Update for Business' template. This profile type allows you to manage update settings such as deferral periods, pause updates, and feature update targeting directly from Intune without requiring on-premises WSUS or additional infrastructure.

Answer

App protection policy

Answer

Device compliance policy

Answer

Endpoint security policy for antivirus

Question 8

A user's Android device is enrolled in Microsoft Intune. The device reports as 'Compliant' but the user cannot access corporate resources that require compliant devices. The conditional access policy is configured to require a compliant device. What is the most likely cause?

Accepted Answer

The conditional access policy requires an approved client app.. Even if the device reports as compliant, the conditional access policy may have additional requirements, such as requiring an approved client app (option C). Option C is correct because the policy might require both a compliant device and an approved client app. Option A is incorrect because the compliance policy not being refreshed would typically cause the device to show as non-compliant, not compliant. Option B is incorrect because the Company Portal app is not required for access; it's used for enrollment and management. Option D is incorrect because the device is reported as compliant, so non-compliance is not the issue.

Answer

The compliance policy has not been refreshed on the device.

Answer

The user does not have the Company Portal app installed.

Answer

The device is not compliant with the compliance policy.

Question 9

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You want to automatically remediate devices that are found to be missing critical security updates during a vulnerability assessment. What should you configure?

Accepted Answer

Configure automated investigation and remediation in Microsoft Defender for Endpoint.. Microsoft Defender for Endpoint's automated investigation and remediation capabilities can be configured to automatically respond to vulnerabilities detected during assessments, including missing critical security updates. This leverages the built-in threat and vulnerability management (TVM) module to trigger remediation actions without manual intervention, aligning with the requirement for automatic remediation.

Answer

Assign a Windows Update for Business policy to all devices.

Answer

Create a compliance policy that marks devices as non-compliant if missing updates.

Answer

Configure an endpoint security policy for Windows Defender Antivirus.

Question 10

You need to ensure that only authorized users can enroll devices in Microsoft Intune. Which setting should you configure?

Accepted Answer

Enrollment restrictions. Device enrollment restrictions in Intune allow you to block personal devices or require user approval. Option A is correct because enrollment restrictions can limit who can enroll. Option B is incorrect because device compliance policies apply after enrollment. Option C is incorrect because conditional access policies control access to resources, not enrollment. Option D is incorrect because device categories are for grouping, not blocking enrollment.

Answer

Device categories

Answer

Device compliance policies

Answer

Conditional access policies

Question 11

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom PowerShell script that runs during enrollment to configure network settings. What should you use?

Accepted Answer

PowerShell scripts in Microsoft Intune. Microsoft Intune's built-in PowerShell scripts feature allows you to upload and run PowerShell scripts during device enrollment or on a schedule, which is exactly what is needed to configure network settings on Windows 11 devices. This feature executes scripts in the system context, making it suitable for network configuration tasks that require administrative privileges.

Answer

Device compliance policy

Answer

Device configuration profile with custom OMA-URI

Answer

Endpoint security policy

Question 12

Which TWO of the following are valid enrollment methods for Windows 10 devices in Microsoft Intune?

Accepted Answer

Windows Autopilot. Windows Autopilot (Option A) is a valid enrollment method that enables zero-touch deployment and automatic enrollment of Windows 10 devices into Intune. Azure AD Join (Option B) is also a valid method, where devices are joined directly to Azure AD and automatically enrolled in Intune for management. Option C is incorrect: Device Enrollment Manager (DEM) is an administrative role used for bulk enrollment, not an enrollment method itself. Option D is incorrect: Bulk enrollment using a provisioning package is a method for enrolling many devices at once, but it is not listed as a distinct enrollment method like Autopilot or Azure AD Join in this context. Option E is incorrect because Apple Business Manager is designed for enrolling Apple devices (iOS, iPadOS, macOS), not Windows 10 devices.

Answer

Device enrollment manager (DEM)

Answer

Bulk enrollment with provisioning package

Answer

Apple Business Manager

Question 13

Which THREE of the following are features of Microsoft Defender for Endpoint that help protect devices?

Accepted Answer

Attack surface reduction rules. Attack surface reduction rules (A) are a feature of Microsoft Defender for Endpoint that help protect devices by applying configurable rules to block behaviors commonly used by malware, such as Office macro execution, script obfuscation, and credential theft. These rules reduce the attack surface by preventing malicious actions at the process level, leveraging Windows Defender Antivirus and the Microsoft Defender for Endpoint cloud service.

Answer

Data loss prevention

Answer

Conditional access policies

Question 14

Which TWO of the following are required to configure Windows Hello for Business using Microsoft Intune?

Accepted Answer

A Trusted Platform Module (TPM) chip on the device. A Trusted Platform Module (TPM) chip is required to provide hardware-based key protection for Windows Hello for Business. Additionally, a key trust model must be configured in Intune to manage the public keys. The Company Portal app is not required; it is used for enrollment but not specifically for Windows Hello configuration. Azure AD Premium P1 licenses are not required for Windows Hello for Business; they are needed for other features like Conditional Access. Certificate-based authentication is optional and not a requirement.

Answer

Company Portal app installed

Answer

Azure AD Premium P1 licenses

Answer

Certificate-based authentication

Question 15

Refer to the exhibit. A Windows 10 device is enrolled in Intune and has the above compliance policy assigned. The device reports as non-compliant. The device has TPM version 2.0, Secure Boot enabled, and a password of 8 characters. Which of the following is the most likely reason for non-compliance?

Accepted Answer

The OS version is outside the allowed range.. The compliance policy likely specifies a minimum OS version requirement, such as Windows 10 22H2 or a specific build number. Since the device reports as non-compliant despite meeting TPM 2.0, Secure Boot, and password length requirements, the most probable cause is that the OS version is below the allowed minimum. Intune evaluates OS version against the 'Minimum OS version' setting in the compliance policy, and failure to meet this threshold results in non-compliance.

Answer

The device does not have a TPM chip.

Answer

Secure Boot is not enabled.

Answer

The password length is less than 6 characters.