MD-102 Protect devices Practice Test 8 — 15 Questions

Question 1

A company uses Microsoft Intune to manage iOS devices. Users report that they cannot install the required Microsoft Defender for Endpoint app from the Company Portal. The app shows as 'Not available' in the Company Portal. Which of the following is the most likely reason?

Accepted Answer

The device is marked as non-compliant with Intune compliance policies.. If the app is assigned as 'Required' but the device is not compliant, the app may not be available. Option A is correct because compliance policies can block app installation. Option B is incorrect because VPP tokens are for volume purchasing, not availability. Option C is incorrect because the Company Portal app is separate. Option D is incorrect because iOS does not have an 'Unknown Sources' setting.

Answer

The app requires a valid Apple VPP token that has expired.

Answer

The Company Portal app version is outdated.

Answer

The device has 'Unknown Sources' enabled.

Question 2

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

Accepted Answer

Device configuration profile for Windows Update for Business. Windows Update for Business settings are configured via device configuration profiles in Intune. Option B is correct because 'Windows Update for Business' is a profile type under 'Update Policies' or 'Device configuration - Windows Update'. Option A is incorrect because compliance policies are for compliance, not updates. Option C is incorrect because app protection policies manage data protection. Option D is incorrect because endpoint security policies include antivirus, not update settings.

Answer

App protection policy

Answer

Device compliance policy

Answer

Endpoint security policy for antivirus

Question 3

A user's Android device is enrolled in Microsoft Intune. The device reports as 'Compliant' but the user cannot access corporate resources that require compliant devices. The conditional access policy is configured to require a compliant device. What is the most likely cause?

Accepted Answer

The conditional access policy requires an approved client app.. Even if the device is compliant, the conditional access policy may also require a specific client app or location. Option C is correct because the conditional access policy might have additional requirements like 'Require approved client app'. Option A is incorrect because the device is compliant. Option B is incorrect because stale compliance is not the issue if it shows compliant. Option D is incorrect because the Company Portal app is not required for access.

Answer

The compliance policy has not been refreshed on the device.

Answer

The user does not have the Company Portal app installed.

Answer

The device is not compliant with the compliance policy.

Question 4

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You want to automatically remediate devices that are found to be missing critical security updates during a vulnerability assessment. What should you configure?

Accepted Answer

Configure automated investigation and remediation in Microsoft Defender for Endpoint.. Microsoft Defender for Endpoint can integrate with Intune to remediate threats. Option D is correct because you can create an automated investigation and remediation policy in MDE that triggers a remediation action on Intune-managed devices. Option A is incorrect because compliance policies can mark non-compliant but not automatically update. Option B is incorrect because update rings require manual assignment. Option C is incorrect because endpoint security policies do not automatically apply updates.

Answer

Assign a Windows Update for Business policy to all devices.

Answer

Create a compliance policy that marks devices as non-compliant if missing updates.

Answer

Configure an endpoint security policy for Windows Defender Antivirus.

Question 5

You need to ensure that only authorized users can enroll devices in Microsoft Intune. Which setting should you configure?

Accepted Answer

Enrollment restrictions. Device enrollment restrictions in Intune allow you to block personal devices or require user approval. Option A is correct because enrollment restrictions can limit who can enroll. Option B is incorrect because device compliance policies apply after enrollment. Option C is incorrect because conditional access policies control access to resources, not enrollment. Option D is incorrect because device categories are for grouping, not blocking enrollment.

Answer

Device categories

Answer

Device compliance policies

Answer

Conditional access policies

Question 6

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a custom PowerShell script that runs during enrollment to configure network settings. What should you use?

Accepted Answer

PowerShell scripts in Microsoft Intune. Intune supports custom scripts via the 'PowerShell scripts' feature under 'Device management'. Option C is correct because you can add a PowerShell script to run during enrollment or at scheduled times. Option A is incorrect because compliance policies do not run scripts. Option B is incorrect because configuration profiles can include OMA-URI settings but not arbitrary scripts. Option D is incorrect because endpoint security policies do not run scripts.

Answer

Device compliance policy

Answer

Device configuration profile with custom OMA-URI

Answer

Endpoint security policy

Question 7

Your organization uses Microsoft Intune with co-management and Configuration Manager. Some Windows 10 devices are enrolled in Intune but also managed by Configuration Manager. You need to ensure that the Intune compliance policy is evaluated and enforced on these devices. What should you configure?

Accepted Answer

Set the Device Compliance workload to Intune in co-management properties.. In co-management, you can set the workload for Device Compliance to 'Intune' or 'Configuration Manager'. Option D is correct because you need to move the compliance workload to Intune. Option A is incorrect because changing MDM authority is not recommended. Option B is incorrect because the client setting does not control workload. Option C is incorrect because the compliance policy is already created; the issue is which management point evaluates it.

Answer

Configure the Configuration Manager client setting to enable compliance evaluation.

Answer

Assign the compliance policy to a device group that includes these devices.

Answer

Change the MDM authority to Intune.

Question 8

Which TWO of the following are valid enrollment methods for Windows 10 devices in Microsoft Intune?

Accepted Answer

Windows Autopilot. Azure AD Join and Autopilot are valid enrollment methods. Option A is correct because Azure AD Join is a standard enrollment. Option B is correct because Windows Autopilot is a zero-touch enrollment method. Option C is incorrect because 'Device enrollment manager' is a role, not a method. Option D is incorrect because 'Bulk enrollment' is not a method but a process using provisioning packages. Option E is incorrect because 'Apple Business Manager' is for iOS/macOS.

Answer

Device enrollment manager (DEM)

Answer

Bulk enrollment with provisioning package

Answer

Apple Business Manager

Question 9

Which THREE of the following are features of Microsoft Defender for Endpoint that help protect devices?

Accepted Answer

Attack surface reduction rules. Attack surface reduction, next-generation protection, and endpoint detection and response are core features. Option A is correct because attack surface reduction rules reduce vulnerabilities. Option B is correct because next-generation protection includes antivirus. Option C is correct because EDR detects and responds to threats. Option D is incorrect because 'Conditional access' is a Microsoft Entra ID feature. Option E is incorrect because 'Data loss prevention' is a Microsoft Purview feature.

Answer

Data loss prevention

Answer

Conditional access policies

Question 10

Which TWO of the following are required to configure Windows Hello for Business using Microsoft Intune?

Accepted Answer

A Trusted Platform Module (TPM) chip on the device. A trusted TPM and a key trust model are required. Option A is correct because Windows Hello for Business requires a TPM for hardware-based key protection. Option B is correct because the key trust model is one of the trust models required for deployment. Option C is incorrect because Azure AD Premium P1 is not required. Option D is incorrect because certificate-based authentication is optional. Option E is incorrect because the Company Portal is not required for configuration.

Answer

Company Portal app installed

Answer

Azure AD Premium P1 licenses

Answer

Certificate-based authentication

Question 11

Refer to the exhibit. A Windows 10 device is enrolled in Intune and has the above compliance policy assigned. The device reports as non-compliant. The device has TPM version 2.0, Secure Boot enabled, and a password of 8 characters. Which of the following is the most likely reason for non-compliance?

Accepted Answer

The OS version is outside the allowed range.. The policy requires the OS version to be between 10.0.19041.0 and 10.0.19045.0. If the device has a newer OS version like 10.0.19046.0, it would exceed the maximum. Option D is correct because the device may have an OS version outside the range. Option A is incorrect because the device has TPM. Option B is incorrect because Secure Boot is enabled. Option C is incorrect because the password length meets the minimum.

Answer

The device does not have a TPM chip.

Answer

Secure Boot is not enabled.

Answer

The password length is less than 6 characters.

Question 12

Refer to the exhibit. A Windows 10 device shows a compliance state of 'noncompliant'. The last sync was 2 hours ago. The device is managed by Intune (mdm). You have verified that the assigned compliance policy requires a device threat level of 'high' from Microsoft Defender for Endpoint. Which of the following is the most likely cause of non-compliance?

Accepted Answer

Microsoft Defender for Endpoint reports a medium-severity threat on the device.. The device threat protection required security level is 'high', meaning the device must have no active threats at medium or high. If Defender for Endpoint reports a medium threat, the device will be non-compliant. Option B is correct. Option A is incorrect because the device synced recently. Option C is incorrect because the device is enrolled. Option D is incorrect because the OS version is not mentioned in the exhibit.

Answer

The device OS version is below the minimum required.

Answer

The device has not synced with Intune for over 24 hours.

Answer

The device is not enrolled in Microsoft Defender for Endpoint.

Question 13

Refer to the exhibit. You have assigned the above compliance policy to a Windows 10 device group. A user reports that their device is non-compliant even though BitLocker is enabled on the system drive. Which of the following is the most likely reason?

Accepted Answer

A removable USB drive is not encrypted with BitLocker.. The policy requires encryption of removable drives as well (bitLockerRemovableDrivesEncryptionRequired). If the user has a USB drive that is not encrypted, the device will be non-compliant. Option C is correct. Option A is incorrect because the policy does not require a specific TPM version. Option B is incorrect because the system drive is encrypted. Option D is incorrect because recovery password rotation does not affect compliance.

Answer

BitLocker recovery password rotation is not enabled.

Answer

The device does not have a TPM 2.0 chip.

Answer

The system drive is not encrypted with BitLocker.

Question 14

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that requires devices to run Windows version 22H2 or later. When you create the policy, which option must you select for the OS version requirement?

Accepted Answer

Minimum OS version. Option C is correct because the 'Minimum OS version' setting checks that the OS version is at least the specified value. Option A is wrong because 'Require' is not a version setting. Option B is wrong because 'Maximum OS version' allows versions up to a value, not above. Option D is wrong because 'Exact OS version' requires a single version, not a minimum.

Answer

Require OS version

Answer

Maximum OS version

Answer

Exact OS version

Question 15

Your company deploys Microsoft Defender for Endpoint (Defender XDR) to all Windows devices. You need to create a custom detection rule that triggers an alert when a specific PowerShell script is executed on any device. Which action should you take in the Microsoft 365 Defender portal?

Accepted Answer

Create a new custom detection rule based on an Advanced hunting query.. Option B is correct because custom detection rules are created using Advanced hunting queries. Option A is wrong because custom detection rules are not created with attack simulation training. Option C is wrong because Indicators of compromise are for blocking or allowing, not creating detection rules. Option D is wrong because policies are for settings, not custom detections.

Answer

Configure a Device control policy to block PowerShell.

Answer

Add an Indicator of compromise for the script hash.

Answer

Create a new attack simulation training campaign.