MD-102 Protect devices Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. A Windows 10 device shows a compliance state of 'noncompliant'. The last sync was 2 hours ago. The device is managed by Intune (mdm). You have verified that the assigned compliance policy requires a device threat level of 'high' from Microsoft Defender for Endpoint. Which of the following is the most likely cause of non-compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device is not enrolled in Microsoft Defender for Endpoint.. In Intune, when a compliance policy requires a device threat level of 'High', the policy actually requires the device to be at or under that threat level. Therefore, a device with a medium-severity threat would be considered compliant, not noncompliant. Given that the device synced recently and is managed, the most likely cause of noncompliance is that it is not enrolled in Microsoft Defender for Endpoint, so it cannot report any threat level.

Answer

Microsoft Defender for Endpoint reports a medium-severity threat on the device.

Answer

The device OS version is below the minimum required.

Answer

The device has not synced with Intune for over 24 hours.

Question 2

Refer to the exhibit. You have assigned the above compliance policy to a Windows 10 device group. A user reports that their device is non-compliant even though BitLocker is enabled on the system drive. Which of the following is the most likely reason?

Accepted Answer

A removable USB drive is not encrypted with BitLocker.. The compliance policy in the exhibit requires encryption of all drives, not just the system drive. Option D is correct because the policy explicitly includes a setting for 'Encryption of removable drives,' and if a USB drive is not encrypted with BitLocker, the device will be marked non-compliant even if the system drive is fully encrypted.

Answer

BitLocker recovery password rotation is not enabled.

Answer

The device does not have a TPM 2.0 chip.

Answer

The system drive is not encrypted with BitLocker.

Question 3

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that requires devices to run Windows version 22H2 or later. When you create the policy, which option must you select for the OS version requirement?

Accepted Answer

Minimum OS version. The requirement for devices to run Windows version 22H2 or later is a minimum version constraint. In Microsoft Intune compliance policies, the 'Minimum OS version' setting enforces that the device's OS version must be equal to or greater than the specified version, which directly matches the '22H2 or later' condition.

Answer

Require OS version

Answer

Maximum OS version

Answer

Exact OS version

Question 4

Your company deploys Microsoft Defender for Endpoint (Defender XDR) to all Windows devices. You need to create a custom detection rule that triggers an alert when a specific PowerShell script is executed on any device. Which action should you take in the Microsoft 365 Defender portal?

Accepted Answer

Create a new custom detection rule based on an Advanced hunting query.. A is correct because custom detection rules in Microsoft 365 Defender are built from Advanced hunting queries (Kusto Query Language) that can detect specific script execution patterns, such as a PowerShell script with a known command line or hash. This allows you to trigger an alert when the exact script runs, meeting the requirement for a custom detection rule.

Answer

Configure a Device control policy to block PowerShell.

Answer

Add an Indicator of compromise for the script hash.

Answer

Create a new attack simulation training campaign.

Question 5

You manage devices with Microsoft Intune. You need to deploy a Windows 10 feature update to a pilot group of devices. Which profile type should you use?

Accepted Answer

Windows 10 feature update profile. A Windows 10 feature update profile is the correct choice because it is specifically designed to deploy feature updates (e.g., Windows 10 version 22H2) to targeted groups in Intune. Unlike update rings, which control the timing and deferral of updates, a feature update profile pins devices to a specific Windows version and orchestrates the upgrade process for pilot or broad deployments.

Answer

Windows 10 configuration profile

Answer

Windows 10 compliance policy

Answer

Windows 10 update ring profile

Question 6

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that all devices have a passcode of at least 6 characters and that devices are updated to the latest iOS version. You create a compliance policy. After assigning the policy, some devices are marked as non-compliant even though they have a passcode. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune since the policy was assigned.. Intune compliance policies are evaluated only when devices check in with the service. If a device has not performed a check-in since the policy was assigned, it will not have received or evaluated the new policy, and its compliance status will remain based on the previous state. The check-in interval for iOS/iPadOS devices is typically every 8 hours, but can be forced manually by the user. Until the device checks in, it cannot be marked compliant even if it meets the passcode and OS version requirements.

Answer

The devices have multiple compliance policies applied.

Answer

iOS devices do not support compliance policies.

Answer

The policy was assigned to a user group instead of a device group.

Question 7

Your company uses Microsoft Intune for device management. You need to configure a Windows 10 device restriction policy that blocks the use of the camera and microphone on all devices. Which settings should you configure?

Accepted Answer

Camera and Microphone. To block the camera and microphone on Windows 10 devices managed by Microsoft Intune, you configure the 'Camera' and 'Microphone' settings within a device restrictions policy (under the 'General' category). These settings directly disable the corresponding hardware devices at the OS level by modifying the relevant registry keys (e.g., HKLM\SOFTWARE\Policies\Microsoft\Camera\AllowCamera and HKLM\SOFTWARE\Policies\Microsoft\Sound\AllowMicrophone). This ensures that no application can access the camera or microphone, meeting the compliance requirement.

Answer

Bluetooth and Nearby Share

Answer

Copy and paste and Clipboard

Answer

Location and Messaging

Question 8

You need to enroll a Windows 11 device into Microsoft Intune using a work or school account. The device is already joined to Microsoft Entra ID. What is the simplest enrollment method?

Accepted Answer

Automatic enrollment via Microsoft Entra join. Microsoft Entra joined devices automatically enroll in Intune when configured, making it the simplest method. Option A (Windows Autopilot) is wrong because it requires additional setup and is not the simplest. Option B (Group Policy) is wrong because Group Policy is typically used for on-premises devices and not automatic. Option C (Manual enrollment via Company Portal) is wrong because it requires user interaction and is not automatic.

Answer

Windows Autopilot

Answer

Group Policy to configure enrollment

Answer

Manual enrollment using the Company Portal

Question 9

Your company uses Microsoft Defender for Endpoint (Defender XDR). You need to configure an automated investigation and remediation (AIR) rule that automatically quarantines a file when a specific alert is triggered. Which action should you take?

Accepted Answer

Create a new automation rule in the Microsoft 365 Defender portal.. Automated investigation and remediation (AIR) rules in Microsoft 365 Defender allow you to define automated actions—such as quarantining a file—when a specific alert is triggered. This is the native mechanism for orchestrating response actions based on alert conditions, directly supporting the requirement to automatically quarantine a file upon alert generation.

Answer

Add an indicator of compromise for the file.

Answer

Configure a device control policy.

Answer

Create an attack surface reduction rule.

Question 10

You need to ensure that only devices that have a specific set of approved iOS apps can access company resources. Which Intune feature should you use?

Accepted Answer

Device compliance policy with required apps. Device compliance policy with required apps allows you to specify a list of iOS apps that must be installed for a device to be compliant. By combining this with conditional access, you can block non-compliant devices from accessing corporate resources, ensuring that only devices with the approved apps gain access.

Answer

Selective wipe

Answer

App protection policy

Answer

App configuration policy

Question 11

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a PowerShell script that runs in the user context during device enrollment. Which two conditions must be met? (Select TWO.)

Accepted Answer

The script must be assigned to the user scope.. PowerShell scripts deployed via Microsoft Intune that run in the user context must be assigned to user groups (user scope). When a script is assigned to users, it executes under the user's security context during enrollment, allowing access to user-specific resources and settings. Assigning to device groups would run the script in the system context, which does not satisfy the requirement for user-context execution.

Answer

The script must be saved as a .psm1 file.

Answer

The script must be assigned to device groups.

Answer

The script must be added via a custom OMA-URI policy.

Question 12

Your company uses Microsoft Defender for Cloud Apps (Microsoft 365 Defender). You need to create a session policy that monitors and controls access to a specific cloud app. Which three components must you configure? (Select THREE.)

Accepted Answer

Policy template (e.g., block download). Session policies in Microsoft Defender for Cloud Apps require a policy template to define the action to enforce, such as 'block download' or 'monitor only'. The template provides the pre-configured settings for controlling data exfiltration or access behavior during a session, which is essential for the policy to function.

Answer

Conditional Access policy assignment

Answer

Device group assignment

Question 13

You are configuring Microsoft Intune for Windows 10 devices. Which two settings can you enforce using a device restrictions profile? (Select TWO.)

Accepted Answer

Disable the camera. A is correct because the device restrictions profile in Microsoft Intune includes a 'Camera' setting under the 'General' category, which allows you to disable the camera on Windows 10 devices by setting it to 'Block'. This enforces a policy that prevents camera access across all apps and the OS, leveraging the CSP (Policy CSP) `Camera/AllowCamera`.

Answer

Set default web browser

Answer

Set battery saver threshold

Answer

Configure Windows Update for Business settings

Question 14

You review the compliance policy JSON for Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.0) with a numeric-only password of 10 characters, BitLocker enabled, firewall enabled, and Microsoft Defender running reports as non-compliant. What is the most likely reason?

Accepted Answer

The password type is not alphanumeric.. The compliance policy JSON for Windows 10 devices specifies a password type requirement of 'alphanumeric'. The device in question uses a numeric-only password (10 characters), which does not meet the alphanumeric requirement, causing it to be reported as non-compliant. All other conditions—BitLocker enabled, firewall enabled, and Microsoft Defender running—are satisfied, so the password type is the sole issue.

Answer

The OS version is outside the allowed range.

Answer

Storage encryption is not enabled.

Answer

Microsoft Defender is not enabled.

Question 15

You are the endpoint administrator for Contoso Ltd., a global company with 5,000 Windows 11 devices managed by Microsoft Intune. The company has a strict security policy requiring that all devices must have BitLocker Drive Encryption enabled on the operating system drive. Additionally, devices must be compliant with the policy to access corporate resources via Conditional Access. Recently, an audit revealed that 200 devices are non-compliant because BitLocker is not enabled. You investigate and find that these devices are all personal devices enrolled as 'Windows bring your own device' (BYOD). The BitLocker policy is configured as a device configuration profile targeting 'All Devices'. The compliance policy requires 'Storage encryption' to be enabled. You need to resolve the non-compliance for these BYOD devices. What should you do?

Accepted Answer

Upgrade the Windows edition on BYOD devices to Windows Pro or Enterprise.. BitLocker Drive Encryption is only available on Windows Pro, Enterprise, or Education editions. BYOD devices often run Windows Home, which does not support BitLocker. Upgrading to Windows Pro or Enterprise enables BitLocker, resolving the non-compliance. Option A is incorrect because the profile is already assigned to 'All Devices', but it cannot enable BitLocker on unsupported editions. Option C is incorrect as it would bypass the security requirement. Option D is incorrect because compliance policies cannot override device capabilities; they can only require encryption on devices that support it.

Answer

Assign the BitLocker configuration profile to device groups that include BYOD devices.

Answer

Create a separate compliance policy for BYOD devices that does not require storage encryption.

Answer

Configure the compliance policy to mark devices as compliant if BitLocker is not enabled but other settings are met.