MD-102 Protect devices — Timed 10 Questions

Question 1

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. Option B is correct because forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration. Option D is wrong because the device is already joined.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 2

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. Option C is correct because the 'Data transfer' settings control how data can be moved between apps, including preventing transfer to unmanaged apps. Option A is wrong because jailbreak detection is a device condition, not an app-level data protection. Option B is wrong because device PIN is a device-level policy. Option D is wrong because app PIN is for access control, not data transfer.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 3

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. Option D is correct because 'Inactive' status often indicates that the sensor data is not being sent, which can be resolved by restarting the Microsoft Defender for Endpoint service. Option A is wrong because the issue is not with the onboarding script. Option B is wrong because modifying a policy is not needed for activation. Option C is wrong because reinstallation is excessive.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 4

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.. Option B is correct because Conditional Access can enforce device compliance for cloud apps like Exchange Online. Option A is wrong because App Protection Policies are for mobile apps, not Outlook desktop. Option C is wrong because Compliance Policies alone don't enforce access; they need Conditional Access. Option D is wrong because device enrollment is a prerequisite, not the enforcement mechanism.

Answer

Enable App Protection Policies for Outlook for Windows.

Answer

Require all devices to be enrolled in Intune before accessing email.

Answer

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Question 5

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. Option C is correct because if the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 6

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. Option A is correct because the Autopilot profile determines the join type; setting it to 'Azure AD joined' ensures the device is joined, not registered. Option B is wrong for the same reason. Option C is wrong because enrollment restrictions affect user enrollment, not the join type. Option D is wrong because the domain join profile is for hybrid scenarios.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.

Question 7

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. Option D is correct because the Microsoft Defender for Endpoint portal provides detailed incident investigation tools, including the attack timeline and initial access vector. Option A is wrong because Event Viewer alone lacks the context of Defender detections. Option B is wrong because Intune compliance reports do not contain threat data. Option C is wrong because Sysinternals is not integrated with Microsoft 365 Defender.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.

Question 8

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Option D is correct because enterprise-signed LOB apps can be added as an iOS LOB app in Intune and deployed to devices. Option A is wrong because the App Store is for public apps. Option B is wrong because Apple Business Manager is for volume purchasing, not LOB distribution. Option C is wrong because the app is already signed; a signing certificate is not needed.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 9

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Option C is correct because the sensor can become disconnected if malware is interfering; running a scan can detect and remove it. Option A is wrong because the issue is not enrollment. Option B is wrong because reinstallation is excessive. Option D is wrong because macOS does not have a Windows Security app.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 10

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Accepted Answer

Retire (selective wipe). Option B and Option D are correct. A remote wipe resets the device to factory settings, and a retire removes corporate data while keeping personal data. Option A is wrong because a remote lock only locks the device. Option C is wrong because a device delete just removes the device from management without wiping. Option E is wrong because a factory reset is a user action, not an Intune action.

Answer

Factory reset from Windows Settings

Answer

Remote lock

Answer

Delete device from Intune