MD-102 Protect devices — Timed 40 Questions

Question 1

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. Option B is correct because forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration. Option D is wrong because the device is already joined.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 2

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

Accepted Answer

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.. Option C is correct because the 'Data transfer' settings control how data can be moved between apps, including preventing transfer to unmanaged apps. Option A is wrong because jailbreak detection is a device condition, not an app-level data protection. Option B is wrong because device PIN is a device-level policy. Option D is wrong because app PIN is for access control, not data transfer.

Answer

Configure device compliance policy to require jailbreak detection.

Answer

Configure device configuration profile to require device PIN.

Answer

Configure App Protection Policy to require app PIN.

Question 3

You are implementing Microsoft Defender for Endpoint on Windows Server devices managed by Microsoft Intune. After onboarding, the devices show as 'Inactive' in the Microsoft Defender XDR portal. Which action should you take?

Accepted Answer

Restart the Microsoft Defender for Endpoint service on the devices.. Option D is correct because 'Inactive' status often indicates that the sensor data is not being sent, which can be resolved by restarting the Microsoft Defender for Endpoint service. Option A is wrong because the issue is not with the onboarding script. Option B is wrong because modifying a policy is not needed for activation. Option C is wrong because reinstallation is excessive.

Answer

Modify the Windows Security app configuration policy to enable real-time protection.

Answer

Re-run the onboarding script on the devices.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 4

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.. Option B is correct because Conditional Access can enforce device compliance for cloud apps like Exchange Online. Option A is wrong because App Protection Policies are for mobile apps, not Outlook desktop. Option C is wrong because Compliance Policies alone don't enforce access; they need Conditional Access. Option D is wrong because device enrollment is a prerequisite, not the enforcement mechanism.

Answer

Enable App Protection Policies for Outlook for Windows.

Answer

Require all devices to be enrolled in Intune before accessing email.

Answer

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Question 5

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

Accepted Answer

The work profile was not created or was removed on the device.. Option C is correct because if the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one. Option D is wrong because compliance policies don't affect app visibility.

Answer

The device is not connected to the internet.

Answer

The device is not compliant with corporate policies.

Answer

The corporate apps are not assigned to the user.

Question 6

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

Accepted Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.. Option A is correct because the Autopilot profile determines the join type; setting it to 'Azure AD joined' ensures the device is joined, not registered. Option B is wrong for the same reason. Option C is wrong because enrollment restrictions affect user enrollment, not the join type. Option D is wrong because the domain join profile is for hybrid scenarios.

Answer

Add the device to a hybrid Azure AD join profile.

Answer

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Answer

Modify the enrollment restrictions to block personally owned devices.

Question 7

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

Accepted Answer

Microsoft Defender XDR incident investigation timeline.. Option D is correct because the Microsoft Defender for Endpoint portal provides detailed incident investigation tools, including the attack timeline and initial access vector. Option A is wrong because Event Viewer alone lacks the context of Defender detections. Option B is wrong because Intune compliance reports do not contain threat data. Option C is wrong because Sysinternals is not integrated with Microsoft 365 Defender.

Answer

Microsoft Sysinternals Process Monitor logs.

Answer

Microsoft Intune compliance reports.

Answer

Windows Event Viewer logs on the device.

Question 8

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Option D is correct because enterprise-signed LOB apps can be added as an iOS LOB app in Intune and deployed to devices. Option A is wrong because the App Store is for public apps. Option B is wrong because Apple Business Manager is for volume purchasing, not LOB distribution. Option C is wrong because the app is already signed; a signing certificate is not needed.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 9

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

Accepted Answer

Run a full scan using Microsoft Defender for Endpoint on the affected devices.. Option C is correct because the sensor can become disconnected if malware is interfering; running a scan can detect and remove it. Option A is wrong because the issue is not enrollment. Option B is wrong because reinstallation is excessive. Option D is wrong because macOS does not have a Windows Security app.

Answer

Check the Windows Security app for any alerts.

Answer

Re-enroll the devices in Microsoft Intune.

Answer

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Question 10

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Accepted Answer

Retire (selective wipe). Option B and Option D are correct. A remote wipe resets the device to factory settings, and a retire removes corporate data while keeping personal data. Option A is wrong because a remote lock only locks the device. Option C is wrong because a device delete just removes the device from management without wiping. Option E is wrong because a factory reset is a user action, not an Intune action.

Answer

Factory reset from Windows Settings

Answer

Remote lock

Answer

Delete device from Intune

Question 11

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Accepted Answer

Devices must be enrolled in Microsoft Intune.. Option A, Option B, and Option C are correct. Devices must be managed by Intune, run a supported Windows 10 version, and have the Microsoft Defender for Endpoint license assigned. Option D is wrong because Microsoft 365 Apps for enterprise is not a prerequisite. Option E is wrong because the Microsoft Defender for Endpoint client is already part of Windows 10; no separate client download is needed.

Answer

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Answer

Devices must have Microsoft 365 Apps for enterprise installed.

Question 12

Which TWO of the following are valid reasons to use Windows Autopilot Reset? (Select TWO.)

Accepted Answer

To reassign a device to a new user without re-imaging.. Option A and Option C are correct. Autopilot Reset can be used to reapply a device to a new user and to quickly resolve device issues by resetting while keeping enrollment. Option B is wrong because Autopilot Reset does not provide a fresh OS image; it resets to a known good state. Option D is wrong because Autopilot Reset is for existing devices, not for adding new devices. Option E is wrong because Autopilot Reset does not change the join type.

Answer

To enroll a new device that was not purchased through an OEM.

Answer

To change a device from Azure AD joined to Hybrid Azure AD joined.

Answer

To deploy a custom Windows image to a device.

Question 13

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device running Windows 10 version 20H2 (OS build 19042.1234) reports as compliant. However, the device does not have BitLocker enabled. Why is the device compliant?

Accepted Answer

The storageRequireEncryption setting is evaluated but not enforced because the device doesn't support encryption.. Option B is correct because the exhibit shows 'storageRequireEncryption' is set to true, which requires encryption, but the device reports as compliant without BitLocker, indicating the setting is not enforced. Option A is wrong because password is required. Option C is wrong because the OS version is above the minimum. Option D is wrong because the device reports compliant.

Answer

The device is not actually compliant; the report is incorrect.

Answer

The password requirement is not enforced because passwordRequiredType is set to deviceDefault.

Answer

The OS version is above the minimum, so compliance is granted regardless of encryption.

Question 14

Refer to the exhibit. You configure this Enrollment Status Page (ESP) policy for Windows Autopilot deployments. During a deployment, a device fails to install a required app. What happens?

Accepted Answer

The device will be blocked from use until the app is installed or the device is reset.. Option C is correct because 'allowDeviceUseOnInstallFailure' is set to false, so the device will be blocked from use if an installation fails. Option A is wrong because 'blockDeviceSetupRetryByUser' is true, meaning the user cannot retry. Option B is wrong because 'allowDeviceResetOnInstallFailure' is true, but that allows a reset, not a retry. Option D is wrong because the timeout is 60 minutes, but the failure occurs within that period.

Answer

The user can retry the installation manually.

Answer

The timeout will extend by 60 minutes.

Answer

The device will automatically retry the installation.

Question 15

Refer to the exhibit. You apply this configuration profile to Windows 10 devices. A user reports that their device's diagnostic data level is set to 'Full' in Settings > Diagnostics & feedback. What is the most likely reason?

Accepted Answer

The policy is not assigned to the device or the device is not enrolled.. Option B is correct because the exhibit shows telemetryLevel set to '1 - Basic', but the user sees 'Full', indicating the policy is not applying. The most common cause is that the device is not properly enrolled or the policy assignment is missing. Option A is wrong because even if the user changed it, Intune should reapply the policy. Option C is wrong because group policies can override Intune if they are configured. Option D is wrong because the exhibit does not mention Windows Defender.

Answer

The user manually changed the setting after the policy applied.

Answer

Windows Defender is blocking the policy application.

Answer

A conflicting Group Policy object is overriding the Intune policy.

Question 16

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune recently.. Option B is correct because compliance policies in Intune are evaluated based on the last check-in time; if a device hasn't checked in recently, its status may be outdated. Option A is wrong because a reboot is not required for compliance evaluation. Option C is wrong because BitLocker status is reported correctly if enabled. Option D is wrong because OS build version reporting is accurate.

Answer

The OS build version is not reported correctly.

Answer

BitLocker is not enabled on the system drive.

Answer

The devices need to be rebooted for the policy to apply.

Question 17

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

Accepted Answer

The policy is not applied to Exchange Online as a cloud app.. Option D is correct because the Conditional Access policy must target all cloud apps, including Exchange Online. Option A is wrong because the policy can apply to all users. Option B is wrong because the policy applies to device platforms. Option C is wrong because the policy should be set to 'Require device to be marked as compliant'.

Answer

The policy does not include iOS as a device platform.

Answer

The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

Answer

The policy is not scoped to all users.

Question 18

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

Accepted Answer

Use the built-in Windows 10 security baseline in Intune.. Option A is correct because Microsoft Intune provides pre-built security baselines for Windows 10 that can be customized. Option B is wrong because Configuration Manager is on-premises and not the modern approach. Option C is wrong because Group Policy is not managed via Intune. Option D is wrong because PowerShell scripts are not a baseline but can be used for custom configurations.

Answer

Create a custom configuration profile using Configuration Manager.

Answer

Deploy a PowerShell script via Intune to configure the settings.

Answer

Apply Group Policy Objects from on-premises Active Directory.

Question 19

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

Accepted Answer

The app is not assigned to the user's device group.. Option B is correct because the app must be assigned to the user or device group. Option A is wrong because the device is compliant. Option C is wrong because Android app approval status is not a common issue. Option D is wrong because Company Portal is installed.

Answer

The device is not compliant with the compliance policy.

Answer

The app is not approved in the Android Enterprise managed Google Play.

Answer

The Company Portal app is not installed on the device.

Question 20

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

Accepted Answer

The devices have the Windows Update for Business policy assigned.. Option C is correct because the device must have the 'Windows Update for Business' (WUfB) policy assigned. Option A is wrong because compliance does not affect update deployment. Option B is wrong because the update ring is configured. Option D is wrong because deferral settings affect timing, not delivery.

Answer

The deferral settings are too long.

Answer

The update ring is assigned to the correct device group.

Answer

The devices are compliant with the compliance policy.