MD-102 Quick Quiz — 10 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint. You need to configure automatic investigation and response for devices. Which setting in the Microsoft Defender XDR portal should you adjust?

Accepted Answer

Automated investigation and response. The correct setting is 'Automated investigation and response' because it directly controls the configuration of automatic investigation and response (AIR) capabilities in Microsoft Defender for Endpoint. This setting allows administrators to enable or disable automated investigations, set the automation level (e.g., full, semi, or no automation), and define remediation actions for devices. Without adjusting this setting, the automatic investigation and response workflow cannot be tailored to the organization's security requirements.

Answer

Threat analytics

Answer

Device inventory

Answer

Alert queue

Question 2

A company uses Microsoft Intune to manage Windows 11 devices. They want to ensure that only devices with a TPM 2.0 and Secure Boot enabled can access corporate resources in Microsoft Entra ID. What should they configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a device compliance policy that checks TPM 2.0 and Secure Boot. Conditional Access policies in Microsoft Entra ID can require devices to be marked as compliant before granting access to corporate resources. A device compliance policy in Intune can be configured to check for TPM 2.0 and Secure Boot status on Windows 11 devices. Only when both conditions are met will the device be considered compliant, and the Conditional Access policy will enforce that compliance requirement, effectively blocking non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business in Intune

Answer

Deploy an attack surface reduction rule in Microsoft Defender XDR

Answer

Use Windows Autopilot to enforce TPM and Secure Boot during provisioning

Question 3

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Conditional Access grant control 'Require device to be marked as compliant' ensures that only devices enrolled in Microsoft Intune and meeting your compliance policies (e.g., encryption, OS version, threat level) can access Microsoft 365 apps. This directly enforces the requirement that only corporate-owned devices are allowed, as compliance status is tied to managed devices. In contrast, other options either don't restrict to corporate-owned devices or address different security concerns.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

Accepted Answer

Selective wipe from the Intune console.. A selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Answer

Full wipe from the Intune console.

Answer

Delete the device from Microsoft Entra ID.

Answer

Retire the device from Intune.

Question 5

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Accepted Answer

Configure a BitLocker policy in Intune that enables key escrow to Azure AD.. Intune's BitLocker policy includes a setting to automatically store recovery keys in Azure AD, which is essential for key escrow. This integration ensures that if a device is lost or stolen, administrators can retrieve the recovery key from Azure AD to access encrypted data or perform a remote wipe. Without this policy, BitLocker keys would not be escrowed to Azure AD even if the device is enrolled in Intune.

Answer

Join devices to on-premises Active Directory.

Answer

Configure a Group Policy to escrow BitLocker keys to Active Directory.

Question 6

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

Accepted Answer

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.. Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Answer

Upload the app to Intune and provide a signing certificate.

Answer

Publish the app to the Apple App Store and assign it as a required app.

Answer

Use Apple Business Manager to assign the app to devices.

Question 7

Which TWO are prerequisites for deploying Win32 apps via Microsoft Intune?

Accepted Answer

The Intune management extension must be installed on devices. The Intune management extension is the client-side component that handles Win32 app detection, download, and installation on Windows devices. Without this extension, Intune cannot process the PowerShell scripts or .intunewin files required for Win32 app deployment.

Answer

The app must be signed with a Microsoft certificate

Answer

Devices must have at least 4 GB of RAM

Answer

Devices must be enrolled with user affinity

Question 8

Your company uses Microsoft Intune to manage iOS devices. You have an app protection policy that requires a PIN to access corporate data. Users report that they can access corporate data without entering a PIN after the first time. You want to ensure that the PIN is required every time the app is opened. What should you configure?

Accepted Answer

Set 'PIN reset after number of hours' to 0.. Setting 'PIN reset after number of hours' to 0 forces the user to enter a PIN every time the app is opened, regardless of whether they previously entered it. Option A is incorrect because 'Require PIN to access' is already set to 'Yes' but does not control PIN frequency; the PIN can be cached for a session. Option B is incorrect because requiring a device PIN instead of an app PIN changes the authentication method, but the issue is about requiring the app PIN on every open, not changing to device PIN. Option D is incorrect because 'Timeout' controls how long the app can be inactive before requiring a PIN, not upon initial app launch.

Answer

Set 'Require PIN to access' to 'Yes'.

Answer

Require device PIN instead of app PIN.

Answer

Set 'Timeout' to 1 minute.

Question 9

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

Accepted Answer

Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.. A Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Answer

Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

Answer

Set a device compliance policy that requires device name prefix 'CORP-'.

Answer

Modify the Enrollment Status Page (ESP) policy to require device naming.

Question 10

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is co-managed with Configuration Manager. You need to configure a policy that requires BitLocker encryption. You create a BitLocker policy in Intune and assign it to the device. After 24 hours, BitLocker is not enabled on the device. You verify that the device is online and the policy is assigned. What is the most likely cause?

Accepted Answer

The encryption workload is set to Configuration Manager.. In a co-managed environment, workload control determines which management authority (Configuration Manager or Intune) handles specific policies. If the encryption workload is set to Configuration Manager, Intune's BitLocker policy will be ignored, even if assigned and the device is online. This is the most likely reason the policy did not take effect after 24 hours.

Answer

The device is not online.

Answer

The device is not enrolled in Intune.

Answer

The BitLocker policy is not assigned to the correct group.