MD-102 Manage and maintain devices Practice Question
A company uses Microsoft Intune to manage iOS devices. They need to enforce a policy that requires a passcode of at least 6 characters, allows Touch ID, and automatically wipes the device after 10 failed attempts. Which three settings should be configured in a device restrictions profile for iOS? (Choose three.)
⚠ Common exam trap
Many candidates confuse 'Maximum passcode age' with the wipe-on-failed-attempts setting, or mistakenly think 'Allow simple passcode' is required to enable Touch ID, when in fact Touch ID is a separate toggle that does not depend on simple passcode being allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Number of failed attempts before wipe.
The 'Number of failed attempts before wipe' setting directly enforces the requirement to automatically wipe the device after 10 failed passcode attempts. This setting is part of the device restrictions profile for iOS and triggers a device wipe when the specified threshold of consecutive incorrect passcode entries is reached.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Number of failed attempts before wipe.
Why this is correct
This triggers a wipe after 10 failed attempts.
- ✗
Maximum passcode age (days).
Why it's wrong here
Password expiration is not part of the requirement.
- ✓
Minimum passcode length.
Why this is correct
This sets the required length of 6 characters.
- ✗
Allow simple passcode.
Why it's wrong here
Allowing simple passcode would weaken security, not enforce strength.
- ✓
Allow Touch ID.
Why this is correct
This enables fingerprint authentication.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Wipe
Wipe is the process of securely erasing all data from a storage device, making it unrecoverable and preparing the device for reuse or disposal.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Intune to manage iOS/iPadOS devices. They require that all corporate data on devices be protected with a passcode of at least 6 digits. Which policy type should you configure?
medium- A.Device configuration policy (settings catalog).
- B.Conditional Access policy.
- ✓ C.Device compliance policy.
- D.App protection policy.
Why C: Device compliance policies can require a passcode length and complexity. Option A is wrong because device configuration policies include passcode settings but are not used for compliance assessment. Option B is wrong because app protection policies protect data at the app level, not the device level. Option D is wrong because conditional access policies grant access based on compliance, but do not configure passcode requirements.
Variation 2. A company uses Microsoft Intune to manage iOS/iPadOS devices. They need to enforce a policy that requires users to set a device passcode of at least 6 characters. Which type of policy should they create?
easy- A.Device configuration profile
- ✓ B.Device compliance policy
- C.Conditional access policy
- D.App protection policy
Why B: A device compliance policy in Microsoft Intune evaluates whether iOS/iPadOS devices meet specific security requirements, such as a minimum passcode length of 6 characters. When a device is noncompliant, Intune can trigger actions like blocking access to corporate resources or sending a notification to the user. This is the correct policy type because passcode enforcement for device-level security is a compliance condition, not a configuration or app-level setting.
Variation 3. A company uses Microsoft Intune to manage iOS devices. They want to ensure that only devices with a passcode of at least 6 characters and without jailbreak can access corporate email. Which policy type should they configure?
easy- A.Conditional Access policy
- B.App protection policy
- ✓ C.Device compliance policy
- D.Device configuration policy
Why C: Device compliance policies in Microsoft Intune evaluate device-level security settings such as jailbreak status and passcode length. By configuring a compliance policy that requires a passcode of at least 6 characters and detects jailbroken devices, Intune can mark non-compliant devices and, when combined with Conditional Access, block access to corporate email. This is the correct policy type because it directly assesses the device's security posture rather than app-level or configuration settings.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.