MD-102 Manage and maintain devices Practice Question
Exhibit
Refer to the exhibit.
{
"@odata.type": "#microsoft.graph.windows10CompliancePolicy",
"displayName": "Win11 Compliance",
"passwordRequired": true,
"passwordMinimumLength": 8,
"passwordMinutesOfInactivityBeforeLock": 5,
"osMinimumVersion": "10.0.22000.0",
"osMaximumVersion": "10.0.22621.1000",
"storageRequireEncryption": true,
"deviceThreatProtectionEnabled": true,
"deviceThreatProtectionRequiredSecurityLevel": "high"
}A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?
⚠ Common exam trap
Candidates often assume noncompliance must be due to a security feature like encryption or threat protection, but the question explicitly states those are met, so the correct answer is the less obvious screen timeout setting, which is a common misconfiguration in Intune compliance policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Screen timeout exceeds the policy setting
The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Screen timeout exceeds the policy setting
Why this is correct
Policy requires lock after 5 minutes; device may have longer timeout.
- ✗
Device threat protection level is not set to high
Why it's wrong here
Device has Defender with high level, so it meets requirement.
- ✗
Storage encryption is not enabled
Why it's wrong here
BitLocker is enabled, so encryption requirement is met.
- ✗
OS version is above the maximum allowed
Why it's wrong here
Build 22621.500 is below the maximum 22621.1000.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.