n32)","isCorrect":false},{"id":"6bbd3cd0-47e5-486c-b775-638b54999f86","label":null,"text":"Android store app","isCorrect":false}],"domainName":"Manage applications","domainSlug":"md102-manage-applications"},{"id":"fd27a0ee-1335-4d94-8d8f-bdc5eb14d037","slug":"you-have-assigned-the-compliance-policy-shown-in-the-exhibit-t491h","questionText":"You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?","explanation":"The compliance policy in the exhibit specifies a maximum OS version of 10.0.22621.1000, but the Windows 11 device is running build 10.0.22621.1500, which is above that maximum. Intune compares the device's OS version against the configured maximum OS version setting; if the device's version exceeds the maximum, it is marked as noncompliant. This setting is used to prevent devices with newer, potentially untested builds from accessing corporate resources.","domainId":"e7378eb7-47b1-4fef-bbf2-0e80913c0eea","difficulty":"hard","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"Refer to the exhibit.\n\n{\n \"@odata.type\": \"#microsoft.graph.windows10CompliancePolicy\",\n \"description\": \"Windows 11 compliance policy\",\n \"displayName\": \"Win11 Compliance Policy\",\n \"passwordRequired\": true,\n \"passwordMinimumLength\": 8,\n \"passwordMinutesOfInactivityBeforeLock\": 15,\n \"osMinimumVersion\": \"10.0.22621.0\",\n \"osMaximumVersion\": \"10.0.22621.1000\",\n \"tpmRequired\": true,\n \"deviceThreatProtectionEnabled\": true,\n \"deviceThreatProtectionRequiredSecurityLevel\": \"medium\"\n}","options":[{"id":"5a5b2df2-43a7-48f9-9d61-ec464182e931","label":null,"text":"OS version is above the maximum allowed","isCorrect":true},{"id":"a5ee2012-3cad-4660-adc5-bdede909c186","label":null,"text":"Password minimum length is not met","isCorrect":false},{"id":"0e3d1cc4-1f03-4437-9b23-5f6ebf0bfc36","label":null,"text":"Device threat protection level is below medium","isCorrect":false},{"id":"cbeae6c8-1d52-4675-868f-34f9b87be9eb","label":null,"text":"TPM is not present","isCorrect":false}],"domainName":"Manage and maintain devices","domainSlug":"manage-maintain-devices"},{"id":"8a5b3c21-811f-4903-87b0-b1155ed6bea4","slug":"refer-to-the-exhibit-you-deploy-this-applocker-policy-via-m-7tyw1","questionText":"Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?","explanation":"AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist. This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.","domainId":"24b49a69-620a-4f15-9eef-d722d8253698","difficulty":"medium","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"{\n \"AppLockerPolicy Version=\"1\" xmlns=\"http://schemas.microsoft.com/AppLocker/2008/V1\">\n \n \n \n \n \n \n \n \n \n ","options":[{"id":"d3470e23-3a73-4633-94c5-8b553e98b093","label":null,"text":"Add a deny rule for all Microsoft signed executables.","isCorrect":false},{"id":"bacd9835-bd76-4a12-8a16-817fd98cd045","label":null,"text":"Keep the policy in A