MD-102 Intune Compliance Policy Practice Question
Exhibit
Refer to the exhibit. PowerShell output: PS C:\> Get-IntuneManagedDevice -DeviceName "DESKTOP-1234" | Select-Object -Property complianceState, lastSyncDateTime, managementAgent, azureADDeviceId complianceState : noncompliant lastSyncDateTime : 2025-12-01T10:30:00Z managementAgent : mdm azureADDeviceId : a1b2c3d4-e5f6-7890-abcd-ef1234567890
Refer to the exhibit. A Windows 10 device shows a compliance state of 'noncompliant'. The last sync was 2 hours ago. The device is managed by Intune (mdm). You have verified that the assigned compliance policy requires a device threat level of 'high' from Microsoft Defender for Endpoint. Which of the following is the most likely cause of non-compliance?
⚠ Common exam trap
Many candidates assume that any threat level below 'High' would cause noncompliance, tempting them to select option A (medium threat). However, 'High' is a maximum allowed level, so a medium threat would meet the requirement. The crucial issue is that without Defender for Endpoint enrollment, the device cannot report a threat level at all, leading to noncompliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device is not enrolled in Microsoft Defender for Endpoint.
In Intune, when a compliance policy requires a device threat level of 'High', the policy actually requires the device to be at or under that threat level. Therefore, a device with a medium-severity threat would be considered compliant, not noncompliant. Given that the device synced recently and is managed, the most likely cause of noncompliance is that it is not enrolled in Microsoft Defender for Endpoint, so it cannot report any threat level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint reports a medium-severity threat on the device.
Why it's wrong here
Incorrect. While a medium-severity threat is below the required 'high' level and would cause noncompliance if reported, it is less likely than missing enrollment because the device synced recently and would have reported a threat if present.
- ✗
The device OS version is below the minimum required.
Why it's wrong here
Incorrect. The OS version is not mentioned in the scenario, and there is no indication that it is below the minimum requirement.
- ✗
The device has not synced with Intune for over 24 hours.
Why it's wrong here
Incorrect. The device synced only 2 hours ago, so this is not the cause of noncompliance.
- ✓
The device is not enrolled in Microsoft Defender for Endpoint.
Why this is correct
Correct. If the device is not enrolled in Microsoft Defender for Endpoint, it cannot provide a threat level, making it noncompliant. This is a common and likely cause given the scenario.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.