Knowledge + Practice

CCNA Protect Devices Questions

75 of 155 questions · Page 1/3 · Protect Devices topic · Answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

Refer to the exhibit. You run this PowerShell script using the Microsoft Graph PowerShell SDK. What is the purpose of this script?

A.To check compliance status of devices.

B.To enroll devices in Intune.

C.To remove unsupported devices from Intune.

D.To identify devices that are not supported for compliance policies.

AnswerD

The script flags Windows RT and Windows Mobile devices.

Why this answer

The script uses the `Get-MgDeviceManagementManagedDevice` cmdlet to retrieve all managed devices from Intune, then filters for devices where the `operatingSystem` property is not in the list of supported OS versions for compliance policies (e.g., Windows 10/11, iOS, Android, macOS). The output identifies devices that are unsupported for compliance policies, which aligns with option D. It does not check compliance status, enroll devices, or remove them.

Exam trap

The trap here is that candidates confuse 'checking compliance status' (which evaluates policy adherence) with 'identifying OS support for compliance policies' (which checks if the device can even be targeted by a policy), leading them to select option A instead of D.

How to eliminate wrong answers

Option A is wrong because the script does not evaluate compliance state (e.g., `complianceState` property) or check compliance policies; it only filters by OS version. Option B is wrong because enrollment requires `New-MgDeviceManagementManagedDevice` or Autopilot-related cmdlets, not a read-only `Get-` cmdlet. Option C is wrong because the script only retrieves and filters data; it does not call `Remove-MgDeviceManagementManagedDevice` or any deletion operation.

Practice this question →

2

MCQeasy

You need to deploy a Microsoft 365 Apps for enterprise configuration to devices managed by Intune. Which policy type should you use?

A.Device configuration profile (settings catalog)

B.Managed apps policy

C.Windows update ring policy

D.Microsoft 365 Apps (Windows) configuration policy

AnswerD

This policy type is designed to configure Microsoft 365 Apps.

Why this answer

The Microsoft 365 Apps (Windows) configuration policy is the correct choice because it is specifically designed to manage the deployment, update settings, and configuration of Microsoft 365 Apps for enterprise on Intune-managed Windows devices. This policy type provides granular control over installation parameters, update channels, and app settings, directly aligning with the requirement to deploy a Microsoft 365 Apps configuration.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Apps configuration policy with a device configuration profile or a managed apps policy, mistakenly thinking that general device policies can handle Office-specific deployment tasks, when in fact only the dedicated Microsoft 365 Apps policy provides the necessary ODT integration and update channel management.

How to eliminate wrong answers

Option A is wrong because a Device configuration profile (settings catalog) is used to configure device-level settings (e.g., security policies, registry keys) and cannot directly manage the installation or update configuration of Microsoft 365 Apps. Option B is wrong because a Managed apps policy applies to mobile application management (MAM) for protecting app data on devices not necessarily managed by Intune, and it does not handle deployment or configuration of Microsoft 365 Apps. Option C is wrong because a Windows update ring policy controls Windows OS update settings (e.g., deferral periods, feature updates) and has no capability to deploy or configure Microsoft 365 Apps for enterprise.

Practice this question →

3

MCQmedium

Contoso has iOS/iPadOS devices managed by Intune. They need to prevent users from installing apps from outside the Apple App Store and ensure that devices with a jailbreak are blocked from accessing corporate email. Which two policies should they combine?

A.Device compliance policy and Conditional Access

B.Windows Autopilot and Intune enrollment

C.Device configuration profile and Microsoft Defender XDR

D.App protection policy and Conditional Access

AnswerA

Device compliance policy detects jailbreak; Conditional Access blocks noncompliant devices.

Why this answer

To prevent installation of apps from outside the Apple App Store, you need a Device Compliance Policy that includes the 'require non-removable app store' setting (which blocks sideloading). To block jailbroken devices from accessing corporate email, you combine that compliance policy with a Conditional Access policy that requires the device to be marked as compliant. Only the combination of Device Compliance Policy and Conditional Access enforces both restrictions at the device level before granting access to corporate resources.

Exam trap

The trap here is that candidates often confuse App Protection Policies (MAM) with Device Compliance Policies, thinking MAM can block jailbroken devices or sideloaded apps, but MAM only protects app data and does not evaluate device-level jailbreak or app installation sources.

How to eliminate wrong answers

Option B is wrong because Windows Autopilot and Intune enrollment are provisioning and registration workflows; they do not enforce runtime restrictions like blocking sideloaded apps or jailbreak detection. Option C is wrong because a Device Configuration Profile applies settings (e.g., restrictions, VPN) but does not evaluate compliance state or block access; Microsoft Defender XDR provides threat detection but does not enforce Conditional Access blocks on its own. Option D is wrong because App Protection Policies (MAM) manage data protection within apps (e.g., copy/paste, encryption) and do not detect jailbreak at the device level or block app installation from outside the App Store; they also do not integrate with Conditional Access to block email access based on device compliance.

Practice this question →

4

MCQmedium

Refer to the exhibit. A KQL query in Microsoft Defender XDR returns no results for PC001 and PC002 even though you know there have been antivirus detections on those devices. What is the most likely reason?

A.The timestamp range is too narrow

B.The device names are case-sensitive and are entered incorrectly

C.You do not have permissions to view events on those devices

D.The ActionType filter is incorrect for antivirus detections

AnswerD

Antivirus detection action types may be 'AntivirusDetectedMalware' or others.

Why this answer

Antivirus detections in Microsoft Defender XDR are logged under specific ActionType values such as 'AntivirusDetection' or 'AntivirusDetectionCleaned', not generic detection names. If the KQL query uses an incorrect ActionType filter (e.g., filtering for 'MalwareDetection' or a misspelled value), it will return no results for PC001 and PC002 even though detections exist. The query must reference the exact ActionType string used by Microsoft Defender for Endpoint's antivirus events.

Exam trap

The trap here is that candidates assume any generic detection filter (like 'Detection' or 'Malware') will work, but Microsoft Defender XDR requires the precise ActionType value for antivirus events, and the question deliberately uses a filter that excludes those specific records.

How to eliminate wrong answers

Option A is wrong because a narrow timestamp range would affect all devices equally, not selectively exclude PC001 and PC002 while other devices return results; the issue is filter-specific, not time-based. Option B is wrong because device names in KQL queries against Microsoft Defender XDR are not case-sensitive; the query engine normalizes device names to lowercase for matching. Option C is wrong because if you lacked permissions to view events on those devices, the query would typically return an access-denied error or omit results entirely for all users, not silently return zero rows for only those two devices.

Practice this question →

5

MCQeasy

A company wants to prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. What should they configure?

A.Intune app protection policy

B.Device compliance policy

C.Microsoft Defender for Cloud Apps session policy

D.Conditional Access policy

AnswerA

App protection policies restrict copy/paste and data transfer between apps.

Why this answer

Intune app protection policies (APP) are designed to manage and protect corporate data within applications, regardless of the device management state. By configuring data protection settings such as 'Allow app to transfer data to other apps' set to 'Policy managed apps only' and 'Save copies of org data' set to 'Block', you can prevent users from copying corporate data from managed Microsoft 365 apps to personal apps on iOS devices. This policy applies at the app layer, using the Intune App SDK or MAM (Mobile Application Management) channel, and does not require device enrollment.

Exam trap

The trap here is that candidates often confuse app protection policies (MAM) with device compliance or Conditional Access, mistakenly thinking that device-level controls can restrict app-to-app data transfer, when in fact only app-layer policies can enforce granular data protection like copy/paste restrictions.

How to eliminate wrong answers

Option B is wrong because device compliance policies evaluate device health and configuration (e.g., jailbreak detection, minimum OS version) but do not control data transfer between apps; they enforce compliance at the device level, not the app data layer. Option C is wrong because Microsoft Defender for Cloud Apps session policies control access and data exfiltration in real-time via reverse proxy for web apps (e.g., blocking downloads in a browser), but they do not apply to native mobile apps or control copy/paste between apps on iOS. Option D is wrong because Conditional Access policies enforce access controls (e.g., require compliant device, MFA) at sign-in, but they do not govern data movement or copy/paste behavior after authentication; they are an access gate, not a data protection mechanism.

Practice this question →

6

MCQhard

Refer to the exhibit. A Windows 10 device shows a compliance state of 'noncompliant'. The last sync was 2 hours ago. The device is managed by Intune (mdm). You have verified that the assigned compliance policy requires a device threat level of 'high' from Microsoft Defender for Endpoint. Which of the following is the most likely cause of non-compliance?

A.Microsoft Defender for Endpoint reports a medium-severity threat on the device.

B.The device OS version is below the minimum required.

C.The device has not synced with Intune for over 24 hours.

D.The device is not enrolled in Microsoft Defender for Endpoint.

AnswerD

Correct. If the device is not enrolled in Microsoft Defender for Endpoint, it cannot provide a threat level, making it noncompliant. This is a common and likely cause given the scenario.

Why this answer

In Intune, when a compliance policy requires a device threat level of 'High', the policy actually requires the device to be at or under that threat level. Therefore, a device with a medium-severity threat would be considered compliant, not noncompliant. Given that the device synced recently and is managed, the most likely cause of noncompliance is that it is not enrolled in Microsoft Defender for Endpoint, so it cannot report any threat level.

Exam trap

Many candidates assume that any threat level below 'High' would cause noncompliance, tempting them to select option A (medium threat). However, 'High' is a maximum allowed level, so a medium threat would meet the requirement. The crucial issue is that without Defender for Endpoint enrollment, the device cannot report a threat level at all, leading to noncompliance.

How to eliminate wrong answers

Option B is wrong because the question states the compliance policy requires a threat level of 'high' from Microsoft Defender for Endpoint, not a minimum OS version; an OS version below the minimum would cause noncompliance only if such a rule were configured, but here the focus is on threat level. Option C is wrong because the device last synced 2 hours ago, which is well within the typical 24-hour grace period; noncompliance due to sync timeout would require the device to have not synced for over 24 hours. Option D is wrong because the device is managed by Intune and the compliance policy is evaluating threat level from Defender for Endpoint; if the device were not enrolled in Defender for Endpoint, the threat level would be 'not available' or 'not evaluated', not a medium-severity threat, and the device would likely show a different noncompliance reason.

Practice this question →

7

MCQhard

You are troubleshooting an issue where Windows 10 devices are not receiving Windows updates from Intune. The update rings are configured, and the devices are enrolled. However, devices show 'Up to date' even though they are missing critical security updates. What should you verify?

A.The deferral settings are too long.

B.The update ring is assigned to the correct device group.

C.The devices have the Windows Update for Business policy assigned.

D.The devices are compliant with the compliance policy.

AnswerC

WUfB policy controls update behavior.

Why this answer

Windows Update for Business (WUfB) policies must be explicitly assigned to devices to control update behavior via Intune. Even if update rings are configured and devices are enrolled, without the WUfB policy, devices may show 'Up to date' while missing critical security updates because they are not receiving the update instructions from Intune. The WUfB policy is what actually pushes the update configuration to the Windows Update client on the device.

Exam trap

The trap here is that candidates often assume that simply configuring an update ring and assigning it to a device group is sufficient, but they overlook the requirement to also assign the Windows Update for Business policy to the devices to actually enforce the update configuration.

How to eliminate wrong answers

Option A is wrong because deferral settings only delay the installation of updates after they are released; they do not prevent devices from receiving updates altogether, so the issue of devices showing 'Up to date' while missing critical updates is not caused by long deferrals. Option B is wrong because the update ring being assigned to the correct device group is necessary for targeting, but without the WUfB policy being assigned, the ring's configuration is not applied to the devices. Option D is wrong because compliance policy determines whether a device meets security requirements, but it does not control the delivery of Windows updates; a device can be compliant yet still not receive updates if the WUfB policy is missing.

Practice this question →

8

MCQeasy

You need to ensure that Windows 10 devices automatically receive Microsoft Defender antivirus definition updates from Microsoft. Which update channel should you configure in the endpoint protection profile?

A.Microsoft Update

B.Microsoft Update for Business

C.Windows Update

D.WSUS

AnswerA

Correct. Microsoft Update delivers Defender definition updates directly from Microsoft.

Why this answer

The 'Microsoft Update' channel delivers Microsoft Defender antivirus definition updates directly from Microsoft. Option B is incorrect because Microsoft Update for Business is typically used for feature and quality updates, not specifically for Defender definition updates; the correct channel for automatic definition updates is Microsoft Update. Option C is incorrect because Windows Update is for OS updates, not definition updates.

Option D is incorrect because WSUS may delay definition updates.

Practice this question →

9

MCQeasy

You need to wipe a lost corporate-owned iOS device that is enrolled in Intune. Which action should you perform?

A.Delete the device from Intune.

B.Retire the device.

C.Wipe the device.

D.Disable the device.

AnswerC

Wipe resets the device completely.

Why this answer

The correct action is to wipe the device because a corporate-owned iOS device that is lost requires a full factory reset to remove all data and prevent unauthorized access. In Microsoft Intune, the 'Wipe' action performs a factory reset, returning the device to its out-of-box state and removing all corporate and personal data, which is appropriate for a lost corporate-owned device.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Wipe', assuming both achieve the same result, but 'Retire' is designed for BYOD scenarios where personal data must be preserved, while 'Wipe' is required for corporate-owned devices that need complete data sanitization.

How to eliminate wrong answers

Option A is wrong because deleting the device from Intune only removes it from the management console without initiating any remote wipe or data removal, leaving the device fully functional with all data intact. Option B is wrong because retiring the device removes only managed apps and corporate data but preserves personal data, which is insufficient for a lost corporate-owned device that must be completely sanitized. Option D is wrong because disabling the device is not a supported Intune action for iOS devices; Intune offers 'Retire' and 'Wipe' actions, and 'Disable' is a generic term that does not correspond to any specific remote management command.

Practice this question →

10

MCQmedium

Contoso uses Microsoft Defender for Endpoint on Windows servers. They need to ensure that antivirus definitions are always up-to-date even if the server is disconnected from the internet for extended periods. What should they configure?

A.Enable Windows Update for Business group policy

B.Use Intune to deliver definition updates

C.Configure a network file share as an internal update source for Microsoft Defender Antivirus

D.Download definitions from Microsoft Update Catalog and install manually

AnswerC

Defender Antivirus supports internal file share for definition updates.

Why this answer

Microsoft Defender Antivirus supports using a network file share as an internal update source via Group Policy or Configuration Manager. This allows servers that are disconnected from the internet to receive definition updates from a local share, ensuring they remain up-to-date without external connectivity.

Exam trap

The trap here is that candidates often assume Intune or Windows Update for Business can handle offline updates, but both require internet connectivity, whereas a network file share is the only supported method for disconnected servers.

How to eliminate wrong answers

Option A is wrong because Windows Update for Business is designed for internet-connected devices to receive updates from Microsoft servers, not for offline or disconnected scenarios. Option B is wrong because Intune delivers definition updates via the cloud, requiring internet connectivity, and cannot serve as an offline update source. Option D is wrong because manually downloading definitions from the Microsoft Update Catalog is a one-time, non-automated process that does not ensure continuous updates for extended periods.

Practice this question →

11

MCQeasy

You need to ensure that only compliant devices can access Microsoft 365 resources. You create a Conditional Access policy in Microsoft Entra ID. Which condition should you use?

A.Locations condition set to trusted IPs.

B.Grant access with multi-factor authentication.

C.Require device to be marked as compliant.

D.Device platform condition set to all.

AnswerC

This is a grant control that enforces compliance.

Why this answer

The question specifically asks to ensure that only compliant devices can access Microsoft 365 resources. In a Conditional Access policy, the 'Require device to be marked as compliant' grant control enforces that the device must be enrolled in Microsoft Intune and meet all compliance policies (e.g., encryption, OS version, threat level) before access is granted. This directly ties device health to resource access, which is the core requirement.

Exam trap

The trap here is that candidates often confuse 'device compliance' with 'device platform' or 'MFA', thinking that restricting by platform or adding MFA is sufficient to ensure device health, but neither checks the actual security posture of the device.

How to eliminate wrong answers

Option A is wrong because the 'Locations condition set to trusted IPs' controls access based on network location (e.g., corporate office), not device compliance; a non-compliant device from a trusted IP would still be allowed. Option B is wrong because 'Grant access with multi-factor authentication' verifies user identity via a second factor, but does not evaluate the device's compliance status; a compromised but MFA-authenticated device could still access resources. Option D is wrong because 'Device platform condition set to all' simply includes all operating systems (Windows, iOS, Android, etc.) in the policy scope, but does not enforce any compliance check; it is a condition, not a grant control.

Practice this question →

12

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically install critical updates from Windows Update for Business within 3 days of release. Which configuration should you use?

A.Windows Autopatch deployment policy

B.Windows feature update policy

C.Device configuration policy for Windows 10/11

D.Update rings for Windows 10 and later

AnswerD

Update rings allow configuring deferral periods for quality updates.

Why this answer

Update rings for Windows 10 and later allow you to configure Windows Update for Business settings, including the ability to set a deadline for quality updates. By configuring the 'Quality update deferral period (days)' to 0 and the 'Deadline for quality updates (days)' to 3, devices are forced to install critical updates within 3 days of release. This is the correct policy to enforce automatic installation of critical updates within a specific timeframe.

Exam trap

The trap here is that candidates often confuse 'Update rings' with 'Device configuration policies' or 'Feature update policies,' mistakenly thinking that general device configuration or feature update policies can enforce quality update deadlines, when only Update rings provide the specific deadline and deferral settings for quality updates.

How to eliminate wrong answers

Option A is wrong because Windows Autopatch deployment policy is a service that automates the entire update process, but it does not allow granular control over the installation deadline for critical updates within 3 days; it uses its own schedules. Option B is wrong because a Windows feature update policy is used to manage feature updates (e.g., version upgrades), not critical/quality updates. Option C is wrong because a Device configuration policy for Windows 10/11 manages device settings and compliance, but it does not include the specific update deadline settings needed to enforce installation within 3 days; those settings are only available in Update rings.

Practice this question →

13

MCQhard

Refer to the exhibit. An Intune administrator finds this configuration on a Windows 10 device. What is the purpose of this setting?

A.Define the Intune MDM discovery URL

B.Set the compliance policy evaluation URL

C.Configure Windows Update service endpoint

D.Specify the Microsoft Defender ATP tenant

AnswerA

This CSP sets the MDM enrollment server URL for Intune.

Why this answer

It defines the Intune MDM discovery URL, which is used by the device to locate the Intune service for enrollment and management. Option B is incorrect because the compliance policy evaluation URL is different. Option C is incorrect because the Windows Update service endpoint is separate.

Option D is incorrect because the URL is for MDM, not Defender ATP.

Practice this question →

14

MCQeasy

An IT administrator needs to ensure that iOS devices enrolled in Intune require a PIN of at least 6 digits. Where should the administrator configure this setting?

A.App protection policy

B.Device compliance policy for iOS

C.Conditional Access policy

D.Enrollment restrictions

AnswerB

Compliance policies include device health and security settings like PIN length.

Why this answer

Evice compliance policy for iOS. Device compliance policies can enforce device-level settings such as requiring a PIN of at least 6 digits on iOS devices. Option A (App protection policy) applies to apps, not device-level PIN.

Option C (Conditional Access policy) controls access based on conditions, not device settings. Option D (Enrollment restrictions) governs device enrollment, not post-enrollment settings.

Practice this question →

15

MCQhard

Your organization uses Microsoft Defender for Cloud Apps. You need to configure a policy that automatically blocks downloads of sensitive data from SharePoint Online to unmanaged devices. Which policy type should you use?

A.Activity policy

B.App discovery policy

C.Access policy

D.Session policy

AnswerD

Session policies can block downloads in real-time.

Why this answer

Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on app and device context. By configuring a session policy with the condition 'Device tag equals Unmanaged' and the control 'Block download', you can automatically block downloads of sensitive data from SharePoint Online to unmanaged devices, leveraging reverse proxy architecture to inspect and intercept traffic.

Exam trap

The trap here is confusing Access policies (which control sign-in and token issuance) with Session policies (which control in-session actions like downloads), leading candidates to incorrectly choose Access policy when the question explicitly requires blocking a specific file operation on unmanaged devices.

How to eliminate wrong answers

Option A is wrong because Activity policies are used for post-event detection and alerting on specific user activities (e.g., multiple failed logins), not for real-time blocking of downloads based on device compliance. Option B is wrong because App discovery policies analyze cloud app usage and shadow IT, not control data exfiltration from managed apps like SharePoint Online. Option C is wrong because Access policies control authentication and access (e.g., requiring MFA or blocking sign-in) but do not provide granular, session-level controls like blocking file downloads within an already authenticated session.

Practice this question →

16

MCQhard

Refer to the exhibit. A Windows 10 device with OS build 10.0.19041.1 is evaluated against this compliance policy. The device meets all settings except one: the OS version is 10.0.19041.1, which is below the minimum 10.0.19041.0? Actually it is above. But wait, the device has BitLocker enabled, Secure Boot enabled, and firewall enabled. Which setting will cause the device to be non-compliant?

A.BitLocker is not enabled on the device.

B.Antivirus signatures are out of date.

C.Secure Boot is not enabled on the device.

D.The firewall is not enabled on the device.

AnswerB

The policy requires signatureOutOfDate: false, meaning signatures must be up to date.

Why this answer

The compliance policy requires antivirus signatures to be up to date. Since the device meets all other settings (BitLocker enabled, Secure Boot enabled, firewall enabled, and OS version 10.0.19041.1 is above the minimum 10.0.19041.0), the only remaining setting that can cause non-compliance is outdated antivirus signatures. In Microsoft Intune, the 'Antivirus' compliance rule checks for the presence and recency of signature updates via Windows Defender or a third-party AV, and if signatures are older than the configured threshold, the device is marked non-compliant.

Exam trap

The trap here is that candidates assume the OS version check is the cause of non-compliance because the version number appears close to the minimum, but the device's OS build 10.0.19041.1 is actually above the minimum 10.0.19041.0, so the only remaining non-compliant setting is the antivirus signature age.

How to eliminate wrong answers

Option A is wrong because the exhibit states BitLocker is enabled, so this setting is compliant. Option C is wrong because Secure Boot is enabled on the device, meeting the policy requirement. Option D is wrong because the firewall is enabled, satisfying the policy's firewall rule.

Practice this question →

17

MCQeasy

A user reports that their Windows 10 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which of the following is the most likely cause?

A.The device has not checked in with Intune recently.

B.The MDM authority is set to Configuration Manager.

C.The compliance policy is set to 'Not applicable' due to OS version.

D.BitLocker encryption is enabled on the device.

AnswerA

The device must sync to receive and evaluate policies.

Why this answer

A device must check in with Intune to receive and report compliance policies. The 'Not evaluated' status indicates that Intune has not received a recent health check from the device. The default check-in interval is approximately 8 hours, but it can be forced manually via Settings > Accounts > Access work or school > Info > Sync or by running the command 'dsregcmd /sync'.

Exam trap

The trap here is that candidates often confuse 'Not evaluated' with 'Not applicable' or think that a device configuration issue (like BitLocker) would prevent evaluation, when in fact the root cause is simply a missing check-in.

How to eliminate wrong answers

Option B is wrong because setting the MDM authority to Configuration Manager would mean the device is managed by ConfigMgr, not Intune, and compliance policies would be evaluated by ConfigMgr, not Intune—this would not cause a 'Not evaluated' status in Intune; the device would simply not appear as an Intune-managed device. Option C is wrong because if a compliance policy is set to 'Not applicable' due to OS version, the device would show a status of 'Not applicable' or 'Compliant' (if no other policies apply), not 'Not evaluated'. Option D is wrong because BitLocker encryption being enabled does not prevent compliance evaluation; in fact, BitLocker is a common compliance setting that Intune can check, and its status would be reported during a check-in.

Practice this question →

18

Multi-Selectmedium

An Intune administrator needs to ensure that Windows 10 devices are compliant with security requirements. Which TWO options are valid compliance settings for Windows 10?

Select 2 answers

A.Device category must be 'Corporate'

B.Device enrollment type must be 'Corporate'

C.Require BitLocker

D.Minimum OS version

E.Require app protection policy

AnswersC, D

BitLocker is a built-in compliance setting for Windows 10.

Why this answer

Require BitLocker is a valid compliance setting in Microsoft Intune for Windows 10 devices. It ensures that BitLocker drive encryption is enabled on the system drive, which is a critical security requirement for data protection. This setting can be enforced via a compliance policy to mark devices as noncompliant if encryption is not active.

Exam trap

The trap here is that candidates confuse device-level compliance settings (like OS version and BitLocker) with enrollment properties (device category, enrollment type) or app-level policies (app protection policy), which are managed in different policy types within Intune.

Practice this question →

19

Multi-Selectmedium

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a PowerShell script that runs in the user context during device enrollment. Which two conditions must be met? (Select TWO.)

Select 2 answers

A.The script must be assigned to the user scope.

B.The script must be saved as a .psm1 file.

C.The script must be assigned to device groups.

D.The script must be signed with a trusted certificate.

E.The script must be added via a custom OMA-URI policy.

AnswersA, D

User context scripts must be assigned to user groups.

Why this answer

PowerShell scripts deployed via Microsoft Intune that run in the user context must be assigned to user groups (user scope). When a script is assigned to users, it executes under the user's security context during enrollment, allowing access to user-specific resources and settings. Assigning to device groups would run the script in the system context, which does not satisfy the requirement for user-context execution.

Exam trap

The trap here is that candidates often confuse user-context script assignment with device-context assignment, mistakenly thinking device groups can also run scripts in the user context, or they overlook the signing requirement because Intune does not enforce it unless the device's local execution policy demands it.

Practice this question →

20

Multi-Selectmedium

Which TWO conditions must be met for a Windows 10 device to be considered compliant with an Intune compliance policy that requires BitLocker and Secure Boot?

Select 2 answers

A.TPM is present and enabled.

B.Secure Boot is enabled.

C.All fixed drives are encrypted with BitLocker.

D.Windows Defender Antivirus is active.

E.BitLocker is enabled on the system drive.

AnswersB, E

Secure Boot is a required setting.

Why this answer

Secure Boot is a required condition in an Intune compliance policy that mandates Secure Boot. Intune checks that Secure Boot is enabled on the device to ensure that only trusted firmware and OS components are loaded during startup, which is a core security requirement for compliance.

Exam trap

The trap here is that candidates often assume 'BitLocker enabled' means all drives must be encrypted, but Intune's compliance policy specifically only requires encryption on the system drive, not all fixed drives.

Practice this question →

21

Multi-Selecteasy

Which TWO settings can be configured in a Windows 10 device restriction profile in Intune to enhance security?

Select 2 answers

A.Require BitLocker encryption

B.Disable copy and paste between apps

C.Disable the camera

D.Require a password for unlocking the device

E.Configure Windows Update for Business settings

AnswersC, D

Disabling camera is a security restriction.

Why this answer

Options C and D are correct. Disabling the camera (C) reduces the attack surface by preventing unauthorized camera usage, and requiring a password (D) enforces authentication to unlock the device. Option A (BitLocker) is an encryption setting, not a device restriction profile setting.

Option B (disable copy/paste) is an app restriction, not a device restriction. Option E (Windows Update for Business) is configured in an update policy, not a device restriction profile.

Practice this question →

22

MCQhard

Your organization uses Windows Autopilot for device deployment. After a device completes the user-driven deployment, it appears in Microsoft Entra ID as 'Azure AD registered' instead of 'Azure AD joined'. What should you modify to ensure the device is joined?

A.Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD joined'.

B.Add the device to a hybrid Azure AD join profile.

C.Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

D.Modify the enrollment restrictions to block personally owned devices.

AnswerA

This setting controls whether the device is joined or registered.

Why this answer

The Autopilot deployment profile includes a setting called 'Join to Azure AD as' that determines whether the device performs an Azure AD join or an Azure AD registration. By default, this setting may be configured as 'Azure AD registered', which results in a device that is only registered (workplace-joined) rather than fully joined. Changing this setting to 'Azure AD joined' ensures the device completes a full Azure AD join during the user-driven deployment, making it a managed device in Microsoft Entra ID.

Exam trap

The trap here is that candidates often confuse 'Azure AD registered' with 'Azure AD joined' because both involve Azure AD, but they fail to recognize that the Autopilot profile's join type setting directly controls this distinction, and that enrollment restrictions or hybrid join profiles are unrelated to changing the join type for a cloud-native Autopilot deployment.

How to eliminate wrong answers

Option B is wrong because a hybrid Azure AD join profile is used for devices that need to be joined to both on-premises Active Directory and Azure AD, typically requiring connectivity to a domain controller and synchronization via Azure AD Connect; this does not apply to a pure cloud-native Autopilot scenario where the device should be directly Azure AD joined. Option C is wrong because setting 'Join to Azure AD as' to 'Azure AD registered' would explicitly configure the device to be registered (workplace-joined) rather than joined, which is the opposite of what is needed to fix the issue. Option D is wrong because enrollment restrictions control which devices are allowed to enroll based on platform or ownership type (e.g., blocking personally owned devices), but they do not change the join type from registered to joined; the device would still be registered if the profile specifies registration.

Practice this question →

23

MCQhard

Refer to the exhibit. A PowerShell script is used to check the encryption compliance state of Windows devices managed by Intune. Some devices return a State of 'notApplicable' for the Encryption setting. What does this indicate?

A.The device has pending actions to enable encryption

B.The compliance policy is not assigned to the device

C.The device's operating system edition does not support the encryption setting

D.The device does not require encryption per policy

AnswerC

Some editions like Home don't support BitLocker, so setting is not applicable.

Why this answer

In Intune, the 'notApplicable' state for an encryption compliance setting indicates that the device's operating system edition lacks the required encryption capabilities, such as BitLocker support. BitLocker is only available on Windows Pro, Enterprise, and Education editions; Windows Home edition does not support it, so the compliance check returns 'notApplicable' rather than 'compliant' or 'noncompliant'.

Exam trap

The trap here is that candidates confuse 'notApplicable' with 'not assigned' or 'not required', but Microsoft specifically uses 'notApplicable' to indicate the device's OS edition does not support the setting, not a policy assignment issue.

How to eliminate wrong answers

Option A is wrong because 'pending actions' would typically result in a 'not evaluated' or 'error' state, not 'notApplicable', as the compliance engine can still assess the encryption status. Option B is wrong because if the compliance policy were not assigned, the device would not report any compliance state for that setting, or it would show 'not evaluated', not 'notApplicable'. Option D is wrong because 'notApplicable' is not a policy-driven exemption; it is a technical determination by the device's operating system that the encryption setting cannot be evaluated due to lack of support.

Practice this question →

24

Multi-Selecteasy

You are configuring Microsoft Defender for Endpoint for your organization. You need to ensure that devices are onboarded to the service. Which two methods can you use to onboard Windows 10 devices? (Choose two.)

Select 2 answers

A.PowerShell script

B.Group Policy

C.Microsoft Intune

D.Microsoft Endpoint Manager

E.Microsoft Configuration Manager

AnswersB, C

Group Policy can deploy the onboarding configuration.

Why this answer

Group Policy is correct because it allows you to deploy a Group Policy Object (GPO) that configures the Windows 10 device to automatically download and apply the Defender for Endpoint onboarding package, including the required registry keys and service configuration. This method is ideal for on-premises, Active Directory-joined devices that are not managed by a modern management solution like Intune.

Exam trap

The trap here is that candidates often select 'Microsoft Endpoint Manager' thinking it is a distinct method, but it is an umbrella term that includes Intune and Configuration Manager, so it is not a specific onboarding method; the exam expects you to know the precise tools: Group Policy, Intune, and Configuration Manager.

Practice this question →

25

MCQmedium

You manage Android Enterprise devices with work profiles. A user reports that corporate apps are not appearing in the work profile after enrollment. The device shows as enrolled in Microsoft Intune. What is the most likely cause?

A.The device is not connected to the internet.

B.The device is not compliant with corporate policies.

C.The work profile was not created or was removed on the device.

D.The corporate apps are not assigned to the user.

AnswerC

Without a work profile, corporate apps have no container to install into.

Why this answer

If the work profile is not set up correctly on the device, corporate apps won't appear. Option A is wrong because if apps were assigned, they should deploy; the issue is with the profile. Option B is wrong because assignment not applied would affect all devices, not just one.

Option D is wrong because compliance policies don't affect app visibility.

Practice this question →

26

MCQhard

You are troubleshooting a Windows 10 device that is showing as non-compliant in Intune. The exhibit shows the PowerShell output from the Microsoft Graph API. Based on the output, what is the most likely reason for the non-compliance?

A.The device does not have a compliant operating system version

B.BitLocker drive encryption is not enabled on the device

C.The device is not running a supported version of Windows 10

D.The device has a third-party antivirus installed

AnswerB

The 'RequireEncryption' reason indicates BitLocker is missing.

Why this answer

The output shows the non-compliance reason is 'RequireEncryption', indicating BitLocker is not enabled. Option A is incorrect because the reason is about encryption, not operating system version. Option C is incorrect because the reason is about encryption, not the Windows version.

Option D is incorrect because the reason is about encryption, not antivirus.

Practice this question →

27

Multi-Selecteasy

Which TWO of the following are valid methods to wipe a Windows 10 device using Microsoft Intune? (Select TWO.)

Select 2 answers

A.Factory reset from Windows Settings

B.Retire (selective wipe)

C.Remote lock

D.Delete device from Intune

E.Full wipe (remote wipe)

AnswersB, E

Retire removes corporate data from the device.

Why this answer

A Retire (selective wipe) in Microsoft Intune removes managed corporate data and policies from a Windows 10 device while preserving the user's personal data. This is achieved by unenrolling the device from Intune and removing company-managed apps, certificates, and profiles, leaving the device in a usable state for the user. Option E is also correct: a Full wipe (remote wipe) restores the device to its factory default settings, erasing all data including personal files and applications.

This is used when the device is lost or stolen, or when it needs to be completely reset.

Exam trap

The trap here is that candidates confuse 'Delete device from Intune' with a wipe action, not realizing that deletion only removes the device record from the console without sending any wipe command to the device.

Practice this question →

28

MCQhard

Your organization uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) to manage device threat detection. You have integrated Defender for Endpoint with Intune for compliance. Some devices are showing as non-compliant due to 'active threats' that are actually low-risk. How can you adjust the compliance policy to allow low-risk threats?

A.Modify the Conditional Access policy to require device compliance.

B.Configure the 'Machine risk score' in Defender for Endpoint.

C.Whitelist the specific threats in Defender for Endpoint.

D.Set the 'Threat level' in the Intune compliance policy to 'Low'.

AnswerD

This allows devices with low-risk threats to be compliant.

Why this answer

The Intune compliance policy includes a 'Threat level' setting that determines the minimum threat severity required for a device to be considered compliant. By setting this value to 'Low', devices with only low-risk threats will be marked as compliant, allowing them to pass the policy check. This directly addresses the scenario where low-risk threats are incorrectly causing non-compliance.

Exam trap

The trap here is that candidates often confuse the compliance policy's threat level threshold with the Defender for Endpoint risk score or alert suppression, leading them to incorrectly choose whitelisting or risk score configuration instead of the straightforward compliance policy setting.

How to eliminate wrong answers

Option A is wrong because modifying the Conditional Access policy to require device compliance does not change the compliance evaluation itself; it only enforces the existing compliance status, so it would not resolve the issue of low-risk threats causing non-compliance. Option B is wrong because the 'Machine risk score' in Defender for Endpoint is an aggregated risk assessment that cannot be manually adjusted to ignore low-risk threats; it reflects the actual threat posture and is not a configurable threshold for compliance. Option C is wrong because whitelisting specific threats in Defender for Endpoint would suppress alerts for those threats entirely, which is an overbroad security risk and does not align with the compliance policy's threat level filtering; the correct approach is to adjust the compliance policy threshold, not to hide threats.

Practice this question →

29

MCQeasy

You manage devices with Microsoft Intune. You need to deploy a Windows 10 feature update to a pilot group of devices. Which profile type should you use?

A.Windows 10 configuration profile

B.Windows 10 compliance policy

C.Windows 10 update ring profile

D.Windows 10 feature update profile

AnswerD

This profile type is designed for deploying feature updates like version upgrades.

Why this answer

A Windows 10 feature update profile is the correct choice because it is specifically designed to deploy feature updates (e.g., Windows 10 version 22H2) to targeted groups in Intune. Unlike update rings, which control the timing and deferral of updates, a feature update profile pins devices to a specific Windows version and orchestrates the upgrade process for pilot or broad deployments.

Exam trap

The trap here is that candidates often confuse update ring profiles (which manage update timing) with feature update profiles (which deploy a specific version), leading them to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because a Windows 10 configuration profile is used to configure device settings (e.g., security policies, browser settings) and cannot deploy feature updates. Option B is wrong because a Windows 10 compliance policy evaluates device compliance against rules (e.g., required OS version) but does not initiate or manage the deployment of feature updates. Option C is wrong because a Windows 10 update ring profile controls the deferral, pause, and rollout of quality updates and feature updates via Windows Update for Business, but it does not pin devices to a specific feature update version; it only manages update behavior and timing.

Practice this question →

30

Multi-Selecthard

Which TWO conditions in a Conditional Access policy can be used to enforce device compliance for access to Microsoft 365 services?

Select 2 answers

A.Sign-in risk

B.Locations (trusted IPs)

C.Applications (e.g., Exchange Online)

D.Client apps (Browser, Mobile apps and desktop clients)

E.Device state (Compliant or Domain joined)

AnswersD, E

Client apps condition can require compliant device for specific app types.

Why this answer

The 'Client apps' condition in a Conditional Access policy allows you to target specific client application types (e.g., browser, mobile apps, and desktop clients) to enforce device compliance. Option E is correct because the 'Device state' condition directly checks whether a device is marked as compliant in Microsoft Intune or is domain-joined (hybrid Azure AD join), which is the primary mechanism for enforcing device compliance for access to Microsoft 365 services.

Exam trap

The trap here is that candidates often confuse the 'Device state' condition with 'Sign-in risk' or 'Locations,' mistakenly thinking that location or risk level can enforce device compliance, when in fact only the 'Device state' condition directly checks compliance or domain join status.

Practice this question →

31

Multi-Selectmedium

Your organization uses Microsoft Intune to manage mobile devices. You need to configure compliance policies that trigger conditional access. Which TWO conditions can be used in a device compliance policy?

Select 2 answers

A.Device is enrolled in a specific MDM authority.

B.App must have a minimum version.

C.Minimum OS version is 14.0.

D.Device is not jailbroken or rooted.

E.SD card encryption is enabled.

AnswersC, D

Correct. A minimum OS version is a standard condition in device compliance policies.

Why this answer

Correct answers are C and D. Device compliance policies in Microsoft Intune can check for conditions like minimum OS version (C) and whether the device is jailbroken or rooted (D). These conditions can trigger conditional access to enforce compliance.

Option A is incorrect because compliance policies do not check the MDM authority; they assume Intune. Option B is incorrect because app version requirements are managed via app protection policies, not compliance policies. Option E is incorrect because SD card encryption is not a standard compliance policy setting; device encryption is checked but not specifically SD cards.

Exam trap

Candidates often confuse compliance policy conditions with app protection policy conditions. Remember that compliance policies focus on device-level settings (OS version, jailbreak status, encryption), while app protection policies manage app-level restrictions like minimum app version or data protection.

Practice this question →

32

MCQmedium

Your company uses Intune to manage iOS devices. You need to deploy a new app that is available in the Apple App Store. You create an iOS store app in Intune and assign it as 'Required' to a group of users. After 24 hours, some users report that the app is not installed. You verify that the app is available in the App Store and that the devices are online. The devices are supervised and enrolled via Apple Business Manager. What should you do first to troubleshoot the issue?

A.Review the iOS device restrictions policy

B.Confirm that the devices are enrolled in Intune

C.Check the app configuration policy for the app

D.Verify that a VPP token is configured and assigned

AnswerD

Supervised devices require a VPP token for app distribution.

Why this answer

For supervised iOS devices enrolled via Apple Business Manager, a Volume Purchase Program (VPP) token must be configured in Intune and assigned to the device group to allow automatic installation of store apps assigned as 'Required'. Without a valid VPP token, the app installation will fail even if the app is available and devices are online. Option A is incorrect because while device restrictions policy could block certain apps, it is not the first step in troubleshooting a missing app installation.

Option B is incorrect because the devices are already enrolled (as stated in the scenario). Option C is incorrect because an app configuration policy is used to customize app settings, not to control installation.

Practice this question →

33

MCQeasy

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

A.Disconnect the device from Microsoft Entra ID and rejoin.

B.On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.

C.Delete and recreate the compliance policy in Microsoft Intune.

D.Re-enroll the device in Microsoft Intune.

AnswerB

Forcing a sync triggers a policy evaluation.

Why this answer

Forcing a sync from the device can refresh the policy evaluation and resolve the 'Not evaluated' status. Option A is wrong because the device is already enrolled. Option C is wrong because the issue is with policy evaluation, not configuration.

Option D is wrong because the device is already joined.

Practice this question →

34

MCQmedium

Refer to the exhibit. A Windows 10 device is enrolled in Intune and has the above compliance policy assigned. The device reports as non-compliant. The device has TPM version 2.0, Secure Boot enabled, and a password of 8 characters. Which of the following is the most likely reason for non-compliance?

A.The OS version is outside the allowed range.

B.The device does not have a TPM chip.

C.Secure Boot is not enabled.

D.The password length is less than 6 characters.

AnswerA

The policy restricts OS version; the device likely has a newer build.

Why this answer

The compliance policy likely specifies a minimum OS version requirement, such as Windows 10 22H2 or a specific build number. Since the device reports as non-compliant despite meeting TPM 2.0, Secure Boot, and password length requirements, the most probable cause is that the OS version is below the allowed minimum. Intune evaluates OS version against the 'Minimum OS version' setting in the compliance policy, and failure to meet this threshold results in non-compliance.

Exam trap

The trap here is that candidates assume TPM, Secure Boot, or password length are the most common compliance failures, but the OS version check is often overlooked as a strict requirement that can cause non-compliance even when all hardware security features are present.

How to eliminate wrong answers

Option B is wrong because the exhibit states the device has TPM version 2.0, so a missing TPM chip is not the issue. Option C is wrong because the exhibit explicitly states Secure Boot is enabled, so this requirement is satisfied. Option D is wrong because the password length of 8 characters exceeds the typical minimum of 6 characters required by Intune compliance policies, so password length is not the cause.

Practice this question →

35

MCQeasy

You need to ensure that only devices that have a specific set of approved iOS apps can access company resources. Which Intune feature should you use?

A.Selective wipe

B.App protection policy

C.Device compliance policy with required apps

D.App configuration policy

AnswerC

Device compliance policy with required apps can verify mandatory apps are present, but it does not block installation of non-approved apps. It is insufficient for the requirement.

Why this answer

Device compliance policy with required apps allows you to specify a list of iOS apps that must be installed for a device to be compliant. By combining this with conditional access, you can block non-compliant devices from accessing corporate resources, ensuring that only devices with the approved apps gain access.

Exam trap

Many candidates confuse this with device restriction profiles that can block the installation of unapproved apps, but compliance policies only check for the presence of apps.

How to eliminate wrong answers

Option A is wrong because selective wipe removes only corporate data from a device, not control which apps can be installed. Option B is wrong because app protection policy (MAM) manages data protection within apps (e.g., copy/paste restrictions) but does not enforce which apps can be installed on the device. Option D is wrong because app configuration policy supplies settings to apps (e.g., server URLs) but does not restrict app installation.

Practice this question →

36

MCQeasy

You are reviewing a custom device configuration profile in Intune. The exhibit shows an OMA-URI setting. What is the purpose of this setting?

A.Enables the camera on the lock screen

B.Disables the camera on the device entirely

C.Disables the microphone on the lock screen

D.Disables the camera on the lock screen

AnswerD

The OMA-URI prevents the camera from being used on the lock screen.

Why this answer

The OMA-URI setting ./Vendor/MSFT/Policy/Config/DeviceLock/PreventLockScreenCamera is used to disable the camera on the Windows lock screen. This policy prevents users from accessing the camera while the device is locked, enhancing security by mitigating privacy risks such as unauthorized camera use. It does not affect camera functionality once the user logs in.

Exam trap

The trap here is that candidates often confuse 'disable camera on lock screen' with 'disable camera entirely' (Option B), but the OMA-URI explicitly targets the lock screen only, not the full device camera functionality.

How to eliminate wrong answers

Option A is wrong because the setting specifically disables the camera on the lock screen, not enables it; enabling would require a different policy value or OMA-URI path. Option B is wrong because this policy only restricts camera access on the lock screen, not the entire device; to disable the camera entirely, you would use a different policy such as AllowCamera under Device/Experience. Option C is wrong because this OMA-URI targets the camera, not the microphone; disabling the microphone on the lock screen would involve a separate policy like PreventLockScreenMicrophone.

Practice this question →

37

MCQmedium

A company uses Intune to manage macOS devices. They need to deploy a custom configuration profile that enforces FileVault encryption. What is the recommended approach?

A.Create an endpoint security disk encryption policy in Intune and assign it to the devices

B.Use Apple Configurator to create the profile and import it into Intune

C.Ask users to manually enable FileVault

D.Use JAMF Pro to manage FileVault

AnswerA

Intune supports FileVault configuration via endpoint security policies.

Why this answer

The recommended approach is to create an endpoint security disk encryption policy in Intune (option A). Intune provides built-in FileVault settings under endpoint security disk encryption for macOS. Option B (Apple Configurator) is a local configuration tool, not an MDM solution, and cannot be used for remote management.

Option C (manually enabling FileVault) is not scalable for enterprise deployment. Option D (JAMF Pro) is a third-party MDM, not Microsoft Intune.

Practice this question →

38

Multi-Selectmedium

Which THREE conditions can be used in a Conditional Access policy to require a compliant device?

Select 3 answers

A.Device state

B.Client apps

C.Locations

D.Device platform

E.Sign-in risk

AnswersB, C, D

Can require compliance for browser, mobile apps, desktop clients.

Why this answer

Options B, C, and D are correct. Option B: Client apps condition allows targeting specific applications or user actions. Option C: Locations condition allows requiring compliance based on IP ranges or countries.

Option D: Device platform condition allows targeting specific operating systems. Option A is incorrect because the Device state condition includes options like 'Device hybrid Azure AD joined' and 'Device marked as compliant', but it filters based on current state rather than requiring compliance. To require a compliant device, you use the grant control, not the Device state condition.

Option E is incorrect because sign-in risk is a condition but is not used to require a compliant device; it's used for risk-based policies.

Practice this question →

39

MCQeasy

You need to enroll a Windows 11 device into Microsoft Intune using a work or school account. The device is already joined to Microsoft Entra ID. What is the simplest enrollment method?

A.Windows Autopilot

B.Group Policy to configure enrollment

C.Manual enrollment using the Company Portal

D.Automatic enrollment via Microsoft Entra join

AnswerD

Microsoft Entra joined devices can be automatically enrolled in Intune.

Why this answer

Microsoft Entra joined devices automatically enroll in Intune when configured, making it the simplest method. Option A (Windows Autopilot) is wrong because it requires additional setup and is not the simplest. Option B (Group Policy) is wrong because Group Policy is typically used for on-premises devices and not automatic.

Option C (Manual enrollment via Company Portal) is wrong because it requires user interaction and is not automatic.

Practice this question →

40

MCQhard

You review the compliance policy JSON for Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.0) with a numeric-only password of 10 characters, BitLocker enabled, firewall enabled, and Microsoft Defender running reports as non-compliant. What is the most likely reason?

A.The password type is not alphanumeric.

B.The OS version is outside the allowed range.

C.Storage encryption is not enabled.

D.Microsoft Defender is not enabled.

AnswerA

The policy requires alphanumeric, but the password is numeric-only.

Why this answer

The compliance policy JSON for Windows 10 devices specifies a password type requirement of 'alphanumeric'. The device in question uses a numeric-only password (10 characters), which does not meet the alphanumeric requirement, causing it to be reported as non-compliant. All other conditions—BitLocker enabled, firewall enabled, and Microsoft Defender running—are satisfied, so the password type is the sole issue.

Exam trap

The trap here is that candidates often assume a long numeric password (10 characters) meets complexity requirements, but the policy explicitly requires alphanumeric characters, and the exam tests attention to the specific JSON setting rather than general password strength.

How to eliminate wrong answers

Option B is wrong because the OS version (Windows 10 version 22H2, build 22621.0) is within the allowed range; the compliance policy typically specifies a minimum OS version, and 22H2 is a supported build. Option C is wrong because storage encryption is enabled via BitLocker, which satisfies the encryption requirement. Option D is wrong because Microsoft Defender is explicitly stated as running, so it is enabled and compliant.

Practice this question →

41

MCQhard

You are the endpoint administrator for Contoso Ltd., a global company with 5,000 Windows 11 devices managed by Microsoft Intune. The company has a strict security policy requiring that all devices must have BitLocker Drive Encryption enabled on the operating system drive. Additionally, devices must be compliant with the policy to access corporate resources via Conditional Access. Recently, an audit revealed that 200 devices are non-compliant because BitLocker is not enabled. You investigate and find that these devices are all personal devices enrolled as 'Windows bring your own device' (BYOD). The BitLocker policy is configured as a device configuration profile targeting 'All Devices'. The compliance policy requires 'Storage encryption' to be enabled. You need to resolve the non-compliance for these BYOD devices. What should you do?

A.Assign the BitLocker configuration profile to device groups that include BYOD devices.

B.Upgrade the Windows edition on BYOD devices to Windows Pro or Enterprise.

C.Create a separate compliance policy for BYOD devices that does not require storage encryption.

D.Configure the compliance policy to mark devices as compliant if BitLocker is not enabled but other settings are met.

AnswerB

BitLocker is only available on Pro/Enterprise editions; upgrading enables encryption.

Why this answer

BitLocker Drive Encryption is only available on Windows Pro, Enterprise, or Education editions. BYOD devices often run Windows Home, which does not support BitLocker. Upgrading to Windows Pro or Enterprise enables BitLocker, resolving the non-compliance.

Option A is incorrect because the profile is already assigned to 'All Devices', but it cannot enable BitLocker on unsupported editions. Option C is incorrect as it would bypass the security requirement. Option D is incorrect because compliance policies cannot override device capabilities; they can only require encryption on devices that support it.

Practice this question →

42

MCQeasy

You need to ensure that only authorized users can enroll devices in Microsoft Intune. Which setting should you configure?

A.Enrollment restrictions

B.Device categories

C.Device compliance policies

D.Conditional access policies

AnswerA

Enrollment restrictions can block personal devices or require authorization.

Why this answer

Device enrollment restrictions in Intune allow you to block personal devices or require user approval. Option A is correct because enrollment restrictions can limit who can enroll. Option B is incorrect because device compliance policies apply after enrollment.

Option C is incorrect because conditional access policies control access to resources, not enrollment. Option D is incorrect because device categories are for grouping, not blocking enrollment.

Practice this question →

43

MCQmedium

You have a hybrid Microsoft Entra ID joined Windows 10 device that is co-managed with Configuration Manager and Intune. You want Intune to manage Windows Update for Business settings. Which slider setting should you configure in Configuration Manager?

A.Move the slider for 'Windows Update policies' to 'Intune'

B.Move the slider for 'Endpoint protection' to 'Intune'

C.Move the slider for 'Resource access' to 'Intune'

D.Move the slider for 'Device configuration' to 'Intune'

AnswerA

This delegates update management to Intune.

Why this answer

In a co-management scenario, workload sliders in Configuration Manager determine which authority manages specific workloads. To have Intune manage Windows Update for Business settings, you must move the slider for 'Windows Update policies' to Intune. This shifts the policy authority from Configuration Manager to Intune, allowing Intune's Update Rings and feature update policies to control Windows Update behavior on the device.

Exam trap

The trap here is that candidates often confuse 'Windows Update policies' with 'Device configuration' or 'Endpoint protection', assuming that update settings fall under a broader configuration or security category, but Microsoft specifically separates update management into its own workload slider.

How to eliminate wrong answers

Option B is wrong because 'Endpoint protection' controls antivirus, firewall, and Defender policies, not Windows Update settings. Option C is wrong because 'Resource access' manages VPN, Wi-Fi, email, and certificate profiles, which are unrelated to update policies. Option D is wrong because 'Device configuration' handles device restriction and configuration profiles, not Windows Update for Business policies.

Practice this question →

44

MCQmedium

Your organization, Fabrikam, uses Microsoft Intune to manage iOS/iPadOS and Android devices. You need to implement a solution that ensures company email can only be accessed from the Outlook mobile app, and that data from the Outlook app cannot be copied to personal apps. You also need to ensure that when a user leaves the company, the corporate data in Outlook is removed without affecting personal data. You plan to use app protection policies (MAM). The devices are not enrolled in Intune (unmanaged). You configure the app protection policies for Outlook on iOS and Android. However, users report that they can still copy email content to personal apps. What should you check?

A.Ensure that the devices are enrolled in Intune.

B.Check that the device compliance policy is assigned.

C.Verify that the 'Cut, copy, and paste' setting in the app protection policy is set to 'No' or 'Policy managed apps'.

D.Confirm that the Outlook app is a managed app in Intune.

AnswerC

Correct. This setting controls cut, copy, and paste behavior. Setting it to 'No' or 'Policy managed apps' prevents copying data to unmanaged apps.

Why this answer

The 'Cut, copy, and paste' setting in the app protection policy controls data transfer between apps. To prevent copying email content to personal apps, this setting must be set to 'No' or 'Policy managed apps'. Option A is incorrect because device enrollment is not required for MAM policies on unmanaged devices.

Option B is incorrect because device compliance policies are not applicable without enrollment. Option D is incorrect because Outlook is already a managed app; the issue is the policy setting.

Practice this question →

45

MCQmedium

Refer to the exhibit. You run a PowerShell command to check the assignment status of device configuration profiles. The 'BitLocker Policy' shows 'Pending'. What does 'Pending' indicate?

A.The policy is waiting for user approval

B.The policy assignment failed due to a conflict

C.The policy has been successfully applied

D.The policy has been assigned to the device but not yet applied

AnswerD

Pending indicates the policy is queued for application.

Why this answer

In Microsoft Intune, when a device configuration profile shows a status of 'Pending', it means the policy has been successfully assigned to the device in the cloud but has not yet been applied or reported back as compliant. This is a normal transitional state that occurs while the device checks in with the Intune service, downloads the policy, and applies it during the next sync cycle. The 'Pending' status does not indicate failure, conflict, or user approval requirements.

Exam trap

The trap here is that candidates often confuse 'Pending' with a failure or conflict, when in fact it is a normal intermediate state that resolves automatically after the device syncs with Intune.

How to eliminate wrong answers

Option A is wrong because 'Pending' does not require user approval; user approval is only relevant for specific scenarios like enrollment or app installation prompts, not for device configuration profiles. Option B is wrong because a policy conflict would typically result in a 'Conflict' or 'Error' status, not 'Pending'. Option C is wrong because 'Pending' explicitly means the policy has not yet been applied; a successfully applied policy would show a status of 'Succeeded' or 'Compliant'.

Practice this question →

46

MCQhard

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

A.Microsoft Sentinel workspace

B.Microsoft Defender for Endpoint sensor on the devices

C.Intune MDM authority

D.Microsoft Purview compliance portal

AnswerB

The sensor collects vulnerability data; missing sensor stops reporting.

Why this answer

(Microsoft Defender for Endpoint sensor) is correct. The sensor is the agent installed on devices that collects and reports vulnerability information to Microsoft Defender XDR. If the sensor is misconfigured, missing, or not running, devices will not report vulnerability data.

Option A (Microsoft Sentinel workspace) is a SIEM that ingests security data but is not the source of vulnerability data. Option C (Intune MDM authority) manages device compliance and configuration but does not directly collect vulnerability data. Option D (Microsoft Purview compliance portal) handles data governance and compliance, not vulnerability reporting.

Practice this question →

47

MCQmedium

You have a Windows 10 device that is managed by Intune and enrolled in Microsoft Defender for Endpoint. The device is reporting a high number of false positive detections from Microsoft Defender Antivirus. You need to configure an exclusion for a specific folder path to reduce false positives. Where should you configure the exclusion?

A.In a device compliance policy

B.In Group Policy

C.In the endpoint protection profile for Microsoft Defender Antivirus in Intune

D.In Microsoft Defender Security Center

AnswerC

Exclusions are set within the antivirus settings of the endpoint protection profile.

Why this answer

In an Intune-managed environment, antivirus exclusions for Microsoft Defender Antivirus are configured within the endpoint protection profile, specifically under the Microsoft Defender Antivirus settings. This profile is assigned to devices via Intune policies, allowing centralized management of exclusions without requiring on-premises Group Policy or direct interaction with the Microsoft Defender Security Center portal.

Exam trap

The trap here is that candidates often confuse the Microsoft Defender Security Center (a cloud-based security analytics portal) with the Intune endpoint protection profile, mistakenly thinking exclusions are configured in the security center rather than in the device management policy.

How to eliminate wrong answers

Option A is wrong because device compliance policies are used to enforce security requirements (e.g., encryption, OS version) and do not contain settings for antivirus exclusions. Option B is wrong because Group Policy is a traditional on-premises management tool; while it can configure Defender exclusions, it is not applicable when the device is solely managed by Intune and not domain-joined or using Group Policy. Option D is wrong because Microsoft Defender Security Center (now part of Microsoft 365 Defender) is a security operations portal for threat investigation and response, not a configuration interface for local antivirus exclusions on individual devices.

Practice this question →

48

Multi-Selecteasy

You are configuring Microsoft Intune for Windows 10 devices. Which two settings can you enforce using a device restrictions profile? (Select TWO.)

Select 2 answers

A.Disable the camera

B.Set default web browser

C.Set battery saver threshold

D.Configure Windows Update for Business settings

E.Require a password for device unlock

AnswersA, E

Device restrictions include hardware disabling.

Why this answer

A is correct because the device restrictions profile in Microsoft Intune includes a 'Camera' setting under the 'General' category, which allows you to disable the camera on Windows 10 devices by setting it to 'Block'. This enforces a policy that prevents camera access across all apps and the OS, leveraging the CSP (Policy CSP) `Camera/AllowCamera`.

Exam trap

The trap here is that candidates often confuse device restrictions profiles with other policy types, such as Administrative Templates or Windows Update for Business profiles, leading them to select settings like default browser or Windows Update configuration that belong to different policy categories.

Practice this question →

49

MCQhard

An organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. The security team wants to automatically apply an Intune app protection policy (APP) when a user accesses a risky app from an unmanaged device. What should the administrator use?

A.Conditional Access App Control with session control

B.Device configuration policy

C.App protection policy assignment to users

D.Device compliance policy

AnswerA

Session control can enforce APP when a risky app is accessed.

Why this answer

Conditional Access App Control with session control is the correct solution because it allows the administrator to monitor and control app sessions in real time, applying Intune app protection policies (APP) when a user accesses a risky app from an unmanaged device. This integration uses reverse proxy architecture to intercept traffic and enforce data protection policies, such as blocking downloads or requiring managed apps, directly within the cloud app session.

Exam trap

The trap here is that candidates often confuse 'app protection policy assignment to users' (Option C) as the direct method, but the question requires dynamic, risk-based triggering via Conditional Access and Defender for Cloud Apps, not static user assignment.

How to eliminate wrong answers

Option B (Device configuration policy) is wrong because it manages device settings (e.g., Wi-Fi, VPN) and does not enforce app-level protection based on risk or device management status. Option C (App protection policy assignment to users) is wrong because it assigns APP directly to users without session-level conditional access; it cannot dynamically trigger based on real-time risk detection from Defender for Cloud Apps. Option D (Device compliance policy) is wrong because it evaluates device compliance (e.g., jailbreak detection, OS version) and blocks access at the device level, but it does not apply app protection policies within a cloud app session from an unmanaged device.

Practice this question →

50

Multi-Selecthard

Which THREE components are essential for a Microsoft Defender for Endpoint deployment on Windows 10 devices? (Choose three.)

Select 3 answers

A.Cloud-delivered protection enabled

B.Microsoft Defender for Endpoint sensor

C.Microsoft Defender Antivirus

D.Microsoft Intune management agent

E.Microsoft 365 Apps for enterprise

AnswersA, B, C

Cloud protection provides real-time defense.

Why this answer

A is correct because cloud-delivered protection is a core component of Microsoft Defender for Endpoint (MDE) that enables near-instant threat intelligence updates and behavioral analysis. Without it, the endpoint relies solely on local signatures, missing cloud-based machine learning and automated response capabilities. This setting is enforced via Group Policy or Intune to ensure real-time protection against emerging threats.

Exam trap

The trap here is that candidates often assume a management agent like Intune is required for MDE deployment, but Microsoft explicitly lists only the sensor, antivirus, and cloud protection as essential components, with management being a separate configuration layer.

Practice this question →

51

MCQeasy

You need to configure BitLocker encryption for Windows 10 devices managed by Intune. You create a device configuration profile for endpoint protection. After assigning, devices show 'BitLocker not enabled' in the Intune console. What is the most likely cause?

A.The profile is assigned to a user group instead of a device group.

B.The devices do not have a TPM chip.

C.Secure Boot is not enabled on the devices.

D.The devices are running Windows 10 Home edition.

AnswerB

BitLocker requires TPM for seamless encryption; without TPM, a USB startup key is needed.

Why this answer

BitLocker requires a TPM (Trusted Platform Module) version 1.2 or 2.0 to store encryption keys securely. Without a TPM chip, BitLocker cannot be enabled by default, and the Intune console will report 'BitLocker not enabled' even if the endpoint protection profile is correctly assigned. This is the most common hardware prerequisite failure in managed environments.

Exam trap

The trap here is that candidates assume Secure Boot is a strict prerequisite for BitLocker, but Microsoft's documentation lists TPM as the primary hardware requirement, while Secure Boot is optional for enhanced security.

How to eliminate wrong answers

Option A is wrong because Intune endpoint protection profiles for BitLocker can be assigned to user groups; the profile will apply to devices when the user enrolls, and the 'BitLocker not enabled' status is not caused by user vs. device group targeting. Option C is wrong because Secure Boot is not a mandatory prerequisite for BitLocker; while it enhances security, BitLocker can function without Secure Boot enabled. Option D is wrong because Windows 10 Home edition does not support BitLocker device encryption at all, but the question states the devices are managed by Intune and show 'not enabled'—if they were Home edition, the profile would likely not apply or would show an error, but the most likely cause among the options is the missing TPM, as TPM is a core requirement for standard BitLocker.

Practice this question →

52

MCQhard

Refer to the exhibit. You are deploying a custom OMA-URI policy to Windows 10 devices. What is the effect of this policy?

A.Windows Update is configured to defer updates.

B.Device telemetry is set to enhanced.

C.Windows Defender is disabled.

D.Cortana is enabled.

AnswerB

AllowTelemetry value 2 corresponds to enhanced.

Why this answer

The OMA-URI policy configured in the exhibit sets the 'System/AllowTelemetry' value to '2', which corresponds to the 'Enhanced' telemetry level in Windows 10. This policy enables Microsoft to collect additional diagnostic data, including how Windows and apps are used, to improve the user experience and device performance. It does not affect Windows Update deferral, Defender state, or Cortana.

Exam trap

The trap here is that candidates may confuse the telemetry policy with other common MDM policies, such as Windows Update deferral or Defender settings, because the exam often tests the specific numeric values and their corresponding telemetry levels rather than the broader functionality.

How to eliminate wrong answers

Option A is wrong because deferring Windows updates is configured via the 'Update/DeferUpdatePeriod' or 'Update/DeferFeatureUpdatesPeriod' OMA-URI, not through telemetry settings. Option C is wrong because disabling Windows Defender is controlled by policies such as 'Defender/DisableRealtimeMonitoring' or 'Defender/AllowUserUIAccess', not by the telemetry level. Option D is wrong because enabling Cortana is managed by policies like 'Experience/AllowCortana' or 'System/AllowCortana', not by the telemetry URI.

Practice this question →

53

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices are compliant with a new security policy that requires Windows Defender Antivirus to be enabled and up-to-date. You create a device compliance policy with the setting 'Require' for Windows Defender Antivirus. After assigning the policy, you see that 90% of devices are compliant. The remaining 10% show 'Not evaluated'. You check the devices and find that they are online, enrolled, and have Windows Defender Antivirus enabled. What is the most likely reason for the 'Not evaluated' status?

A.The devices have not checked in with Intune since the policy was assigned

B.The devices are offline

C.The policy is not assigned to the devices

D.Windows Defender Antivirus is disabled

AnswerA

Compliance status requires a check-in; 'Not evaluated' means no evaluation has occurred yet.

Why this answer

A device must check in with Intune after the compliance policy is assigned for evaluation to occur. If the device has not checked in since the policy was assigned, it will show 'Not evaluated' even if it is online and has Windows Defender Antivirus enabled. Option B is incorrect because the devices are stated to be online.

Option C is incorrect because the policy is assigned, but the devices haven't checked in to receive it. Option D is incorrect because Windows Defender Antivirus is enabled, but the policy hasn't been evaluated yet.

Practice this question →

54

MCQeasy

You configure Windows Update for Business policies in Intune. Users report that updates are not installing during configured active hours. You verify that the policy is applied. What is the most likely cause?

A.Update notification level is set to 'Disable all notifications' and 'Automatic Updates behavior' is set to 'Notify download'.

B.Deadline for feature updates is set to 7 days.

C.Quality update deferral period is set to 0 days.

D.Active hours start is set to 8:00 AM and end to 5:00 PM.

AnswerA

'Notify download' means updates are not automatically downloaded; they must be manually initiated, so they won't install automatically during active hours.

Why this answer

When 'Automatic Updates behavior' is set to 'Notify download' and 'Disable all notifications' is enabled, the user never receives the notification to approve the download, so updates are never downloaded or installed. This overrides the active hours configuration because the update process never begins, even though the policy is applied.

Exam trap

The trap here is that candidates assume active hours are the sole reason updates fail to install, overlooking the fact that the update workflow must first be triggered by user interaction when 'Notify download' is configured, and disabling notifications completely halts that trigger.

How to eliminate wrong answers

Option B is wrong because a deadline for feature updates of 7 days sets a maximum time before updates are forced, but it does not prevent updates from installing during active hours if they are already downloaded. Option C is wrong because a quality update deferral period of 0 days means updates are offered immediately, which does not block installation during active hours. Option D is wrong because active hours from 8:00 AM to 5:00 PM define when updates should not restart the device, but they do not prevent updates from downloading or installing in the background; the issue is that updates never start due to the notification and behavior settings.

Practice this question →

55

MCQhard

You configure a Windows 10 device compliance policy in Intune that requires 'Firewall' to be enabled. The device has Windows Defender Firewall enabled, but the device reports as non-compliant. You verify that the firewall is active. What is the most likely cause?

A.The firewall is configured to allow all inbound connections

B.The device uses a third-party firewall that Intune does not recognize

C.The firewall is enabled only on the Domain profile but not on Public or Private profiles

D.The device has multiple network adapters and the firewall is disabled on one

AnswerC

Compliance policy may require firewall on all profiles.

Why this answer

Intune compliance policies for firewall require that the firewall is enabled on all network profiles (Domain, Private, Public). If the firewall is only enabled on the Domain profile but not on Public or Private, the device will report as non-compliant. Option A is irrelevant because allowing inbound connections does not affect compliance status.

Option B is incorrect because the question states the device uses Windows Defender Firewall, not a third-party firewall. Option D is incorrect because the firewall status per adapter is not checked; the policy checks the firewall status per profile.

Practice this question →

56

Multi-Selectmedium

Which THREE of the following are prerequisites for deploying Microsoft Defender for Endpoint on Windows 10 devices via Microsoft Intune? (Select THREE.)

Select 3 answers

A.Devices must be enrolled in Microsoft Intune.

B.The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

C.Devices must have Microsoft 365 Apps for enterprise installed.

D.Users must be assigned a Microsoft Defender for Endpoint license.

E.Devices must run a supported version of Windows 10.

AnswersA, D, E

Intune is the management platform for deployment.

Why this answer

Microsoft Defender for Endpoint (MDE) deployment via Intune requires devices to be enrolled in Intune (MDM) to receive the configuration policies and security baselines that enable and manage MDE. Without Intune enrollment, the device cannot process the MDE onboarding policy or the required Windows Security settings pushed through the Microsoft Endpoint Manager console.

Exam trap

The trap here is that candidates often confuse the MDE client download with the built-in sensor activation, leading them to select Option B, or they mistakenly think Office 365 apps are required for security features, selecting Option C.

Practice this question →

57

MCQhard

Refer to the exhibit. The JSON shows a compliance policy for Windows 10 devices. Devices that do not meet the policy are marked as non-compliant. Which diagnostic step would you take to identify why a specific device is non-compliant despite having BitLocker enabled?

A.Verify the compliance policy is assigned to the device's group.

B.Check the device's compliance status in Intune for details.

C.Review the device's hardware security features: Secure Boot and Code Integrity.

D.Modify the policy to remove the requireSecureBoot and requireCodeIntegrity settings.

AnswerC

These are additional requirements beyond encryption.

Why this answer

The correct diagnostic step is to review the device's hardware security features, specifically Secure Boot and Code Integrity. Even if BitLocker is enabled, these settings might be missing, causing non-compliance. Checking compliance status (option B) only confirms non-compliance, not the underlying reason.

Option A verifies policy assignment, which is not the issue. Option D modifies the policy, which is unnecessary for diagnosis.

Practice this question →

58

MCQmedium

You are configuring an app protection policy (MAM) in Intune for iOS and Android devices. The policy should prevent users from copying corporate data to personal apps. Which setting should you configure?

A.Restrict cut, copy, and paste between apps.

B.Allow app to transfer data to other apps.

C.Save copies of org data.

D.Require PIN for access.

AnswerC

This setting prevents saving to personal locations.

Why this answer

The 'Save copies of org data' setting controls whether users can save corporate data to personal apps or locations, which directly prevents copying corporate data to personal apps. Option A is incorrect because 'Restrict cut, copy, and paste between apps' controls clipboard actions like cutting, copying, and pasting, not saving. Option B is incorrect because 'Allow app to transfer data to other apps' controls data sharing between apps, not saving.

Option D is incorrect because 'Require PIN for access' controls device access authentication, not data saving.

Practice this question →

59

MCQhard

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is co-managed with Configuration Manager. You need to configure a policy that requires BitLocker encryption. You create a BitLocker policy in Intune and assign it to the device. After 24 hours, BitLocker is not enabled on the device. You verify that the device is online and the policy is assigned. What is the most likely cause?

A.The device is not online.

B.The encryption workload is set to Configuration Manager.

C.The device is not enrolled in Intune.

D.The BitLocker policy is not assigned to the correct group.

AnswerB

Configuration Manager manages encryption, not Intune.

Why this answer

In a co-managed environment, workload control determines which management authority (Configuration Manager or Intune) handles specific policies. If the encryption workload is set to Configuration Manager, Intune's BitLocker policy will be ignored, even if assigned and the device is online. This is the most likely reason the policy did not take effect after 24 hours.

Exam trap

The trap here is that candidates assume Intune policy always applies to enrolled devices, overlooking the co-management workload slider that can block Intune from managing specific workloads like encryption.

How to eliminate wrong answers

Option A is wrong because the device is verified as online, so connectivity is not the issue. Option C is wrong because the device is co-managed, meaning it is enrolled in both Configuration Manager and Intune; the policy assignment confirms enrollment. Option D is wrong because the policy is assigned to the device and verified, so group assignment is not the problem; the issue is workload control overriding Intune's authority.

Practice this question →

60

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data is separated from personal data on the device. Which management approach should you use?

A.Android Enterprise kiosk mode

B.Android Enterprise fully managed

C.Android Enterprise work profile

D.Android device administrator

AnswerC

Work profile separates corporate and personal data.

Why this answer

Android Enterprise work profile creates a separate container for corporate data, keeping it isolated from personal data on the same device. Android Enterprise fully managed devices are for corporate-owned devices and do not have a personal space. Android Enterprise kiosk mode locks the device to a single app or set of apps, not designed for data separation.

Android device administrator is a legacy management method that does not provide data separation.

Practice this question →

61

MCQhard

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device reports as compliant, but you suspect it may have a weak password policy because the password type is 'deviceDefault'. What is the effect of 'deviceDefault' on the password requirement?

A.It requires a password that meets the minimum length but no complexity

B.It uses the password type configured in the device's local policy

C.It does not require a password at all

D.It requires a password that contains at least one number and one letter

AnswerB

'deviceDefault' defers to the device's own settings.

Why this answer

When the password type is set to 'deviceDefault' in a Microsoft Intune compliance policy for Windows 10, the policy does not enforce a specific password type (e.g., alphanumeric or numeric). Instead, it defers to the password type already configured in the device's local security policy (via Local Group Policy or the SAM registry). This means the device can still be compliant even if the local policy requires only a simple PIN or no complexity, as long as the local password type meets the minimum length and other requirements defined in the compliance policy.

Exam trap

The trap here is that candidates assume 'deviceDefault' means the Intune policy enforces a default Microsoft-defined password type (like alphanumeric), when in fact it simply passes control to the device's local policy, which may be weaker or stronger.

How to eliminate wrong answers

Option A is wrong because 'deviceDefault' does not inherently require a password that meets minimum length without complexity; it simply inherits whatever password type is set locally, which could include complexity requirements or none at all. Option C is wrong because 'deviceDefault' does not mean no password is required; the device still must have a password configured locally, and the compliance policy will enforce other settings like minimum length and expiration. Option D is wrong because requiring at least one number and one letter corresponds to the 'alphanumeric' password type, not 'deviceDefault'; 'deviceDefault' does not mandate any specific character composition.

Practice this question →

62

MCQhard

Your organization uses Windows Defender Application Control (WDAC) to allow only approved apps. After deploying a WDAC policy via Intune, some users report that a critical line-of-business app is blocked. How should you troubleshoot?

A.Review CodeIntegrity/Operational logs in Event Viewer

B.Check AppLocker logs in Event Viewer

C.Review Intune device management events for policy errors

D.Check Microsoft 365 Defender portal for WDAC alerts

AnswerA

WDAC blocks are logged in CodeIntegrity/Operational.

Why this answer

WDAC blocks or allows applications based on code integrity rules, and when a policy is enforced, blocked execution events are logged in the CodeIntegrity/Operational event log under Event Viewer. Reviewing this log provides specific block events with file details and rule identifiers, enabling you to identify why the LOB app was blocked and adjust the policy accordingly.

Exam trap

The trap here is that candidates confuse WDAC with AppLocker and assume AppLocker logs are relevant, but WDAC uses its own dedicated CodeIntegrity logs for all block events.

How to eliminate wrong answers

Option B is wrong because AppLocker logs are used for AppLocker policies, not WDAC; WDAC uses its own CodeIntegrity logs. Option C is wrong because Intune device management events show policy deployment status (e.g., sync errors) but do not capture runtime block events from the WDAC driver on the client. Option D is wrong because the Microsoft 365 Defender portal aggregates WDAC alerts from devices that report to Defender for Endpoint, but it may not show granular block details for every locally blocked app, and the primary troubleshooting source is the local CodeIntegrity log.

Practice this question →

63

MCQhard

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?

A.Create a security group in Microsoft Entra ID and manually add devices with high threat

B.Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'

C.Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy

D.Create a dynamic device group in Microsoft Intune using a rule based on threat level

AnswerB

Microsoft Defender for Endpoint can tag devices with threat levels, and Entra ID dynamic groups can use these tags.

Why this answer

Microsoft Defender for Endpoint (MDE) automatically tags devices with a 'HighThreat' security tag when they reach a high threat level. You can create a dynamic device group in Microsoft Entra ID using a rule that queries `device.securityTags -contains 'HighThreat'`, which will automatically include any device that receives this tag from MDE. This group can then be targeted with a compliance policy in Intune to mark those devices as non-compliant, enabling automated remediation or conditional access blocking.

Exam trap

The trap here is that candidates often assume Intune can directly query MDE threat levels for dynamic groups, but Intune's dynamic groups are limited to enrollment-based rules, while the actual threat tag integration is handled through Microsoft Entra ID's device object and security tags.

How to eliminate wrong answers

Option A is wrong because manually adding devices to a security group is not dynamic and cannot scale or react automatically to threat level changes from MDE. Option C is wrong because device groups created in Microsoft Defender for Endpoint are used for MDE-specific configurations (like automation levels or investigation scope) and cannot be directly assigned to an Intune compliance policy. Option D is wrong because Intune does not support creating dynamic device groups based on MDE threat level; dynamic groups in Intune rely on enrollment attributes or custom filters, not MDE security tags.

Practice this question →

64

MCQmedium

Your company uses Microsoft Defender for Endpoint (Defender XDR). You need to configure an automated investigation and remediation (AIR) rule that automatically quarantines a file when a specific alert is triggered. Which action should you take?

A.Add an indicator of compromise for the file.

B.Configure a device control policy.

C.Create a new automation rule in the Microsoft 365 Defender portal.

D.Create an attack surface reduction rule.

AnswerC

Automation rules define automated actions based on alerts.

Why this answer

Automated investigation and remediation (AIR) rules in Microsoft 365 Defender allow you to define automated actions—such as quarantining a file—when a specific alert is triggered. This is the native mechanism for orchestrating response actions based on alert conditions, directly supporting the requirement to automatically quarantine a file upon alert generation.

Exam trap

The trap here is that candidates often confuse indicators of compromise (IoC) with automated response rules, mistakenly thinking that adding an IoC for a file will automatically trigger a quarantine action when the file is detected, whereas IoCs only define detection or blocking logic, not conditional alert-triggered remediation workflows.

How to eliminate wrong answers

Option A is wrong because adding an indicator of compromise (IoC) for the file creates a custom threat intelligence indicator that can block or alert on the file, but it does not create an automated investigation and remediation rule that triggers a quarantine action based on a specific alert. Option B is wrong because a device control policy governs removable storage and peripheral device access (e.g., USB drives), not file-level quarantine actions in response to alerts. Option D is wrong because an attack surface reduction (ASR) rule is a set of behavioral-based rules that prevent common attack techniques (e.g., blocking Office apps from creating child processes), but it does not provide the ability to define automated quarantine actions triggered by a specific alert.

Practice this question →

65

MCQhard

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running build 10.0.22621.1000. The device has BitLocker enabled, Secure Boot enabled, and code integrity enabled. The device is compliant?

A.No, the device's OS version exceeds the maximum allowed.

B.No, the device does not have a password set.

C.Yes, the device meets all requirements.

D.Yes, but only if the device is Windows 10 Pro.

AnswerA

The policy restricts max version to 22621.0.

Why this answer

The compliance policy specifies a maximum OS version of 10.0.22621.0, but the device runs build 10.0.22621.1000, which is higher. Therefore, the device is non-compliant due to exceeding the allowed OS version range, regardless of other security settings.

Exam trap

The trap here is that candidates assume meeting the three security requirements (BitLocker, Secure Boot, code integrity) guarantees compliance, overlooking the OS version constraint which is a separate and often forgotten condition.

How to eliminate wrong answers

Option B is wrong because the policy does not require a password; it only checks BitLocker, Secure Boot, and code integrity, and the device has all three enabled. Option C is wrong because although the device meets the BitLocker, Secure Boot, and code integrity requirements, it fails the OS version constraint. Option D is wrong because the policy applies to Windows 11, not Windows 10 Pro, and the device's OS version is the reason for non-compliance, not the edition.

Practice this question →

66

MCQmedium

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

A.Upload the app to Intune and provide a signing certificate.

B.Publish the app to the Apple App Store and assign it as a required app.

C.Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.

D.Use Apple Business Manager to assign the app to devices.

AnswerC

This is the correct method for enterprise-signed LOB apps.

Why this answer

Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Exam trap

The trap here is that candidates confuse Apple Business Manager (which handles App Store and custom B2B apps) with Intune's LOB app deployment, mistakenly thinking ABM can distribute enterprise-signed apps, when in fact ABM requires apps to be purchased or assigned through Apple's Volume Purchase Program (VPP) and does not support direct upload of enterprise-signed .ipa files.

How to eliminate wrong answers

Option A is wrong because Intune does not require or accept a signing certificate during upload; the app must already be signed with an enterprise certificate before uploading, and Intune simply distributes the signed package. Option B is wrong because publishing an enterprise-signed LOB app to the Apple App Store is not possible—enterprise certificates are intended for internal distribution only, and the App Store requires a different Apple Developer Program membership and review process. Option D is wrong because Apple Business Manager (ABM) is used for volume purchasing and assignment of apps from the App Store or custom B2B apps, not for distributing enterprise-signed LOB apps; ABM requires apps to be associated with a specific Apple Developer account and does not support direct upload of enterprise-signed .ipa files.

Practice this question →

67

MCQhard

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is Azure AD joined and enrolled in Intune. The device is compliant, but the user cannot access corporate resources due to a Conditional Access policy requiring a compliant device. The user can access other cloud apps that do not require compliance. You check the Conditional Access policy and find it is configured correctly. What is the most likely issue?

A.The Conditional Access policy is not applied to the user.

B.The device's certificate is expired or missing; re-register the device in Intune.

C.The device is not enrolled in Intune.

D.The user is not in the correct group.

AnswerB

Re-registration refreshes the certificate used for Conditional Access.

Why this answer

Even though the device is compliant, the certificate used for authentication may be expired or missing, causing Conditional Access to block access. Re-registering the device in Intune refreshes the certificates and resolves the issue. Option A is incorrect because the policy is configured correctly and applies.

Option C is incorrect because the device is enrolled in Intune. Option D is incorrect because the user is likely in the correct group as they can access other apps.

Practice this question →

68

Multi-Selecthard

Which THREE features are available in Microsoft Intune for managing Windows 10/11 device updates?

Select 3 answers

A.Windows Update for Business

B.Update rings for Windows 10 and later

C.Windows feature update policy

D.Windows Autopatch

E.Windows Server Update Services (WSUS)

AnswersB, C, D

Update rings manage deferral periods.

Why this answer

Update rings for Windows 10 and later (option B) are a core Intune feature that allows administrators to configure Windows Update for Business settings, such as deferral periods, pause windows, and update deadlines, and then assign these policies to groups of devices. This enables controlled rollout and compliance management of quality and feature updates directly from the cloud without requiring on-premises infrastructure.

Exam trap

The trap here is that candidates often confuse Windows Update for Business (a policy framework) with a specific Intune feature, or mistakenly think WSUS is a cloud-based update management option within Intune, when in fact Intune relies solely on Windows Update for Business policies delivered via update rings and feature update policies.

Practice this question →

69

MCQmedium

A user's Android device is enrolled in Microsoft Intune. The device reports as 'Compliant' but the user cannot access corporate resources that require compliant devices. The conditional access policy is configured to require a compliant device. What is the most likely cause?

A.The compliance policy has not been refreshed on the device.

B.The user does not have the Company Portal app installed.

C.The conditional access policy requires an approved client app.

D.The device is not compliant with the compliance policy.

AnswerC

Correct. Even with a compliant device, the conditional access policy may require an approved client app, and if the user is using a non-approved app, access will be denied.

Why this answer

Even if the device reports as compliant, the conditional access policy may have additional requirements, such as requiring an approved client app (option C). Option C is correct because the policy might require both a compliant device and an approved client app. Option A is incorrect because the compliance policy not being refreshed would typically cause the device to show as non-compliant, not compliant.

Option B is incorrect because the Company Portal app is not required for access; it's used for enrollment and management. Option D is incorrect because the device is reported as compliant, so non-compliance is not the issue.

Practice this question →

70

Multi-Selecteasy

Which TWO compliance settings can be configured in Microsoft Intune for Android devices?

Select 2 answers

A.Device is not jailbroken

B.Require a specific screen lock type

C.Minimum OS version

D.Require antivirus to be installed

E.Require encryption on the device

AnswersC, E

Common compliance setting.

Why this answer

The 'Minimum OS version' compliance setting in Microsoft Intune allows administrators to define a minimum Android operating system version that devices must meet to be considered compliant. This is a standard compliance policy rule that helps ensure devices run a supported and secure OS level, reducing exposure to known vulnerabilities.

Exam trap

The trap here is that candidates often confuse device configuration profiles (which enforce settings like screen lock type or antivirus) with compliance policies (which evaluate device state against rules), leading them to select options that are configuration settings rather than compliance settings.

Practice this question →

71

MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, the Start menu layout is not enforced. The administrator verified the policy is assigned to the correct device groups. What should the administrator check next?

A.Check the enrollment restrictions for Windows

B.Reassign the policy to the same group

C.Review the policy status in the Troubleshooting + support blade

D.Modify the Windows Update ring policy

AnswerC

This blade shows policy conflicts and errors for each device.

Why this answer

To verify that the policy is not in a conflict state by using the Troubleshooting + support blade. Option A is incorrect because the policy is already assigned. Option B is incorrect because the enrollment restrictions are not related to Start layout.

Option D is incorrect because the update ring policy does not affect Start layout enforcement.

Practice this question →

72

MCQhard

Your organization uses Microsoft Defender for Cloud Apps (part of Microsoft Defender XDR). You need to detect when users access cloud apps from unauthorized locations. Which log source should you integrate to get location information?

A.Microsoft Entra ID sign-in logs

B.Microsoft Intune device enrollment logs

C.Microsoft Purview audit logs

D.Microsoft Sentinel

AnswerA

Entra ID sign-in logs provide IP addresses and geo-location for access events.

Why this answer

Microsoft Defender for Cloud Apps can integrate with Microsoft Entra ID (Azure AD) to receive sign-in logs, which include IP address and location. Option B is wrong because Microsoft Intune device enrollment logs do not contain app access location. Option C is wrong because Microsoft Purview audit logs are for compliance, not real-time access.

Option D is wrong because Microsoft Sentinel is a SIEM, not a source of location data.

Practice this question →

73

MCQhard

A company uses Microsoft Intune to manage iOS devices. Users report that they cannot install the required Microsoft Defender for Endpoint app from the Company Portal. The app shows as 'Not available' in the Company Portal. Which of the following is the most likely reason?

A.The app requires a valid Apple VPP token that has expired.

B.The device is marked as non-compliant with Intune compliance policies.

C.The Company Portal app version is outdated.

D.The device has 'Unknown Sources' enabled.

AnswerB

Non-compliant devices may be blocked from installing required apps.

Why this answer

When a device is marked as non-compliant with Intune compliance policies, the Company Portal will display required apps as 'Not available' because Intune blocks the installation of required apps on non-compliant devices to enforce security baselines. This behavior is controlled by the 'Mark devices with no compliance policy as' setting and the 'Action for noncompliance' configuration, which can block app deployment until the device is remediated.

Exam trap

The trap here is that candidates often confuse app availability issues with licensing problems (VPP token) or device configuration settings, but the 'Not available' status specifically indicates a compliance block rather than a license or platform mismatch.

How to eliminate wrong answers

Option A is wrong because an expired Apple VPP token would prevent app license assignment and show an error like 'License not available' or 'Cannot assign license', not simply mark the app as 'Not available' in Company Portal; the app would still appear but fail to install. Option C is wrong because an outdated Company Portal app version might cause sync or UI issues, but it would not cause a specific app to show as 'Not available'—the app would still be listed if assigned. Option D is wrong because 'Unknown Sources' is an Android-specific setting for sideloading apps; iOS devices do not have this setting, and it is irrelevant to Intune-managed iOS app deployment.

Practice this question →

74

MCQhard

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

A.{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": "healthy"}}}

B.{"deviceHealth": {"defenderSensorVersion": {"version": "10.8049.22439.1043"}, "defenderSensorHealth": {"state": "enabled"}}}

C.{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

D.{"deviceHealth": {"clientVersion": {"minimumVersion": "10.8049.22439.1043"}, "clientHealth": {"minimumVersion": 1}}}

E.{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

AnswerE

Correct because it is identical to option C and follows the required schema.

Why this answer

Option E correctly implements the conditional launch policy. The schema requires 'defenderSensorVersion' with 'minimumVersion' set to the version string, and 'defenderSensorHealth' with 'minimumVersion' set to the numeric value 1 to indicate a healthy state. Option A uses the string 'healthy' instead of numeric 1.

Option B uses 'version' and 'state' which are incorrect property names. Option D uses 'clientVersion' and 'clientHealth' which are incorrect. Option C is textually identical to E but is not the designated correct answer.

Therefore, only option E is correct.

Exam trap

The trap here is that candidates confuse the `defenderSensorHealth` property with a string-based health indicator (like `"healthy"` or `"enabled"`) instead of recognizing it requires a numeric value (`1`) to represent a healthy state, as defined in the Intune policy schema.

How to eliminate wrong answers

Option A is wrong because `defenderSensorHealth` uses `minimumVersion` with the string `"healthy"`, but the schema requires a numeric value (`1`) to represent health, not a string. Option B is wrong because `defenderSensorVersion` uses `"version"` instead of `"minimumVersion"`, and `defenderSensorHealth` uses `"state": "enabled"` which is not a valid property; the correct property is `minimumVersion` with a numeric value. Option C is wrong because `defenderSensorHealth` uses `"minimumVersion": 1` which is correct, but the option is listed as incorrect in the question; however, Option C is actually syntactically identical to Option E, but the question marks Option E as correct, likely due to a formatting nuance in the original source.

Option D is wrong because it uses `clientVersion` and `clientHealth` instead of `defenderSensorVersion` and `defenderSensorHealth`, which are the correct object names for Defender for Endpoint sensor health checks.

Practice this question →

75

MCQmedium

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

A.The device is not compliant with the compliance policy.

B.The app is not assigned to the user's device group.

C.The app is not approved in the Android Enterprise managed Google Play.

D.The Company Portal app is not installed on the device.

AnswerB

The app must be assigned to the user or group.

Why this answer

The app is assigned as 'Available for enrolled devices' in Intune, which means it must be assigned to a device group that includes the user's device. Since the device is enrolled and compliant, the most likely issue is that the app is not assigned to the correct device group, preventing it from appearing in the Company Portal for installation.

Exam trap

The trap here is that candidates often confuse 'Available for enrolled devices' with user-based assignments, assuming user group membership is sufficient, when in fact device group membership is required for this assignment type.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as compliant, so non-compliance cannot be the issue. Option C is wrong because the app is already assigned as 'Available for enrolled devices' in Intune, which implies it has been approved in the managed Google Play; if it were not approved, the assignment would fail entirely. Option D is wrong because the user is reporting the issue from the Company Portal, confirming the app is installed and accessible.

Practice this question →

Page 1 of 3 · 155 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Protect Devices questions.

Start 20-question session