Protect devices practice questions

Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.

Setting 'Allow app to transfer data to other apps' to Policy managed apps and restricting cut, copy and paste prevents corporate data leaving the protected app ecosystem into unmanaged apps, protecting Microsoft 365 data even on a compromised device.

Restart the Microsoft Defender for Endpoint service on the devices.

Restarting the service can re-establish communication.

The work profile was not created or was removed on the device.

A work profile is the container that hosts corporate apps on Android Enterprise personally-owned devices. If it was never created during provisioning, or the user deleted it afterwards, Intune still reports the device as enrolled while no managed container exists to receive the required apps, so nothing appears.

Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.

Adding the signed LOB app as an iOS/iPadOS line-of-business app in Microsoft Intune lets you upload the .ipa package directly, then assign it to users so managed devices install it via the Intune company portal. This satisfies the enterprise-signed LOB distribution requirement without App Store involvement.

Run a full scan using Microsoft Defender for Endpoint on the affected devices.

Malware can cause sensor disconnection; scanning may resolve it.

Retire (selective wipe)

Retire performs a selective wipe, removing only corporate data such as managed apps, policies and profiles while leaving personal files intact. It satisfies the stem's requirement for a valid Intune wipe method, though it does not restore the device to factory settings like a full wipe does.

Full wipe (remote wipe)

A full wipe resets the device to factory defaults, removing all user data, apps and settings, and it can be triggered remotely from the Intune admin centre. This satisfies the scenario's requirement for a valid remote wipe method on enrolled Windows 10 devices.

Devices must be enrolled in Microsoft Intune.

Intune can only deliver the Defender for Endpoint onboarding package to devices it manages, so enrolment in Microsoft Intune is mandatory. Without enrolment, no policy or configuration profile can reach the device, making this a hard prerequisite.

Users must be assigned a Microsoft Defender for Endpoint license.

Each device consuming Defender for Endpoint requires a licence assigned to its user, otherwise the service rejects onboarding and the portal shows the device as unlicensed. Licence assignment is therefore a prerequisite before Intune deployment succeeds.

Devices must run a supported version of Windows 10.

The Defender for Endpoint sensor supports only specific Windows 10 builds and editions; unsupported versions cannot run the onboarding script or sensor service. Running a supported Windows 10 version is thus a prerequisite for successful Intune deployment.

To reassign a device to a new user without re-imaging.

Autopilot Reset removes user data, apps and configuration while preserving Microsoft Entra ID join and Intune enrolment, so the device returns to a ready-for-use state. A new user can then sign in and receive their assigned policies without re-imaging.

To quickly resolve device performance issues by resetting to a clean state.

Autopilot Reset returns Windows to a clean, enrolled state by clearing user profiles, apps and settings while retaining Microsoft Entra ID join and Intune management. This removes accumulated configuration problems, restoring responsiveness without a full re-image or manual rebuild.

The storageRequireEncryption setting is evaluated but not enforced because the device doesn't support encryption.

Windows 10 20H2 build 19042.1234 predates the minimum OS version required for the BitLocker device-encryption compliance check, so Microsoft Entra ID evaluates the storageRequireEncryption setting as not applicable rather than non-compliant. The device therefore satisfies the policy's OS version constraint while encryption remains unenforced.

The policy is not assigned to the device or the device is not enrolled.

Without assignment or enrolment, the profile never reaches the device, so its telemetry setting stays at the user-configured 'Full' value. Intune settings only apply to enrolled, targeted devices, so an unassigned or unenrolled device keeps whatever diagnostic level was set locally.

The devices have not checked in with Intune recently.

Compliance state depends on the device reporting its status to Intune; until a device checks in, Intune cannot evaluate BitLocker or OS build against the policy, so it remains 'Not compliant' regardless of actual configuration. This satisfies the stem's scenario where devices genuinely meet requirements but show stale, unevaluated status.

The policy is not applied to Exchange Online as a cloud app.

Conditional Access only enforces device compliance for cloud apps explicitly included in the policy's target scope. If Exchange Online is omitted, unenrolled personal devices bypass the requirement entirely, so verify the cloud app assignment first.

The app is not assigned to the user's device group.

'Available for enrolled devices' assignments target users, but the app must also be assigned to the device group (or user group) covering this device. Without that assignment, the app never appears in Company Portal for installation.

The devices have the Windows Update for Business policy assigned.

Windows Update for Business policies are the mechanism that delivers update ring settings to devices; without this policy assigned, devices report 'Up to date' while missing updates. Verifying its assignment confirms the update source constraint in the stem.

Save copies of org data.

Setting 'Save copies of org data' to Block stops users sending corporate data to personal apps, since it removes the Save As and share-to-unmanaged-app paths. This directly satisfies the requirement to prevent copying corporate data out of managed apps on iOS and Android.

Set the 'Threat level' in the Intune compliance policy to 'Low'.

The Intune compliance policy's Threat level setting defines the minimum Defender for Endpoint threat severity that marks a device non-compliant. Setting it to Low allows low-severity active threats to pass while still blocking medium and high ones.

Secure Boot is enabled.

Secure Boot must be enabled in UEFI firmware, since the compliance policy evaluates this hardware-backed state through the device health attestation service. A device with Secure Boot disabled fails the policy regardless of BitLocker, as both conditions are assessed independently.

BitLocker is enabled on the system drive.

BitLocker must be enabled on the operating system drive, as the policy checks encryption state via health attestation. Encryption on secondary drives does not satisfy the requirement; the system drive specifically must be protected for the device to report compliant.

Use Windows Hello for Business.

Correct. This is the primary setting that enables WHfB in an Intune device configuration profile. Without it enabled, no other WHfB settings take effect.

Minimum PIN length.

Correct. A minimum PIN length must be configured as a security baseline when enabling WHfB. It is a required setting in the policy.

Android Enterprise corporate-owned work profile.

Correct. Corporate-owned work profile is a supported Android Enterprise enrollment method.

Android Enterprise fully managed.

Correct. Fully managed is a supported Android Enterprise enrollment method for corporate-owned devices.

Antivirus signatures are out of date.

Outdated antivirus signatures directly breach the Defender antivirus requirement, which mandates current signature updates. The stem confirms BitLocker, Secure Boot and firewall all pass, and the OS build exceeds the minimum, so signature staleness is the sole failing condition rendering the device non-compliant in Microsoft Entra ID.