Protect devices practice questions

Create network segmentation rules

Why wrong: Network segmentation is done by network infrastructure, not Intune.

Enable email attachment scanning

Why wrong: Email scanning is done by Exchange Online Protection, not Intune.

Deploy third-party antivirus software

Why wrong: Intune can deploy apps but not manage third-party AV settings.

Set 'Driver update deferral period (days)' to 0

Why wrong: Incorrect. This setting controls driver update deferral, not quality updates.

Set 'Feature update deferral period (days)' to 0

Why wrong: Incorrect. This setting controls feature update deferral, not quality updates.

Set 'Microsoft product updates' to 'Allow'

Why wrong: Incorrect. While this setting allows Microsoft product updates, it does not specifically ensure immediate receipt of Windows quality updates.

BitLocker recovery key is not backed up to Microsoft Entra ID

Why wrong: Incorrect. While it's best practice to back up the recovery key, Intune compliance does not require it; devices with the key not backed up can still be compliant.

The device does not have a TPM chip

Why wrong: Incorrect. If BitLocker is already enabled on the system drive, the device has a TPM chip (or is using a password, but TPM is common). A missing TPM would prevent BitLocker from being enabled in the first place.

The compliance policy requires 'Encryption' but the device reports 'Encrypted'

Why wrong: Incorrect. Intune does not differentiate between 'Encryption' and 'Encrypted' states; a device with BitLocker enabled reports as compliant. This is a common misconception.

Configure the Configuration Manager client setting to enable compliance evaluation.

Why wrong: This would make ConfigMgr evaluate compliance, not Intune.

Assign the compliance policy to a device group that includes these devices.

Why wrong: Assignment is needed but not sufficient if workload is not switched.

Change the MDM authority to Intune.

Why wrong: MDM authority is already Intune; this is not the issue.

The app is only available for corporate-owned devices.

Why wrong: Wrong. Managed Google Play apps can be deployed to both corporate-owned and personally-owned work profile devices. The device ownership type does not block app availability if the app is approved and targeted correctly.

Android Enterprise enrollment is not enabled in Intune.

Why wrong: Wrong. If Android Enterprise enrollment was not enabled in Intune, the device would not have a work profile at all. Since users report the app is not available in the work profile, it implies the work profile exists, so enrollment must be enabled.

The device does not have a work profile configured.

Why wrong: Wrong. If the device did not have a work profile configured, there would be no work profile to deploy to. The users' report of the app being unavailable in the work profile indicates that the work profile is present.

Check if the compliance policy is assigned to the device's group.

Why wrong: Incorrect. The device is already compliant, which means the compliance policy is assigned and applied. Checking the assignment is not the first step.

Confirm the device is enrolled in Intune.

Why wrong: Incorrect. The device is enrolled because it shows as compliant in Intune. Enrollment is not the issue.

Verify the user is in the correct Azure AD group for Conditional Access.

Why wrong: Incorrect. The user's group membership could affect policy application, but since the device is compliant, the policy is likely targeting the right group. The issue is more likely the policy's requirement settings.

Remove the Conditional Access policy for these users.

Why wrong: This would remove all protection.

Update the compliance policy to accept Android 11.0.

Why wrong: This would reduce security requirements.

Ask users to upgrade their devices to Android 12.0.

Why wrong: Not all devices support the upgrade.

The devices are not in the correct group; re-assign the policy.

Why wrong: Incorrect. The policy is assigned to the correct group containing all devices; reassignment won't change the pending status.

Re-create the security baseline and assign again.

Why wrong: Incorrect. Re-creating the baseline policy will not address the pending status; the devices need a reboot to apply the settings.

The devices have low battery; plug them in.

Why wrong: Incorrect. The devices are online and have network connectivity; low battery is not the issue here.

Disconnect the device from Microsoft Entra ID and rejoin.

Why wrong: Disconnecting and rejoining is more drastic than needed.

Delete and recreate the compliance policy in Microsoft Intune.

Why wrong: The policy might be fine; the issue is with the device not evaluating it.

Re-enroll the device in Microsoft Intune.

Why wrong: Re-enrollment is not necessary if the device is already enrolled.

Configure device compliance policy to require jailbreak detection.

Why wrong: This is device-level, not app-level data protection.

Configure device configuration profile to require device PIN.

Why wrong: This is device-level, not app-level data protection.

Configure App Protection Policy to require app PIN.

Why wrong: App PIN is for access, not data transfer protection.

Modify the Windows Security app configuration policy to enable real-time protection.

Why wrong: Real-time protection is separate from sensor communication.

Re-run the onboarding script on the devices.

Why wrong: The script was already run; the issue is likely service-related.

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Why wrong: This is disruptive and may not be necessary.

Enable App Protection Policies for Outlook for Windows.

Why wrong: App Protection Policies are primarily for mobile devices.

Require all devices to be enrolled in Intune before accessing email.

Why wrong: Enrollment is needed but not sufficient to enforce compliance-based access.

Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

Why wrong: Compliance policy alone does not enforce access; it requires Conditional Access.

The device is not connected to the internet.

Why wrong: Enrollment succeeded, so internet connectivity is present.

The device is not compliant with corporate policies.

Why wrong: Compliance does not prevent app deployment.

The corporate apps are not assigned to the user.

Why wrong: If assigned, they should appear; the issue is likely profile-related.

Add the device to a hybrid Azure AD join profile.

Why wrong: Hybrid join is for on-premises AD integration, not needed here.

Modify the Autopilot deployment profile to set 'Join to Azure AD as' to 'Azure AD registered'.

Why wrong: That would cause the issue.

Modify the enrollment restrictions to block personally owned devices.

Why wrong: This does not affect the join type.

Microsoft Sysinternals Process Monitor logs.

Why wrong: Process Monitor is a manual tool, not integrated with Defender.

Microsoft Intune compliance reports.

Why wrong: Compliance reports do not include malware infection details.

Windows Event Viewer logs on the device.

Why wrong: Event Viewer logs are useful but not the primary source for Defender detections.

Upload the app to Intune and provide a signing certificate.

Why wrong: The app is already signed; no additional certificate needed.

Publish the app to the Apple App Store and assign it as a required app.

Why wrong: The app is LOB, not public.

Use Apple Business Manager to assign the app to devices.

Why wrong: Apple Business Manager is for VPP apps, not LOB.

Check the Windows Security app for any alerts.

Why wrong: macOS does not have a Windows Security app.

Re-enroll the devices in Microsoft Intune.

Why wrong: Re-enrollment does not address sensor disconnection.

Uninstall and reinstall the Microsoft Defender for Endpoint agent.

Why wrong: This is a last resort, not first step.

Factory reset from Windows Settings

Why wrong: This is a manual user action, not an Intune action.

Remote lock

Why wrong: Remote lock does not wipe data.

Delete device from Intune

Why wrong: Deleting only removes the device record.

The Microsoft Defender for Endpoint client must be separately downloaded from the Microsoft 365 admin center.

Why wrong: The client is built into Windows 10; no separate download is needed.

Devices must have Microsoft 365 Apps for enterprise installed.

Why wrong: Not a prerequisite for Defender for Endpoint.

To enroll a new device that was not purchased through an OEM.

Why wrong: Autopilot Reset is for devices already enrolled via Autopilot.

To change a device from Azure AD joined to Hybrid Azure AD joined.

Why wrong: Autopilot Reset does not change the join type.

To deploy a custom Windows image to a device.

Why wrong: Autopilot Reset uses the built-in recovery, not custom images.